Abstract:The functions of automobiles are becoming increasingly intelligent, which leads to the increasing number of electrical control units for one automobile. Hence, it makes software migration and extension more complicated. In order to avoid these problems, the standard OSEK/VDX has been proposed jointly by a German automotive company consortium and the University of Karlsruhe. This standard provides specifications for the development of automotive software, this standard has become one of the major standards for real-time automotive operating systems (OSs). Since errors in the automotive OS may pose threat to the safety of people in a vehicle, it is necessary to verify the correctness of the OSEK OS which is used by many manufacturers around the world. Formal methods can be adopted to verify the correctness of both software and hardware. Therefore, we propose a formal model of the OSEK OS at the code level and verify three significant properties of the OSEK-based system. In this study, the code-level OSEK OS is verified to ensure compliance with the specifications. An automotive OS always requires that the systemreacts in a timelymanner to external events and performs the computations within the timing constraints. However, there is a possibility that the running time of the tasks exceeds the timing requirements due to the complexity of the tasks. Therefore, by referring to one of the extensions of the OSEK OS, Automotive Open System Architecture (AUTOSAR), we proposed tpOSEK, which is capable of extending the OSEK OS with a timing protection mechanism in AUTOSAR in this study. In our previous study, it was verified that the higher-priority task cannot be preempted by lower-priority tasks. In this paper, after improvement made to the OSEK OS model by adding interrupt service routine models and alarms, and extension of the OSEK OS model with a timing protection model, we have verified that tpOSEK satisfies three significant properties, which include deadlock f ree, complete and no timeout. These properties represent the basic conditions for the systemto run smoothly. If such properties as deadlock f ree and complete are satisfied, it means no deadlock is encountered by this system and all of the tasks can be scheduled completely. Moreover, if the property timeout cannot be satisfied, it means that none of the tasks would miss the deadline. Based on the tpOSEK model, the correct timing protection APIs can be designed at the code level. Thus, by extending the OSEKOSwith theseAPIs,we can update theOSEKOS faster and the need tomodify the dependent applications can be removed. Furthermore, we have constructed formal models for two industrial cases based on tpOSEK OS to demonstrate the soundness of our methods.

Verifying OSEK/VDX Automotive Applications: A Spin‐based Model Checking Approach

Verifying OSEK/VDX Applications: an Optimized SMT-based Bounded Model Checking Approach

SMT-Based Bounded Model Checking for OSEK/VDX Applications

An Approach for Checking OSEK/VDX Applications

Autoc: an Efficient Translator for Model Checking Deterministic Scheduler Based OSEK/VDX Applications

An Efficient Approach for Verifying Automobile Distributed Application Systems on Timing Property

Formal Verification of OSEK/VDX Real-Time Operating System (empirical Report)

Modeling and Verifying the Code-Level OSEK/VDX Operating System with CSP

Modeling and Verification of A Timing Protection Mechanism in the OSEK/VDX OS Using CSP

Model-Based Design and Verification of Automotive Electronics Compliant with Osek/Vdx

Model Checking Safety Critical Software With Spin: An Application To A Railway Interlocking System

Smartosek Based Design And Verification For In-Vehicle Network System: A Model-Based Approach

End to End Verification and Validation with SPIN

Model checking Trampoline OS: a case study on safety analysis for automotive software

A new approach for developing safety-critical software in automotive industry

Model-Checking in the Loop Model-Based Testing for Automotive Operating Systems

Formalizing Application Programming Interfaces of the OSEK/VDX Operating System Specification

Verifying scheduling point constraints with model checking

The role of model checking in software engineering

ModelX: Using Model Checking to Find Design Errors of Cloud Applications

Experiences from Large-Scale Model Checking: Verification of a Vehicle Control System