Stream-based runtime monitors can effectively verify specified system behavior in a real-time online manner, but the effectiveness of these monitors relies heavily on complying with the system’s timing and resource constraints and the correctness of the monitor’s implementation. The R2U2 runtime monitoring framework provides real-time guarantees and a resource-aware architecture; however, we further reduce R2U2’s overhead by optimizing both Mission-time Linear Temporal Logic (MLTL) and past-time MLTL (ptMLTL) operators and their corresponding instruction formats. We evaluate our optimizations on a suite of benchmarks and observe a significant decrease in latency and memory requirements. To improve the correctness guarantees of R2U2, we manually transpile the previous C version to safe embedded Rust and verify the correctness with hand-constructed proofs, testing, and code verification with Verus. We specifically target safe embedded Rust (i.e., no_std) to allow for deployment on embedded platforms with bare-metal environments (e.g., microcontrollers), and we provide complete proofs for all of R2U2’s operators and verify the Rust code implementation of 25 of these operators with Verus code contracts.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Towards a Safe, Verified Runtime Monitor for Embedded Systems: R2U2 in Embedded Rust

  • Alexis Aurandt,
  • Phillip H. Jones,
  • Kristin Yvonne Rozier

摘要

Stream-based runtime monitors can effectively verify specified system behavior in a real-time online manner, but the effectiveness of these monitors relies heavily on complying with the system’s timing and resource constraints and the correctness of the monitor’s implementation. The R2U2 runtime monitoring framework provides real-time guarantees and a resource-aware architecture; however, we further reduce R2U2’s overhead by optimizing both Mission-time Linear Temporal Logic (MLTL) and past-time MLTL (ptMLTL) operators and their corresponding instruction formats. We evaluate our optimizations on a suite of benchmarks and observe a significant decrease in latency and memory requirements. To improve the correctness guarantees of R2U2, we manually transpile the previous C version to safe embedded Rust and verify the correctness with hand-constructed proofs, testing, and code verification with Verus. We specifically target safe embedded Rust (i.e., no_std) to allow for deployment on embedded platforms with bare-metal environments (e.g., microcontrollers), and we provide complete proofs for all of R2U2’s operators and verify the Rust code implementation of 25 of these operators with Verus code contracts.