Simulink Design Verifier Research Articles

Validation of decision logic of an autoland system for a UAV using model-based safety-assessment techniques

Software of automatic flight control systems requires thorough verification and validation. Traditionally, this is achieved with elaborate development processes following pertinent industry standards. To reduce the development effort, however, new methods have emerged: a model-based software development process is used at the Institute of Flight System Dynamics of the Technical University of Munich for the design of auto-flight systems with MATLAB/Simulink. Besides, the model-based safety assessment (MBSA) framework ExCuSe has been developed, which implements methods for fault modeling and automatic cut-set extraction using the Simulink Design Verifier. This paper proposes an application of MBSA techniques for the efficient requirements and design validation of decision logic in auto-flight-system software. With ExCuSe, software design models of an investigated decision logic are supplemented by models for off-nominal inputs (e.g., a sensor fault) and for the design requirements. With the analysis, either a formal proof is obtained that the investigated decision logic fulfills the requirements under any circumstances (guaranteed properties), or a counterexample illustrates a requirement violation. The functional principle and applicability of the method are demonstrated by the analysis of decision logic of the autoland system of the SAGITTA Demonstrator UAV. ExCuSe is used to prove that the logic guarantees a timely flare initiation so that a safe touchdown sink rate is achieved despite altitude-measurement inaccuracy and closed-loop flare dynamics uncertainty. As virtually all auto-flight systems feature decision logic, this initial demonstration of the technique opens up many opportunities for further applications in future work.

Dependable Model-driven Development of CPS

Simulink is widely used for model-driven development (MDD) of cyber-physical systems. Typically, the Simulink-based development starts with Stateflow modeling, followed by simulation, validation, and code generation mapped to physical execution platforms. However, recent trends have raised the demands of rigorous verification on safety-critical applications to prevent intrinsic development faults and improve the system dependability, which is unfortunately challenging. Even though the constructed Stateflow model and the generated code pass the validation of Simulink Design Verifier and Simulink Polyspace, respectively, the system may still fail due to some implicit defects contained in the design model (design defect) and the generated code (implementation defects). In this article, we bridge the Stateflow-based MDD and a well-defined rigorous verification to reduce development faults. First, we develop a self-contained toolkit to translate a Stateflow model into timed automata, where major advanced modeling features in Stateflow are supported. Taking advantage of the strong verification capability of Uppaal, we can not only find bugs in Stateflow models that are missed by Simulink Design Verifier but also check more important temporal properties. Next, we customize a runtime verifier for the generated non-intrusive VHDL and C code of a Stateflow model for monitoring. The major strength of the customization is the flexibility to collect and analyze runtime properties with a pure software monitor, which offers more opportunities for engineers to achieve high reliability of the target system compared with the traditional act that only relies on Simulink Polyspace. In this way, safety-critical properties are both verified at the model level and at the consistent system implementation level with physical execution environment in consideration. We apply our approach to the development of a typical cyber-physical system-train communication controller based on the IEC standard 61375. Experiments show that more ambiguousness in the standard are detected and confirmed and more development faults and those corresponding errors that would lead to system failure have been removed. Furthermore, the verified implementation has been deployed on real trains.

Formal verification of a peer-to-peer streaming protocol

Peer (P2P) networks have emerged as an efficient and affordable means of transmitting videos to numerous end-users via the Internet. The dynamic and heterogeneous nature of P2P streaming systems (P2PSS) makes testing, analyzing and verification a cumbersome task. However, formal methods offer efficient approaches to rigorously analyze and verify P2PSS. This paper demonstrates the use of formal verification techniques for analyzing the behavioral properties of P2PSS. We use temporal logics to analyze whether all the possible behaviors within the P2P streaming systems conform to the defined specifications. Specifically, we apply model checking to check the consistency, completeness and certainty of the model if the temporal properties of the proposed system satisfies the required specifications. Furthermore, the P2PSS framework was modeled and verified using Simulink Design Verifier (SDV) in MATLAB simulation tool. The simulations results showed 100% validation for all frames and 50% validation for I-frames prioritisation. Further, the probability of a peer capable of forwarding frames while receiving is at most 0.5.

Formal Verification of Event-driven Health Applications

Software does an important task in almost every part of our everyday life, particularly in systems designed for the healthcare, aircraft navigation and automotive. One of the important objectives of software engineering is to support developers for building systems that function reliably even they are complex. In this paper, we show how Model-Based Design is used to model a safety-related application. By applying formal verification techniques, we also define specific properties to ensure that a software system satisfies its correctness criteria. We use the formal approach to study and verify the properties of a medical device known as Endotracheal intubation. The system is modeled in a concurrent manner and synchronization between components is done through events. We present how the system is modeled in the Simulink and Stateflow and present formalization of some safety and temporal requirements based on the events issued from the controller. In order to formally prove the defined properties, we employ Simulink Design Verifier toolset.

Deployment of Effective Testing Methodology in Automotive Software Development

Software development in automotive industry has bestowed greater comforts and conveniences to mankind. A remarkable progress in this field often faces a setback due to minor defects in the software. So there is recurring need for standardization and implementation of testing strategies. But the process of creation of test scripts to check if the software created complies with its specifications and requirements is both time- and resource-consuming. Generating a short but effective test suite usually requires a lot of manual work and expert knowledge. Patronizing research work in this field is the need of the hour. This paper solves the problem by using Model-Based Testing where test harness and evaluation are performed economically through automation. Simulink Design Verifier and Reactis are the tools used to carry out this purpose in Adaptive Front Light System. The resulting outputs obtained from Simulink Design Verifier and Reactis using Model-Based Testing prove that short test suites can be generated for the model where full model coverage can be achieved easily through automation. The outputs of these test cases when compared with the expected outputs confirm that the model developed is working as per the requirements.

Compositional verification of a medical device system

Complex systems are by necessity hierarchically organized. Decomposition into subsystems allows for intellectual control, as well as enabling different subsystems to be created by distinct teams. This decomposition affects both requirements and architecture. The architecture describes the structure and this affects how requirements ``flow down'' to each subsystem. Moreover, discoveries in the design process may affect the requirements. Demonstrating that a complex system satisfies its requirements when the subsystems are composed is a challenging problem. In this paper, we present a medical device case example where we apply an iterative approach to architecture and verification based on software architectural models. We represent the hierarchical composition of the system in the Architecture Analysis and Design Language (AADL), and use an extension to the AADL language to describe the requirements at different levels of abstraction for compositional verification. The component-level behavior for the model is described in Simulink/Stateflow. We assemble proofs of system level properties by using the Simulink Design Verifier to establish component-level properties and an open-source plug-in for the OSATE AADL environment to perform the compositional verification of the architecture. This combination of verification tools allows us to iteratively explore design and verification of detailed behavioral models, and to scale formal analysis to large software systems.