Generic Negative Scenarios for the Specification of Collaborative Cyber-Physical Systems

Stenkova, Viktoria; Brings, Jennifer; Daun, Marian; Weyer, Thorsten

doi:10.1007/978-3-030-33223-5_34

Cited by 5 publications

(4 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Hazard/failure-oriented testing [10,25] and requirements falsification based on negative scenarios [35,11,34] are useful if R is not available or needs to be validated and revised. In contrast, our approach is complete once R is validated, that is, any deviation from R detectable by such techniques is also uncovered by at least one test case generated by our approach.…”

Section: Related Work and Discussionmentioning

confidence: 99%

Sound Development of Safety Supervisors

Gleirscher¹,

Plecher²,

Peleskã³

2022

Preprint

View full text Add to dashboard Cite

Safety supervisors are controllers enforcing safety properties by keeping a system in (or returning it to) a safe state. The development of such high-integrity components can benefit from a rigorous workflow integrating formal design and verification. In this paper, we present a workflow for the sound development of safety supervisors combining the best of two worlds, verified synthesis and complete testing. Synthesis allows one to focus on problem specification and model validation. Testing compensates for the crossing of abstraction, formalism, and tool boundaries and is a key element to obtain certification credit before entry into service. We establish soundness of our workflow through a rigorous argument. Our approach is tool-supported, aims at modern autonomous systems, and is illustrated with a collaborative robotics example.

show abstract

Section: Related Work and Discussionmentioning

confidence: 99%

Sound Development of Safety Supervisors

Gleirscher¹,

Plecher²,

Peleskã³

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Whereas hazard-or failure-oriented testing [8,20] and requirements falsification based on negative scenarios [28,9,27] are highly useful if no complete R is available or if R still needs to be validated and revised, our approach is complete once R is successfully validated. That is, any deviation from R detectable by these techniques is also uncovered by at least one test case generated by our approach.…”

Section: Introductionmentioning

confidence: 99%

Complete Test of Synthesised Safety Supervisors for Robots and Autonomous Systems

Gleirscher

Peleskã

2021

Electron. Proc. Theor. Comput. Sci.

View full text Add to dashboard Cite

Verified controller synthesis uses world models that comprise all potential behaviours of humans, robots, further equipment, and the controller to be synthesised. A world model enables quantitative risk assessment, for example, by stochastic model checking. Such a model describes a range of controller behaviours some of which-when implemented correctly-guarantee that the overall risk in the actual world is acceptable, provided that the stochastic assumptions have been made to the safe side. Synthesis then selects an acceptable-risk controller behaviour. However, because of crossing abstraction, formalism, and tool boundaries, verified synthesis for robots and autonomous systems has to be accompanied by rigorous testing. In general, standards and regulations for safety-critical systems require testing as a key element to obtain certification credit before entry into service. This work-in-progress paper presents an approach to the complete testing of synthesised supervisory controllers that enforce safety properties in domains such as human-robot collaboration and autonomous driving. Controller code is generated from the selected controller behaviour. The code generator, however, is hard, if not infeasible, to verify in a formal and comprehensive way. Instead, utilising testing, an abstract test reference is generated, a symbolic finite state machine with simpler semantics than code semantics. From this reference, a complete test suite is derived and applied to demonstrate the observational equivalence between the synthesised abstract test reference and the generated concrete controller code running on a control system platform.

show abstract

“…However, challenges remain for supporting validation processes for systems that are highly connected, such as highly collaborative cyber‐physical systems (CPSs). Collaborative CPSs connect with each other to form collaborative CPS networks at runtime that enable them to fulfill purposes individual systems cannot fulfill (e.g., platooning enables autonomous cars to increase safety, improve traffic flow, and reduce energy consumption) 9 . In such collaborative CPS networks, there is usually a constant change as different collaborative CPSs connect to and disconnect from the existing network.…”

Section: Introductionmentioning

confidence: 99%

“…Collaborative CPSs connect with each other to form collaborative CPS networks at runtime that enable them to fulfill purposes individual systems cannot fulfill (e.g., platooning enables autonomous cars to increase safety, improve traffic flow, and reduce energy consumption). 9 In such collaborative CPS networks, there is usually a constant change as different collaborative CPSs connect to and disconnect from the existing network. Hence, a plethora of possible instance-level configurations exist that need to be considered during validation as the current instance-level configuration can have an impact on desired and undesired behavior.…”

mentioning

confidence: 99%

Model inspections in the engineering of collaborative cyber‐physical systems with instance‐level review diagrams

Daun

Brings

Weyer

2021

J Software Evolu Process

Self Cite

View full text Add to dashboard Cite

Model inspections are important to ensure high‐quality software and to satisfy legal obligations in model‐based engineering processes. As model‐based specifications are typically documented on type‐level, errors concerning the interactions between multiple system instances can go unnoticed. For collaborative cyber‐physical systems (CPS), a plethora of possible instance‐level configurations need to be taken into account. Therefore, we propose the definition of instance‐level review diagrams that show representative interactions of instance‐level configurations that help detect defects in the system specification. To evaluate the approach, we conducted a controlled experiment whose results indicate that instance‐level review diagrams have—compared with type‐level diagrams—important positive effects on reviewing processes for behavioral specifications of CPS. Specifically, the experiment provides empirical evidence that instance‐level review diagrams are significantly more expressive and effective than type‐level diagrams.

show abstract

Generic Negative Scenarios for the Specification of Collaborative Cyber-Physical Systems

Cited by 5 publications

References 17 publications

Sound Development of Safety Supervisors

Sound Development of Safety Supervisors

Complete Test of Synthesised Safety Supervisors for Robots and Autonomous Systems

Model inspections in the engineering of collaborative cyber‐physical systems with instance‐level review diagrams

Contact Info

Product

Resources

About