8,812 research outputs found
PALS-Based Analysis of an Airplane Multirate Control System in Real-Time Maude
Distributed cyber-physical systems (DCPS) are pervasive in areas such as
aeronautics and ground transportation systems, including the case of
distributed hybrid systems. DCPS design and verification is quite challenging
because of asynchronous communication, network delays, and clock skews.
Furthermore, their model checking verification typically becomes unfeasible due
to the huge state space explosion caused by the system's concurrency. The PALS
("physically asynchronous, logically synchronous") methodology has been
proposed to reduce the design and verification of a DCPS to the much simpler
task of designing and verifying its underlying synchronous version. The
original PALS methodology assumes a single logical period, but Multirate PALS
extends it to deal with multirate DCPS in which components may operate with
different logical periods. This paper shows how Multirate PALS can be applied
to formally verify a nontrivial multirate DCPS. We use Real-Time Maude to
formally specify a multirate distributed hybrid system consisting of an
airplane maneuvered by a pilot who turns the airplane according to a specified
angle through a distributed control system. Our formal analysis revealed that
the original design was ineffective in achieving a smooth turning maneuver, and
led to a redesign of the system that satisfies the desired correctness
properties. This shows that the Multirate PALS methodology is not only
effective for formal DCPS verification, but can also be used effectively in the
DCPS design process, even before properties are verified.Comment: In Proceedings FTSCS 2012, arXiv:1212.657
Distributed Graph Automata and Verification of Distributed Algorithms
Combining ideas from distributed algorithms and alternating automata, we
introduce a new class of finite graph automata that recognize precisely the
languages of finite graphs definable in monadic second-order logic. By
restricting transitions to be nondeterministic or deterministic, we also obtain
two strictly weaker variants of our automata for which the emptiness problem is
decidable. As an application, we suggest how suitable graph automata might be
useful in formal verification of distributed algorithms, using Floyd-Hoare
logic.Comment: 26 pages, 6 figures, includes a condensed version of the author's
Master's thesis arXiv:1404.6503. (This version of the article (v2) is
identical to the previous one (v1), except for minor changes in phrasing.
Formal Design of Asynchronous Fault Detection and Identification Components using Temporal Epistemic Logic
Autonomous critical systems, such as satellites and space rovers, must be
able to detect the occurrence of faults in order to ensure correct operation.
This task is carried out by Fault Detection and Identification (FDI)
components, that are embedded in those systems and are in charge of detecting
faults in an automated and timely manner by reading data from sensors and
triggering predefined alarms. The design of effective FDI components is an
extremely hard problem, also due to the lack of a complete theoretical
foundation, and of precise specification and validation techniques. In this
paper, we present the first formal approach to the design of FDI components for
discrete event systems, both in a synchronous and asynchronous setting. We
propose a logical language for the specification of FDI requirements that
accounts for a wide class of practical cases, and includes novel aspects such
as maximality and trace-diagnosability. The language is equipped with a clear
semantics based on temporal epistemic logic, and is proved to enjoy suitable
properties. We discuss how to validate the requirements and how to verify that
a given FDI component satisfies them. We propose an algorithm for the synthesis
of correct-by-construction FDI components, and report on the applicability of
the design approach on an industrial case-study coming from aerospace.Comment: 33 pages, 20 figure
Using Indexed and Synchronous Events to Model and Validate Cyber-Physical Systems
Timed Transition Models (TTMs) are event-based descriptions for modelling,
specifying, and verifying discrete real-time systems. An event can be
spontaneous, fair, or timed with specified bounds. TTMs have a textual syntax,
an operational semantics, and an automated tool supporting linear-time temporal
logic. We extend TTMs and its tool with two novel modelling features for
writing high-level specifications: indexed events and synchronous events.
Indexed events allow for concise description of behaviour common to a set of
actors. The indexing construct allows us to select a specific actor and to
specify a temporal property for that actor. We use indexed events to validate
the requirements of a train control system. Synchronous events allow developers
to decompose simultaneous state updates into actions of separate events. To
specify the intended data flow among synchronized actions, we use primed
variables to reference the post-state (i.e., one resulted from taking the
synchronized actions). The TTM tool automatically infers the data flow from
synchronous events, and reports errors on inconsistencies due to circular data
flow. We use synchronous events to validate part of the requirements of a
nuclear shutdown system. In both case studies, we show how the new notation
facilitates the formal validation of system requirements, and use the TTM tool
to verify safety, liveness, and real-time properties.Comment: In Proceedings ESSS 2015, arXiv:1506.0325
Rewriting Logic Semantics of a Plan Execution Language
The Plan Execution Interchange Language (PLEXIL) is a synchronous language
developed by NASA to support autonomous spacecraft operations. In this paper,
we propose a rewriting logic semantics of PLEXIL in Maude, a high-performance
logical engine. The rewriting logic semantics is by itself a formal interpreter
of the language and can be used as a semantic benchmark for the implementation
of PLEXIL executives. The implementation in Maude has the additional benefit of
making available to PLEXIL designers and developers all the formal analysis and
verification tools provided by Maude. The formalization of the PLEXIL semantics
in rewriting logic poses an interesting challenge due to the synchronous nature
of the language and the prioritized rules defining its semantics. To overcome
this difficulty, we propose a general procedure for simulating synchronous set
relations in rewriting logic that is sound and, for deterministic relations,
complete. We also report on two issues at the design level of the original
PLEXIL semantics that were identified with the help of the executable
specification in Maude
Expressing the Behavior of Three Very Different Concurrent Systems by Using Natural Extensions of Separation Logic
Separation Logic is a non-classical logic used to verify pointer-intensive
code. In this paper, however, we show that Separation Logic, along with its
natural extensions, can also be used as a specification language for
concurrent-system design. To do so, we express the behavior of three very
different concurrent systems: a Subway, a Stopwatch, and a 2x2 Switch. The
Subway is originally implemented in LUSTRE, the Stopwatch in Esterel, and the
2x2 Switch in Bluespec
Using the PALS Architecture to Verify a Distributed Topology Control Protocol for Wireless Multi-Hop Networks in the Presence of Node Failures
The PALS architecture reduces distributed, real-time asynchronous system
design to the design of a synchronous system under reasonable requirements.
Assuming logical synchrony leads to fewer system behaviors and provides a
conceptually simpler paradigm for engineering purposes. One of the current
limitations of the framework is that from a set of independent "synchronous
machines", one must compose the entire synchronous system by hand, which is
tedious and error-prone. We use Maude's meta-level to automatically generate a
synchronous composition from user-provided component machines and a description
of how the machines communicate with each other. We then use the new
capabilities to verify the correctness of a distributed topology control
protocol for wireless networks in the presence of nodes that may fail.Comment: In Proceedings RTRTS 2010, arXiv:1009.398
- …