Rely-Guarantee Reasoning about Messaging System for Autonomous Vehicles

Messaging system as a communicating infrastructure is a safety-critical component of autonomous vehicles. For the purpose of safety certification of Level 4 autonomous driving systems, its necessary to provide a formally verified specification of messaging systems. This paper presents a realistic case study using the PiCore rely-guarantee framework to formally verify the DGPS (Differential Global Positioning System) of UISEE autonomous driving systems. We first create an axiom model of messaging systems by extending PiCore, which is reusable for concrete applications. The model supports dynamic configuration of message buffers as well as the automatic generation of the rely and guarantee conditions for compositional reasoning. It is instantiated when developing the formal specification of DGPS. Then, we use the rely-guarantee proof system of PiCore to verify the functional correctness and invariant of DGPS. The specification and its proof provide a strong evidence for the ongoing safety certification of DGPS.