Skip to main content
SpringerLink
Log in

Applying Rely-Guarantee Reasoning on Concurrent Memory Management and Mailbox in \(\mu \)C/OS-II: A Case Study

  • Conference paper
  • First Online:
Formal Methods for Industrial Critical Systems (FMICS 2023)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 14290))

  • 228 Accesses

Abstract

Real-time operating systems (RTOSs) such as \(\mu \)C/OS-II are critical components of many industrial systems, which makes it of vital importance to verify their correctness. However, earlier specifications for verification of RTOSs often do not explicitly specify the behavior of possible unbounded kernel service invocations. To address the problem, a new event-based modelling approach is recently proposed to treat the operating system as a concurrent reactive system (CRS). Besides, a respective parametric rely-guarantee style reasoning framework called PiCore is developed to verify such systems effectively. Witnessing the advancement, we conduct a case study to investigate the use of PiCore to compositionally verify two important entangled modules of a practical RTOS \(\mu \)C/OS-II, i.e., the memory management module and the mailbox module. Several desirable safety properties regarding the memory pools and mailboxes are formally defined and proved with PiCore (\(\approx \) 2500 lines of specifications and proof scripts in Isabelle/HOL) based on a formal execution model considering the two modules simultaneously. We also discuss the shortcomings of PiCore for our case study and present possible improvement directions.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 49.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 64.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Aceto, L., et al.: Reactive Systems: Modelling, Specification and Verification. Cambridge University Press, Cambridge (2007)

    Book  Google Scholar 

  2. Zhao, Y., Sanán, D., Zhang, F., Liu, Y.: A parametric rely-guarantee reasoning framework for concurrent reactive systems. In: ter Beek, M.H., McIver, A., Oliveira, J.N. (eds.) FM 2019. LNCS, vol. 11800, pp. 161–178. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-30942-8_11

    Chapter  Google Scholar 

  3. Zhao, Y., Sanán, D.: Rely-guarantee reasoning about concurrent memory management in Zephyr RTOS. In: Dillig, I., Tasiran, S. (eds.) CAV 2019. LNCS, vol. 11562, pp. 515–533. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-25543-5_29

    Chapter  Google Scholar 

  4. Xu, F., Fu, M., Feng, X., Zhang, X., Zhang, H., Li, Z.: A practical verification framework for preemptive OS kernels. In: Chaudhuri, S., Farzan, A. (eds.) CAV 2016. LNCS, vol. 9780, pp. 59–79. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-41540-6_4

    Chapter  Google Scholar 

  5. Klein, G., et al.: seL4: formal verification of an OS kernel. In: Proceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Principles (2009)

    Google Scholar 

  6. Klein, G., Tuch, H.: Towards verified virtual memory in L4. TPHOLs Emerging Trends 4, 16 (2004)

    Google Scholar 

  7. Gu, R., et al.: Deep specifications and certified abstraction layers. ACM SIGPLAN Notices 50.1, 595–608 (2015)

    Google Scholar 

  8. Gu, R., et al.: CertiKOS: an extensible architecture for building certified concurrent OS kernels. OSDI, vol. 16 (2016)

    Google Scholar 

  9. Chen, H., et al.: Toward compositional verification of interruptible OS kernels and device drivers. In: Proceedings of the 37th ACM SIGPLAN Conference on Programming Language Design and Implementation (2016)

    Google Scholar 

  10. Nelson, L., et al.: Hyperkernel: push-button verification of an OS kernel. In: Proceedings of the 26th Symposium on Operating Systems Principles (2017)

    Google Scholar 

  11. The \(\mu \)C/OS-II project. https://github.com/weston-embedded/uC-OS2

  12. O’hearn, P.W.: Resources, concurrency, and local reasoning. Theoretical Computer Science 375.1-3, 271–307 (2007)

    Google Scholar 

  13. Vafeiadis, V., Parkinson, M.: A marriage of rely/guarantee and separation logic. In: Caires, L., Vasconcelos, V.T. (eds.) CONCUR 2007. LNCS, vol. 4703, pp. 256–271. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-74407-8_18

    Chapter  Google Scholar 

  14. Andronick, J., Corey L., Morgan, C.: Controlled Owicki-Gries concurrency: reasoning about the preemptible eChronos embedded operating system. arXiv preprint arXiv:1511.04170 (2015)

  15. Dingel, J., et al.: Towards a formal treatment of implicit invocation using rely/guarantee reasoning. Formal Aspects Comput. 10, 193–213 (1998)

    Article  Google Scholar 

  16. Fenkam, P., Gall, H., Jazayeri, M.: Composing specifications of event based applications. In: Pezzè, M. (ed.) FASE 2003. LNCS, vol. 2621, pp. 67–86. Springer, Heidelberg (2003). https://doi.org/10.1007/3-540-36578-8_6

    Chapter  Google Scholar 

  17. Fenkam, P., Gall, H., Jazayeri, M.: Constructing deadlock free event-based applications: a rely/guarantee approach. In: Araki, K., Gnesi, S., Mandrioli, D. (eds.) FME 2003. LNCS, vol. 2805, pp. 636–657. Springer, Heidelberg (2003). https://doi.org/10.1007/978-3-540-45236-2_35

    Chapter  Google Scholar 

  18. Fenkam, P., Gall, H., Jazayeri, M.: Constructing deadlock free event-based applications: a rely/guarantee approach. In: Araki, K., Gnesi, S., Mandrioli, D. (eds.) FME 2003. LNCS, vol. 2805, pp. 636–657. Springer, Heidelberg (2003). https://doi.org/10.1007/978-3-540-45236-2_35

    Chapter  Google Scholar 

  19. Jones, C.B.: Tentative steps toward a development method for interfering programs. ACM Trans. Programm. Lang. Syst. (TOPLAS) 5.4, 596–619 (1983)

    Google Scholar 

  20. Feng, X.: Local rely-guarantee reasoning. In: Proceedings of the 36th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (2009)

    Google Scholar 

  21. \(\mu \)C/OS-II documentation. https://micrium.atlassian.net/wiki/spaces/osiidoc/overview

  22. Owicki, S., Gries, D.: An axiomatic proof technique for parallel programs I. Acta Inform. 6(4), 319–340 (1976)

    Article  MathSciNet  Google Scholar 

  23. Verbeek, F., et al.: Formal API specification of the PikeOS separation kernel. In: Havelund, K., Holzmann, G., Joshi, R. (eds.) NFM 2015. LNCS, vol. 9058, pp. 375–389. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-17524-9_26

    Chapter  Google Scholar 

  24. Carbonneaux, Q., et al.: Applying formal verification to microkernel IPC at Meta. In: Proceedings of the 11th ACM SIGPLAN International Conference on Certified Programs and Proofs (2022)

    Google Scholar 

  25. Jung, R., et al.: Iris from the ground up: a modular foundation for higher-order concurrent separation logic. J. Functional Programm. 28, e20 (2018)

    Google Scholar 

  26. Jung, R., et al.: Iris: monoids and invariants as an orthogonal basis for concurrent reasoning. ACM SIGPLAN Notices 50.1, 637–650 (2015)

    Google Scholar 

  27. Nieto, L.P.: The Rely-Guarantee method in Isabelle/HOL. In: Degano, P. (ed.) ESOP 2003. LNCS, vol. 2618, pp. 348–362. Springer, Heidelberg (2003). https://doi.org/10.1007/3-540-36575-3_24

    Chapter  Google Scholar 

  28. Abrial, J.-R., Hallerstede, S.: Refinement, decomposition and instantiation of discrete models. Abstract State Machines (2005)

    Google Scholar 

  29. Hoang, T.S., Abrial, J.-R.: Event-B decomposition for parallel programs. In: Frappier, M., Glässer, U., Khurshid, S., Laleau, R., Reeves, S. (eds.) ABZ 2010. LNCS, vol. 5977, pp. 319–333. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-11811-1_24

    Chapter  Google Scholar 

  30. The \(\mu \)C/OS-II verification project: https://github.com/SunHuan321/uc-OS-verification

Download references

Acknowledgement

This work was supported by the National Key R &D Program of China (Grant No. 2020YFB2010900), and Provincial Key R &D Program of Zhejiang (Grant No. 2020C01038 and Grant No. 2021C01032).

Author information

Authors and Affiliations

  1. Zhejiang University, Hangzhou, China

    Huan Sun, Ziyu Mao, Jingyi Wang, Ziyan Zhao & Wenhai Wang

Authors
  1. Huan Sun
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Ziyu Mao
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Jingyi Wang
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Ziyan Zhao
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Wenhai Wang
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding authors

Correspondence to Jingyi Wang or Wenhai Wang .

Editor information

Editors and Affiliations

  1. Fondazione Bruno Kessler, Povo, Italy

    Alessandro Cimatti

  2. NASA Langley Research Center, AMA-NASA LaRC, Hampton, VA, USA

    Laura Titolo

Rights and permissions

Reprints and permissions

Copyright information

© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Sun, H., Mao, Z., Wang, J., Zhao, Z., Wang, W. (2023). Applying Rely-Guarantee Reasoning on Concurrent Memory Management and Mailbox in \(\mu \)C/OS-II: A Case Study. In: Cimatti, A., Titolo, L. (eds) Formal Methods for Industrial Critical Systems. FMICS 2023. Lecture Notes in Computer Science, vol 14290. Springer, Cham. https://doi.org/10.1007/978-3-031-43681-9_13

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-43681-9_13

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-43680-2

  • Online ISBN: 978-3-031-43681-9

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation