SEKE 2012 Proceedings - Knowledge Systems Institute

A HybridUML and QdL Based Verification Method
for CPS Self-Adaptability
Jiakai Li, Bixin Li, Qiaoqiao Chen, Min Zhu, Shunhui Ji, Xiaoxiang Zhai
School of Computer Science and Engineering, Southeast University, Nanjing, China
{jiakai_li, bx.li}@seu.edu.cn
Abstract—CPS (Cyber-Physical Systems) are physical and
engineered systems featuring a tight combination of computation
and physical processes by communication networks. CPS are
mainly applied in some critical domains, so it is very essential to
ensure the correctness of CPS. Formal verification has been
successfully applied in the correctness verification of CPS;
however, the high theoretical level of formal modeling techniques
of formal verification and the lack of visualization of formal
models make it difficult to integrate formal verification with
enterprise standard system development process. In this paper,
we model CPS by HybridUML, an extension of UML, and then
transform HybridUML model into the input language of
theorem prover KeYmaera-QHP(Quantified Hybrid Program),
and finally verify the QHP code with KeYmaera.
Keywords-CPS; Formal Verification; HybridUML; QHP;
MetaModel; Model Transformation
I. INTRODUCTION
CPS, in a broad sense, are controllable, trustable and
extensible networked physical device systems that deeply
integrate computation, communication and control capabilities
based on environment perception [1] . CPS are mainly applied in
areas having a high demand on performance, so to ensure the
correctness of CPS is extremely important.
CPS evolve over time with interacting discrete and
continuous dynamics, which accords with the definition of
hybrid systems, so the verification theory of hybrid systems
can be referenced in CPS verification. Although many present
model checking [2,3,4,5] and theorem proving methods [6,7,8] have
been proposed for Hybrid Systems verification, these
methods have great deficiencies in supporting the verification
of s ystems with distributed characteristics. To solve this,
André Platzer proposed a verification technique based on QdL
(Quantified Differential Dynamic Logic) [9,10,11] . In order to
achieve automatic verification, André designed a theorem
prover- KeYmaera. However, the high theoretical level of
formal modeling method in QdL and the lack of visualization
of QHP make it difficult to integrate QdL based formal
verification with enterprise system development processes in
which the Unified Modeling Language (UML) has been
This work is supported partially by National Natural Science Foundation of
China under Grant No. 60973149, partially by the Open Funds of State Key
Laboratory of Computer Science of Chinese Academy of Sciences under Grant
No.SYSKF1110, partially by Doctoral Fund of Ministry of Education of China
under Grant No. 20100092110022, and partially by the College Industrialization
Project of Jiangsu Province under Grant No.JHB2011-3.
accepted as the de facto standard modeling language.
However, UML lacks precise formal semantics, making it
hard to directly verify UML models formally. The paper first
models CPS by HybridUML, and then translates the model
into the input model of KeYmaera [12] , and finally performs
formal verification with KeYmaera to ensure the correctness
of CPS.
The interconnection topology and the number of active
members of CPS network, especially those composed of
mobile devices such as the Distributed Air Traffic Collision
Avoidance System (DATC), tend to change dynamically,
making how to ensure critical properties hold dynamically
really challenging. The characteristic that CPS adjust their
behaviors flexibly according to the network structural and
dimensional dynamics is called self-adaptability. Verifying
self-adaptability, Hierarchical Hybrid StateMachine-Mode is
chosen as the CPS modeling view. First, the hierarchical
feature of the top-level Mode model is eliminated according to
execution semantics and a FlatMode model is gotten. Second,
transform the FlatMode model to a QHP model by executing
corresponding ATL transformation rules. Third, template rules
in a customized template language will be called to transform
the QHP model to QHP code, and then specify the CPS selfadaptability
property with a QdL formula . Finally, verify
property formula automatically with KeYmaera.
The paper is organized as follows. Section introduces
HybridUML based modeling method. Section describes the
translation from HybridUML model to QHP code. Section
illustrates the application of our verification architecture by
a case study of a DATC. Section summarizes the paper and
makes a discussion about the future work.
II.
CPS MODELING BASED ON HYBRIDUML
A. Basic modeling elements of HybridUML
1) Agent
In HybridUML, Agent is a stereotype for Class in UML.
As the basic building block for describing the static system
architecture, an Agent can own an internal structure consisting
of other Agent instances to support hierarchical models [13] .
2) Hierarchical Hybrid StateMachine –Mode
In HybridUML, Mode is an extension of UML
StateMachine and is used for describing Agents′ behavior [13] .
As a Hierarchical Hybrid StateMachine, a Mo de can contain
sub-modes and transitions inside its region. When a Mode is
239