Service-oriented Abstraction and Verification of Hybrid Simulink Models with Simulink2dL

Embedded control systems combine discrete and continuous behavior. To cope with the immense complexity of the resulting systems, they are increasingly designed with model-driven development and tools like Matlab Simulink. At the same time, application of embedded systems in safety-critical areas, like in the automotive industry or medical context, require high safety standards. In this project, we investigate a formally well-founded, service-oriented design and verification approach for Simulink. The key ideas of our approach are threefold: First, we propose a service-oriented design approach for Simulink, where we introduce services for Simulink, hybrid contracts to cleanly define these services, and feature models to model their variability. Second, we propose a transformation of Simulink models into the expressive and formally well-defined differential dynamic logic. This enables the formal verification of hybrid systems modeled in Simulink using the powerful interactive theorem prover KeYmaera X. To overcome scalability issues, we enable compositional verification by replacing the inner structure of services by their contracts for system verification.

Contact: Prof. Dr. Paula Herber, Timm Liebrenz, MSc

 

 

Access to our framework (Simulink2dL and SimulinkRL2dL)

Our framework for the automated transformation from Simulink (and the RL Toolbox) to differential dynamic logic (dL) is freely available under the MIT open source license at:

https://github.com/EmbSys-WWU/Simulink2dL

Contributors are very welcome. For any questions, please contact emb.sys@wwu.de

Verification Flow

The overall verification flow of our service-oriented verification approach with Simulink2dL is as follows: First, the designer identifies parts of the system that can be considered to be independent and configurable services and creates hybrid contracts for them. The best candidates for such services are subsystems, which already encapsulate functionality and have an interface via their input and output ports. It is also possible to choose a group of connected blocks as service. Second, each service can then individually be transformed into a behaviorally equivalent formal dL representation with Simulink2dL. Third, the designer (resp. verifier) can use interactive theorem prover KeYmaera X to verify that the service fulfills its contract. Note that services can be reused in other designs and their verified contracts can be reused for the following steps without repeating the second and third step. Fourth, the contracts are used to generate an abstract formal system model, where all services are replaced by their contract. A hybrid contract abstracts from the inner structure of a given service, but describes the interface behavior in sufficient detail to represent their behavior in the resulting dL model. In a fifth step, this abstract dL representation can be used to semi-automatically verify safety properties using KeYmaera X. Note that the verified properties can be represented as a hybrid contract of the overall system. Thus, our approach can be used hierarchically, i.e., a large system can be divided into services that can be individually verified, and each service can again be divided into smaller services.

 

Service-oriented Verification Approach
Service-oriented Verification Approach
© Timm Liebrenz

Example Models and Proofs

Note that the "transformed models" do not contain assumptions and guarantees for verifying contracts.

 

Temperature Control Service

Simulink Model Service Temperature Control

All KeYmaera X files and the Simulink model as zip ServiceTemperatureControl.zip

Property to Prove KeYmaera X Model KeYmaera X Proof
Transformed Model TemperatureControlService.kyx  
Temperature Range TemperatureControlService_Range.kyx TemperatureControlService_Range_Proof.kyp
No Rapid Switching TemperatureControlService_Switching.kyx TemperatureControlService_Switching_Proof.kyp

Temperature Control System

Simulink model Temperature Control System

All KeYmaera X files and the Simulink model as zip TemperatureControlSystem.zip

Temperature Control System (concrete)

Property to Prove KeYmaera X Model KeYmaera X Proof
Transformed Model TemperatureControlSystemConcrete.kyx  
Temperature Range TemperatureControlSystemConcrete_Range.kyx TemperatureControlSystemConcrete_Range_Proof.kyp
No Rapid Switching TemperatureControlSystemConcrete_Switching.kyx ---

Temperature Control System (abstracted)

Generic Infusion Pump

Simulink Model Gip

All KeYmaera X files and the Simulink Model as zip GIP.zip

KeYmaera X files for the Patient

Property to Prove KeYmaera X Model KeYmaera X Proof
Transformed Model PatientInput.kyx  
Input Processing Patientinput_Processing.kyx Patientinput_Processing_Proof.kyx

KeYmaera X files for the Input Processing

Property to Prove KeYmaera X Model KeYmaera X Proof
Transformed Model Inputprocessing.kyx  
Output 0 Inputprocessing_Out0.kyx Inputprocessing_Out0_Proof.kyx
Output 1 Inputprocessing_Out1.kyx Inputprocessing_Out1_Proof.kyx

KeYmaera X files for DrugInBlood

Property to Prove KeYmaera X Model KeYmaera X Proof
Transformed Model Druginblood.kyx  
Positve Concentration Druginblood_Positive.kyx Druginblood_Positive_Proof.kyx
No Infusion Druginblood_Noinfusion.kyx Druginblood_Noinfusion_Proof.kyx
Decreasing Concentration Druginblood_Decrease.kyx Druginblood_Decrease_Proof.kyx
Increasing Concentration Druginblood_Increase.kyx Druginblood_Increase_Proof.kyx
Balanced Concentration Druginblood_Balance.kyx Druginblood_Balance_Proof.kyx

KeYmaera X files for the Controller

Property to Prove KeYmaera X Model KeYmaera X Proof
Transformed Model Controller.kyx  
Valied Pumping Controller_Valid.kyx Controller_Valid_Proof.kyx
Crtical Concentration Controller_Critical.kyx Controller_Critical_Proof.kyx

KeYmaera X files for WarningGenerator

KeYmaera X files for the Pump

Property to Prove KeYmaera X Model KeYmaera X Proof
Transformed Model Pump.kyx  
Normal Pumping Pump_Normal.kyx Pump_Normal_Proof.kyx
No Pumping Pump_Stop.kyx Pump_Stop_Proof.kyx
Max Pumping Pump_Max.kyx Pump_Max_Proof.kyx

KeYmaera X files for Tank

Property to Prove KeYmaera X Model KeYmaera X Proof
Transformed Model Tank.kyx  
No Consumption Tank_Noconsumption.kyx Tank_Noconsumption_Proof.kyx
Normal Consumption Tank_Normalconsumption.kyx Tank_Normalconsumption_Proof.kyx
Tank Change Tank_Change.kyx Tank_Change_Proof.kyx

KeYmaera X files for the Power Source

Property to Prove KeYmaera X Model KeYmaera X Proof
Transformed Model Powersource.kyx  
Positve Output Powersource Positivevoltage.kyx Powersource Positivevoltage Proof.kyx
Battery Change Powersource Change.kyx Powersource Change Proof.kyx

 

Examples and Proofs with Reinforcement Learning

In the following, the Simulink Models and a selection of KeYmaera X files from the SimulinkRL2dL Case Study are available for download.

The full set of KeYmaera X files is available here: VerificationResults.zip

Note that  Mathematica was used for most proofs exept for the Top Level, the Sensor Service and the Evasive Move Checker Service (see Zip file above), where Z3 was used instead.

 

 

Factory with 2 Opponents 

Simulink Model of the Factory with 2 Opponents:  RL Factory 2 Opponents

Top Level of the Factory

Property to Prove KeYmaera X Model KeYmaera X Proof
Overall Collision Freedom Top Level 2 Opp Top Level 2 Opp Proof

RL Robot

Property to Prove KeYmaera X Model KeYmaera X Proof
Contract: Opponent A Rl Robot 2 Opp A Rl Robot 2 Opp A Proof
Contract: Opponent B Rl Robot 2 Opp B Rl Robot 2 Opp B Proof

Opponent

Property to Prove KeYmaera X Model KeYmaera X Proof
Contract: No Collision  with RL Robot Opponent No Collision Opponent No Collision Proof
Contract: Below Max Velocity Opponent Velocity Opponent Velocity Proof

Factory Model with Sensor Disturbance

Simulink Model of the Factory with 2 Opponents and Disturbance: RL Factory Disturbance

Top Level

Property to Prove KeYmaera X Model KeYmaera X Proof
Overall Collision Freedom with Disturbance Top Level 2 Opp Noise Top Level 2 Opp Noise Proof

RL Robot

Property to Prove KeYmaera X Model KeYmaera X Proof
Contract: Opponent A with Disturbance Rl Robot Disturbance A Rl Robot Disturbance A Proof
Contract: Opponent B with Disturbance Rl Robot Disturbance B Rl Robot Disturbance B Proof

Sensor and Sensor Subsystem

Property to Prove KeYmaera X Model KeYmaera X Proof
Contract: Sensor with Disturbance A   Sensor Disturbance A Sensor Disturbance A Proof
Contract: Sensor with Disturbance B Sensor Disturbance B Sensor Disturbance B Proof
Contract: Sensor Subsystem with Disturbance Sensor Subsystem Disturbance Sensor Subsystem Disturbance Proof
     

Factory with 6 Opponents

Simulink Model of the Factory with 6 Opponents: RL Factory 6 Opponents

Top Level

Property to Prove KeYmaera X Model KeYmaera X Proof
Overall Collision Freedom Top Level 6 Opp Top Level 6 Opp Proof

RL Robot

Only the proof involving the additional Opponent C are shown here. Proofs for the other opponents are analogous and available from the Zip file.

Property to Prove KeYmaera X Model KeYmaera X Proof
Contract: Opponent C Rl Robot 6 Opp C Rl Robot 6 Opp C Proof