Refinement-Based Verification of the FreeRTOS Scheduler in VCC

Abstract

Abstract. We describe our experience with verifying the schedulerrelated functionality of FreeRTOS, a popular open-source embedded real-time operating system. We propose a methodology for carrying out refinement-based proofs of functional correctness of abstract data types in the popular code-level verifier VCC. We then apply this methodology to carry out a full machine-checked proof of the functional correctness of the FreeRTOS scheduler. We describe the bugs found during this exercise, the fixes made, and the effort involved.

Formal Analysis of FreeRTOS Scheduler on ARM Cortex-M4 Cores

“…Both of the works proved FreeRTOS task invariants such as the running task always has the top priority. Divakaran et al [19] verified the FreeR-TOS scheduler with refinement-based method. Specifically, the method not only checks functional correctness but also proves that their abstraction in the Z notation is refined by the FreeRTOS implementation.…”

Formal methods by stealth: The INSPEX experience

“…In Divakaran et al, 65 there is an account of a formal model in Z of the FreeRTOS system. The discovery of this work was welcomed with joy, as it held out the promise of being able to integrate our application modelling with an equally rigorous model of the underlying system that the code relied on.…”

“…Essentially, there was an abstraction level impedance mismatch that prevented efficient interworking. We would have had to model much more of the basic memory system than we could afford, in order to bring our models to the level of abstraction of Divakaran et al 65 In point [J] (Optimisation), we mentioned the enthusiasm for automatic code generation. However, we could see at a distance the mismatch between the kind of code that we could expect to generate automatically, and the anticipation of highly optimised code that was the day to day reality in the embedded world, we did not pursue this angle seriously; all this notwithstanding the impact on working practices that would be needed, and the nontrivial cost of production quality tools in this area.…”

Formal Verification for Advanced Sensing Applications: Data Pre-processing in the INSPEX System

“…Verification of conditions of this type can build upon existing work which has been done to verify operating-system level components. For example, there is a body of work related to the verification of the real-time operating system FreeRTOS (FreeRTOS, 2011;Divakaran et al, 2015), which is widely used in this type of application. From our point of view, it is interesting that this work uses a multi-tool approach, starting with refinement based tools to relate overall system requirements to those of specific subsystems, and then transitioning to tools designed to verify C code in order to check that these subsystems correctly perform their function.…”