Component-based Verification of Cyber-Physical Flow Systems Andreas - - PowerPoint PPT Presentation
Verified Traffic Networks: Component-based Verification of Cyber-Physical Flow Systems Andreas Mller andreas.mueller@jku.at Stefan Mitsch - stefan.mitsch@jku.at Andr Platzer - aplatzer@cs.cmu.edu Johannes Kepler University, Linz
Andreas Müller – andreas.mueller@jku.at Stefan Mitsch - stefan.mitsch@jku.at
Johannes Kepler University, Linz Department of Cooperative Information Systems (CIS ) http://cis.jku.at/
André Platzer - aplatzer@cs.cmu.edu
Carnegie Mellon University, Pittsburgh Computer Science Department http://www.ls.cs.cmu.edu/
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Introduction Challenges Approach Implementation Conclusion
2
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Management System
→Safety of critical actions is crucial
3
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Management System
→Safety of critical actions is crucial
3
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Management System
→Safety of critical actions is crucial
3
adapt interval
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Management System
→Safety of critical actions is crucial
3
adapt interval set speed limit
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Management System
→Safety of critical actions is crucial
Safety
3
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Management System
→Safety of critical actions is crucial
Safety
3
load capacity
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Management System
→Safety of critical actions is crucial
Safety
3
load capacity load ≤ capacity
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Management System
→Safety of critical actions is crucial
Safety
3
capacity load
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Management System
→Safety of critical actions is crucial
Safety
3
capacity load load ≥ capacity
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Management System
→Safety of critical actions is crucial
Safety
3
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Management System
→Safety of critical actions is crucial
Safety
Cyber-physical systems (CPS)
3
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Management System
→Safety of critical actions is crucial
Safety
Cyber-physical systems (CPS)
3
𝑚𝑝𝑏𝑒′ = 𝑢𝑚 𝑢𝑚 ≔ 𝑠𝑓𝑒/𝑠𝑓𝑓𝑜
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Management System
→Safety of critical actions is crucial
Safety
Cyber-physical systems (CPS)
Methods to analyze models of CPS
3
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Management System
→Safety of critical actions is crucial
Safety
Cyber-physical systems (CPS)
Methods to analyze models of CPS
3
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Verification
Example
4
≤ → 𝑗𝑔 𝑠𝑓𝑒 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ∪ 𝑗𝑔 𝑠𝑓𝑓𝑜 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 − 𝑝𝑣𝑢
≤
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Verification
Example
4
≤ → 𝑗𝑔 𝑠𝑓𝑒 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ∪ 𝑗𝑔 𝑠𝑓𝑓𝑜 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 − 𝑝𝑣𝑢
≤
∪
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Verification
Example
4
≤ → 𝑗𝑔 𝑠𝑓𝑒 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ∪ 𝑗𝑔 𝑠𝑓𝑓𝑜 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 − 𝑝𝑣𝑢
≤
∪
→ ≤ → 𝑗𝑔 𝑠𝑓𝑒 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ≤ → ≤ → 𝑗𝑔 𝑠𝑓𝑓𝑜 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 − 𝑝𝑣𝑢 ≤
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Verification
Example
4
≤ → 𝑗𝑔 𝑠𝑓𝑒 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ∪ 𝑗𝑔 𝑠𝑓𝑓𝑜 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 − 𝑝𝑣𝑢
≤
∪
→ ≤ → 𝑗𝑔 𝑠𝑓𝑒 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ≤ → ≤ → 𝑗𝑔 𝑠𝑓𝑓𝑜 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 − 𝑝𝑣𝑢 ≤
…
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Verification
Example
4
≤ → 𝑗𝑔 𝑠𝑓𝑒 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ∪ 𝑗𝑔 𝑠𝑓𝑓𝑜 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 − 𝑝𝑣𝑢
≤
∪
→ ≤ → 𝑗𝑔 𝑠𝑓𝑒 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ≤ → ≤ → 𝑗𝑔 𝑠𝑓𝑓𝑜 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 − 𝑝𝑣𝑢 ≤ ∧ → ≤ ∧ 𝑠𝑓𝑒 → 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ≤
…
𝑗𝑔
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Verification
Example
4
≤ → 𝑗𝑔 𝑠𝑓𝑒 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ∪ 𝑗𝑔 𝑠𝑓𝑓𝑜 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 − 𝑝𝑣𝑢
≤
∪
→ ≤ → 𝑗𝑔 𝑠𝑓𝑒 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ≤ → ≤ → 𝑗𝑔 𝑠𝑓𝑓𝑜 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 − 𝑝𝑣𝑢 ≤ ∧ → ≤ ∧ 𝑠𝑓𝑒 → 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ≤ [′]
… …
𝑗𝑔
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Verification
Example
4
≤ → 𝑗𝑔 𝑠𝑓𝑒 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ∪ 𝑗𝑔 𝑠𝑓𝑓𝑜 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 − 𝑝𝑣𝑢
≤
∪
→ ≤ → 𝑗𝑔 𝑠𝑓𝑒 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ≤ → ≤ → 𝑗𝑔 𝑠𝑓𝑓𝑜 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 − 𝑝𝑣𝑢 ≤ ∧ → ≤ ∧ 𝑠𝑓𝑒 → 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ≤ [′]
… …
𝑗𝑔
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Real systems are large
challenging
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Real systems are large
challenging
5
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Real systems are large
challenging
6
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Real systems are large
6
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Real systems are large Any change to the model requires full re-verification
7
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Real systems are large Any change to the model requires full re-verification
7
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Real systems are large Any change to the model requires full re-verification
8
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Real systems are large Any change to the model requires full re-verification Systems often consist of multiple similar patterns
9
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Real systems are large Any change to the model requires full re-verification Systems often consist of multiple similar patterns
9
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
33
Real systems are large Any change to the model requires full re-verification Systems often consist of multiple similar patterns
10
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
34
Real systems are large Any change to the model requires full re-verification Systems often consist of multiple similar patterns
10
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Real systems are large Any change to the model requires full re-verification Systems often consist of multiple similar patterns
Component-based modeling
11
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Real systems are large Any change to the model requires full re-verification Systems often consist of multiple similar patterns
Component-based modeling
11
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Real systems are large Any change to the model requires full re-verification Systems often consist of multiple similar patterns
Component-based modeling
verified system
11
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Component-based modeling
necessarily entail verified system
12
Real systems are large Any change to the model requires full re-verification Systems often consist of multiple similar patterns
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Component-based Verification
Process
(1) Model component types (2) Verify safety conditions for each type and their composition
(3) Compose component instances to form system model
Result
13
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Component-based Verification
Process
(1) Model component types (2) Verify safety conditions for each type and their composition
(3) Compose component instances to form system model
Result
13
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Generic component
(load, capacity, actual, max)
(actual, max)
14
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Light
Generic component
(load, capacity, actual, max)
(actual, max)
Example:
14
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Light
Generic component
(load, capacity, actual, max)
(actual, max)
Example:
Traffic Light Component
𝑗𝑜𝑛𝑏𝑦
𝑗𝑔 𝑠𝑓𝑒 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 ∪ 𝑗𝑔 𝑠𝑓𝑓𝑜 𝑚𝑝𝑏𝑒′ = 𝑗𝑜 − 𝑝𝑣𝑢
load cap Inflows Outflows
𝑗𝑜𝑏𝑑𝑢 𝑝𝑣𝑢𝑏𝑑𝑢 𝑝𝑣𝑢𝑛𝑏𝑦
Controller
14
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Generic component
(load, capacity, actual, max)
(actual, max)
Component types
14
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Safety Property: No traffic breakdown occurs
15
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Safety Property: No traffic breakdown occurs
Contracts
𝑑𝑏𝑞 ≥ max 𝑈
𝑠 ∗ 𝑗𝑛𝑏𝑦, 𝑈 ∗ 𝑗𝑛𝑏𝑦 − max 0, 𝑝𝑛𝑏𝑦 ∗ 𝑈 − 𝑈 𝑠
2 → ℎ𝑞𝑢𝑚 𝑢 ≤ 𝑈 → 𝑚𝑝𝑏𝑒 ≤ 𝑑𝑏𝑞 𝑑𝑏𝑞1 ≥ 𝑈 ∗ 𝑗1𝑛𝑏𝑦 ∧ 𝑑𝑏𝑞2 ≥ 𝑈 ∗ 𝑗2𝑛𝑏𝑦 → ℎ𝑞𝑛 𝑢 ≤ 𝑈 → 𝑚𝑝𝑏𝑒1 ≤ 𝑑𝑏𝑞1 ∧ 𝑚𝑝𝑏𝑒2 ≤ 𝑑𝑏𝑞2 𝑑𝑏𝑞 ≥ max 0, 𝑈 ∗ 𝑗𝑛𝑏𝑦 − min 𝑝1𝑛𝑏𝑦, 𝑝2𝑛𝑏𝑦 → ℎ𝑞𝑡 𝑢 ≤ 𝑈 → 𝑚𝑝𝑏𝑒 ≤ 𝑑𝑏𝑞
15
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Safety Property: No traffic breakdown occurs
Contracts
𝑑𝑏𝑞 ≥ max 𝑈
𝑠 ∗ 𝑗𝑛𝑏𝑦, 𝑈 ∗ 𝑗𝑛𝑏𝑦 − max 0, 𝑝𝑛𝑏𝑦 ∗ 𝑈 − 𝑈 𝑠
2 → ℎ𝑞𝑢𝑚 𝑢 ≤ 𝑈 → 𝑚𝑝𝑏𝑒 ≤ 𝑑𝑏𝑞 𝑑𝑏𝑞1 ≥ 𝑈 ∗ 𝑗1𝑛𝑏𝑦 ∧ 𝑑𝑏𝑞2 ≥ 𝑈 ∗ 𝑗2𝑛𝑏𝑦 → ℎ𝑞𝑛 𝑢 ≤ 𝑈 → 𝑚𝑝𝑏𝑒1 ≤ 𝑑𝑏𝑞1 ∧ 𝑚𝑝𝑏𝑒2 ≤ 𝑑𝑏𝑞2 𝑑𝑏𝑞 ≥ max 0, 𝑈 ∗ 𝑗𝑛𝑏𝑦 − min 𝑝1𝑛𝑏𝑦, 𝑝2𝑛𝑏𝑦 → ℎ𝑞𝑡 𝑢 ≤ 𝑈 → 𝑚𝑝𝑏𝑒 ≤ 𝑑𝑏𝑞
15
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Compose components
→Composition is again a safe component
Rebuild overall network
desired network is rebuilt
C1 C2 16
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Compose components
→Composition is again a safe component
Rebuild overall network
desired network is rebuilt
C1 C2 16
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Compose components
→Composition is again a safe component
Rebuild overall network
desired network is rebuilt
C1 C2
16
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Compose components
→Composition is again a safe component
Rebuild overall network
desired network is rebuilt
C1 C2
16
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
𝑝 𝑛𝑏𝑦 𝑝𝑝 𝑝 𝑛𝑏𝑦 𝑛𝑛𝑏𝑏𝑦𝑦 𝑝 𝑛𝑏𝑦 Compose components
Theorem: Preserve Safety
→Composition is again
a safe component →Composition is again a safe component
Rebuild overall network
desired network is rebuilt
C1 C2
16
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
𝑝 𝑛𝑏𝑦 𝑝𝑝 𝑝 𝑛𝑏𝑦 𝑛𝑛𝑏𝑏𝑦𝑦 𝑝 𝑛𝑏𝑦 Compose components
Theorem: Preserve Safety
→Composition is again a safe component
Rebuild overall network
desired network is rebuilt
C1 C2
16
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Network Graph
Add components Connect components (automatic compatibility check)
Extensible Component Library
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Network Graph
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Network Graph
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Load Graph Time Slider Analysis Panel
t=7: OVERFLOW@‘C1‘ load=10.0 …
Analyze model: How long is it safe? Simulate Model: How do loads change
Analyze model: Which components
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Traffic Network
Monolithic Component-based Number of Proofs 1 (presumably large) 3 + N Checks (traffic light/split/merge) Model Size # Variables X*6 + Y*6 + Z*7 6/6/7 LoC X*60 + Y*50 + Z*50 60/50/50 Connect… …Components Reproof of Composite Arithmetic Check Change… …Component or Properties Reproof Entire Model Redo Arithmetic Checks …Connections Reproof Entire Model Redo Arithmetic Checks Add… …Component Type Reproof Entire Model Reproof Component Model 20
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Example Network
Monolithic Component-based Number of Proofs 1 3 + 10 Checks (traffic light/split/merge) Model Size # Variables 95 6/6/7 LoC 800 60/50/50 Connect… …Components Reproof of Composite Arithmetic Check Change… …Component or Properties Reproof Entire Model Redo Arithmetic Checks …Connections Reproof Entire Model Redo Arithmetic Checks Add… …Component Type Reproof Entire Model Reproof Component Model 21
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Example Network
Monolithic Component-based Number of Proofs 1 3 + 10 Checks (traffic light/split/merge) Model Size # Variables 95 6/6/7 LoC 800 60/50/50 Connect… …Components Reproof of Composite Arithmetic Check Change… …Component or Properties Reproof Entire Model Redo Arithmetic Checks …Connections Reproof Entire Model Redo Arithmetic Checks Add… …Component Type Reproof Entire Model Reproof Component Model 21
THANKS FOR YOUR ATTENTION!
22
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Component-based CPS modeling and verification
Traffic models
Intelligent traffic management systems
[1] Damm, W.; et al. (2010): Towards Component Based Design of Hybrid Systems: Safety and Stability. In: Time for
[2] Henzinger, T.; et al. (2001): Assume-Guarantee Reasoning for Hierarchical Hybrid Systems. In: Hybrid Systems: Computation and Control. Springer Berlin Heidelberg. [3] Greenshields, B. D.; et al. (1933): The Photographic Method of Studying Traffic Behavior. In: Proceedings of the 13th Annual Meeting of the Highway Research Board. [4] Lighthill, M. J.;et al. (1955): On Kinematic Waves. II. A Theory of Traffic Flow on Long Crowded Roads. In: Proceedings of the Royal Society of London. [5] Baumgartner, N.; et al. (2014): A Tour of BeAware! – A situation awareness framework for control centers. In: Information Fusion 20. [6] Almejalli, K.; et al. (2007): Intelligent Traffic Control Decision Support System. In: Applications of Evolutionary
23
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
Consider traffic phenomena (e.g., shock-waves) Introduce further components Automatically transform networks into components and compositions Generic Component Definitions
24
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
25
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
26
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
27
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
28
Andreas Müller – Johannes Kepler University, Linz, Austria – September 7, 2015
29