SEKE 2012 Proceedings - Knowledge Systems Institute

MappingRule MappingTGtoHP {
[Rule Input]
TransitionGraph tg
[Declaration]
HPContent hpcontent
Trans TG : TG T TG
Mode TG : TG M TG
[Mapping]
// Transforming the discrete transition
for each t in Trans TG ( tg )
hpcontent ( ? hp.ActiveState = srcMode T (t) ;?grd T (t) ;
act T (t) ; hp.ActiveState tarMode(t)) hpcontent
// Transforming the continous evolution
for each m in Mode TG ( tg )
hpcontent ( ?hp.ActiveState = m; flow M (m) &
inv M (m)) hpcontent
[Return Result]
return hpcontent
}
Figure 4. Rule MappingTGtoHP
C. Template of rules applied
In section IV we have built model transformation rules. To
organize those rules, a te mplate of rules is needed. Before
building the template, we gi ve two methods: method
RenameSharedVariables sets the shared variables to the same
name and method MergeHPModel merges the primitive mode
in HP.After model transformation, we get the following HP:
ETCS ( train rbc)*
train ctrl; drive
ctrl 1 2 3 4
1 (?ActiveState = drive; ?(v recommendSpeed);
a *; ?(-b a A); SB v2
2b + ( A b + 1) ( A 2 2 + v);
(?(m–z SB message = emergency); a -b;
ActiveState drive))
2 (?ActiveState = drive;?(v recommendSpeed);
a *; ?(-b a A); SB v2
2b + ( A b + 1) ( A 2 2 + v);
(?(m – z SB message != emergency);a A;
ActiveState drive))
3 (?ActiveState = drive;?(v recommendSpeed);
a *;?(-b a 0); SB v2
2b + ( A b + 1) ( A 2 2 + v);
(?(m – z SB message = emergency ); a -b;
ActiveState drive ) )
4 ( ? ActiveState = drive; ? ( v recommendSpeed );
a *; ? ( -b a 0 ); SB v2
2b + ( A b + 1) ( A 2 2 + v);
(?(m –z SB message != emergency); a A;
ActiveState drive))
drive ? ActiveState = drive; t 0; ( z = v, v = a, t = 1 & v
0 t )
rbc message emergency ( m *, recommendSpeed
*; ? ( recommendSpeed > 0 ) )
IV. SPECIFICATION AND VERIFICATION OF ETCS
This case verifies the safety of the ETCS cooperation
protocol, that is, whether train can always move within MA.
The safety of ETCS is specified by DDL formula as follows:
[ ETCS*]
z m
ActiveState = drive v 2 2b(m – z) b > 0 A 0
ETCS ( ctrl ; drive) rbc, ctrl 1 2 3 4
In the formula , is the initial condition. There are lots of
branches while reasoning, and the process ends when all th e
branches are reduced to an obvious expression. It costs 236
steps to reduce in KeYmaera and generates 10 branches in all.
To sum up, we know that train will stay within its MA all the
time when the initial condition is satisfied. There will not be
any crash when all trains moves within their own MA and the
train cooperation protocol is safe.
V. CONCLUSION
In this paper, we propose a DDL based framework for CPS
modeling and verification. We model an ETCS using a unified
modeling language HybridUML, transform HybridUML model
to the operating model of DDL-Hybrid Program, and reason
the resulting ETCS property formula by DDL proof rules. We
propose a tra nsformation method to translate a Hybr idUML
model to it s corresponding hybrid program. Through the
framework, we not only get a unified modeling method that can
be comprehended by most system designers but also can verify
property through DDL calculus using KeYmaera.
[1] Lee EA. Cyber physical systems: Design challenges. UCB/EECS. 2008
[2] Lygeros J, C ollins P. Computability of finite-time reachable sets for
hybrid systems. Proceedings of the 44th IEEE Conference on Decision
and Control, and the European Control Conference. 2005: 4688-4693.
[3] Chutinan A, Bruce H. Computational techniques for hybrid system
verification. IEEE Transactions on Automatic Control(HSCC'03). 2003:
64-75.
[4] Tiwari A. Approxi mate reachability for linear systems. In Proceedings
of Hybrid Systems: Computation and Control (HSCC’03). 2003: 51 4-
525.
[5] Ravn AP, Zhou CC, Hansen MR. An extended duration calculus for
hybrid real-time systems. Hybrid Systems. 1993. 7: 36–59:
[6] Hansen MR, Zhou CC. Duration Calculus: A Formal Approach to Real-
Time Systems. Monographs in Theoretical Computer Science. 2004.
[7] Clarke EM, Platzer A. The image computation problem in hy brid
systems model checking. In Proceedings of Hybrid Systems:
Computation and Control (HSCC’07). 2007: 473–486.
[8] Caplat G, Sourrouille JL. Model Mapping Using Formalism Extensions.
Software,IEEE. 2005. 22(2): 44-51.
[9] Bisanz S, Berkenkötter K, Hannemann U, Pele ska J. The HybridUML
profile for UML 2.0. International Journal on Software Tools f or
Technology Transfer (STTT). 2006. 8(2):
[10] Bisanz S. Execu table HybridUML Semantics: A T ransformation
Definition. PhD thesis. University of Bremen. 2005.
[11] Platzer A, Quesel JD. European Train Control System: A case study in
formal verification. ICFEM, LNCS. Springer: 2009: 246–265.
[12] Quesel JD, Platzer A. KeYmaera: A hybrid theorem prover for hybrid
systems. Proc. of IJCAR 2008, LNCS 5195. Springer: Heidelberg. 2008:
171-178.
[13] Huang ZQ, Liu YP, Zhu Y. Research on Model Transformation Method
of Real-time System Based on Metamodeling. Journal of Chinese
Computer Systems. 2010. 31(11): 2146-2153.
[14] Platzer A. Logical Analysis of Hybrid Systems: Proving Theorems for
Complex Dynamics. Springer. 2010.
238