Behavior modeling and verification of movement authority scenario of Chinese Train Control System using AADL

Abstract

Train control systems like most digital controllers are, by definition, hybrid systems as they interact with or try to control some aspects of the physical world. Detailed behavior modeling with constraints specification and formal verification, required for reliability prediction, is a great challenge for hybrid system designers. Train control systems further intensify this challenge with extensive interaction between computing units and their physical environment and their mutual dependence on each other. In this paper, we investigate behavior modeling and formal verification of Chinese Train Control System Level 3 (CTCS-3) using Architectural Analysis & Design Language (AADL) to cope with this challenge. AADL is an architecture description language for embedded systems and is based on model-based engineering paradigm. Along with structural modeling of embedded systems using the core language constructs, AADL also provides support for language extension through annex sublanguages. In system requirements specification document, the behavior of the CTCS-3 is specified as a set of basic operation scenarios that cooperate with each other to achieve safe and secure functionality of trains. Movement Authority (MA) scenario, explored in this paper, is considered as a basic and most crucial scenario to prevent trains from colliding with each other. The detailed discrete behavior of control system is modeled and verified using the Behavior Language for Embedded Systems with Software (BLESS) annex sublanguage of AADL, and the continuous behavior of train with the cyber–physical interaction (communication between train and control system) is modeled using the Hybrid annex sublanguage. The behavior of the MA scenario at system level is verified using the Hybrid Hoare Logic theorem prover. Behavior constraints are specified as assertions using first-order logic formulas augmented with a simple temporal operator.

摘要

创新点

列控系统像大多数数字控制系统一样, 需要和物理部件交互或者控制它们行为, 因而是混成系统。对混成系统行为建模与验证, 从而使得混成系统行为可靠并可以预测, 是混成系统设计的一个挑战。列控系统中, 计算单元和物理环境相互依赖, 交替影响, 是复杂混成系统, 这增加建模与验证的难度。本文考虑如何使用AADL对中国高速铁路3级控制系统( CTCS-3) 建模与验证。AADL是基于模型的嵌入式系统体系结构描述语言, 它提供了结构化建模机制, 同时通过附件子语言支持对语言本身的扩充。在CTCS-3的系统级别规范文档中, CTCS-3包含14个基本场景, 在任意时刻, 列车由CTCS-3中的某些基本场景相互作用, 共同控制列车的功能与安全。本文考虑的移动授权场景是其中最重要的基本场景, 它能够保证列车间不会发生碰撞。我们使用AADL的BLESS附件描述和验证移动授权场景中的离散行为, 使用混成附件描述和验证其中的连续行为, 使用混成Hoare逻辑及其定理证明器验证该场景整体性质。