Hybrid systems with both discrete and continuous dynamics are an important model for real-world cyber-physical systems. The key challenge is to ensure their correct functioning w.r.t. safety requirements. Promising techniques to ensure safety seem to be model-driven engineering to develop hybrid systems in a well-defined and traceable manner, and formal verification to prove their correctness. Their combination forms the vision of verification-driven engineering. Often, hybrid systems are rather complex in that they require expertise from many domains (e. g., robotics, control systems, computer science, software engineering, and mechanical engineering). Moreover, despite the remarkable progress in automating formal verification of hybrid systems, the construction of proofs of complex systems often requires nontrivial human guidance, since hybrid systems verification tools solve undecidable problems. It is, thus, not uncommon for development and verification teams to consist of many players with diverse expertise. This paper introduces a verification-driven engineering toolset that extends our previous work on hybrid and arithmetic verification with tools for (1) graphical (UML) and textual modeling of hybrid systems, (2) exchanging and comparing models and proofs, and (3) managing verification tasks. This toolset makes it easier to tackle large-scale verification tasks.
@cite_30: The specification of modeling and analysis of real-time and embedded systems (MARTE) is an extension of the unified modeling language (UML) in the domain of real-time and embedded systems. Even though MARTE time model offers a support to describe both discrete and dense clocks, the biggest effort has been put so far on the specification and analysis of discrete MARTE models. To address hybrid real-time and embedded systems, we propose to extend statecharts using both MARTE and the theory of hybrid automata. We call this extension hybrid MARTE statecharts. It provides an improvement over the hybrid automata in that: the logical time variables and the chronometric time variables are unified. The formal syntax and semantics of hybrid MARTE statecharts are given based on labeled transition systems and live transition systems. As a case study, we model the behavior of a train control system with hybrid MARTE statecharts to demonstrate the benefit.
@cite_26: In this article, a new UML extension for the specification of hybrid systems, where observables may consist of both discrete and time-continuous parameters, is presented. Whereas hybrid modeling constructs are not available in standard UML, several specification formalisms for this type of system have been elaborated and discussed, among them the CHARON language of which possesses already several attractive features for modeling embedded real-time systems with hybrid characteristics. Adopting this as a basis, the profile inherits formal semantics based on CHARON, so it offers the possibility for formal reasoning about hybrid UML specifications. Conversely, the CHARON framework is associated with a new syntactic representation within the UML 2.0 world, allowing to develop hybrid specifications with arbitrary CASE tools supporting UML 2.0 and its profiling mechanism. The “look-and-feel” of the profile is illustrated by means of a case study of an embedded system controlling the cabin illumination in an aircraft. The benefits and weaknesses of the constructed hybrid UML profile are discussed, resulting in feed-back for the improvement of both UML 2.0 and the CHARON formalism.
@cite_4: We present a scalable reachability algorithm for hybrid systems with piecewise affine, non-deterministic dynamics. It combines polyhedra and support function representations of continuous sets to compute an over-approximation of the reachable states. The algorithm improves over previous work by using variable time steps to guarantee a given local error bound. In addition, we propose an improved approximation model, which drastically improves the accuracy of the algorithm. The algorithm is implemented as part of SpaceEx, a new verification platform for hybrid systems, available at spaceex.imag.fr. Experimental results of full fixed-point computations with hybrid systems with more than 100 variables illustrate the scalability of the approach.
@cite_41: Satisfiability Modulo Theories (SMT) problem is a decision problem for logical first order formulas with respect to combinations of background theories such as: arithmetic, bit-vectors, arrays, and uninterpreted functions. Z3 is a new and efficient SMT Solver freely available from Microsoft Research. It is used in various software verification and analysis applications.
@cite_36: The emergence of the UML as a de facto standard for object-oriented modeling has been mirrored by the success of the B method as a practically useful formal modeling technique. The two notations have much to offer each other. The UML provides an accessible visualization of models facilitating communication of ideas but lacks formal precise semantics. B, on the other hand, has the precision to support animation and rigorous verification but requires significant effort in training to overcome the mathematical barrier that many practitioners perceive. We utilize a derivation of the B notation as an action and constraint language for the UML and define the semantics of UML entities via a translation into B. Through the UML-B profile we provide specializations of UML entities to support model refinement. The result is a formally precise variant of UML that can be used for refinement based, object-oriented behavioral modeling. The design of UML-B has been guided by industrial applications.
@cite_6: During embedded systems development, decisions must be made regarding which portions of the system will be implemented in software, hardware, firmware etc. The latest version of UML (UML 2.1.1), and the Systems Modeling Language, (SysML) now enable embedded systems developers to more closely model their systems. Systems engineering principals, can also aid this process. Consequently, essential aspects of systems engineering issues such as concurrency, hardware architecture, and requirements traceability can be applied to embedded systems. This paper proposes a method for analyzing and designing a system into logical units so that the allocation process can be successfully completed. Constraints and elements can be traced to and reflected in the generated code.
@cite_19: This article explores a dual approach to real-time software development. Models are written in UML, as this is expected to be relatively easy and economic. Then models are automatically translated into a formal notation that supports the verification of properties such as safety, utility, liveness, etc. In this way, developers can exploit the advantages of formal notations while skipping the complex and expensive formal modelling phase. The proposed appraoch is applied to the Generalised Railroad Crossing (GRC) problem, one of the best known benchmarks porposed in the literature. A UML model of the GRC is built, and then translated into TRIO (a first order temporal logic). The resulting specification properties are tested by a history checking tool which exploits the formality of TRIO. The work described here highlights the shortcomings of UML as a real-time modelling language, proposes enhancements and workarounds to overcome UML limitations, and demonstrates the viability of using UML as a front-end for a formal real-time notation. By translating the GRC model into TRIO, we also give formal semantics to some of the UML constructs.
@cite_40: In this paper we present Maestro, a model-based systems engineering (MBSE) environment for design and simulation of complex electronic systems using Orchestra—a simulation tool developed at Sandia National Laboratories. Maestro is deployed as a plugin for MagicDraw and uses Orchestra domain-specific language (DSL) which is based on SysML. Maestro enables a model-based design and analysis approach that replaces the traditional document-based systems engineering process. It provides a unified graphical modeling environment to domain experts who have had to depend on drawing tools for defining system architecture and manual transcription of system topology in creating complex simulation models.
@cite_15: Abstract The mathematical notations of Formal Verification Tools (FVTs) do not prevent us from wrongly defining the behavior of systems, any more than modern CASE tools do. With software rapidly growing in size and complexity, graphical specifications in languages like UML need to be formally verified, before the implementation phase, in order to guarantee the development of more reliable systems. While the enterprise of integrating CASE and FVTs has had reasonable success with the translation of simple diagrams to model checkers' notations, there has been few progress regarding the fundamental aspects an interface should have to fully integrate them. In this work we present an interface for joining both technologies as a reliable solution to bridging this gap.
@cite_51: Distributed real-time and embedded (DRE) systems have become critical in domains such as avionics (e.g., flight mission computers), telecommunications (e.g., wireless phone services), tele-medicine (e.g., robotic surgery), and defense applications (e.g., total ship computing environments). These types of system are increasingly interconnected via wireless and wireline networks to form systems of systems. A challenging requirement for these DRE systems involves supporting a diverse set of quality of service (QoS) properties, such as predictable latency jitter, throughput guarantees, scalability, 24x7 availability, dependability, and security that must be satisfied simultaneously in real-time. Although increasing portions of DRE systems are based on QoS-enabled commercial-off-the-shelf (COTS) hardware and software components, the complexity of managing long lifecycles (often 15-30 years) remains a key challenge for DRE developers and system integrators. For example, substantial time and effort is spent retrofitting DRE applications when the underlying COTS technology infrastructure changes. This paper provides two contributions that help improve the development, validation, and integration of DRE systems throughout their lifecycles. First, we illustrate the challenges in creating and deploying QoS-enabled component middleware-based DRE applications and describe our approach to resolving these challenges based on a new software paradigm called Model Driven Middleware (MDM), which combines model-based software development techniques with QoS-enabled component middleware to address key challenges faced by developers of DRE systems - particularly composition, integration, and assured QoS for end-to-end operations. Second, we describe the structure and functionality of CoSMIC (Component Synthesis using Model Integrated Computing), which is an MDM toolsuite that addresses key DRE application and middleware lifecycle challenges, including partitioning the components to use distributed resources effectively, validating software configurations, assuring multiple simultaneous QoS properties in real-time, and safeguarding against rapidly changing technology.
@cite_66: Today, mechanical engineering products can largely be classified as mechatronic systems, i.e. systems integrating electrical and mechanical components with software. Mechatronic systems are often employed in safety-critical areas, for instance in the automotive or railway domain. MECHATRONIC UML is a UML profile specifically tailored towards the modelling of mechatronic systems. It aims at bringing model-based design and formal analysis to the mechatronic area, which has originally been dominated by engineering techniques. In this paper we give a survey of the modelling as well as verification techniques supported by MECHATRONIC UML.
@cite_12: In 1995, HyTech broke new ground as a potentially powerful tool for verifying hybrid systems – yet it has remained severely limited in its applicability to more complex systems. We address the main problems of HyTech with PHAVer, a new tool for the exact verification of safety properties of hybrid systems with piecewise constant bounds on the derivatives. Affine dynamics are handled by on-the-fly overapproximation and by partitioning the state space based on user-definable constraints and the dynamics of the system. PHAVer's exact arithmetic is robust due to the use of the Parma Polyhedra Library, which supports arbitrarily large numbers. To manage the complexity of the polyhedral computations, we propose methods to conservatively limit the number of bits and constraints of polyhedra. Experimental results for a navigation benchmark and a tunnel diode circuit show the effectiveness of the approach.
In summary, we address model-driven engineering and formal verification as follows. Unlike @cite_6 @cite_40 @cite_51 , who focus on exchanging models, we also facilitate collaboration on formal verification. Unlike @cite_12 @cite_4 @cite_41 , who focus on one aspect of verification, we provide modeling and collaboration tools that should make it easier for domain experts to work in verification teams and exchange models and verification results between different tools. Unlike @cite_12 @cite_41 , who focus on verification tools, we also work on modeling support and collaboration. Unlike @cite_26 @cite_30 @cite_66 , who define a hybrid automaton semantics for UML Statecharts, we define a hybrid program semantics for UML Activity Diagrams. Unlike @cite_19 @cite_15 @cite_36 , who combine formal models with semi-formal modeling in UML for discrete systems, we define a UML profile for hybrid systems modeling.