摘要:航天器等安全关键系统是典型的嵌入式系统，具有多任务并发、中断频发等特点.操作系统是其最基础的软件，构建一个正确的操作系统是保障航天器系统高可信运行的关键.异常管理作为操作系统最底层的功能，负责引导系统控制流的突变来响应处理器状态中的某些变化，异常管理的正确性是整个操作系统正确性的基础.提出一种基于Hoare-logic的验证框架，用于证明面向SPARC处理器架构操作系统异常管理的正确性，特别针对多任务并发和中断频发实时操作系统异常嵌套与异常中发生任务切换的情况，将异常管理划分为5个阶段进行全面的形式化建模，并且在Coq证明定理辅助工具中实现了此框架.基于该框架，验证了我国北斗三号在轨实际应用的航天器嵌入式实时操作系统SpaceOS异常管理功能的正确性.



Abstract:Safety-critical systems such as spacecraft are typical embedded systems with the characteristics of multi-task concurrency and frequent interruptions. The operating system is the most fundamental software of computer, and building a correct operating system is crucial to ensure the reliability of the spacecraft system. Exception management, as the lowest level function of the operating system, is responsible for guiding sudden changes of control flow in response to certain changes in the processor state. Exception management is the basis for the correctness of the entire operating system correctness. This study proposes a verification framework based on Hoare-logic to prove the correctness of exception management for SPARC processor architecture operating systems. Especially for multi-task concurrency and frequent interruption of real-time operating system exception nesting and task switching in exceptions, the exception management is divided into five stages for comprehensive formal modeling, and this framework is implemented in the Coq proving theorem assistant tool. Based on this framework, the correctness of the exception management function of the spacecraft embedded real-time operating system SpaceOS, which is actually used by China's Beidou-3, is verified.



PDF全文下载地址:

http://jos.org.cn/jos/article/pdf/6241