Progress on Powertrain Verification Challenge with C2E2

Abstract

In this paper, we present the progress we have made in verifying a benchmark powertrain control system. We implemented the on-the-fly algorithm for computing discrepancy of nonlinear dynamical systems in the C2E2 verification tool. We created Stateflow translations of the original models to aid the processing using C2E2 tool and we encoded the different driver behaviors in the form of state machines. With these customizations, we have been successful in verifying one of the benchmarks from the powertrain suite. In this paper, we discuss the engineering challenges and the lessons learned from the process. The powertrain benchmarksThe benchmark suite of powertrain control systems were published in [11,10] as challenge problems for hybrid system verification. The suite has a set of Simulink TM models with increasing levels of sophistication and fidelity. At a high-level, all the models take inputs from a driver (throttle angle) and the environment (sensor failures), and define the dynamics of the engine. The key controlled quantity is the air to fuel ratio which in turn influences the emissions, the fuel efficiency, and torque generated.The first model (model 1) is the most complex. It has look-up tables, delayed differential equations, and switches. Models 2 and 3 are simpler but still complicated enough for most hybrid verifcation tools. Model 3 is a hybrid automaton with polynomial differential equations and continuously computed control inputs, and Model 2 is similar but with nonlinear differential equations and both continuous and discretely sampled variables. The requirements for the system are stated in signal temporal logic (STL). A typical property, for example, 3 t (x ∈ [x eq − , x eq + ]), states that after t units of time, the continuous variable x is within the range x eq ± . * We thank Jim Kapinski, Jyotirmoy Deshmukh, and Xiaoqing Jin of Toyota for several useful discussions on the powertrain models.

Periodically-Scheduled Controller Analysis Using Hybrid Systems Reachability and Continuization

“…A challenge problem was recently proposed to the research community by Toyota on the verification of a powertrain control system [25]. Although initial progress has been made on simplified versions of the system [26], the full benchmark model presents four main challenges for verification tools: (1) controllers that periodically actuate the plant, (2) lookup tables to describe the system dynamics, (3) the presence of time delays in the model, and (4) large system scale.…”

DryVR: Data-Driven Verification and Compositional Reasoning for Automotive Systems

“…For testing purposes, the control system designers work with sets of driver profiles that essentially define families of switching signals across the different modes. Previous verification results on this problem have been reported in [21,27] on a simplified version of the powertrain control model.…”

Cyber-Physical Specification Mismatches

“…In the second case study, we present the potential cyber-physical speci cation mismatches of the abstract fuel control (AFC) system benchmarks provided by Toyota [23,24], and further studied in [19]. The goal of these benchmarks is to determine the fuel rate that should be injected into the manifold to maintain the air-fuel ratio within a desirable range using the feedforward and Proportional-Integral (PI) controllers.…”

“…The goal of these benchmarks is to determine the fuel rate that should be injected into the manifold to maintain the air-fuel ratio within a desirable range using the feedforward and Proportional-Integral (PI) controllers. Particularly, we focus on the third model of the benchmarks including a sequence of Simulink blocks and State ow chart that increase levels of sophistication and delity of the system [19]. The model consists of four operation modes and four continuous variables.…”

“…The values of all constant parameters c j , j ∈ [1, 25], θ and ω are speci ed in [24]. We note that this system can be formally represented as a closed-loop CPIOA, which is the parallel composition of a plant and controller model, and both of them have three exogenous inputs including θ , ω, and sensor failure event fail_event [19].…”