A modeling and verification method for cyber-physical systems

Abstract

The present invention relates to a modeling and verification method suitable for information-physical systems, and belongs to the field of informatization. The method includes selecting a complete and closed-loop information-physical system design case; formally modeling the discrete mode changes, continuous dynamic behaviors and hierarchical structures of the information-physical system to obtain a multi-level hybrid model of the system; graphically modeling the multi-level hybrid model in the PtolemyII platform; converting the multi-level hybrid model into a timed automaton network containing multiple timed automaton models according to rules; formally specifying the properties and behaviors of the information-physical system; and verifying the multi-level hybrid model by combining the timed automaton network with the formalized specifications. Aiming at the differences between the multi-level hybrid model and the timed automaton model, the present invention defines the mapping rules of the model, so that the information-physical system can be modeled and verified more comprehensively.

Description

Technical Field

[0001] The present invention belongs to the field of informatization and relates to a modeling and verification method suitable for information-physical systems. Background Art

[0002] In the early stages of development of cyber-physical systems, the safety and reliability of system behavior are important indicators for evaluating system stability. Therefore, modeling the system and formally verifying the model are necessary steps in the early stages of development.

[0003] Due to the complexity and hybridity of cyber-physical systems, their modeling requires the combination of multi-level and multi-granular factors. At present, most modeling methods and tools provide support for graphical symbols and realize a visual tool platform, which facilitates model designers in various fields to establish accurate and unified models based on the same symbol standard. As a modeling and simulation platform for cyber-physical systems, PtolemyII covers multiple complex fields and can realize different model construction, but lacks a formal language and is difficult to perform formal verification.

[0004] Due to the high development cost of cyber-physical systems, the model behavior needs to be verified for safety, reliability and other properties. Existing model verification technologies mainly focus on model checking and are suitable for hybrid system model verification that combines discrete and continuous behaviors. As a formal verification tool, UPPAAL can verify system safety, correctness and other properties, but it does not have the ability to verify hierarchical systems and is not suitable for the verification of complex cyber-physical systems. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a modeling and verification method suitable for information-physical systems, which can realize multi-level hybrid modeling of information-physical systems, and design meta-model-based transformation rules to complete the formal verification of the model by converting the model into a verifiable timed automaton model.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] A modeling and verification method applicable to a cyber-physical system, the method comprising the following steps:

[0008] S1: Select complete and closed-loop cyber-physical system design cases;

[0009] S2: Formal modeling of the discrete mode changes, continuous dynamic behaviors and hierarchical structures of the cyber-physical system is performed to obtain a multi-level hybrid model of the system;

[0010] S3: graphically modeling the multi-level hybrid model in the PtolemyII platform;

[0011] S4: converting the multi-level hybrid model into a timed automaton network including multiple timed automaton models according to a rule;

[0012] S5: Formalize the properties and behaviors of the cyber-physical system;

[0013] S6: Combine the timed automaton network described in S4 with the formal specification described in S5 to verify the multi-level hybrid model.

[0014] Optionally, in S1, the selection of cyber-physical system design cases includes two sources:

[0015] (1) Analyze system requirements and design functions in the early stage of system development;

[0016] (2) Improvement plan for system enhancement points when enhancing the existing system.

[0017] Optionally, in S2, the discrete mode change of the system is modeled, including the formal definition of ports, parameters, states, transitions, relations, conditional judgment formulas, output actions and assignment actions in the discrete mode change, and determining the association relationship between them;

[0018] The discrete mode change specifically refers to the response of the internal state of the cyber-physical system to the input event and a series of operations on the system data;

[0019] The discrete mode change is formally defined as a sextuple:

[0020] DMC=<IOPort,Param,State,Trans,Guard,Action>

[0021] The port is defined as: IOPort: = (name, IOType, type, default, value)

[0022] Parameter definition: Param: = (name, type, value)

[0023] The state is defined as: State: = (name, type)

[0024] The transfer definition is: Trans: = (name, mode, guard, output, set)

[0025] The relationship is defined as: Link: = (source, target, trans)

[0026] The conditional judgment is defined as: Guard: = (name, type, expression)

[0027] The output action is defined as: A output :=(portName=expression)

[0028] The assignment action is defined as: A set :=(paramName=expression).

[0029] Optionally, in S2, modeling the continuous dynamic behavior of the system includes formally defining a continuous signal that changes over time in the continuous dynamic behavior, and determining a correlation relationship between an input stimulus, an ordinary differential equation expression, and an output response;

[0030] The continuous dynamic behavior specifically refers to the continuous physical process in the internal state of the cyber-physical system and the trend of the corresponding parameters changing over time;

[0031] The continuous dynamic behavior is formally defined as a triple:

[0032] CDB=<IOPort,Param,Signal,Expression,Link>

[0033] The ordinary differential equation expression specifically includes the function expression of the system parameters changing with time, the constraint conditions and the solution interval, which is expressed as: ODE =<Func,Cond,Interval> .

[0034] Optionally, in S2, the hierarchical structure of the system is modeled, including the formal definition of constants, attributes, components, interfaces and hierarchical relationships in the hierarchical structure.

[0035] The hierarchical structure specifically refers to the multi-granularity decomposition of the cyber-physical system to form a hierarchical relationship between the whole and the components of the system;

[0036] The hierarchical structure is formally defined and specifically represented as a five-tuple:

[0037] Component=<Const,Attr,Entity,Port,Relation> .

[0038] Optionally, in S3, the multi-level hybrid model is graphically modeled in PtolemyII, including selecting appropriate indicators, components, labels and connection methods in the PtolemyII platform for graphical expression based on the formal definitions of discrete mode changes, continuous dynamic behavior and hierarchical structure in S2.

[0039] Optionally, in S4, the multi-level hybrid model is converted into a timed automaton network including multiple timed automaton models according to the rules, including exporting the established multi-level hybrid model as an xml file through PtolemyII as input, traversing the data and elements in the model, and converting the multi-level hybrid model into a verifiable timed automaton model according to the conversion rules corresponding to the element type and saving the data that conforms to the timed automaton network structure;

[0040] The conversion rules corresponding to the element types specifically refer to the abstraction of core modeling elements as metamodels based on the theory of metamodel-driven architecture, and the formulation of mapping rules from multi-level hybrid models to timed automata models, including conversion rules for data types, components and elements, and hierarchical flattening;

[0041] The data conforming to the network structure of the timed automaton specifically refers to the element data corresponding to the timed automaton metamodel, including the XML target file containing file, template, parameter, location, migration and label information, which can be recognized by the UPPAAL tool.

[0042] Optionally, in S5, the properties and behaviors of the information-physical system are formally specified, including describing the reliability, security, and deadlock situation of the model designed for the system in S1 as CTL formulas.

[0043] Optionally, in S6, the verification of the multi-level hybrid model includes placing the timed automaton network data in S4 under the UPPAAL framework, combining it with the CTL formula in S5, and outputting the verification result of the formula.

[0044] The beneficial effects of the present invention are:

[0045] (1) Based on the rules of domain-specific modeling languages, a multi-level hybrid model that can describe cyber-physical systems is designed. In view of the discreteness, continuity, and hierarchy of cyber-physical system behaviors, the system behaviors are constructed from three perspectives: discrete mode changes, continuous dynamic behaviors, and hierarchical structures.

[0046] (2) Based on the transformation rule design of metamodel mapping, the model mapping rules are defined according to the differences between the multi-level hybrid model and the timed automaton model.

[0047] Other advantages, objectives and features of the present invention will be described in the following description to some extent, and to some extent, will be obvious to those skilled in the art based on the following examination and study, or can be taught from the practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below in conjunction with the accompanying drawings, wherein:

[0049] Figure 1 This is a technical framework diagram of the modeling and verification method of the present invention;

[0050] Figure 2 This is an example diagram of a hierarchical model according to an embodiment of the present invention;

[0051] Figure 3 A component and element mapping diagram of an embodiment of the present invention;

[0052] Figure 4 This is a flattened diagram of the hierarchical structure of an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments only illustrate the basic concept of the present invention in a schematic manner, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0054] Among them, the drawings are only used for illustrative explanations, and they only represent schematic diagrams rather than actual pictures, and should not be understood as limitations on the present invention. In order to better illustrate the embodiments of the present invention, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the size of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings may be omitted.

[0055] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if the terms "upper", "lower", "left", "right", "front", "back" and the like indicate directions or positional relationships, they are based on the directions or positional relationships shown in the drawings, which are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction. Therefore, the terms describing the positional relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0056] like Figure 1 As shown, it is divided into the following steps:

[0057] Step 1: Select complete and closed-loop cyber-physical system design cases. There are two sources for selecting cyber-physical system design cases: (1) system demand analysis and functional design in the early stage of system development; (2) improvement plans for system enhancement points when enhancing the functions of existing systems.

[0058] Step 2: Formal modeling of the discrete mode changes, continuous dynamic behaviors and hierarchical structures of the information-physical system is performed to obtain a multi-level hybrid model of the system; modeling of the discrete mode changes of the system includes formal definitions of ports, parameters, states, transfers, relationships, conditional judgments, output actions and assignment actions in the discrete mode changes, and determining the associations between them.

[0059] The discrete mode changes mentioned herein specifically refer to the response of the internal state of the information-physical system to input events and a series of operations on system data.

[0060] The discrete mode change is formally defined as a sextuple:

[0061] DMC=<IOPort,Param,State,Trans,Guard,Action>

[0062] The port is defined as: IOPort: = (name, IOType, type, default, value)

[0063] Parameter definition: Param: = (name, type, value)

[0064] The state is defined as: State: = (name, type)

[0065] The transfer definition is: Trans: = (name, mode, guard, output, set)

[0066] The relationship is defined as: Link: = (source, target, trans)

[0067] The conditional judgment is defined as: Guard: = (name, type, expression)

[0068] The output action is defined as: A output :=(portName=expression)

[0069] The assignment action is defined as: A set :=(paramName=expression)

[0070] Modeling the continuous dynamic behavior of the system includes formalizing the continuous signals that change over time in the continuous dynamic behavior and determining the relationship between the input stimulus, ordinary differential equation expression, and output response.

[0071] The continuous dynamic behavior specifically refers to the continuous physical process in the internal state of the information-physical system and the trend of the corresponding parameters changing over time.

[0072] The continuous dynamic behavior is formally defined as a triple:

[0073] CDB=<Encourage,Component,Responce>

[0074] The ordinary differential equation expression specifically includes the function expression of the system parameters changing with time, the constraint conditions and the solution interval, which is expressed as: ODE =<Func,Cond,Interval>

[0075] Modeling the hierarchical structure of the system, including the formal definition of constants, properties, components, interfaces and hierarchical relationships in the hierarchy,

[0076] The hierarchical structure specifically refers to the multi-granularity decomposition of the information-physical system to form a hierarchical relationship between the whole and the components of the system.

[0077] The hierarchical structure is formally defined and specifically represented as a five-tuple:

[0078] Component=<Const,Attr,Entity,Port,Relation>

[0079] Step 3: Graphically model the multi-level hybrid model in the PtolemyII platform; The multi-level hybrid model is graphically modeled in PtolemyII, including selecting appropriate indicators, components, labels and connection methods for graphical expression in the PtolemyII platform based on the formal definitions of discrete mode changes, continuous dynamic behaviors and hierarchical structures in step 2.

[0080] Step 4: Convert the multi-level hybrid model into a timed automaton network containing multiple timed automaton models according to rules; convert the multi-level hybrid model into a timed automaton network containing multiple timed automaton models according to rules, including exporting the established multi-level hybrid model into an xml file through PtolemyII as input, traversing the data and elements in the model, and converting the multi-level hybrid model into a verifiable timed automaton model according to the conversion rules corresponding to the element type and saving the data that conforms to the timed automaton network structure.

[0081] Among them, the conversion rules corresponding to the element types specifically refer to abstracting the core modeling elements into metamodels based on the theory of metamodel-driven architecture, and formulating mapping rules from multi-level hybrid models to timed automaton models, which include conversion rules for data types, components and elements, and flattening of hierarchical structures.

[0082] The data conforming to the network structure of the timed automaton specifically refers to the element data corresponding to the timed automaton metamodel, including the XML target file containing file, template, parameter, location, migration and label information, which can be recognized by the UPPAAL tool.

[0083] The data type conversion rules can directly convert equivalent basic data types, such as integer, floating point, Boolean, etc., to data types that are equivalent or backward compatible.

[0084] The component and element conversion rules described above can realize conversion through one-to-one syntax mapping for semantically equivalent basic elements, while additional conversion processes are required for semantically overlapping elements.

[0085] According to the hierarchy flattening rule, the hierarchical components are composed of composite components and atomic components. When a composite component is activated, only one subcomponent is executed at the same time. Figure 2 Take the example to explain the rules of hierarchical flattening. The composite component Count in the example diagram consists of two atomic components Add and Sub. The top-level state transition is<add, / ,true, / ,sub> The steps to flatten the hierarchy are as follows:

[0086] (1) According to the component and element conversion rules, Figure 2 Convert to Figure 3 The transformed subcomponent Add is called the composite source state, and the subcomponent Sub is called the composite target state;

[0087] (2) For the input and output ports of the subcomponent, convert them into the entry state and exit state of the corresponding time automaton, and the conversion rules are specifically described by -;

[0088] (3) To comply with the input port semantics of the composite source state, an entry state in is added to the automaton Add, and a transition is added with the entry state in as the source state and the initial state start as the target state.<A.in, / ,true, / ,A.start> , the migration condition is true;

[0089] (4) To comply with the output port semantics of the composite source state, an exit state out is added to the automaton Add, and a transition is added with the end state end as the source state and the exit state out as the target state.<A.end,sig!,true, / ,A.out> , send synchronization signal sig during migration;

[0090] (5) To comply with the input port semantics of the composite target state, add an entry state in to the automaton Sub, and add a transition with the entry state in as the source state and the initial state start as the target state.<S.in,sig?,true, / ,S.start> , migrate when receiving the synchronization signal sig;

[0091] (6) To comply with the output port semantics of the composite target state, add an exit state out to the automaton Sub, and add a transition with the end state end as the source state and the exit state out as the target state.<S.end, / ,true, / ,S.out> , the migration condition is true.

[0092] The model obtained through steps (3)-(6) is as follows Figure 4 shown.

[0093] Step 5: Formalize the properties and behaviors of the information-physical system; Formalize the properties and behaviors of the information-physical system, including describing the reliability, security, and deadlock situation of the model designed in the system in step 1 as CTL formulas.

[0094] Step 6: Verify the multi-level hybrid model by combining the timed automaton network described in Step 4 with the formal specification described in Step 5. Verification of the multi-level hybrid model includes placing the timed automaton network data in Step 4 under the UPPAAL framework, combining it with the CTL formula in Step 5, and outputting the verification result of the formula.

[0095] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution, which should be included in the scope of the claims of the present invention.

Claims

1. A modeling and verification method applicable to cyber-physical systems, characterized in that: The method comprises the following steps: S1: Select complete and closed-loop cyber-physical system design cases; S2: Formal modeling of the discrete mode changes, continuous dynamic behaviors and hierarchical structures of the cyber-physical system is performed to obtain a multi-level hybrid model of the system; S3: graphically modeling the multi-level hybrid model in the Ptolemy II platform; S4: converting the multi-level hybrid model into a timed automaton network including multiple timed automaton models according to a rule; S5: Formalize the properties and behaviors of the cyber-physical system; S6: Combine the timed automaton network described in S4 with the formal specification described in S5 to verify the multi-level hybrid model.

2. A modeling and verification method applicable to a cyber-physical system according to claim 1, characterized in that: In S1, the selection of cyber-physical system design cases includes two sources: (1) Analyze system requirements and design functions in the early stage of system development; (2) Improvement plan for system enhancement points when enhancing the existing system.

3. A modeling and verification method applicable to a cyber-physical system according to claim 2, characterized in that: In said S2, the discrete mode change of the system is modeled, including the formal definition of ports, parameters, states, transitions, relations, conditional judgment formulas, output actions and assignment actions in the discrete mode change, and the determination of the association relationship between them; The discrete mode change specifically refers to the response of the internal state of the cyber-physical system to the input event and a series of operations on the system data; The discrete mode change is formally defined as a sextuple: DMC=<IOPort,Param,State,Trans,Guard,Action> The port is defined as: IOPort: = (name, IOType, type, default, value) Parameter definition: Param: = (name, type, value) The state is defined as: State: = (name, type) The transfer definition is: Trans: = (name, mode, guard, output, set) The relationship is defined as: Link: = (source, target, trans) The conditional judgment is defined as: Guard: = (name, type, expression) The output action is defined as: A output :=(portName=expression) The assignment action is defined as: A set :=(paramName=expression).

4. A modeling and verification method applicable to cyber-physical systems according to claim 3, characterized in that: In said S2, the continuous dynamic behavior of the system is modeled, including formally defining the continuous signal that changes with time in the continuous dynamic behavior, and determining the correlation between the input stimulus, the ordinary differential equation expression and the output response; The continuous dynamic behavior specifically refers to the continuous physical process in the internal state of the cyber-physical system and the trend of the corresponding parameters changing over time; The continuous dynamic behavior is formally defined as a triple: CDB=<IOPort,Param,Signal,Expression,Link> The ordinary differential equation expression specifically includes the function expression of the system parameters changing with time, the constraint conditions and the solution interval, which is expressed as: ODE =<Func,Cond,Interval> .

5. A modeling and verification method applicable to cyber-physical systems according to claim 4, characterized in that: In S2, the hierarchical structure of the system is modeled, including the formal definition of constants, attributes, components, interfaces and hierarchical relationships in the hierarchy. The hierarchical structure specifically refers to the multi-granularity decomposition of the cyber-physical system to form a hierarchical relationship between the whole and the components of the system; The hierarchical structure is formally defined and specifically represented as a five-tuple: Component=<Const,Attr,Entity,Port,Relation> .

6. A modeling and verification method applicable to cyber-physical systems according to claim 5, characterized in that: In S3, the multi-level hybrid model is graphically modeled in Ptolemy II, including selecting appropriate indicators, components, labels and connection methods for graphical expression in the Ptolemy II platform based on the formal definitions of discrete mode changes, continuous dynamic behavior and hierarchical structure in S2.

7. A modeling and verification method applicable to cyber-physical systems according to claim 6, characterized in that: In the S4, the multi-level hybrid model is converted into a timed automaton network including multiple timed automaton models according to the rules, including exporting the established multi-level hybrid model into an xml file through Ptolemy II as input, traversing the data and elements in the model, and converting the multi-level hybrid model into a verifiable timed automaton model according to the conversion rules corresponding to the element type and saving the data that conforms to the timed automaton network structure; The conversion rules corresponding to the element types specifically refer to the abstraction of core modeling elements as metamodels based on the theory of metamodel-driven architecture, and the formulation of mapping rules from multi-level hybrid models to timed automata models, including conversion rules for data types, components and elements, and hierarchical flattening; The data conforming to the network structure of the timed automaton specifically refers to the element data corresponding to the timed automaton metamodel, including the XML target file containing file, template, parameter, location, migration and label information, which can be recognized by the UPPAAL tool.

8. A modeling and verification method applicable to cyber-physical systems according to claim 7, characterized in that: In S5, the properties and behaviors of the cyber-physical system are formally specified, including describing the reliability, security, and deadlock conditions of the model designed in S1 as CTL formulas.

9. A modeling and verification method applicable to cyber-physical systems according to claim 8, characterized in that: In S6, the verification of the multi-level hybrid model includes placing the timed automaton network data in S4 under the UPPAAL framework, combining it with the CTL formula in S5, and outputting the verification result of the formula.

Images