OS-Aware Interaction Model for the Verification of Multitasking Embedded Software

As the behavior of multitasking embedded software is dependent on the underlying operating system(s), rigorous and efficient verification in this domain requires models of operating systems (OS) that enable OS-aware verification of application programs at reduced cost. However, the heterogeneity of the languages used for OS models and of the program source code makes it difficult to compose these seemingly independent components and thus requires translation of one language into another, causing various issues in verification. To alleviate this problem, we propose a hybrid approach that composes formal OS models with application programs in an interaction model. Based on typical OS-application interaction behavior, our interaction model is a composition framework that connects an OS model to application programs as long as they share the same Application Program Interface (API). It provides seamless composition of two heterogeneous software artifacts by formulating source code annotations based on control-flow analysis and by synchronizing state transitions over API function calls to regulate the context switching of multitasking programs. A prototype implementation of the interaction model was applied to eight benchmark programs of the Erika OS and a control program with real-scale complexity from the automotive domain. It was shown that the framework supports systematic and effective verification of multitasking embedded software, which has not been possible using code-level model checking.