From Stateflow Simulation to Verified Implementation: A Verification Approach and A Real-Time Train Controller Design

Abstract

Abstract-Simulink is widely used for model driven development (MDD) of industrial software systems. Typically, the Simulink based development is initiated from Stateflow modeling, followed by simulation, validation and code generation mapped to physical execution platforms. However, recent industrial trends have raised the demands of rigorous verification on safety-critical applications, which is unfortunately challenging for Simulink.In this paper, we present an approach to bridge the Stateflow based model driven development and a well-defined rigorous verification. First, we develop a self-contained toolkit to translate Stateflow model into timed automata, where major advanced modeling features in Stateflow are supported. Taking advantage of the strong verification capability of Uppaal, we can not only find bugs in Stateflow models which are missed by Simulink Design Verifier, but also check more important temporal properties. Next, we customize a runtime verifier for the generated nonintrusive VHDL and C code of Stateflow model for monitoring. The major strength of the customization is the flexibility to collect and analyze runtime properties with a pure software monitor, which opens more opportunities for engineers to achieve high reliability of the target system compared with the traditional act that only relies on Simulink Polyspace. We incorporate these two parts into original Stateflow based MDD seamlessly. In this way, safety-critical properties are both verified at the model level, and at the consistent system implementation level with physical execution environment in consideration. We apply our approach on a train controller design, and the verified implementation is tested and deployed on a real hardware platform.

Information Flow Analysis of Combined Simulink/Stateflow Models

“…The timed path conditions for the Simulink part of this example correctly show that information flow is indeed possible from i c to o p , as shown in [18]. However, as the Stateflow controller is responsible for the modification of the system state i s , an analysis of its behavior in conjunction with the timed path conditions is necessary to evaluate whether the combined (2) We adapt the method presented in [11,34] to translate embedded Stateflow components to a system of UPPAAL timed automata (2.a). We are confident that their translation is sound, as it provides a direct mapping of each Stateflow process into a semantically equivalent timed automata representation, and explicitly models the execution semantics of Stateflow, including the event queue.…”

“…The timed path conditions extracted using our approach describe sufficient conditions for the execution of a given path, i. e., they provide a sound over-approximation of the possible information flow. For Stateflow, we utilize an approach that translates Stateflow components to a system of UPPAAL timed automata [11,34]. With that, the semantics of a Stateflow component is precisely defined.…”

A framework for supporting the development of verifiably safe medical best practice guideline systems

“…Based on Lemma 4.4 and Lemma 4.5, every state, transition, and variable in Y have an unique corresponding location, edge, and variable in U . In formula (18), the guard д ′ satisfies ∀(s, д ′ , * , γ ′ , * ) ∈ T : γ > γ ′ . Hence, ¬д ′ satisfies ∀(s, д ′ , * , γ ′ , * ) ∈ T : γ ≤ γ ′ , which can be implied by Φ(s, s ′ , γ , ν (V )) in formula (17).…”

“…To bridge the gap between state-oriented models and formal verification, efforts are also made from research community to transform state-oriented modeling specifications/languages, such as UML (unified modeling language) statecharts [22,33], hierarchical timed automata (HTA) [6], discrete event system specification for realtime (RT-DEVS) [9], parallel object-oriented specification language (POOSL) [32], and Stateflow models [17,18] to UPPAAL timed automata. On the other hand, Pajic et al developed a tool to transform UPPAAL timed automata to Stateflow models for implementation issues [24,25].…”

Model and integrate medical resource availability into verifiably correct executable medical guidelines

“…Over past two decades, significant amount of efforts have also been made in obtaining various computer-interpretable models and developing tools for the management of medical guidelines, such as Asbru [4], GLIF [21], GLARE [23], EON [24], and PROforma [8]. Along with the well development and use of formal techniques on system design [17], [16], [26], our previous work [10] also designed a platform to model medical guidelines with statecharts and automatically transform statecharts [11] to timed automata [1] for formal verification. Furthermore, runtime verification is proposed and well adapted to working directly on the medical guidance systems [15], [14], [9] to improve the system performance.…”