Trustworthy Systems

Controlled Owicki-Gries concurrency: reasoning about the preemptible eChronos embedded operating system

Authors

June Andronick, Corey Lewis and Carroll Morgan

NICTA

UNSW

Abstract

We introduce a controlled concurrency framework, derived from the Owicki-Gries method, for mod- elling a hardware interface in sufficient detail to support the modelling and verification of small, embedded operating systems (OS) whose run-time responsiveness is paramount. Such real-time sys- tems run with interrupts mostly enabled, including during scheduling. That differs from many other successfully modelled and verified OS’es that typically reduce the complexity of concurrency by running on uniprocessor platforms and by switching interrupts off as much as possible. Our framework builds on the traditional Owicki-Gries method, for its fine-grained concurrency needed for high-performance system code. We adapt it to support explicit concurrency control, by providing a simple, faithful representation of the hardware interface that allows software to control the degree of interleaving between user code, OS code, interrupt handlers and a scheduler that con- trols context switching. We apply this framework to model the interleaving behavior of the eChronos OS, a preemptible real-time OS for embedded micro-controllers. We discuss the accuracy and us- ability of our approach when instantiated to model the eChronos OS. Both our framework and the eChronos model are formalised in the Isabelle/HOL theorem prover, taking advantage of the high level of automation in modern reasoning tools.

BibTeX Entry

  @inproceedings{Andronick_LM_15,
    address          = {Suva, Fiji},
    author           = {Andronick, June and Lewis, Corey and Morgan, Carroll},
    booktitle        = {Workshop on Models for Formal Analysis of Real Systems (MARS 2015)},
    editor           = {{Robert J. van Glabbeek and Jan Friso Groote and Peter H{\"{o}}fner}},
    keywords         = {concurrency; embedded operating system; owicki-gries; software verification; echronos},
    month            = nov,
    pages            = {10--24},
    paperurl         = {https://trustworthy.systems/publications/nicta_full_text/8971.pdf},
    slides           = {https://trustworthy.systems/publications/nicta_slides/8971.pdf},
    title            = {Controlled {Owicki-Gries} Concurrency: Reasoning about the Preemptible {eChronos} Embedded Operating
                        System},
    year             = {2015}
  }

Download