Cyber-physical systems process a huge amount of data coming from sensors and other information sources and they often have to provide real-time feedback and reaction. Cyber-physical systems are often critical, which means that their failure can lead to serious injuries or even loss of human lives. Ensuring correctness is an important issue, however traditional design-time verification approaches can not be applied due to

the complex interaction with the changing environment, the

distributed behavior and the intelligent/autonomous solutions.

In this paper we present a framework for distributed runtime

verification of cyber-physical systems including the solution for executing queries on a distributed model stored on multiple

nodes

Szilágyi, Gábor

Vörös, András

Repository of the Academy's Library

Distributed Runtime Veriﬁcation of Cyber-PhysicalSystems Based on Graph Pattern MatchingGa´bor Szila´gyi1, Andra´s Vo¨ro¨s1,21Budapest University of Technology and Economics,Department of Measurement and Information Systems, Budapest, Hungary2MTA-BME Lendu¨let Cyber-Physical Systems Research Group, Budapest, HungaryEmail: szilagyi@db.bme.hu, vori@mit.bme.huAbstract—Cyber-physical systems process a huge amount ofdata coming from sensors and other information sources andthey often have to provide real-time feedback and reaction.Cyber-physical systems are often critical, which means that theirfailure can lead to serious injuries or even loss of human lives.Ensuring correctness is an important issue, however traditionaldesign-time veriﬁcation approaches can not be applied due tothe complex interaction with the changing environment, thedistributed behavior and the intelligent/autonomous solutions.In this paper we present a framework for distributed runtimeveriﬁcation of cyber-physical systems including the solution forexecuting queries on a distributed model stored on multiplenodes.I. INTRODUCTIONThe rapid development of technology leads to the rise ofcyber-physical systems (CPS) even in the ﬁeld of safety crit-ical systems like railway, robot and self-driving car systems.Cyber-physical systems process a huge amount of data comingfrom sensors and other information sources and it often hasto provide real-time feedback and reaction.Cyber-physical systems are often critical, which meansthat their failure can lead to serious damages or injuries.Ensuring correctness is an important issue, however traditionaldesign-time veriﬁcation approaches can not be applied due tothe complex interaction with the environment, the distributedbehavior and the intelligent controller solutions. These charac-teristics of CPS result many complex behavior, huge or eveninﬁnite number of possible states, so design-time veriﬁcationis infeasible.There are plenty of approaches for monitoring require-ments [6]. Runtime analysis provides a solution where graph-based speciﬁcation languages and analysis algorithms arethe proper means to analyze the behavior of cyber-physicalsystems at runtime.In this paper a distributed runtime veriﬁcation frameworkis presented. It is capable of analyzing the correctness ofcyber-physical systems and examining the local behavior ofthe components. An open-source graph query engine beingable to store a model in a single machine served as a base ofthe work [4]. It was extended to support distributed storageand querying: in case of complex speciﬁcations, the algorithmcollects the information from the various analysis componentsand infers the state of the system. The introduced frameworkwas evaluated in a research project of the department andproved its usefulness.Figure 1 shows the basic approach to runtime veriﬁcation.System development is started by specifying the requirementsfor the system. Then it is designed, according to the speciﬁca-tion. From the speciﬁcation and the system design, a monitoris created for observing the environment. The monitoringcomponent stores the gathered information in a live modelwhich is updated continuously to represent the actual stateof the system. The runtime requirements can be evaluated onthe live model and the solution can ﬁnd if a requirement isviolated. Various monitoring approaches exist, some observesdata dependent behavior, others can analyze temporal behavior.In this paper the focus is on the runtime analysis of datadependent behavior which can be captured by a graph basedrepresentation.Runtime verificationEngineeringMonitorSpecificationSystem designRuntime requirementsLive modelImplementationMonitoringFig. 1. Model-based runtime veriﬁcation of a cyber-physical system.II. GRAPHS AS ABSTRACTIONSTo verify cyber-physical systems, we need to have informa-tion about its operation context. Various kinds of informationmight belong to the context such as the physical environment,computational units, conﬁguration settings or other domainspeciﬁc information. In modern cyber-physical systems, sen-sors provide a huge amount of data to be processed by themonitors, it is important to have a comprehensive image ofthe operation context which can be supported by graph-basedknowledge representations.78The current snapshot of the system and its operationalcontext can be formally captured as a live model whichcontinuously gets updated to reflect relevant changes in theunderlying real system [3]. This live model serves as anabstraction of the analyzed system. The framework uses graphrepresentation to model the actual state of the system. Theseare directed, typed and attributed graphs. Their vertex types,edge types, and other constraints must be specified in a meta-model. The metamodel is also needed for the formalization ofspecification, since it also specifies the possible structure ofthe live model.Runtime verificationModelingAllocationRequirementSpecification Fig. 2. The presented approach for runtime verification.The steps of our approach to graph based runtime verifi-cation are illustrated on Figure 2. First we need to describethe metamodel which captures the domain information of themonitored system. According to the metamodel and the initialstate of the system, a live model is created. This live modelis used during the runtime analysis. Then requirements can bedefined. After modeling, the system engineer shall specify theallocation i.e. how the elements of the live model are allocatedto the computational units of the distributed system. Afterthese tasks, the framework is able to generate the code forruntime verification of the system.We illustrate this approach with an example of a simplifiedversion of a train control system. First the metamodel shallbe created for the system. (Figure 3). In our case, the modelis composed of two types of elements: Segment and Train.Segments next to each other in the physical configuration areconnected with connectedTo edges in the model. If a train is ona segment, the model represents it with the onSegment edge.An example live model of the system can be seen on Figure 4.SegmentTrainconnectedToonSegmentFig. 3. The metamodel for the systemSafety requirements of the system can be described usinggraph patterns. A graph pattern is given by1) a list of variables, each representing a vertex of the livemodel with a given type2) a set of constraints, which must be satisfied by thevariables, to match the patternS1:SegmentconnectedToconnectedToT5 :TrainS2:SegmentS3:SegmentS4:SegmentT6 :TrainonSegment onSegmentconnectedToconnectedToconnectedToconnectedToFig. 4. An example live model for a train control systemGraph patterns in the framework are defined using theVIATRA Query Language (VQL) [1]. It has a rich expressivepower capable of expressing constraints like:• path expression – a specific reference, an attribute, or apath of references must exist between two variables.• attribute equality – an attribute of a vertex must be agiven value• matching to a pattern – a list of given vertices must matchto a pattern• negative pattern matching – a list of given vertices mustnot match to another pattern• check expression - an arbitrary expression containingattributes must be evaluated trueGraph patterns expressed as VQL expressions are evaluatedon the input models. Graph pattern matching is reduced toa search for isomorphic subgraphs in the input model. Thestructure of the graph pattern yields the constraints duringthe search: the parameters of the graph pattern will finallybe assigned to the corresponding graph nodes.For example, if we want to find trains on adjacent segments,we can use the following pattern (given in VQL):pattern NeighboringTrain(TA, TB) // 1{Train(TA); // 2 TA is a trainTrain(TB); // 3 TB is a trainTrain.currentlyOn(TA, SA); // 4 TA is currently on SASegment.connectedTo(SA, SB); // 5 SA is connected to SBTrain.currentlyOn(TB, SB); // 6 TB is currently on SB}Fig. 5. Graphical visualization of the query.The pattern’s header (1) specifies its name and its parame-ters. Every statement in the body of the pattern is a constraint(2–6) for variables (SA, SB) and parameters (TA, TB). Thevisualized version of this pattern can be seen on Figure 5.In the example model (Figure 4) there are 2 matches of thispattern. One is {TA = T5 ,TB = T6 ,SA = S2 ,SB = S3}and the other is {TA = T6 ,TB = T5 ,SA = S3 ,SB = S2}.79After the requirements are speciﬁed, the user has to decom-pose the model and allocate it into computational units (seeSection III). We call this the allocation of the live model. Thecomputational units, the live model, and its allocation can begiven in JSON format:{"nodes" : [{"name" : "nodeA","ip" : "127.0.0.1","port" : 54321},...],"model" : [{":id": 0, ":node": "nodeA", ":type": "Segment","connectedTo" : [1] },{":id": 1, ":node": "nodeA", ":type": "Segment","connectedTo" : [0, 2] },{":id": 2, ":node": "nodeB", ":type": "Segment","connectedTo" : [1, 3] },...]}The allocation of a model element can be given by the ”:node”attribute. Model elements, like trains still must be assigned toa speciﬁc computational unit, although its physical place canchange in time.After the model elements are allocated to the computationalunits, and the framework generated the necessary artifacts,runtime veriﬁcation can be started.It works in a way depicted on Figure 6. The live modelis continuously updated with the runtime information comingfrom sensors. Runtime requirements of the system – for-malized as graph patterns – are veriﬁed on the live modelcontinuously, as it is described in the next section, to ensurethe system’s correct operation.Fig. 6. Runtime veriﬁcation of the systemIII. DISTRIBUTED GRAPH QUERIESThe distributed nature of cyber-physical systems makesruntime veriﬁcation a challenging task. Various approachesexist regarding the model and query management. The maindifference is the way they gather and process the informationand evaluate the requirements:• Centralized model and query management. It would re-quire the sensor information to be transmitted to a centralprocessing machine.• Distributing the model to each computational unit. Itwould require model synchronization between nodes.• Dividing the live model and the query processing tasksto the computational units.Centralized approaches are not always viable due to variousreasons, like the central machine can be easily overloaded, itcan be a single point of failure (SPOF), which is undesirablein safety-critical systems. In the second case, model synchro-nization can introduce unwanted complexity, and overhead innetwork communication. We solve these problems by process-ing the sensor information on the corresponding computationalunits, and updating the local part of a distributed live model.A. Distributing the storage of the modelAfter the metamodel is speciﬁed, which describes the typesof vertices and edges, etc., an initial live model shall becreated, representing the initial state of the system. As partsof the model are stored on different computational units,each vertex of the global model must be assigned to a givencomputational unit. References are stored where the sourceobject for that reference is stored. Basically, the reference canonly refer to a local object, i.e. a vertex assigned to the samecomputational unit. If the reference’s destination vertex is notassigned to the same computational unit, we create a proxyobject on the same computational unit. Vertices are identiﬁedwith a globally unique identiﬁer, which is portable betweenthe computational units.B. Distributed Query Evaluation AlgorithmThe algorithm is based on the so-called local search algo-rithm [2]. To ﬁnd matches of a given graph pattern, we startfrom a frame, i.e. a list of variables, unassigned at ﬁrst. Afterthat, we execute a given list of search operations (called searchplan) being speciﬁc to the pattern.To make the algorithm working in distributed systems, weexamined the search operations that cannot be executed locally.There are basically two operations, that need to be handleddifferently from the single machine solution:• Iterating over the instances of a given vertex type cannotbe done locally, since there can be instances for that typeon any of the computational units.• Assigning a variable through a given reference cannot bedone, if the source object is not present on the node.At these operations we inserted a ,,virtual” search operation. Itdoesn’t operate on the frame, but transmits the query executionto the other computational units of the system. To iterateover instances, ﬁrst the query execution is distributed betweenunits by the virtual operation, and after that, iterating overlocal instances can be done. In case of assigning variablevia a reference the virtual search operation checks, whetherthe source object is present on the computational unit, thentransmits it to the other units if the source object is notavailable.80Network...QueryServiceQueryRunner QueryRunner QueryRunnerGenerated QueryGenerated QueryGenerated QueryLocal live model...QueryServiceQueryRunner QueryRunner QueryRunnerGenerated QueryGenerated QueryGenerated QueryLocal live model...Fig. 7. Architecture of the distributed query evaluation.C. ArchitectureThe architectural overview of the distributed query engineis depicted on Figure 7.On every computational unit of the distributed system, aQueryRunner is set up for each generated query. Their role isto execute query tasks speciﬁc to their Generated Query, onthe given local part of the model. An input for a query taskconsists of 1) a frame, containing the assigned variables, i.e.partial match, and 2) the index of the next search operation tobe executed.If an operation needs distributed execution, the QueryRun-ner uses the QueryService of the computational unit, whichhandles network communication and reach other computa-tional unit. To serialize the data between different nodes, weused Protocol Buffers [5].IV. EVALUATIONThe query evaluation time of the framework was measuredin several conﬁguration with the example railway controlsystem, that was presented before, but with a more complexlive model, containing 6000 elements. We split the model ofthe railway system into 2, 3, and 4 parts. First we ran theexample query on each conﬁguration, but every computationalunit was run on the same machine. So practically, networkcommunication had no overhead during the measurement(Figure 8).After that, every computational unit of the system wasrun on different machines. This shows how network com-munication affects the speed of our implementation. We canconclude, that networking introduces overhead, but using morecomputational units makes the system’s performance closer tosingle machine solution. The integration of sensor informationin cyber-physical systems cause additional overhead, that canbe prevented using the distributed solution.V. CONCLUSIONIn this paper, we presented a framework for distributedruntime veriﬁcation of cyber-physical systems based on graphFig. 8. Average time of query execution by computational unitsqueries. Our approach represents the gathered information ina distributed live model and evaluates the queries as close tothe informations sources as possible. A method for distributedmodel storage and query execution is developed based on awidely used search algorithm. In the future we plan to integrateincremental graph query algorithms to further improve theefﬁciency of the framework.REFERENCES[1] G. Bergmann, I. Da´vid, A´. Hegedu¨s, A´. Horva´th, I. Ra´th, Z. Ujhelyi,and D. Varro´. VIATRA 3: A reactive model transformation platform.In Theory and Practice of Model Transformations - 8th InternationalConference, ICMT 2015, Proceedings, pages 101–110, 2015.[2] M. Bu´r. A general purpose local search-based pattern matching frame-work. masters thesis. 2015.[3] I. Da´vid, I. Ra´th, and D. Varro´. Foundations for streaming modeltransformations by complex event processing. Software & SystemsModeling, 2016.[4] R. Do´czi. Search-based query evaluation over object hierarchies. Master’sthesis, Budapest University of Technology and Economics, 2016.[5] Google. Protocol buffers – data interchange format. https://github.com/google/protobuf.[6] M. Vierhauser, R. Rabiser, and P. Gru¨nbacher. Requirements monitoringframeworks: A systematic review. Information & Software Technology,80:89–109, 2016.81

Distributed Runtime Verification of Cyber-Physical Systems Based on Graph Pattern Matching

Abstract

Similar works

Full text

Available Versions

Repository of the Academy's Library