In this paper, we present the progress we have made in verifying a benchmark powertrain control system. We implemented the on-the-fly algorithm for computing discrepancy of nonlinear dynamical systems in the C2E2 verification tool. We created Stateflow translations of the original models to aid the processing using C2E2 tool and we encoded the different driver behaviors in the form of state machines. With these customizations, we have been successful in verifying one of the benchmarks from the powertrain suite. In this paper, we discuss the engineering challenges and the lessons learned from the process.
The powertrain benchmarksThe benchmark suite of powertrain control systems were published in [11,10] as challenge problems for hybrid system verification. The suite has a set of Simulink TM models with increasing levels of sophistication and fidelity. At a high-level, all the models take inputs from a driver (throttle angle) and the environment (sensor failures), and define the dynamics of the engine. The key controlled quantity is the air to fuel ratio which in turn influences the emissions, the fuel efficiency, and torque generated.The first model (model 1) is the most complex. It has look-up tables, delayed differential equations, and switches. Models 2 and 3 are simpler but still complicated enough for most hybrid verifcation tools. Model 3 is a hybrid automaton with polynomial differential equations and continuously computed control inputs, and Model 2 is similar but with nonlinear differential equations and both continuous and discretely sampled variables. The requirements for the system are stated in signal temporal logic (STL). A typical property, for example, 3 t (x ∈ [x eq − , x eq + ]), states that after t units of time, the continuous variable x is within the range x eq ± . * We thank Jim Kapinski, Jyotirmoy Deshmukh, and Xiaoqing Jin of Toyota for several useful discussions on the powertrain models.