Componend-Based Deductive Verification of Cyber-Physical
Total Page：16
File Type：pdf, Size：1020Kb
Submitted by Andreas M¨uller Submitted at Department of Cooperative Information Systems Supervisor and First Examiner Wieland Schwinger Second Examiner Component-based Andr´ePlatzer Co-Supervisor Deductive Verification of Stefan Mitsch Cyber-physical Systems October 2017 Doctoral Thesis to obtain the academic degree of Doktor der technischen Wissenschaften in the Doctoral Program Technische Wissenschaften JOHANNES KEPLER UNIVERSITY LINZ Altenbergerstraße 69 4040 Linz, Osterreich¨ www.jku.at DVR 0093696 To Katrin – that much. Eidesstattliche Erkl¨arung Ich erkl¨arean Eides statt, dass ich die vorliegende Dissertation selbstst¨andigund ohne fremde Hilfe verfasst, andere als die angegebenen Quellen und Hilfsmittel nicht benutzt bzw. die w¨ortlich oder sinngem¨aßentnommenen Stellen als solche kenntlich gemacht habe. Die vorliegende Dissertation ist mit dem elektronisch ¨ubermittelten Textdokument identisch. v Acknowledgements First of all and most importantly, I want to thank my beloved wife Katrin: Without you, all this would have been impossible! Thank you for your repeated encouragement and your almost endless patience, especially over the last 5 years. Furthermore, I want to thank my parents Klaus and Gertrude, my brother Daniel, my grandparents Karl and Rosi, and my parents-in-law Karl and Gundi. Thank you for your ongoing support and for always believing in me. During my time as a doctoral candidate I had the pleasure of meeting nu- merous further inspiring people from all over the world. I want to thank all of you, for making this time of my life so special. Many thanks to my supervisors in Linz, Wieland Schwinger and Werner Retschitzegger, for your support and the countless fruitful discussions. Special thanks, to my supervisor in Pittsburgh, Andr´ePlatzer, who made it possible for me to visit Carnegie Melon University in Pittsburgh twice. These visits along with your continuous support, allowed me to dive into the fascinating world of cyber-physical systems. Last but definitely not least, a very special thank you to my colleague, mentor and friend Stefan Mitsch. Thank you for the countless discussions— regardless if you were in the next office, or on another continent. Thank you for your answering my endless questions—no matter how stupid. Thank you for the numerous evenings we spent together—no matter if at a bar, a football match or at home. vii Abstract Cyber-physical systems (CPS) are pervasively embedded into our lives and in- creasingly act in close proximity to as well as with direct impact on humans. Because of their safety-criticality, formal verification techniques that guarantee correctness properties for all of the infinitely many possible states of a CPSare of paramount importance. Since formal verification of CPS is known to be unde- cidable for realistic models, techniques to handle system complexity are needed. Verification methods based on hybrid automata focus on full automation andare therefore restricted to less expressive classes of CPS, while deductive verification methods rely on human guidance to make progress despite undecidability. To make human guidance possible, however, the inherent complexities of CPS prac- tically mandate techniques to handle system complexity. This thesis introduces a component-based verification approach for CPS based on deductive verifica- tion. Crucially, the approach builds safety proofs about systems from smaller component proofs without analyzing the systems as a whole. As a result, the approach reduces verification complexity while simultaneously increasing proof reusability and maintainability. We develop the approach in three stages of in- creasing generality and suitable to various areas of application. First, we focus on modeling and verification of large traffic networks, and aim at avoiding traf- fic breakdowns on roads (i. e., the number of cars must not exceed the road’s capacity) as fixed safety property. Second, we generalize flow exchange between components to instantaneous, lossless information exchange being restricted to globally known regions (e. g., robot position relative to a fixed reference point) and allow arbitrary safety properties. Third, we relate component time to global system time in order to describe information exchange history in terms of the magnitude of change and rate of change (e. g., robot position relative to previous position some time ago). We show the applicability of these three approaches by modeling examples from traffic control, vehicle control and autonomous robots. The results indicate that, compared to monolithic analysis, our approaches re- duce verification effort, increase proof automation, facilitate reuse of component proofs and increase the overall maintainability of a verified CPS. ix Kurzfassung Cyber-physische Systeme (CPS) sind untrennbar mit unserem t¨aglichen Leben verbunden und arbeiten immer mehr in unserer direkten Umgebung bzw. mit direktem Einfluss auf Menschen. Weil die Sicherheit solcher Systeme dadurch besonders kritisch ist, sind formale Verifikationstechniken, die die Sicherheit aller m¨oglichen Zust¨andeeines solchen CPS sicherstellen, von gr¨oßterWich- tigkeit. Da formale Verifikation von realistischen cyber-physischen Modellen aber unentscheidbar ist, sind Techniken zur Komplexit¨atsreduktion(z.B. zer- legen eines Systems in kleinere Teilsysteme) unabdingbar. In dieser Disserta- tion pr¨asentieren wir einen komponentenbasierten Ansatz zur Verifikation von CPS, basierend auf deduktiver Verifikation. Der Ansatz erm¨oglicht es, von kleineren Komponenten-Beweisen auf systemweite Sicherheitseigenschaften zu schließen, ohne das System als Ganzes analysieren zu m¨ussen. Dadurch re- duziert sich die Verifikationskomplexit¨at,w¨ahrendgleichzeitig die Wiederver- wendbarkeit und Wartbarkeit von Beweisen erh¨oht wird. Wir entwickeln den Ansatz in drei Schritten, welche die Analyse von immer allgemeineren Syste- men erlauben. Zuerst fokussieren wir uns auf Modellierung und Verifikation von großen Verkehrsnetzen, mit dem festen Ziel einen Zusammenbruch des Fließverkehrs zu verhindern (d.h., es d¨urfensich nie mehr Fahrzeuge gleich- zeitig auf einer Straße befinden, als erlaubt). Im n¨achsten Schritt verallge- meinern wir Kommunikation und Sicherheitseigenschaften, weg von Verkehrs- komponenten und Fließverkehr, hin zu beliebiger Informationsweitergabe und frei w¨ahlbarenSicherheitseigenschaften. Die kommunizierten Werte sind dabei durch global festgelegte Regionen beschr¨ankt(z.B. die Position eines Roboters, relativ zu einem festgelegten Referenzpunkt). Im letzten Schritt synchronisieren wir die Zeit zwischen Komponenten und dem Gesamtsystem und erm¨oglichen Zugriff auf fr¨uherkommunizierte Werte, um Aussagen ¨uber die Gr¨oßenordnung und die Rate der Werte¨anderungtreffen zu k¨onnen(z.B., die Position eines Roboters, relativ zu seiner letzten Position und der Zeit die seitdem vergangen ist). Wir zeigen die Anwendbarkeit unserer Ans¨atzeanhand von Fallstudien aus den Bereichen Straßenverkehr, Fahrzeugsteuerung und autonome Roboter. Die Ergebnisse legen nahe, dass unsere Ans¨atzetats¨achlich zu einer Verringerung der Beweiskomplexit¨atf¨uhrenund gleichzeitig die Wiederverwendbarkeit und Wartbarkeit von Beweisen erh¨ohen. xi Contents I Fundamentals 1 Introduction................................. 3 1.1 Challenges............................... 4 1.2 Contribution ............................. 5 1.3 Structure ............................... 6 1.4 Disclaimer............................... 8 2 Modeling and Verification of CPS – A Conceptual Reference Model.. 9 2.1 (Cyper-physical) Systems ...................... 10 2.2 Modeling ............................... 12 2.2.1 Modeling Formalism ..................... 12 2.2.2 Specification Formalism ................... 14 2.3 Verification .............................. 16 2.3.1 Verification Goal ....................... 16 2.3.2 Verification Evidence..................... 16 2.4 Tool Support ............................. 17 2.4.1 Tool .............................. 17 2.4.2 Artifacts............................ 17 2.4.3 Verification Tools....................... 19 2.5 Summary – Scope of our Approach................. 20 3 Component-based Modeling........................ 21 3.1 Terminology.............................. 21 3.1.1 Component and Interface .................. 21 3.1.2 Composition and Compatibility............... 24 3.1.3 Contracts and Refinement.................. 27 3.2 Strategy................................ 30 3.3 Requirements Summary ....................... 33 4 Related Work................................ 35 4.1 Selection of Approaches ....................... 35 xiii CONTENTS 4.2 Component-based CPS Verification................. 36 4.3 Assume-Guarantee Reasoning.................... 39 4.4 Summary ............................... 41 5 Motivational Examples........................... 43 5.1 Flow Components .......................... 43 5.1.1 Traffic Control ........................ 43 5.1.2 Traffic Modeling ....................... 44 5.1.3 Summary ........................... 47 5.2 Vehicle Cruise Control........................ 48 5.2.1 Components and Composition................ 48 5.2.2 Summary ........................... 49 5.3 Tele-operated Robot......................... 50 5.3.1 Components and Composition................ 50 5.3.2 Summary ........................... 51 5.4 Example Summary.......................... 52 6 Preliminaries ................................ 53 6.1 Differential Dynamic Logic ..................... 53 6.1.1 Hybrid Time ........................