[Paper Review] From Design to Implementation: an Automated, Credible Autocoding Chain for Control Systems

Timothy C. Wang, Romain Jobredeaux+5 more|arXiv (Cornell University)|Jul 10, 2013

Real-time simulation and control systems4 citations

TL;DR

This paper presents an automated, credible autocoding chain that translates control system designs into verified C code, leveraging domain-specific knowledge and formal methods. By embedding Lyapunov stability proofs and performance guarantees as annotations in a graphical modeling language (e.g., Simulink), the framework automatically generates annotated code and machine-checkable certificates using theorem provers, ensuring correctness across all executions with formal verification.

ABSTRACT

This article describes a fully automated, credible autocoding chain for control systems. The framework generates code, along with guarantees of high level functional properties which can be independently verified. It relies on domain specific knowledge and fomal methods of analysis to address a context of heightened safety requirements for critical embedded systems and ever-increasing costs of verification and validation. The platform strives to bridge the semantic gap between domain expert and code verification expert. First, a graphical dataflow language is extended with annotation symbols enabling the control engineer to express high level properties of its control law within the framework of a familiar language. An existing autocoder is enhanced to both generate the code implementing the initial design, but also to carry high level properties down to annotations at the level of the code. Finally, using customized code analysis tools, certificates are generated which guarantee the correctness of the annotations with respect to the code, and can be verified using existing static analysis tools. Only a subset of properties and controllers are handled at this point.

Motivation & Objective

• To close the semantic gap between control engineers and formal verification experts by enabling domain experts to express high-level functional properties directly in familiar design tools.
• To automate the end-to-end translation from high-level control system design to verified, production-quality C code with formal correctness certificates.
• To integrate formal verification into the control system development lifecycle, ensuring that safety-critical properties like Lyapunov stability are preserved and provably correct at the code level.
• To reduce the cost and complexity of verification and validation in safety-critical embedded systems by leveraging control-theoretic proofs as inputs to automated code analysis.

Proposed method

• Extends a graphical dataflow language (e.g., Simulink) with domain-specific annotations to express high-level control properties such as Lyapunov stability and vector margins.
• Enhances an existing autocoder to propagate these annotations from the model level down to the generated C code, preserving semantic meaning.
• Uses a customized static analysis pipeline involving Why3, PVS, and the proveit theorem prover to generate and discharge verification conditions from code annotations.
• Employs a PVS plugin (pvs-ellipsoid) to formally verify matrix inequalities related to ellipsoidal invariants, ensuring correctness under floating-point arithmetic.
• Automates the proof chain by dynamically generating and guiding theorem prover strategies based on verification condition analysis.
• Integrates external tools like INTLAB for numerical checks on matrix definiteness when native PVS capabilities are insufficient.

Experimental results

Research questions

• RQ1 Can control-theoretic proofs such as Lyapunov stability be systematically encoded and propagated from high-level models to low-level code?
• RQ2 How can formal verification be automated in a way that respects the domain-specific knowledge of control engineers without requiring them to master formal methods?
• RQ3 What is the feasibility of generating machine-checkable certificates for control system properties directly from annotated models?
• RQ4 How can floating-point arithmetic errors be soundly handled in formal proofs of control system invariants?
• RQ5 To what extent can this framework be extended to support broader classes of controllers and properties beyond the current scope?

Key findings

• The framework successfully automates the translation of Simulink models with control semantics into annotated C code, with formal certificates for key properties such as Lyapunov stability.
• The proof chain is fully automated: verification conditions are extracted, processed via Why3, and discharged using PVS and the proveit theorem prover, with dynamic strategy guidance.
• The pvs-ellipsoid plugin enables sound verification of matrix inequalities related to ellipsoidal invariants, even in the presence of floating-point arithmetic.
• The final verification condition—ensuring the state remains within an initial ellipsoid—is discharged using a combination of PVS and external numerical tools like INTLAB.
• The prototype demonstrates feasibility on a mass-spring-damper system, proving open-loop stability with formal guarantees.
• The approach enables independent verification of code correctness by separating domain expertise (control design) from formal verification expertise (proof generation).