SEKE 2012 Proceedings - Knowledge Systems Institute

protocol of DATS we used is properly modified from [11].
The differential equation set representing the flight dynamics
of an aircraft i of type A is shown in formula F w(i) (i) in which
x 1 (i) and x 2 (i) denote the shift of i in the x-axis and y-axis
respectively, d 1 (i) and d 2 (i) represent the velocity of aircraft i
in the x-axis and y-axis respectively, and w(i) represents the
angular velocity of i.
x 1 (i)′=d 1 (i)∧x 2 (i)′=d 2 (i)∧d 1 (i)′=-w(i)d 2 (i)∧d 2 (i)′=w(i)d(i) (F w(i) (i))
Two aircraft i and j satisfy safety separation property if
and only if the following formula holds:
S(i, j)≡( x 1 (i)- x 1 (j)) 2 +( x 2 (i)- x 2 (j)) 2 ≥P 2 ∨ i=j
At the beginning, all aircraft are fa r apart from one
another, and they fly freely with angular velocity w(i).
However, when the distance between aircraft is no larger than
∂ that is positively proportional to P and the radius of the
roundabout circle, all involved aircraft will come to an
agreement on a c ommon angular speed w and a roundabout
circle center c(c 1 ,c 2 ), then through phase Entry, each aircraft
reaches a tangential location around center c. During Circle
phase, each aircraft flies along the roundabout circle
tangentially with the agreed common angular speed w. When
a new aircraft dynamically appears in the collision avoidance
zone, all aircraft again negotiate a new common angular speed
w and roundabout circle center c, and then each aircraft goes
through phase Entry and Circle again. Once the maneuver
finishes, each aircraft will continue to fly in the original
direction and enter phase free again. Adaptive collision
avoidance protocol is illustrated in Figure 2 in the form of a
Mode model. After the transformation of the model, final
QHP code shown in Figure 4 is gotten.
B. Self-Adaptability specification and verification
In this case, we focus on the verification of adaptive
collision avoidance property, i.e., when a new member enters
the collision avoidance zone of existing aircrafts, the collision
avoidance property still holds. Let φ≡∀i,j:A S(i, j), and the
property verified can be specified in the following formula:
φ→[CAMP]φ. The formula expresses that φ will always hold
after evolving along CAMP for an arbitrary length of time if φ
holds in the initial condition. In QdL, property verification is
accomplished in the form of QdL proof calculus for which
Sequent Calculus, which works by QdL proof rules, is
adopted as the basic proof system [9] . During the proof, the
proven property formula is placed at the bottom of the whole
process, and the proof calculus is carried out from the bottom
up. If the property finally holds, then the proof process ends
up with a star symbol, otherwise the precondition that is
required for the formula to hold is given. The a bbreviated
proof process that KeYmaera executes inside is shown in
Figure 5. That all branches end successfully means the
verified self-adaptability property holds.
true true true true
DR ' ax
[?] ax
φ [ M1] φ φ [ free] φ φ [? true] φ φ [( newP; M1)]
φ
[] gen
[ ]
φ [ α] φ φ [ β]
φ
[;][] gen
φ [ α; β]
φ
→ rind ,
φ → [ M *] φ
Figure 5. Property proof process
V. CONCLUSION
The paper proposes a QdL based verification architecture
for CPS self-adaptability property. First, CPS are modeled by
HybridUML. Second, the model expressed by HybridUML is
transformed into the input language of KeYmaera-QHP. Third,
combined with the QHP code, the property to be proven is
specified in the form of a QdL formula. Finally, the QdL
formula is verified automatically using KeYmaera. In order to
achieve the automatic translation from HybridUML Mode to
QHP code and automatic verification by effective integration
with KeYmaera, our future work will focus on t he
implementation of a model transformation tool.
ACKNOWLEDGMENT
The authors thank all the teachers and students who
provide support for our work. Particularly, we thank Qi
ShanShan and Liu CuiCui for their substantial work during
paper correction.
REFERENCES
[1] He JF. Cyber-physical Systems. Communication of the CCF,
2010,6(1):25-29.
[2] Clarke EM, Emerson EA, Sifakis J. Model checking: algorithmic
verification and debugging. Communications of The ACM, 2009,
52(11):74–84 .
[3] Alur R, Courcoubetis C, Halbwachs N, et al. The algorithmic analysis of
hybrid systems. Theoretical Computer Science, 1995,138(1): 3–34.
[4] Henzinger TA. The theory of hybrid automata. Proc. of the 11th Annual
IEEE Symposium on Logic in Computer Science. 1996. 278-292.
[5] Clarke EM, Zuliani P. Statistical Model Checking for Cyber-Physical
Systems. T. Bultan and P.-A. Hsiung (Eds.): ATVA 2011, LNCS 6996,
2011,1–12.
[6] Manna Z, S ipma H. Deductive verification of hybrid systems using
STeP. Proc. of Hybrid Systems: Computation and Control, First
International Workshop, HSCC 98, Berkeley, California, USA.
California: Springer. 1998. 305–318
[7] Van Beek DA, Man KL, Reniers MA, et al. Syntax and consistent
equation semantics of hybrid Chi. Journal of Logic and Algebraic
Programming, 2006, 68(1-2):129–210.
[8] Zhou CC, Ravn AP, Hansen MR. An extended duration calculus for
hybrid real-time systems. Hybrid Systems, 1993, 7: 36–59.
[9] Platzer A. Quantified Differential Dynamic Logic for Distributed
Hybrid Systems. In: A.Dawar, H.Veith, eds. Proc. of CSL 2010, LNCS
6247. Heidelberg: Springer-Verlag, 2010. 469-483.
[10] Platzer A. Quantified differential dynamic logic for distributed hybrid
systems. Technical Report, CMU-CS-10-126, SCS, Carnegie Mellon
University, 2010.
[11] Platzer A. Quantified Differential Invariants. In: Emilio Frazzoli, Radu
Grosu, eds. Proc. of the 14th ACM International Conference on Hybrid
Systems: Computation and Control, HSCC 2011, Chicago, USA, April
12-14, 2011, Chicago: ACM, 2011. 63-72.
[12] Platzer A, Quesel JD. KeYmaera: A hybrid theorem prover for hybrid
systems. In: Alessandro Armando, Peter Baumgartner, et.al, eds. Proc.
of IJCAR 2008, LNCS 5195, Heidelberg: Springer, 2008.171-178.
[13] Berkenkötter K, Bisanz S, Hannemann U, et al. The HybridUML profile
for UML 2.0. International Journal on Software Tools for Technology,
2006, 8(2):167–176.
[14] Alur R, Grosu R, Lee I, et al. Compositional modeling and refinement
for hierarchical hybrid systems. In Proceedings of J. Log. Algebr.
Program.. 2006, 105-128.
[15] Jouault F, Allilaire F. ATL: A model transformation tool. Science of
Computer Programming, 2008, 72(1-2):31-39.
242