Specification of Railway Transportation Cyber Physical Systems Using Formal Approach

Transcription

1 Speifiation of Railway Transportation Cyber Physial Systems Using Formal Approah Lihen Zhang *, Jifeng He and Wensheng Yu Shanghai Key Laboratory of Trustworthy Computing East China Normal University, Shanghai , China *Corresponding Author: Abstrat Transportation yber physial systems suh as automotive, aviation, and rail involve interations between software ontrollers, ommuniation networks, and physial devies. These systems are among the most omplex yber physial systems being designed by humans, but added time and ost onstraints make their development a signifiant tehnial hallenge. Formal speifiation tehnologies are now indispensable for quikly developing safe and reliable transportation systems. In this paper, we propose a formal speifiation approah for Transportation yber physial systems. The proposed formal framework is suh a formwork. On the one hand, it an deal with ontinuous-time systems based on sets of ordinary differential equations. On the other hand, it an deal with disrete-event systems, without ontinuous variables or differential equations. We present a ombination of the formal methods Timed-CSP, ZimOO and differential dynami logi (DL). Eah method an desribe ertain aspets of a transportation yber physial system: CSP an desribe ommuniation, onurrent and real-time requirements; ZimOO expresses omplex data operations; differential dynami logi (DL) model the dynamis and ontrol (DC) parts. A ase study of train ontrol system illustrates the speifiation proess for Transportation yber physial systems. Keywords: Transportation Cyber Physial Systems, ZimOO; Timed-CSP; Differential Logi 1. Introdution Transportation yber physial systems [1] onsist of three parts: the dynamis and ontrol (DC) parts, the ommuniation part and omputation part. The DC part is that of a predominantly ontinuous-time system, whih is modeled by means of differential (algebrai) equations, or by means of a set of trajetories. The evolution of a hybrid system in the ontinuous-time domain is onsidered as a set of pieewise ontinuous funtions of time. The omputation part is that of a predominantly disrete-event system. A well-known model is a (hybrid) automaton, but modeling of disrete-event systems is also based on, among others, Z,VDM, proess algebras, Petri nets, and data flow languages. Clearly, yber physial systems represent a domain where the DC, ommuniation and omputation aspets must be met, and we believe that a formalism that integrates the DC, ommuniation and omputation aspets is a valuable ontribution towards integration of the DC, ommuniation and omputation methods, tehniques, and tools [2]. In this paper, we provide some ideas for formal speifiation of transportation yber physial systems and one well known ase study to validate formal speifiation. 157

2 2. Formal Speifiation for Transportation Cyber Physial Systems There are three parts in Transportation yber physial systems. First, the physial part is physial entities of a yber physial system. It is simply that part of the systems that is not realized with omputers or digital systems. It an inlude mehanial parts, biologial or hemial proesses, or human operators. Seond, there are one or more omputational plateforms, whih onsist of sensors, atuators, one or more omputers, and (possible one or more operating systems). Third, there is a ommuniation part, whih provides the mehanisms for ommuniations and physial parts to ommuniate. Thus, we an separate yber physial systems into three parts: yber, physial, and ommuniation by aspetoriented development methods [3-5] as shown in Figure 1. Figure 1. Speifiation of Three aspets of CPS In this paper, we propose a formal approah that integrates CSP [6], ZIMOO [7] and differential dynami logi [8] to speify yber physial systems by aspet-oriented methods. The proposed approah allows us to present in a modular way the dynami ontinuous, data hanges, and timing aspets of the systems we want to verify. We use Communiating Sequential Proesses (CSP) to speify the ommuniation part, ZIMOO to desribe the state spae and its hange, and the differential dynami logi to model the dynami ontinuous of transportation yber physial systems. After the establishment of three sub-aspets models, then form a omplete system model by integrating the three sub-aspets through aspetoriented method. Z [19] is a formal language used to define data types and to show the effet of operations on these types. It laks, however, features to express the order in whih the operations are exeuted. Proess algebras [5], like CSP, on other hand, are suitable for showing the order of 158

3 the ourrene of events but lak the ability to handle omplex abstrat data types and operations. Finally, formalisms like differential dynami logi on dynami aspets [17]. ZimOO is an extended subset of Objet-Z [20-21]allowing desriptions of disrete and ontinuous features of a system in a ommon formalism ZimOO supports three different kinds of lasses: disrete as in Objet-Z, ontinuous and hybrid lasses. Thus, the system an be strutured better and the well-known suitable formalisms an be applied to desribe, analyze, and refine the different parts of the system. The bridge between the ontinuous and the disrete world is built by hybrid lasses. The differential dynami logi (dl) is a logi for speifying and verifying hybrid systems [17, 15]. The logi dl an be used to speify orretness properties for hybrid systems given operationally as hybrid programs. The basi idea for dl formulas is to have formulas of the form [α]φ to speify that the hybrid system α always remains within region φ, i.e., all states reahable by following the transitions of hybrid system α statisfy the formula φ. Dually, the dl formula <α>φ expresses that the hybrid system α is able to reah region φ, i.e., there is a state reahable by following the transitions of hybrid system α that statisfies the formula φ. For instane, the following formula expresses that for the state of a train ontroller train, the property y m always holds true when starting in a state where v 2 2b(m-y) is true: v 2 2b(my) -> [train]y m. Aspet-oriented approahes use a separation of onern strategy, in whih a set of simpler models, eah built for a speifi aspet of the system, are defined and analyzed. Eah aspet model an be onstruted and evolved relatively independently from other aspet models. Aspet-oriented speifiation is made by extending TCOZ and ZIMOO notation with aspet notations. The shema for aspet speifiation in has the general form as shown in Figure 2, Figure 3, Figure 4, and Figure 5. AspetName [generi parameters] Type and Constant Definitions Inherited Aspets PointCut State PointCut Operations InterType State InterType Operations Composite Shema Figure 2. Aspets of Model Struture PointCutName Type and Constant Definitions ClassRef / AspetRef Prediates Figure 3. PointCut Operation Shema of Struture 159

4 JoinPoint Composition Composition Rule:= JoinPoint 1 JoinPoint 2 JoinPoint n $p 1, p 2 :Pointut Ù $ j ÎJoinpoint Ù bî BasiModel Ù jîp 1 p 2. p 1 = p 2 Þ W(b,{p 1, p 2 })=W(W(b,p 1 ),p 2 ) Figure 4. Composition Shema of Struture PointCut state := PointCut PointName:P jionpoint InterType state := TypeName:Delaration PointCut operation := PointCutName ΩClassRef/AspetRef Type definitions [Insert/Replae]Prediates InterType operation := TypeName::opreationName Type definitions Prediates Composition shema := Composition JointPoint Composition rule:= PointName 1 PointName 2 PointName m _ _:Pointut Name PointutName p1,p2:pointutname j Joinpoint B Basi model j p1 P2 p1=p2 =>W(b{p1,p2})=W(W,(b,p2),p1) Figure 5. Speifiation of Operations and Shema 3. Case Study: Formal Speifiation of Train Control Systems Figure 6 surveys the ontroller arhiteture we want to speify in this ase study [9-12]. In the entre of the diagram is the train ontroller whose purposes are to limit the speed of the train, deide when it is time to swith points and seure rossings, and make sure that the train does not enter them too early. The odometer keeps trak of the speed and position of the train. The position is measured by various means. The speed ontroller supervises the speed and makes sure that it does not exeed the limit set by the train ontroller, otherwise it automatially slows down the train. When the speed limit is set to zero, the train will break until it omes to a safe halt. The ommuniation with rossings is done by the radio ontroller. Trak Data Radio ontroller Train ontroller Odometer Speed ontroller Figure 6. Logi Struture of Train Dispathing 160

5 Safety and seurity are very are important in our life [18, 22], we should use formal tehnique to speify train ontrol systems. The first aspet is ommuniation. Formal methods is very power to make strit speifiation [13]. Most of the ommuniations are initiated by the train ontroller itself, e.g., the train ontroller deides when it is time to seure a trak element. But there are also ommuniations initiated externally, e.g., the signal that is sent when a rossing affirms that it is safe. These ommuniations an be naturally modelled with CSP [14]. As an example we an model the loop supervising the speed in CSP by the following reursive equation: Radio _ om SuperviseTrain 1 SuperviseTrain 2 SuperviseTrain 1 getspd getpos almaxspd setmaxspd SuperviseTrain 1 SuperviseTrain 2 There are two ommuniation operation for train (ontroler)part: one is to report the situation of urrent train, another is to supervise the situation of train movement. The CSP model is as follows: Train _ om Re port Supervise Re port reportinfo Re port Supervise superviseinfo Supervise The ommuniation model of the whole transport systems is expressed by CSP as follows: Main radio _ om train _ om OtherParal lel Pr oess The purpose of the train ontrol system is to ensure that train annot rash into other trains or pass open gates. Its seondary objetive is to maximize throughput and veloity without endangering safety. Permission to move is granted dynamially by deentralized Radio Blok Controllers (RBCs) depending on the urrent trak situation and movement of the other traffi agents within the region of responsibility of the RBC as shown in Figure 7. We assume that an MA (movement authority) has been granted up to some trak position, whih we an all in, and the train is loated at position z, heading with urrent speed v towards m. We represent the point SB as the safety distane s relative to the end m of the MA (i.e., m-s=sb). In this situation, differential dynami logi (dl) [15-16] an speify the following ruial safety property of the train ontrol system, whih we state as a DL formula as shown in Figure 8. It expresses that a train always remains with its MA. 161

6 RBC z SB s m Figure 7. Train Coordination Protool ( ontrol ; dirve)* z m where ontrol (? m z s; a : b ) (? m - z s; a : A), drive : 0;( z ' v, v ' a, ' 1& v 0 Ù ). Figure 8. Safety Property of the Train Control System A trak element has a unique identifier id and an be either a rossing or a point. The assoiated danger position is stored in pos as shown in Figure 9. TrakElement id:identifier type:type pos:position Figure 9. Speifiation of Trak Element The trak atlas ontains information about trak elements, urrent speed, urrent position, diretion and the maximum speed for eah trak segment. It is also represented by a Z shema as shown in Figure 10. TrakData id:identifier pos:position dir:diretion ur_spd:speed max_spd:speed ur_time:time Elems:seq_TrakElement Figure 10. Speifiation of Trak Data 162

7 The train ontrol is deomposed into different sub-aspets so that omplex appliation is deomposed into simple small aspets. For train ontrol, first, the ommuniation hannels of the lass are delared. Every hannel has a type whih restrits the values that it an ommuniate. There are also loal hannels that are visible only inside the lass and that are used by the CSP, ZIMOO, and differential dynami logi (dl) parts for interation. Seond, the CSP part follows; it is given by a system of (reursive) proess equations. Third, the Z part is given whih itself onsists of the state spae, the Init shema and ommuniation shemas. For eah ommuniation event a orresponding ommuniation shema speifies in whih way the state should be hanged when the event ours. Finally, below a horizontal line the differential dynami logi (dl) part is stated. Classes an be ombined into larger speifiations by CSP operators like parallel omposition, hiding and renaming. Figure 11 gives out the model of the train ontrol. TrainController Train _ om Re port Supervise Re port reportinfo Re port Supervise sup erviseinfo Supervise [CSP part] position:[p!:position] han speed:[s?:speed] han t:[t?:time] han state:[state?state]han Init t=time now speed=0 positon=position now om_reportinfo position!=position speed!=speed om_reeiveinfo Δ(t,maxSpeed) maxspeed =maxspeed om_superviseinfo Δ(t,speed,position) speed?:speed position?:position speed =speed 0<speed<maxSpeed position =Position om_log Δ(t,reord) reord =reord ( ontrol ; dirve)* position dangerpositon where ontrol (? dangerposition position d; a : b) (? dangerposition - position d; [DLpart] a : A), run : 0; ( position ' v, v' a, ' 1& v 0 Ù ). Figure 11. Modeling Train Controller by the Integration of CSP, ZIMOO and Differential Dynami Logi (dl) 163

8 The movement permissions of trains are neither known beforehand nor fixed statially. They are determined based on the urrent trak situation by a Radio Blok Controller (RBC). Trains are only allowed to move within their urrent movement authority (MA), whih an be updated by the RBC using wireless ommuniation. Hene the train ontroller needs to regulate the movement of a train loally suh that it always remains within its MA. The RBC is modeled by CSP, ZIMOO, and differential dynami logi (dl) as shown in Figure 12 and Figure 13. train:seq Position speed:seq Speed maxspeed:speed emergenytrain:n d:position a:r n:n brakingdist:speed Position n # train # speed 0 d brakingdist (max Speed ) s, s ': Speed s s ' brakingdist ( s ) brakingdist ( s ') Figure 12. State Spae of Radio Controller RadioController Radio _ om SuperviseTrain 1 SuperviseTrain 2 SuperviseTrain 2 SuperviseTrain 1 getspd getpos almaxspd setmaxspd SuperviseTrain 1 train:seq Position speed:seq Speed maxspeed:speed emergenytrain:n d:position a:r n:n brakingdist:speed Position n # train # speed 0 d brakingdist (max Speed ) s, s ': Speed s s ' brakingdist ( s ) brakingdist ( s ') Init emergenyt rain n i : dom speed 0 speed ( i ) max Speed i : dom train i 1trian ( i ) train ( i 1) brakingdis t ( speed ( i )) om_supervisetrain ( speed, emergenytrain ) newemergenytrain? : N newemergenytrain? n emergenytrain' min{ newemergenytrain?, emergenytrain} speed '( emergenytrain') 0 i Î N i emergenytrain' speed '( i ) speed ( i ) Figure 13. Speifition of Radio Blok Controller 164

9 In the shema CrossController, train represents the partiular finite set of potential Trains embodied in the systems. All of the trains need not atually exist at any partiular time, in this sense they are like Trains with a unique segments being reserved for all possible Train segments instantiations during the lifetime of the system. The importane funtion gives a user-assigned priority to eah train and is hosen aording to how ritial thr Trains is to the safe and orret funtion of the system. The shema CrossController desribes the information neessary to shedule proesses in a running systems as shown in Figure 14. CrossController[X] train : Train tstate: Train Tstate shed : Train Pr iority swith : Swith running : Train { } t : Train Tstate ( t ) freet dom Shed t : Train Tstate ( t ) free Shed ( t ) impor tan e( t ) let Re adytrain domtstate {Re ady} Re adytrain Þ running Re adytrian Þ ( Shed ( Running ) max Shed ( Re adytrian ) Ù Init Swith=off runningî Re adytrain) entercrossing Δ(swith) readytrain?:train swith=off leavecrossing Δ(swith) readytrain?:train swith=on Main r entercrossin g leavecrossin g Figure 14. Speifiation of Crossing Control Logs monitor system behavior. Whether you are running train ontrol systems, whether eah event happens, all of these have some sort of event logging inbuilt into them. Any time your system reats to anything an event log is generated as shown in Figure

10 Log[X] log:seq X reord:han Add Δ(reord) x?:x reord ' reord Ù Main L Write Write x : X reod? x Add Ù Figure 15. Speifiation of PonitCut PC 1 :{rosscontroller} PointCut PC 2 :{Log} PC 1 state =rosscontroller[position,speed] PC 2 reord =Log[reord] Composition Compostion rule:=pc 2 PC 1 4. Conlusion Figure 16. Composition of the System In this paper we proposed to use formal speifiation for transportation yber physial systems based on the ombination of the formal methods Timed-CSP, ZimOO and differential dynami logi. A ase study of train ontrol system was used to illustrate the speifiation proess of formal speifiation for Transportation yber physial systems. The further work is devoted to integrated formal speifiation with AADL further. Aknowledgements This work is supported by Shanghai 085 Projet for Muniipal Universities and the Innovation Program of Shanghai Muniipal Eduation Commission under grant No. ZF1213, national high tehnology researh and development program of China (No.2011AA010101), national basi researh program of China (No.2011CB302904), the national siene 166

11 foundation of China under grant No , No , No , No ), dotoral program foundation of institutions of higher eduation of China (No ), national; siene foundation of Guangdong provine under grant (No.S ). Referenes [1] Grand Challenges for transportation Cyber-Physial Systems, [2] E. A. Lee and S. A. Seshia, Introdution to Embedded Systems A Cyber-Physial Systems Approah, Berkeley, CA: LeeSeshia.org, (2011). [3] G. Kizales, Aspet-Oriented Programming, Pro. of the 11 th European Conf. on Objet-Oriented Programming, (1997) June. [4] X. Wen and H. Yu, Real-Time Systems Modeling and Verifiation with Aspet-Oriented Timed Stateharts, International Journal of Hybrid Information Tehnology, vol. 5, no. 1, (2012) January, pp [5] J. Y. Liu, L. C. Zhang, Y. Zhong and Y. Chen, Middleware-based Distributed Systems Software Proess, International Journal of Advaned Siene and Tehnology, vol. 13, (2009) Deember, pp [6] J. Davies and S. Shneider, A Brief History of Timed CSP, Theoretial Computer Siene, vol. 138, no. (1995), pp [7] V. Friesen, An Exerise in Hybrid System Speifiation Using an Extension of Z, iteseerx.ist.psu.edu/viewdo/download?doi= &rep. [8] A. Platzer, Differential dynami logi for verifying parametri hybrid systems, LNCS 4548, Springer, (2007), pp [9] J. Hoenike, Speifiation of Radio Based Railway Crossings with the Combination of CSP, OZ, and DC, [10] J. Faber, S. Jaobs and V. Sofronie-Stokkermans, Verifying CSP-OZ-DC Speifiations with Complex Data Typesand Timing Parameters, Integrated Formal Methods, (2007), July 3 rd. [11] P. Derler, E. A. Lee and A. Sangiovanni-Vinentelli, Modeling Cyber-Physial Systems, Proeedings of the IEEE speial issue on CPS, (2011) Deember. [12] J. Hoenike, Combination of Proesses, Data, and Time, PhD thesis, University of Oldenburg, (2006) July. [13] C. F. Ngolah and Y. Wang, Tool Support for Software Development Based on Formal Speifiations in RTPA, International Journal of Software Engineering and Its Appliations, vol. 3, no. 3, (2009) July, pp [14] A. Sherif, A. Cavalanti, J. He and A. Sampaio, A proess algebrai framework for speifiation and validation of real-time systems, Formal Asp. Comput., vol. 22, no. 2, (2010), pp [15] A. Platzer, Differential dynami logi for hybrid systems, Journal of Automated Reasoning, vol. 41, no. 2, (2008), pp [16] A. Platzer, Differential dynami logi for verifying parametri hybrid systems, LNCS 4548, Springer, (2007), pp [17] S. Rekhis, N. Bouassida, R. Bouaziz, C. Duvallet and B. Sadeg, Modeling Real-Time appliations with Reusable Design Patterns, International Journal of Advaned Siene and Tehnology, vol. 22, September (2010), pp [18] M. B. Swarup and P. S. Ramaiah, A Software Safety Model for Safety Critial Appliations, International Journal of Software Engineering and Its Appliations, vol. 3, no. 4, (2009) Otober, pp [19] J. Spivey, The Z Notation: A Referne Manual (2rd Edition), Prentie Hall, UK, (1992). [20] G. Smith, The Objet-Z Speifiation Language, Software Verifiation Researh Centre University of Queensland, (2000). [21] B. P. Mahony and J. S. Dong, Blending Objet-Z and Timed CSP: An introdution to TCOZ, ICSE'98, (1998) April. [22] F. Y. Sattarova and T. -h. Kim, IT Seurity Review: Privay, Protetion, Aess Control, Assurane and System Seurity, International Journal of Multimedia and Ubiquitous Engineering, vol. 2, no. 2, (2007), April, pp

12 168