Verified Traffic Networks: Component-based Verification of ...
Transcript of Verified Traffic Networks: Component-based Verification of ...
Verified Traffic Networks: Component-based Verification of
Cyber-Physical Flow SystemsAndreas Mรผl ler โ andreas.muel [email protected]
Stefan Mitsch - [email protected]
J o h a n n e s Ke p l e r U n i v e rs i t y, L i n z
D e p a r t m e n t o f C o o p e ra t i v e I n fo r m a t i o n Sy st e m s ( C I S )
h t t p : / / c i s . j ku . a t /
Andrรฉ P latzer - ap [email protected]
C a r n e g i e M e l l o n U n i v e rs i t y, P i t t s b u rg h
C o m p u t e r S c i e n c e D e p a r t m e n t
h t t p : / / w w w. l s . c s . c m u . e d u /
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Overview
Introduction
Challenges
Approach
Implementation
Conclusion
2
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Traffic ManagementTraffic Management System Operate traffic through control actionsโSafety of critical actions is crucial
3
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Traffic ManagementTraffic Management System Operate traffic through control actionsโSafety of critical actions is crucial
3
- - - - - - - - - - - - - - - - - - - - - - -
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Traffic ManagementTraffic Management System Operate traffic through control actionsโSafety of critical actions is crucial
3
- - - - - - - - - - - - - - - - - - - - - - -
adapt interval
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Traffic ManagementTraffic Management System Operate traffic through control actionsโSafety of critical actions is crucial
3
- - - - - - - - - - - - - - - - - - - - - - -
adapt intervalset speed limit
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Traffic ManagementTraffic Management System Operate traffic through control actionsโSafety of critical actions is crucial
Safety No traffic breakdown=load never exceeds capacity
3
- - - - - - - - - - - - - - - - - - - - - - -
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Traffic ManagementTraffic Management System Operate traffic through control actionsโSafety of critical actions is crucial
Safety No traffic breakdown=load never exceeds capacity
3
- - - - - - - - - - - - - - - - - - - - - - -
load
capacity
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Traffic ManagementTraffic Management System Operate traffic through control actionsโSafety of critical actions is crucial
Safety No traffic breakdown=load never exceeds capacity
3
- - - - - - - - - - - - - - - - - - - - - - -
load
capacity
load โค capacity
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Traffic ManagementTraffic Management System Operate traffic through control actionsโSafety of critical actions is crucial
Safety No traffic breakdown=load never exceeds capacity
3
- - - - - - - - - - - - - - - - - - - - - - -
capacity
load
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Traffic ManagementTraffic Management System Operate traffic through control actionsโSafety of critical actions is crucial
Safety No traffic breakdown=load never exceeds capacity
3
- - - - - - - - - - - - - - - - - - - - - - -
capacity
load
load โฅ capacity
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Traffic ManagementTraffic Management System Operate traffic through control actionsโSafety of critical actions is crucial
Safety No traffic breakdown=load never exceeds capacity
Property: Starting in safe state, all runs stay in safe state
3
- - - - - - - - - - - - - - - - - - - - - - -
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Traffic ManagementTraffic Management System Operate traffic through control actionsโSafety of critical actions is crucial
Safety No traffic breakdown=load never exceeds capacity Property: Starting in safe state, all runs stay in safe state
Cyber-physical systems (CPS) Cyber and physical capabilities Continuous physical-part: traffic flow Discrete cyber-part: traffic light switching
3
- - - - - - - - - - - - - - - - - - - - - - -
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Traffic ManagementTraffic Management System Operate traffic through control actionsโSafety of critical actions is crucial
Safety No traffic breakdown=load never exceeds capacity Property: Starting in safe state, all runs stay in safe state
Cyber-physical systems (CPS) Cyber and physical capabilities Continuous physical-part: traffic flow Discrete cyber-part: traffic light switching
3
- - - - - - - - - - - - - - - - - - - - - - -
๐๐๐๐โฒ = ๐ก๐๐ก๐ โ ๐๐๐/๐๐๐๐๐
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Traffic ManagementTraffic Management System Operate traffic through control actionsโSafety of critical actions is crucial
Safety No traffic breakdown=load never exceeds capacity Property: Starting in safe state, all runs stay in safe state
Cyber-physical systems (CPS) Cyber and physical capabilities Continuous physical-part: traffic flow Discrete cyber-part: traffic light switching
Methods to analyze models of CPS Simulation and Testing (analyze some runs): good for complex phenomena Verification (mathematically prove correctness of all runs): simplified models
3
- - - - - - - - - - - - - - - - - - - - - - -
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Traffic ManagementTraffic Management System Operate traffic through control actionsโSafety of critical actions is crucial
Safety No traffic breakdown=load never exceeds capacity Property: Starting in safe state, all runs stay in safe state
Cyber-physical systems (CPS) Cyber and physical capabilities Continuous physical-part: traffic flow Discrete cyber-part: traffic light switching
Methods to analyze models of CPS Simulation and Testing (analyze some runs): good for complex phenomena Verification (mathematically prove correctness of all runs): simplified models
3
- - - - - - - - - - - - - - - - - - - - - - -
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Verification
VerificationTransform property by user-guided application of proof rules
Starting in safe state, all runs stay in safe state
Example
4
- - - - - - - - - - - - - - - - - -
โค โ ๐๐ ๐๐๐ ๐๐๐๐โฒ = ๐๐ โช ๐๐ ๐๐๐๐๐ ๐๐๐๐โฒ = ๐๐ โ ๐๐ข๐ก
- - - - - - - - - - - - - - - - - -
โค
or
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Verification
VerificationTransform property by user-guided application of proof rules
Starting in safe state, all runs stay in safe state
Example
4
- - - - - - - - - - - - - - - - - -
โค โ ๐๐ ๐๐๐ ๐๐๐๐โฒ = ๐๐ โช ๐๐ ๐๐๐๐๐ ๐๐๐๐โฒ = ๐๐ โ ๐๐ข๐ก
- - - - - - - - - - - - - - - - - -
โค
โช
or
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Verification
VerificationTransform property by user-guided application of proof rules
Starting in safe state, all runs stay in safe state
Example
4
- - - - - - - - - - - - - - - - - -
โค โ ๐๐ ๐๐๐ ๐๐๐๐โฒ = ๐๐ โช ๐๐ ๐๐๐๐๐ ๐๐๐๐โฒ = ๐๐ โ ๐๐ข๐ก
- - - - - - - - - - - - - - - - - -
โค
โช
โ
โค โ ๐๐ ๐๐๐ ๐๐๐๐โฒ = ๐๐ โค
โ
โค โ ๐๐ ๐๐๐๐๐ ๐๐๐๐โฒ = ๐๐ โ ๐๐ข๐ก โค
or
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Verification
VerificationTransform property by user-guided application of proof rules
Starting in safe state, all runs stay in safe state
Example
4
- - - - - - - - - - - - - - - - - -
โค โ ๐๐ ๐๐๐ ๐๐๐๐โฒ = ๐๐ โช ๐๐ ๐๐๐๐๐ ๐๐๐๐โฒ = ๐๐ โ ๐๐ข๐ก
- - - - - - - - - - - - - - - - - -
โค
โช
โ
โค โ ๐๐ ๐๐๐ ๐๐๐๐โฒ = ๐๐ โค
โ
โค โ ๐๐ ๐๐๐๐๐ ๐๐๐๐โฒ = ๐๐ โ ๐๐ข๐ก โค
โฆ
or
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Verification
VerificationTransform property by user-guided application of proof rules
Starting in safe state, all runs stay in safe state
Example
4
- - - - - - - - - - - - - - - - - -
โค โ ๐๐ ๐๐๐ ๐๐๐๐โฒ = ๐๐ โช ๐๐ ๐๐๐๐๐ ๐๐๐๐โฒ = ๐๐ โ ๐๐ข๐ก
- - - - - - - - - - - - - - - - - -
โค
โช
โ
โค โ ๐๐ ๐๐๐ ๐๐๐๐โฒ = ๐๐ โค
โ
โค โ ๐๐ ๐๐๐๐๐ ๐๐๐๐โฒ = ๐๐ โ ๐๐ข๐ก โค
โง โ
โค โง ๐๐๐ โ ๐๐๐๐โฒ = ๐๐ โค โฆ๐๐
or
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Verification
VerificationTransform property by user-guided application of proof rules
Starting in safe state, all runs stay in safe state
Example
4
- - - - - - - - - - - - - - - - - -
โค โ ๐๐ ๐๐๐ ๐๐๐๐โฒ = ๐๐ โช ๐๐ ๐๐๐๐๐ ๐๐๐๐โฒ = ๐๐ โ ๐๐ข๐ก
- - - - - - - - - - - - - - - - - -
โค
โช
โ
โค โ ๐๐ ๐๐๐ ๐๐๐๐โฒ = ๐๐ โค
โ
โค โ ๐๐ ๐๐๐๐๐ ๐๐๐๐โฒ = ๐๐ โ ๐๐ข๐ก โค
โง โ
โค โง ๐๐๐ โ ๐๐๐๐โฒ = ๐๐ โค
[โฒ]โฆ
โฆ๐๐
or
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Introduction โ Verification
VerificationTransform property by user-guided application of proof rules
Starting in safe state, all runs stay in safe state
Example
4
- - - - - - - - - - - - - - - - - -
โค โ ๐๐ ๐๐๐ ๐๐๐๐โฒ = ๐๐ โช ๐๐ ๐๐๐๐๐ ๐๐๐๐โฒ = ๐๐ โ ๐๐ข๐ก
- - - - - - - - - - - - - - - - - -
โค
โช
โ
โค โ ๐๐ ๐๐๐ ๐๐๐๐โฒ = ๐๐ โค
โ
โค โ ๐๐ ๐๐๐๐๐ ๐๐๐๐โฒ = ๐๐ โ ๐๐ข๐ก โค
โง โ
โค โง ๐๐๐ โ ๐๐๐๐โฒ = ๐๐ โค
[โฒ]โฆ
โฆ๐๐
or
VerificationOne rule application/proof step per statement
Not fully automatable
Tool support: KeYmaeraTheorem prover
Some automation
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Real systems are largeVerification for large systems is
challenging
Challenges
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Real systems are largeVerification for large systems is
challenging
5
Challenges
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Real systems are largeVerification for large systems is
challenging
6
Challenges
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Real systems are large
6
Challenges
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Real systems are large Any change to the model requires full re-verificationRe-verification only for affected parts
7
Challenges
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Real systems are large Any change to the model requires full re-verificationRe-verification only for affected parts
7
Challenges
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Real systems are large
Any change to the model requires full re-verification
8
Challenges
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Real systems are large
Any change to the model requires full re-verification
Systems often consist of multiple similar patterns Redundancy should be utilized in verification
9
Challenges
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Real systems are large
Any change to the model requires full re-verification
Systems often consist of multiple similar patterns Redundancy should be utilized in verification
9
Challenges
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
33
Real systems are large
Any change to the model requires full re-verification
Systems often consist ofmultiple similar patterns Redundancy should be utilized in verification
10
Challenges
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
34
Real systems are large
Any change to the model requires full re-verification
Systems often consist ofmultiple similar patterns
10
Challenges
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Real systems are large
Any change to the model requires full re-verification
Systems often consist of multiple similar patterns
Component-based modeling
11
Challenges
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Real systems are large
Any change to the model requires full re-verification
Systems often consist of multiple similar patterns
Component-based modeling
11
Challenges
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Real systems are large
Any change to the model requires full re-verification
Systems often consist of multiple similar patterns
Component-based modeling Verified components do not necessarily entail
verified system
11
Challenges
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Component-based modeling Verified components do not
necessarily entail verified system
12
Challenges
Real systems are large
Any change to the model requires full re-verification
Systems often consist of multiple similar patterns
How do verification results about traffic flow components transfer
to entire traffic networks?
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
ApproachComponent-based VerificationVerified Components and Verified CompositionComposition comes down to arithmetic checks
Process(1) Model component types(2) Verify safety conditions for each type
and their compositionNo traffic breakdown
(3) Compose component instances to form system model
Check arithmetic constraints
Result Fully verified system model
13
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
ApproachComponent-based VerificationVerified Components and Verified CompositionComposition comes down to arithmetic checks
Process(1) Model component types(2) Verify safety conditions for each type
and their compositionNo traffic breakdown
(3) Compose component instances to form system model
Check arithmetic constraints
Result Fully verified system model
13
โข Once per typeโข Verification expert
โข Once per networkโข Traffic expert
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Generic component Inflows
(load, capacity, actual, max)
Outflows (actual, max)
Controller
Approach โ Components
14
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Traffic Light
- - - - - - - - - - - - - - - - - - -
Generic component Inflows
(load, capacity, actual, max)
Outflows (actual, max)
Controller
Example:
Approach โ Components
14
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Traffic Light
- - - - - - - - - - - - - - - - - - -
Generic component Inflows
(load, capacity, actual, max)
Outflows (actual, max)
Controller
Example:
Approach โ Components
Traffic Light Component
๐๐๐๐๐ฅ
๐๐ ๐๐๐๐๐๐๐โฒ = ๐๐
โช๐๐ ๐๐๐๐๐
๐๐๐๐โฒ = ๐๐ โ ๐๐ข๐ก
load
capInflows Outflows
๐๐๐๐๐ก ๐๐ข๐ก๐๐๐ก ๐๐ข๐ก๐๐๐ฅ
Co
ntro
ller
14
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Generic component Inflows
(load, capacity, actual, max)
Outflows (actual, max)
Controller
Component typesTraffic light (one in, one out)
Flow merge (two in, one out)
Flow split (one in, two out)
Approach โ Components
14
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Approach โ Safety Properties
Safety Property: No traffic breakdown occursNo load ever exceeds its capacity
Must once be verified for each component type
15
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Approach โ Safety Properties
Safety Property: No traffic breakdown occursNo load ever exceeds its capacity
Must once be verified for each component type
Contracts
๐๐๐ โฅ max ๐๐๐ โ ๐๐๐๐ฅ, ๐ โ ๐๐๐๐ฅ โmax 0, ๐๐๐๐ฅ โ๐ โ ๐๐๐
2โ โ๐๐ก๐ ๐ก โค ๐ โ ๐๐๐๐ โค ๐๐๐
๐๐๐1 โฅ ๐ โ ๐1๐๐๐ฅ โง ๐๐๐2 โฅ ๐ โ ๐2๐๐๐ฅ โ โ๐๐ ๐ก โค ๐ โ ๐๐๐๐1 โค ๐๐๐1 โง ๐๐๐๐2 โค ๐๐๐2
๐๐๐ โฅ max 0, ๐ โ ๐๐๐๐ฅ โmin ๐1๐๐๐ฅ, ๐2๐๐๐ฅ โ โ๐๐ ๐ก โค ๐ โ ๐๐๐๐ โค ๐๐๐
15
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Approach โ Safety Properties
Safety Property: No traffic breakdown occursNo load ever exceeds its capacity
Must once be verified for each component type
Contracts
๐๐๐ โฅ max ๐๐๐ โ ๐๐๐๐ฅ, ๐ โ ๐๐๐๐ฅ โmax 0, ๐๐๐๐ฅ โ๐ โ ๐๐๐
2โ โ๐๐ก๐ ๐ก โค ๐ โ ๐๐๐๐ โค ๐๐๐
๐๐๐1 โฅ ๐ โ ๐1๐๐๐ฅ โง ๐๐๐2 โฅ ๐ โ ๐2๐๐๐ฅ โ โ๐๐ ๐ก โค ๐ โ ๐๐๐๐1 โค ๐๐๐1 โง ๐๐๐๐2 โค ๐๐๐2
๐๐๐ โฅ max 0, ๐ โ ๐๐๐๐ฅ โmin ๐1๐๐๐ฅ, ๐2๐๐๐ฅ โ โ๐๐ ๐ก โค ๐ โ ๐๐๐๐ โค ๐๐๐
15
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Approach โ Composition
Compose componentsConnect Outputs to Inputs
Flow is passed on
โค ๐๐๐๐ฅ
Both components safe
โComposition is again a safe component
Rebuild overall networkCompose components until
desired network is rebuilt
Check if condition fulfilled
C1 C2
16
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Approach โ Composition
Compose componentsConnect Outputs to Inputs
Flow is passed on
โค ๐๐๐๐ฅ
Both components safe
โComposition is again a safe component
Rebuild overall networkCompose components until
desired network is rebuilt
Check if condition fulfilled
C1 C2
16
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Approach โ Composition
Compose componentsConnect Outputs to Inputs
Flow is passed on
โค ๐๐๐๐ฅ
Both components safe
โComposition is again a safe component
Rebuild overall networkCompose components until
desired network is rebuilt
Check if condition fulfilled
C1 C2C3
16
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Approach โ Composition
Compose componentsConnect Outputs to Inputs
Flow is passed on
โค ๐๐๐๐ฅ
Both components safe
โComposition is again a safe component
Rebuild overall networkCompose components until
desired network is rebuilt
Check if condition fulfilled
C1 C2C3
16
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Approach โ Composition๐ ๐๐๐ฅ ๐๐ ๐ ๐๐๐ฅ ๐๐๐๐๐ฅ๐ฅ ๐ ๐๐๐ฅ
Compose components Connect Outputs to Inputs Flow is passed on
Theorem: Preserve Safety Both components safeโComposition is again
a safe componentโComposition is again
a safe component
Rebuild overall network Compose components until
desired network is rebuilt Check if condition fulfilled
C1 C2C3
16
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Approach โ Composition๐ ๐๐๐ฅ ๐๐ ๐ ๐๐๐ฅ ๐๐๐๐๐ฅ๐ฅ ๐ ๐๐๐ฅ
Compose componentsConnect Outputs to Inputs Flow is passed on
Theorem: Preserve SafetyBoth components safeโComposition is again
a safe component
Rebuild overall networkCompose components until
desired network is rebuiltCheck if condition fulfilledCheck if condition fulfilled
C1 C2C3
16
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Implementation โ SAFE-T
Network Graph
Add components
Connect components (automatic compatibility check)
ExtensibleComponent Library
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Implementation โ SAFE-T
Network Graph
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Implementation โ SAFE-T
Network Graph
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Implementation โ SAFE-T
Load Graph
Time Slider
AnalysisPanel
t=7: OVERFLOW@โC1โ
load=10.0โฆ
Analyze model:How long is it safe?
Simulate Model:How do loads change over time?
Analyze model:Which components overflows first?
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Traffic NetworkX Traffic lights
Y Flow Splits
Z Flow Merges
N Connections
Conclusion
Monolithic Component-based
Number of Proofs 1(presumably large)
3 + N Checks(traffic light/split/merge)
Model Size # Variables X*6 + Y*6 + Z*7 6/6/7
LoC X*60 + Y*50 + Z*50 60/50/50
Connectโฆ โฆComponents Reproof of Composite Arithmetic Check
Changeโฆ โฆComponent or Properties Reproof Entire Model Redo Arithmetic Checks
โฆConnections Reproof Entire Model Redo Arithmetic Checks
Addโฆ โฆComponent Type Reproof Entire Model Reproof Component Model
20
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Example Network5 Traffic lights
5 Flow Splits
5 Flow Merges
10 Connections
Conclusion
Monolithic Component-based
Number of Proofs 1 3 + 10 Checks(traffic light/split/merge)
Model Size # Variables 95 6/6/7
LoC 800 60/50/50
Connectโฆ โฆComponents Reproof of Composite Arithmetic Check
Changeโฆ โฆComponent or Properties Reproof Entire Model Redo Arithmetic Checks
โฆConnections Reproof Entire Model Redo Arithmetic Checks
Addโฆ โฆComponent Type Reproof Entire Model Reproof Component Model
21
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Example Network5 Traffic lights
5 Flow Splits
5 Flow Merges
10 Connections
Conclusion
Monolithic Component-based
Number of Proofs 1 3 + 10 Checks(traffic light/split/merge)
Model Size # Variables 95 6/6/7
LoC 800 60/50/50
Connectโฆ โฆComponents Reproof of Composite Arithmetic Check
Changeโฆ โฆComponent or Properties Reproof Entire Model Redo Arithmetic Checks
โฆConnections Reproof Entire Model Redo Arithmetic Checks
Addโฆ โฆComponent Type Reproof Entire Model Reproof Component Model
21
AdvantagesSmall proofs & checks instead of one huge proof
Increased reusability
Easy model evolution
LimitationSimplified models
THANKS FOR YOUR ATTENTION!
22
Verified Traffic Networks: Component-based Verification of
Cyber-Physical Flow Systems
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Related WorkComponent-based CPS modeling and verification Few handle discrete and continuous CPS aspects Formal verification is not consideredE.g.: Damm et al. [1], Henzinger et al. [2]
Traffic modelsPlethora of modelsMostly purely continuousVerification not consideredE.g.: Greenshields et al. [3], Lighthill et al. [4]
Intelligent traffic management systems Support traffic operatorsComplementary to our approachE.g.: Baumgartner et al. [5], Almejalli et al. [6]
[1] Damm, W.; et al. (2010): Towards Component BasedDesign of Hybrid Systems: Safety and Stability. In: Time forVerification. Springer Berlin Heidelberg.[2] Henzinger, T.; et al. (2001): Assume-Guarantee Reasoning for Hierarchical Hybrid Systems. In: Hybrid Systems: Computation and Control. Springer Berlin Heidelberg.[3] Greenshields, B. D.; et al. (1933): The Photographic Method of Studying Traffic Behavior. In: Proceedings of the 13th Annual Meeting of the Highway Research Board.[4] Lighthill, M. J.;et al. (1955): On Kinematic Waves. II. A Theory of Traffic Flow on Long Crowded Roads. In: Proceedings of the Royal Society of London.[5] Baumgartner, N.; et al. (2014): A Tour of BeAware! โ A situation awareness framework for control centers. In: Information Fusion 20.[6] Almejalli, K.; et al. (2007): Intelligent Traffic Control Decision Support System. In: Applications of EvolutionaryComputing. Springer Berlin Heidelberg.
23
Andreas Mรผller โ Johannes Kepler University, Linz, Austria โ September 7, 2015
Future Work
Consider traffic phenomena (e.g., shock-waves)
Introduce further components
Automatically transform networks into components and compositions
Generic Component DefinitionsCurrently work-in-progress
24