PALS-Based Analysis of an Airplane Multirate Control System in Real-Time Maude

Abstract

Distributed cyber-physical systems (DCPS) are pervasive in areas such as aeronautics and ground transportation systems, including the case of distributed hybrid systems. DCPS design and verification is quite challenging because of asynchronous communication, network delays, and clock skews. Furthermore, their model checking verification typically becomes unfeasible due to the huge state space explosion caused by the system's concurrency. The PALS ("physically asynchronous, logically synchronous") methodology has been proposed to reduce the design and verification of a DCPS to the much simpler task of designing and verifying its underlying synchronous version. The original PALS methodology assumes a single logical period, but Multirate PALS extends it to deal with multirate DCPS in which components may operate with different logical periods. This paper shows how Multirate PALS can be applied to formally verify a nontrivial multirate DCPS. We use Real-Time Maude to formally specify a multirate distributed hybrid system consisting of an airplane maneuvered by a pilot who turns the airplane according to a specified angle through a distributed control system. Our formal analysis revealed that the original design was ineffective in achieving a smooth turning maneuver, and led to a redesign of the system that satisfies the desired correctness properties. This shows that the Multirate PALS methodology is not only effective for formal DCPS verification, but can also be used effectively in the DCPS design process, even before properties are verified

Designing and verifying distributed cyber-physical systems using Multirate PALS: An airplane turning control system case study

“…If the system has "local" physical environments, then they should be integrated with the controller machines as explained in Section 3. Our framework extends the one in [7] by supporting also nondeterministic typed machines. The entire executable Real-Time Maude semantics is available at http :/ /maude .cs .illinois .edu /tools /synchaadl /airplane.…”

“…7 Remember that only the outermost "big-step" transitions contribute to the state space. However, computing each such "big-step" transition of duration 600 ms involves computing many "small-step" transitions that do not contribute to the state space; i.e., 10 transitions of the main controller, 40 transitions of each left/right wing subcontroller (15 ms), and 30 transitions of the rudder controller (20 ms).…”

“…This paper is a substantial extension of our workshop paper [7]. In addition to a discussion of related work, the main new contributions include:…”