Formal Specification, Verification and Repair of Contiki’s Scheduler

This paper presents an approach for model extraction, formal specification, verification and repair of the scheduler of Contiki, which is an event-driven lightweight Operating System for the Internet of Things (IoT). We first derive a state machine-based abstraction of the scheduler’s modes of operation along with the control flow abstractions of the scheduler’s most important functions. We then use a set of transformation rules to formally specify the scheduler and all its internal functions in Promela. Additional contributions with respect to the conference version of this article include (1) modeling nested function calls in the Promela model of the scheduler using a novel technique amenable to model checking in SPIN; (2) modeling protothreads in Promela; (3) specifying and formally verifying twelve critical requirements of the scheduler; (4) detecting new design flaws in Contiki’s scheduler, for the first time (to the best of our knowledge); (5) repairing the model and the source code of Contiki’s scheduler towards fixing the flaws detected through verification, as well as regression verification of the entire model of the scheduler, and (6) experimentally analyzing the time and space costs of verification before and after repair. The proposed formal model of Contiki’s scheduler along with novel modeling techniques enhance our knowledge regarding the most critical components of Contiki, and provide reusable methods for formal specification and verification of other event-driven operating systems used in Cyber Physical Systems (CPS) and IoT.