No description available.

In this thesis, we describe how to use UML sequence diagrams with MARTE timing constraints to specify entirely the behavior of component-based systems while abstracting as much as possible the functional roles of components composing it. We have shown how to conduct compositional analysis of such specifications. For this, we have defined operational semantics to sequence diagrams by translating them into TIOSTS which are symbolic automata with timing constraints. We have used symbolic execution techniques to compute possible executions of the system in the form of a symbolic tree. We have defined projection mechanisms to extract the execution tree associated with any distinguished component. The resulting projected tree characterizes the possible behaviors of the component with respect to the context of the whole system specification. As such, it represents a constraint to be satisfied by the component and it can be used as a correctness reference to validate the system in a compositional manner. For that purpose, we have grounded our validation framework on testing techniques. We have presented compositional results relating the correctness of a system to the correctness of components. Based on these results, we have defined an incremental approach for testing from sequence diagrams.

Compared to conventional Steiner tree signal net routing, non-tree topology is often superior in many aspects including timing performance, tolerance to open faults and variations. In nano-scale VLSI designs, interconnect delay is a performance bottleneck and variation effects are increasingly problematic. Therefore the advantages of non-tree topology are particularly appealing for timing critical net routings in nano-scale VLSI designs. We propose Steiner network construction heuristics which can generate either tree or non-tree of signal net with different slack wirelength tradeoffs, and handle both long path and short path constraints. Extensive experiments in different scenarios show that our heuristics usually improve timing slack by hundreds of pico seconds compared to traditional tree approaches while increasing only slightly in wirelength. These results show that our algorithm is a very promising approach for timing critical net routings.

Compared to conventional Steiner tree signal net routing, non-tree topology is often superior in many aspects including timing performance, tolerance to open faults and variations. In nano-scale VLSI designs, interconnect delay is a performance bottleneck and variation effects are increasingly problematic. Therefore the advantages of non-tree topology are particularly appealing for timing critical net routings in nano-scale VLSI designs. We propose Steiner network construction heuristics which can generate either tree or non-tree of signal net with different slack wirelength tradeoffs, and handle both long path and short path constraints. Extensive experiments in different scenarios show that our heuristics usually improve timing slack by hundreds of pico seconds compared to traditional tree approaches while increasing only slightly in wirelength. These results show that our algorithm is a very promising approach for timing critical net routings.

In this thesis, we describe how to use UML sequence diagrams with MARTE timing constraints to specify entirely the behavior of component-based systems while abstracting as much as possible the functional roles of components composing it. We have shown how to conduct compositional analysis of such specifications. For this, we have defined operational semantics to sequence diagrams by translating them into TIOSTS which are symbolic automata with timing constraints. We have used symbolic execution techniques to compute possible executions of the system in the form of a symbolic tree. We have defined projection mechanisms to extract the execution tree associated with any distinguished component. The resulting projected tree characterizes the possible behaviors of the component with respect to the context of the whole system specification. As such, it represents a constraint to be satisfied by the component and it can be used as a correctness reference to validate the system in a compositional manner. For that purpose, we have grounded our validation framework on testing techniques. We have presented compositional results relating the correctness of a system to the correctness of components. Based on these results, we have defined an incremental approach for testing from sequence diagrams.

Dans cette thèse, nous décrivons comment on peut utiliser un diagramme de séquence UML avec des contraintes de temps MARTE pour spécifier complètement le comportement des systèmes à base de composants tout en faisant abstraction des rôles fonctionnels des composants. Nous avons proposé une approche qui permet d'analyser ces spécifications d'une manière modulaire. Pour cela, nous avons attribué une sémantique opérationnelle aux diagrammes de séquence en les traduisant vers les TIOSTS qui sont des automates symbolique et temporisé. Nous avons utilisé des techniques d'exécution symbolique pour calculer les exécutions du système sous la forme d'un arbre symbolique. Nous avons défini des mécanismes de projection pour extraire l'arbre d'exécution associé à un composant sous-jacent. L'arbre résultant de la projection caractérise les comportements attendus du composant et peut être utilisé comme une référence pour valider le système bout par bout. Pour ce faire, nous nous sommes intéressés à des techniques de test. Nous avons présenté un résultat qui ramène la conformité du système à la conformité des composants qui le composent. Sur la base de ces résultats, nous avons proposé une méthodologie incrémentale de test basé sur des spécifications décrites sous la forme de diagrammes de séquence. / In this thesis, we describe how to use UML sequence diagrams with MARTE timing constraints to specify entirely the behavior of component-based systems while abstracting as much as possible the functional roles of components composing it. We have shown how to conduct compositional analysis of such specifications. For this, we have defined operational semantics to sequence diagrams by translating them into TIOSTS which are symbolic automata with timing constraints. We have used symbolic execution techniques to compute possible executions of the system in the form of a symbolic tree. We have defined projection mechanisms to extract the execution tree associated with any distinguished component. The resulting projected tree characterizes the possible behaviors of the component with respect to the context of the whole system specification. As such, it represents a constraint to be satisfied by the component and it can be used as a correctness reference to validate the system in a compositional manner. For that purpose, we have grounded our validation framework on testing techniques. We have presented compositional results relating the correctness of a system to the correctness of components. Based on these results, we have defined an incremental approach for testing from sequence diagrams.

The Java platform is becoming a vital tool for developing real-time and safety-critical systems. Design patterns and the availability of Java libraries, both provide solutions to many known problems. Furthermore, the object-oriented nature of Java simplifies modular development of real-time systems. However, limitations of Java as a programming language for real-time systems are a notable obstacle to producing safe real-time systems. These limitations are found in the unpredictable execution model of the language, due to Java’s garbage collector, and the lack of support for non-functional specification and verification tools. In this dissertation I introduce SafeJML, a specification language for support of functional and non-functional specifications, based on an implementation of a safety-critical Java platform and the Java Modeling Language (JML). This dissertation concentrates on techniques that enable specification and dynamic checking of timing constraints for some important Java features, including methods and subtyping. SafeJML and these dynamic checking techniques allow modular specification and checking of safety-critical systems, including those that use object-orientation and design patterns. Such coding techniques could have maintenance benefits for real-time and safety-critical software

<p>Formal methods such as Event-B are a widely used approach for developing critical systems. This thesis demonstrates that creating models and proving the consistency of the models at the requirements level during software (system) development is an effective way to reduce the occurrence of faults and errors in a practical application. An insulin infusion pump (IIP) is a complicated and time critical system. This thesis uses Event-B to specify models for an IIP, based on a draft requirements document developed by the US Food and Drug Administration (FDA). Consequently it demonstrates Event-B can be used effectively to detect the missing properties, the missing quantities, the faults and the errors at the requirements level of a system development. The IIP is an active and reactive time control system. To achieve the goal of handling timing issues in the IIP system, we made extensions of an existing time pattern specified using Event-B to enrich the semantics of the Event-B language. We created several sets to model the activation times of different events and the union of these time sets defines a global time activation set. The tick of global time is specified as a progress tick event. All the actions in an event are triggered only when the global time in the time tick event matches the time specified in the event. Time is deleted from the corresponding time set, but not the corresponding global time set while the event is triggered. A time point is deleted from the global time set only when there are no pending actions for that time point. Through discharging proof obligations using Event-B, we achieved our goal of improving the requirements document.</p> / Master of Computer Science (MCS)

Si un algorithme cryptographique peut être mathématiquement sûr, son implémentation matérielle quant à elle est souvent la cible de nombreuses attaques. Cette thèse porte sur l'étude des mécanismes d'injection de fautes pouvant permettre une cryptanalyse physique des circuits sécurisés et sur la conception de contre-mesures matérielles pour empêcher ces attaques.Dans un premier temps une mise en pratique d'injection de fautes sur une implémentation matérielle de l'AES a été menée à l'aide d'attaques physiques : variations statiques et dynamiques de la tension, de la fréquence, de la température et de l'environnement électromagnétique. La comparaison des fautes injectées nous a permis de conclure que ces différentes attaques partagent un mécanisme d'injection identique : la violation de contraintes temporelles.La conception et l'implémentation d'un voltmètre intégré nous a permis d'observer les perturbations internes dues aux attaques par variations transitoires de la tension. Ces observations ont permis une meilleure compréhension du mécanisme d'injection de fautes associé et une amélioration de la précision temporelle de ces injections.Ensuite, un détecteur a été implémenté et son efficacité face à des attaques électromagnétiques a été étudiée. Du fait de la localité spatiale de ces attaques, la zone effectivement protégée par le détecteur est limitée. Une implémentation de plusieurs détecteurs a été suggérée.Enfin, un nouveau chemin d'attaque exploitant la sensibilité du détecteur a été proposé et validé expérimentalement. / Even if a cryptographic algortihm could be mathematically secure, its physical implementation could be targeted by several attacks. This thesis focus on time-based fault injection mechanisms used for physical cryptanalysis of secure circuits.First, practical fault injections have been performed on a hardware AES implementation using non-invasive attacks : static and dynamic variations of the power supply voltage, frequency, temperature and electromagnetic environement. Then a comparison of these obtained faults led us to conclude that these different injection means share a common injection mecanism : timing constraints violations.An on-chip voltmeter has been designed and implemented to observe internal disturbences due to voltage glitchs. These observations led to a better understanding of the fault injection mecanism and to a better temporal accuracy.Then, a contermeasure has been designed and its effectiveness against electromagnetic attacks has been studied. Because of the electromagnetic pulses local effects, the aera effectively protected by the countermeasure is limited. The implementation of several countermeasures has been considered in order to extend the protected aera.Finally, a new attack path using the countermeasure detection threshold variations has been proposed and experimentaly validated. This attack exploit the electrical coupling between the AES and the coutnermeasure. Because of this coupling the countermeasure sensitivity variations are related to data handled by the AES.

L'exportation et la mutualisation des industries de fabrication des circuits intégrés impliquent de nombreuses interrogations concernant l'intégrité des circuits fabriqués. On se retrouve alors confronté au problème d'insertion d'une fonctionnalité dissimulée pouvant agir de façon cachée : on parle de Cheval de Troie Matériel (CTM). En raison de la complexité d'un circuit intégré, repérer ce genre de modification se révèle particulièrement difficile. Le travail proposé dans ce manuscrit s'oriente vers une technique de détection non destructrice de CTM. L’approche consiste à utiliser les temps de calculs internes du système étudié comme canal permettant de détecter des CTM. Dans ces travaux, un modèle décrivant les temps de calcul est défini. Il prend notamment en compte deux paramètres importants que sont les conditions expérimentales et les variations de procédés.Des attaques en faute par glitchs d’horloge basée sur la violation de contraintes temporelles permettent de mesurer des temps de calcul internes. Des cartes fiables sont utilisées pour servir de référence. Après avoir validé la pertinence de ce canal d’étude concernant l’obtention d’informations sur le comportement interne du circuit cible, on procède à des détections expérimentales de CTM insérés à deux niveaux d’abstraction (niveau RTL et après l'étape de placement/routage). Des traitements avec prise en compte des variations de procédés permettent d'identifier si les cartes testées sont infectées par un CTM. / The globalization of integrated circuits fabrication involves several questions about the integrity of the fabricated circuits. Malicious modifications called Hardware Trojans (HT) can be introduced during the circuit production process. Due to the complexity of an integrated circuit, it is really difficult to find this kind of alterations.This work focuses on a non-destructive method of HT detection. We use the paths delays of the studied design as a channel to detect HT. A model to describe paths delays is defined. It takes into account two important parameters which are the experimental conditions and the process variations.Faults attacks by clock glitches based on timing constraints violations have been performed to measure data paths delays. Reliable circuits are used for reference. After validating the relevance of this channel to get information on the internal behavior of the targeted design, experimental detections of HT inserted on two different abstraction levels (RTL and after place and route) were achieved. Process variations are taken into consideration in the studies to detect if the tested circuits are infected.