Formal Specification for Transportation Cyber Physical Systems

Transcription

1 Formal Speifiation for Transportation Cyber Physial Systems ihen Zhang, Jifeng He and Wensheng Yu Shanghai Key aboratory of Trustworthy Computing East China Normal University Shanghai , China Abstrat. Transportation yber physial systems suh as automotive, aviation, and rail involve interations between software ontrollers, ommuniation networks, and physial devies. These systems are among the most omplex yber physial systems being designed by humans, but added time and ost onstraints make their development a signifiant tehnial hallenge. Formal speifiation tehnologies are now indispensable for quikly developing safe and reliable transportation systems. In this paper, we propose a formal speifiation approah for Transportation yber physial systems. The proposed formal framework is suh a formwork. On the one hand, it an deal with ontinuous-time systems based on sets of ordinary differential equations. On the other hand, it an deal with disrete-event systems, without ontinuous variables or differential equations. We present a ombination of the formal methods Timed-CSP, ZimOO and differential (algebrai) equations or differential logi. Eah method an desribe ertain aspets of a transportation yber physial system: CSP an desribe ommuniation, onurrent and real-time requirements; ZimOO expresses omplex data operations; differential (algebrai) equations model the dynamis and ontrol (DC) parts. A ase study of train ontrol system illustrates the speifiation proess for Transportation yber physial systems. Keywords: Transportation Cyber Physial Systems, ZimOO, Timed-CSP, Differential ogi 1 Introdution Transportation yber physial systems[1] automotive, aviation, and rail involve interations between software ontrollers, ommuniation networks, and physial devies. These systems are among the most omplex yber physial systems being designed by humans, but added time and ost onstraints make their development a signifiant tehnial hallenge. Formal speifiation tehnologies are now indispensable for quikly developing safe and reliable transportation systems. Transportation yber physial systems onsist of three parts: the dynamis and ontrol (DC) parts, the ommuniation part and omputation part. The DC part is that 122

2 of a predominantly ontinuous-time system, whih is modeled by means of differential (algebrai) equations, or by means of a set of trajetories. The evolution of a hybrid system in the ontinuous-time domain is onsidered as a set of pieewise ontinuous funtions of time. The omputation part is that of a predominantly disrete-event system. A well-known model is a (hybrid) automaton, but modeling of disrete-event systems is also based on, among others, Z,VDM, proess algebras, Petri nets, and data flow languages. Clearly, yber physial systems represent a domain where the DC, ommuniation and omputation aspets must be met, and we believe that a formalism that integrates the DC, ommuniation and omputation aspets is a valuable ontribution towards integration of the DC, ommuniation and omputation methods, tehniques, and tools [2]. In this paper, we provide some ideas for formal speifiation of transportation yber physial systems and one well known ase study to validate formal speifiation. 2 Formal Speifiation for Transportation Cyber Physial Systems Transportation systems are omplex systems and urrent formal speifiation tehnology does not sale to the sizes of these systems. These systems need to be analyzed at several levels of abstration. It is unlikely that a single speifiation tehnique will suffie at every level. CSP is suitable for showing the order of the ourrene of events but lak the ability to handle omplex abstrat data types and operations.[3] ZimOO [4] is based on Objet-Z [5], an objet-oriented extension of Z [6], ZimOO is an extended subset of Objet-Z allowing desriptions of disrete and ontinuous features of a system in a ommon formalism ZimOO supports three different kinds of lasses: disrete as in Objet-Z, ontinuous and hybrid lasses. The differential dynami logi (d) [7] is a logi for speifying and verifying hybrid systems [17][15]. The logi d an be used to speify orretness properties for hybrid systems given operationally as hybrid programs. The basi idea for d formulas is to have formulas of the form [α]φ to speify that the hybrid system α always remains within region φ, i.e., all states reahable by following the transitions of hybrid system α statisfy the formula φ. Dually, the d formula <α>φ expresses that the hybrid system α is able to reah region φ, i.e., there is a state reahable by following the transitions of hybrid system α that statisfies the formula φ. Aspet-oriented approahes[8] use a separation of onern strategy, in whih a set of simpler models, eah built for a speifi aspet of the system, are defined and analyzed. Eah aspet model an be onstruted and evolved relatively independently from other aspet models. Aspet-oriented speifiation is made by extending TCOZ [9] and ZIMOO notation with aspet notations. The shema for aspet speifiation in has the general form as shown in Fig

3 Fig.1. Aspets of Model Struture 3 Case Study: Formal Speifiation of Train Control Systems Train ontrol systems ontain several omponents onneted by ommuniation hannels. One important omponent is the train ontroller whose purposes are to limit the speed of the train, deide when it is time to swith points and seure rossings, and make sure that the train does not enter them too early. The odometer omponent keeps trak of the speed and position of the train. The speed ontroller supervises the speed and makes sure that it does not exeed the limit set by the train ontroller, otherwise it automatially slows down the train. When the speed limit is set to zero, the train will break until it omes to a safe halt. The ommuniation with rossings is done by the radio ontroller. As said above, the ommuniation medium is radio based. Speial are has to be taken, beause radio transmissions are inherently unsafe. The safety must still be established under the assumption that no message an be transferred [10][11] For speifiation of train ontrol using formal methods, First, the ommuniation hannels of the lass are delared. Every hannel has a type whih restrits the values that it an ommuniate. There are also loal hannels that are visible only inside the lass and that are used by the CSP, ZIMOO, and differential dynami logi (d) parts for interation. Seond, the CSP part follows; it is given by a system of (reursive) proess equations. Third, the Z part is given whih itself onsists of the state spae, the Init shema and ommuniation shemas. For eah ommuniation event a orresponding ommuniation shema speifies in whih way the state should be hanged when the event ours. Finally, below a horizontal line the differential dynami logi (d) part is stated. Classes an be ombined into larger speifiations by CSP operators like parallel omposition, hiding and renaming. The first aspet is ommuniation. These ommuniations an be naturally modelled with CSP. As an example we an model the loop supervising the speed in CSP by the following reursive equation: Radio_ om= SuperviseTrain1 SuperviseTrain2 SuperviseTrain1= getspd getpos almaxspd setmaxspd SuperviseTrain1 SuperviseTrain 2= It is assumed that an MA (movement authority) has been granted up to some trak position, whih we an all in, and the train is loated at position z, heading with urrent speed v towards m. We represent the point SB as the safety distane s relative 124

4 to the end m of the MA (i.e., m-s=sb). In this situation, differential dynami logi (d) an speify the following ruial safety property of the train ontrol system, whih we state as a D formula whih expresses that a train always remains with its MA [12]. ψ [( ontrol ; dirve )*] z m where ontrol drive (? m z τ : = 0; ( s; a : = b ) (? m - z s; a : = A ), z ' = v, v ' = a, τ ' = 1& v 0 τ ε ). A train ontroller limits the speed of the train, deides when it is time to swith points and seure rossings, and makes sure that the train does not enter them too early [13].There are main variables and operations in the train movement proess: speed, time, reportinfo, update log, reeive ommand, brake, supervise. This paper uses ZIMOO to speify state spae. Fig.2 gives out the model of the train ontrol. Train_ om= Re port Supervise Re port= reportinfo Re port Supervise= superviseinfo Supervise ψ [ ( ontrol; dirve)* ] position dangerpositon where ontrol (? dangerposition position d; a: = b) (? dangerposition- position d; a: = A), run τ : = 0; ( position' = v, v' = a, τ' = 1& v 0 τ ε). Fig. 2. Modeling Train Controller by the integration of CSP, ZIMOO, and differential dynami logi (d) The movement permissions of trains are neither known beforehand nor fixed statially. They are determined based on the urrent trak situation by a Radio Blok Controller (RBC) [14] [15] [16]. Trains are only allowed to move within their urrent 125

5 movement authority (MA), whih an be updated by the RBC using wireless ommuniation. Hene the train ontroller needs to regulate the movement of a train loally suh that it always remains within its MA. The RBC is modeled by CSP[17], ZIMOO, and differential dynami logi (d) [18] as shown in Fig.3. Radio _ om= SuperviseTrain1 SuperviseTrain 2 SuperviseTrain1= getspd getpos almaxspd SuperviseTrain 2= setmaxspd SuperviseTrain1 n= # train= # speed 0< d = brakingdist(max Speed) s, s': Speed s s' brakingdist( s) brakingdist( s') emergenyt rain > n i: dom speed 0 speed ( i) max Speed i: dom train i 1 trian( i) < train( i 1) brakingdis t( speed ( i)) ( speed, emergenytrain) newemergenytrain?: N newemergenytrain? n emergenytrain' = min{ newemergenytrain?, emergenytrain} speed' ( emergenytrain' ) = 0 i N i emergenytrain' speed' ( i) = speed( i) Fig.3. Speifiation of Radio Blok Controller 4 Conlusion In this paper, we proposed a formal speifiation approah for Transportation yber physial systems. The proposed formal framework is suh a formwork. On the one hand, it an deal with ontinuous-time systems based on sets of ordinary differential equations. On the other hand, it an deal with disrete-event systems, without ontinuous variables or differential equations. We presented a ombination of the formal methods Timed-CSP, ZimOO and differential (algebrai) equations or differential logi. Eah method an desribe ertain aspets of a transportation yber physial system: CSP an desribe ommuniation, onurrent and real-time requirements; ZimOO expresses omplex data operations; differential (algebrai) equations model the dynamis and ontrol (DC) parts. A ase study of train ontrol system illustrates the speifiation proess for Transportation yber physial systems. system was used to illustrate the speifiation proess of formal speifiation for yber physial systems. The further work is devoted to integrated formal speifiation with AAD further. 126

6 Aknowledgments. This work is supported by national high tehnology researh and development program of China (No.2011AA010101), national basi researh program of China (No.2011CB302904), the national siene foundation of China under grant No , No , No ), dotoral program foundation of institutions of higher eduation of China (No ), national; siene foundation of Guangdong provine under grant No.S Referenes 1. Grand Challenges for transportation Cyber-Physial Systems 2. E. A. ee and S. A. Seshia, Introdution to Embedded Systems A Cyber-Physial Systems Approah, Berkeley, CA: eeseshia.org, Adnan Sherif, Ana Cavalanti, Jifeng He, Augusto Sampaio: A proess algebrai framework for speifiation and validation of real-time systems. Formal Asp. Comput. 22(2): (2010) 4. Viktor Friesen. An Exerise in Hybrid System Speifiation Using an Extension of Z. iteseerx.ist.psu.edu/viewdo/download?doi= &rep. 5. Graeme Smith. The Objet-Z Speifiation anguage[m]. Software Verifiation Researh Centre University of Queensland J. Spivey: The Z Notation: A Referne Manual (2rd Edition). Prentie Hall, UK, André Platzer. Differential dynami logi for hybrid systems. Journal of Automated Reasoning, 41(2), pp , Kizales G,et al.aspet-oriented Programming. In:pro.of the 11 th European Conf. on Objet-Oriented Programming, June B. P. Mahony and J.S. Dong. Blending Objet-Z and Timed CSP: An introdution to TCOZ. ICSE'98, April Johen Hoenike. Combination of Proesses, Data, and Time. PhD thesis, University of Oldenburg, July Johen Hoenike:Speifiation of Radio Based Railway Crossings with the Combination of CSP, OZ, and DC A. Platzer. ogial Analysis of Hybrid Systems: Proving Theorems for Complex Dynamis. Springer, p. ISBN Johannes Faber, Swen Jaobs, Vioria Sofronie-Stokkermans: Verifying CSP-OZ-DC Speifiations with Complex Data Types and Timing Parameters. Integrated Formal Methods 2007, July 3 rd. 14. André Platzer. Differential dynami logi for verifying parametri hybrid systems. NCS 4548, pp Springer, Johen Hoenike and Patrik Maier. Model-heking of speifiations integrating proesses, data and time. In J.S. Fitzgerald, I.J. Hayes, and A. Tarleki, editors, FM 2005, volume 3582 of NCS, pages Springer, J. Hoenike and E.-R. Olderog. CSP-OZ-DC: A ombination of speifiation tehniques for proesses, data and time. Nordi Journal of Computing, 9(4): , Davies J, Shneider S. A Brief History of Timed CSP[J]. Theoretial Computer Siene, 1995, 138(1): A. Platzer. A omplete axiomatization of quantified differential dynami logi for distributed hybrid systems. ogial Methods in Computer Siene, 42 pages. Speial issue for seleted papers from CS'10 127