SEKE 2012 Proceedings - Knowledge Systems Institute

HybridUML Based Verification of CPS Using
Differential Dynamic Logic
Min Zhu, Bixin Li, Jiakai Li, Qiaoqiao Chen,Xiaoxiang Zhai, Shunhui Ji
School of Computer Science and Engineering, Southeast University, Nanjing, China
{kong, bx.li}@seu.edu.cn
Abstract—CPS (Cyber-Physical Systems) which are characterized
by the combination of computation, communication and control
are applied in many safety-critical domains. For the successful
application of CPS, it is very important to ensure the correctness
of CPS. Many researchers are concerned about using formal
verification to verify the correctness of CPS since it has played a
key role in improving the security and reliability of systems. In
this paper, we demonstrated the feasibility of our CPS modeling
and verification framework through a case study. We first
introduced HybridUML, an extension of UML, to model CPS,
then we presented a model transformation method mapping
HybridUML model to Hybrid Program, and finally verified the
properties of the resulting model with KeYmaera.
verification of CPS [7] and the operating model of a DDL
formula is named Hybrid Programs(HP). Transforming generic
model into a formal model for verification is a h ot research
field of software engineering [8] . In addition, HybridUML [9] , an
extension of UML, is introduced since UML has no precise
semantics [10] and cannot model continuous states. This p aper
introduces HybridUML as a generic model to model CPS,
presents a method based on model transformation mapping
HybridUML to Hybrid Programs, and ve rifies the resulting
model finally.
Keywords-CPS; differential dynamic logic; HybridUML; model
transformation; verification
I. INTRODUCTION
Cyber-Physical Systems (CPS) integrate computation with
physical processes. Embedded computers and networks
monitor and control the p hysical processes, usually with
feedback loops where physical processes affect computations
and vice versa [1] . CPS have brought many opportunities and
challenges to various industries, such as intelligent
transportation, industrial automation, smart medical, agriculture
and national defense. It is crucial that the designed CPS work
as expected. A growi ng number of researchers are concerned
about the property verification of CPS since ver ification
technique has played a key role in improving the security and
reliability of CPS. Howe ver, traditional model checking
techniques which are designed for finite state systems do n ot
work well in verifying CPS as there are an infinite number of
states in CPS d ue to the dis crete and cont inuous behaviors.
Although model checking has been extended for infinite state
systems in many studies [2-4] , it still could not do w ell in
verifying large-scale CPS si nce the restriction of reachability
problem. Zhou [5] extended duration calculus [6] by introducing
mathematical expression to the derivative of state variable.
However, the reasoning m ethod is n ot appropriate for
automatic verification, especially for derivative and continuity.
A theorem proving method based on differential dynamic logic
(DDL) proposed by A.Platzer has b een well applie d in the
This work is supported partially by National Natural Science Fou ndation of
China under Grant No. 60 973149, partially by the Open Funds of State Key
Laboratory of Computer Science of Chinese Academy of Sciences under Grant
No.SYSKF1110, partially by Doctoral Fund of Ministry of Education of China
under Grant No. 20100092110022, and partially by the College Industrialization
Project of Jiangsu Province under Grant No.JHB2011-3.
Figure 1. Dynamic movemnett authorities of ETCS
This paper demonstrates our DDL based framework for
CPS modeling and verification by a case s tudy. A simplified
European Train Control System (ETCS) is shown in Fi gure
1 [11] . Trains are guided by moving block principle and they are
only allowed to move in the specified MA (Movement
Authority). The RBCs (Radio Block Controller) update the MA
dynamically based on the current track situation by wireless
communication. The speed of a train can be regulated freely in
the far mode, and the train can switch to the neg (negotiation)
mode for MA extensions from ST (start taking). If there is no
new MA updated after SB point, it starts braking in cor
(correcting) mode.
Our verification architecture works as follows. First, the
transformation from HybridUML to HP Model is accomplished
through executing model transformation rules and rule template;
second, KeYmaera in put code generation from the resulting
Model generated in the first step is fulfilled. KeYmaera is an
automated and interactive theorem prover for a natural
specification and verification logic for hybrid systems that
combines deductive, real algebraic, and c omputer algebraic
prover technologies [12] . The transformation rules in the paper
are defined according to th e relation between source metamodel
and target meta-model on the basis o f model
235