Formal development process of safety-critical embedded human machine interface systems

Ge, Ning; Dieumegard, Arnaud; Jenn, Éric; daAusbourg, Bruno; Aït‐Ameur, Yamine

doi:10.1109/tase.2017.8285636

Cited by 7 publications

(4 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The semantics of this language is based on synchronous data flows similar to Lustre that makes the process easy for formal verification and code generation. In [15], the authors propose a formal development process for designing HMI for safety-critical systems using LIDL and S3 solver.…”

Section: Related Workmentioning

confidence: 99%

Formal Development of Multi-Purpose Interactive Application (MPIA) for ARINC 661

Singh

Aït‐Ameur

Méry

et al. 2020

Communications in Computer and Information Science

View full text Add to dashboard Cite

This paper reports our experience for developing Human-Machine Interface (HMI) complying with ARINC 661 specification standard for interactive cockpits applications using formal methods. This development relies on the FLUID modelling language, we have proposed and formally defined in the FORMEDICIS 1 project. FLUID contains essential features required for specifying HMI. To develop the MultiPurpose Interactive Applications (MPIA) use case, we follow the following steps: an abstract model of MPIA is written using the FLUID language; this MPIA FLUID model is used to produce an Event-B model for checking the functional behaviour, user interactions, safety properties, and interaction related to domain properties; the Event-B model is also used to check temporal properties and possible scenario using the ProB model checker; and finally, the MPIA FLUID model is translated to Interactive Cooperative Objects (ICO) using the PetShop CASE tool to validate the dynamic behaviour, visual properties and task analysis. These steps rely on different tools to check internal consistency along with possible HMI properties. Finally, the formal development of the MPIA case study using FLUID and its embedding into other formal techniques, demonstrates reliability, scalability and feasibility of our approach defined in the FORMEDICIS project.

show abstract

Section: Related Workmentioning

confidence: 99%

Formal Development of Multi-Purpose Interactive Application (MPIA) for ARINC 661

Singh

Aït‐Ameur

Méry

et al. 2020

Communications in Computer and Information Science

View full text Add to dashboard Cite

show abstract

“…The semantics of this language are centered on Lustre‐like synchronous data flows for formal verification and code generation. In Ge et al, 72 the authors proposed a formal development process for designing interactive systems in the LIDL modeling language, and then, S3 solver is used for formal verification of the required interaction behavior. Our work is inspired from the published works and the use of LIDL language.…”

Section: Related Workmentioning

confidence: 99%

F3FLUID: A formal framework for developing safety‐critical interactive systems in FLUID

Singh

Aït‐Ameur

Mendil

et al. 2022

J Software Evolu Process

View full text Add to dashboard Cite

This paper proposes a unified formal framework, Formal Framework For FLUID (F3FLUID), for the development of safety-critical interactive systems. This framework is based on the Formal Language of User Interface Design (FLUID) pivot modeling language defined in the FORMEDICIS project, which enables high-level system requirements for interactive systems to be specified in the FLUID language. This modeling language is specifically designed for handling concepts of safety-critical interactive systems, including domain knowledge. A FLUID model is used as a source model for the generation of several target models in different modeling languages to support the formal verification methods, such as theorem proving and model checking. In this paper, we use the Event-B modeling language for checking functional behaviors, user interactions, safety properties, and domain properties. A FLUID model is transformed into an Event-B model, and then, the Rodin tool is used to check the internal consistency with respect to the given safety properties. We illustrate the operational semantics of the FLUID language, and the transformation strategy of FLUID models into Event-B models, including the tool development. We use the ProB model checker to analyze the temporal properties and to animate the formalized specification. In addition, an interactive cooperative objects (ICOs) model is derived from the Event-B model for animation, visualization and validation of dynamic behaviors, visual properties, and task analysis. Finally, an industrial case study, complying with the ARINC 661 standard, Multi-Purpose Interactive Applications (MPIA), is used to illustrate the effectiveness of our F3FLUID framework for the development of safety-critical interactive systems.

show abstract

“…TwIRTee's architecture, software, and hardware components are representative of a significant family of aeronautical, spatial, and automotive systems. It has been used to evaluate new methods and tools in the domain of hardware/software codesign, virtual integration, and application of formal methods for the development of equipment . In this paper, we give a brief description of the function and some statistics about the model and the verification effort.…”

Section: The Case Study: Automatic Rover Protectionmentioning

confidence: 99%

“…It has been used to evaluate new methods and tools in the domain of hardware/software codesign, virtual integration, 14 and application of formal methods for the development of equipment. 13,16,[19][20][21] In this paper, we give a brief description of the function and some statistics about the model and the verification effort.…”

Section: The Case Study: Automatic Rover Protectionmentioning

confidence: 99%

Correct‐by‐construction specification to verified code

Dieumegard

Jenn

et al. 2018

J Software Evolu Process

Self Cite

View full text Add to dashboard Cite

Event‐B is a formal notation and method for the systems development. The key feature of this method is to produce correct‐by‐construction system designs. Once the correct design is established, the remaining work is to generate or implement correct code from the design. Two main problems remain in the process from the correct‐by‐construction design to the correct software. First, the Event‐B design is “quasi‐correct” due to some technical limitations. For instance, it is still difficult to prove the liveness properties by the Rodin platform; it is not possible to construct the Event‐B design with floating‐point arithmetic, and sometimes, the Event‐B model is incomplete and must rely on the third‐party libraries. Therefore, a method is needed to complement these modeling and proof gaps. Secondly, proving the correctness of an automatic code generator is very difficult; therefore, a method is needed to guarantee the correctness of the produced code without proving the code generator. In this article, we address the above 2 problems by introducing an intermediate formal language called High‐Level Language (HLL) between the Event‐B models and the C code. The Event‐B model is translated to HLL with an additional schedule configuration, where Event‐B invariants and system invariants (here, deadlock‐freeness and liveness properties) are proved using a SAT‐based model checker called S3. This proof guarantees the correctness of the HLL model with respect to the Event‐B model. The C code is then automatically generated from the HLL model for most functions and is manually implemented for the third‐party ones according to the function contracts defined in Event‐B. The correctness of the generated C code is guaranteed using the equivalence proof, and the correctness of the implemented C code is guaranteed using the conformance proof. Through the article, we use a traffic light controller to illustrate the proposed method; then, we apply the method to an automatic protection function of a 3‐wheeled robot to evaluate its feasibility.

show abstract

Formal development process of safety-critical embedded human machine interface systems

Abstract: OATAO is an open access repository that collects the work of Toulouse researchers and makes it freely available over the web where possible.

Cited by 7 publications

References 20 publications

Formal Development of Multi-Purpose Interactive Application (MPIA) for ARINC 661

Formal Development of Multi-Purpose Interactive Application (MPIA) for ARINC 661

F3FLUID: A formal framework for developing safety‐critical interactive systems in FLUID

Correct‐by‐construction specification to verified code

Contact Info

Product

Resources

About