On the formal verification of component-based embedded operating systems

The increasing complexity of embedded systems is pushing their design to System-Level, thus leading to a convergence between software and hardware. Consequently, operating systems in this realm are also being required to deliver their services both as software and as hardware. In such a scenario, it is desirable to verify system properties regardless of whether its components are instantiated at software or hardware. In this paper, we describe an approach to formally verify functional correctness and safety properties of such system-level component. The approach is illustrated by a case study of EPOS' scheduler, whose implementation can be driven to yield both a software instance compiled by the GCC C++ compiler or a hardware instance synthesized by the CatapultC ESL tool. We demonstrate that the scheduler follows its specification regardless of the domain for which it is instantiated. We also demonstrate that the proposed approach causes no run-time overhead, since the adopted Software Model Checking techniques are deployed at compile-time.