Safety-critical Java programs from Circus models

Abstract

Safety-Critical Java (SCJ) is a novel version of Java that addresses issues related to real-time programming and certification of safety-critical applications. In this paper, we propose a technique that reveals the issues involved in the formal verification of an SCJ program, and provides guidelines for tackling them in a refinement-based approach. It is based on Circus, a combination of well established notations: Z, CSP, Timed CSP, and object orientation. We cater for the specification of timing requirements and their decomposition towards the structure of missions and event handlers of SCJ. We also consider the integrated refinement of value-based specifications into class-based designs using SCJ scoped memory areas. We present a refinement strategy, a Circus variant that captures the essence of the SCJ paradigm, and a substantial example based approach on a concurrent version of a case study that has been used as a benchmark by the SCJ community: an aircraft collision detector.

Appendices

Appendix A: Definitions in anchor A of the CD _x

The type Frame is the set of partial functions from aircraft to (3d) vectors whose size is less than or equal to $\mathit{MAX\_AIRCRAFT}$, the maximum number of aircraft detected.

The domain of the function determines the aircraft in view of the radar. We introduce Aircraft as the set of non-empty sequences of byte values: $\mathit{Aircraft} \;\widehat{=}\; \mathrm{seq}_{1}(\mathit{byte})$ where byte is the set of integers from −128 to 127. The sequences represent unique call signs, mirroring the way aircraft are identified in aviation. The type Vector is defined by a schema whose components x, y and z correspond to the coordinates of a vector.

The work in Oliveira and Barros (1997) describes how real numbers can be axiomatised in Z.

We introduce common operators on vectors such as sum (+ _V ), difference (− _V ), scalar produce (∗ _V ), dot product (⋅ _V ) and length (|_|). Their Z definitions are omitted here as they are standard. We also define ZeroV and UnitV for the zero and unit vector. MkVector(c ₁,c ₂,c ₃) yields a record ⦉x==c ₁,y==c ₂,z==c ₃⦊ of type Vector.

The function CalcCollisionSet yields collisions as a set of aircraft pairs.

The pairs (a ₁,a ₂) in the set of collisions are characterised by a set comprehension that uses of a relation collide that captures whether their trajectories (posns  a ₁,motions  a ₁) and (posns  a ₂,motions  a ₂) are at risk of colliding. A trajectory is a pair of vectors: the first gives the trajectory’s position and the second its motion. We define $\mathit{Trajectory} \;\widehat{=}\; \mathit{Vector} \times \mathit{Vector}$.

THRESHOLD is a constant that specifies the minimum acceptable distance between two trajectories; if it is less than or equal to that, we signal a potential collision.

The distance function carries out the actual distance calculation of aircraft trajectories.

We determine the minimal distance between two traversing points. This may not be the minimal distance between any two points, but is consistent with the algorithm in Kalibera et al. (2009).

Appendix B: Some classes

2.1 B.1 Class RawFrame

The class RawFrame is used to encode radar frames as data objects in the program. It records the position of all aircraft, identified by their call sign, that are currently in view of the radar. Some constants capture static variables used in the program.

The implementation uses two arrays: callsigsn, to record aircraft positions, and positions, to determine the respective call signs of the aircraft. It also includes a planeCnt integer component to determine the number of valid entries in the array ensemble.

The initialisation schema captures the initilisations of the state components in the code. Here, we create the data objects for both arrays and also define that, initially, there are no valid entries in the arrays; hence, no aircrafts are initially recorded in the frame.

The logical methods are used in the refinement for the definition of retrieve relations. The function getCallSign determines the call sign result! recorded in callsigns with index plane?.

The find logical function uses getCallSign to obtain the index result! for an aircraft given by its call sign a? within the array ensemble. This, in particular, allows us to determine the position of an aircraft with a given call sign.

The following private method is overloaded. Although, strictly speaking, overloading is not allowed in OhCircus, a simple renaming can be used to give semantics to the class. To be faithful to the code, we use the overloading here. In the same vein, we also use for loops, whose meaning can be given by recursion in the usual way.

The only method in the interface of RawFrame is copy defined below.

It uses the private copy methods above to copy the arrays of a given instance of the class RawFrame itself to the arrays of the current object.

2.2 B.2 Class StateTable

The class StateTable is used to record previous aircraft positions. This is important to calculate the predicted trajectories of aircraft and determine their potential collisions.

A hash map positionMap stores aircraft positions. For memory management, there is a store of pre-allocated objects for 3d vectors: the allocatedVectors and usedVectors fields.

The initialisation creates the data objects for the position map and as allocates 3d vector objects for the object store. The allocation during initialisation ensures that the vector objects are created in mission memory; this is crucial since those objects are shared between the handlers. Initially, no objects are in use from the store.

The put method is used to insert an element into the position_map. This is essentially using the corresponding put method of HashMap, with added logic that ensures that 3d vector objects are not created anew, but recycled from the pre-allocated object store.

The get method infers the position of an aircraft from the position map.

2.3 B.3 Class Partition

The class Partition holds the data for partitions of the voxel space.

It records a list parts of arrays corresponding to the partitions as well as a cyclic counter that facilitates recording voxels’ aircrafts in the partitions.

The initialisation allocates the parts list and determines that all partitions are empty (this is achieved by a call to the method clear of this same class defined next).

The clear method clears the voxel lists for all partitions.

The recordMotionList records the aircraft in a voxel in one of the partitions. The cyclic counter counter is used to ensure that partitions are populated in a balanced manner.

The getDetectorWork method obtains the content of one of the partitions subsequent to all voxel motion lists being recorded. It simply returns the respective entry of the parts array.