CN102722593A - Cyber physical system (CPS) attribute verification method based on differential algebra timing sequence dynamic logic (DATL) - Google Patents

Abstract

The invention discloses a cyber physical system (CPS) attribute verification method based on differential algebra timing sequence dynamic logic (DATL), and the method is used for performing system modeling, attribute regulation and attribute verification on a CPS. The key operation of the CPS attribute verification method comprises the following steps of: (1) performing system modeling on the CPS by using a differential algebra program on the basis of detailed analysis on the CPS to acquire an operation model of the system; (2) performing attribute regulation on the CPS to be verified by using DATL to acquire a DATL formula, wherein a time sequence behavior of the CPS is considered in the regulation process; and (3), verifying the acquired DATL formula by using sequent calculus in the DATL, wherein the whole calculus process is reasoned by continuously using the DATL rules, and finally the establishment of the DATL formula is achieved, i.e., the CPS attribute is met.

Description

A kind of CPS attribute verification method based on differential algebra sequential dynamic logic

Technical field

The present invention is a kind of information physics emerging system (CPS) attribute verification method based on differential algebra sequential dynamic logic (DATL), is mainly used in CPS is carried out modeling, the CPS attribute is carried out stipulations and checking.

Background technology

CPS is the system of a kind of integrated calculating and physical process.System utilizes embedded computer and network that physical process is monitored, and has feedback loop, and the physical process influence is calculated, and calculating influences physical process.Domestic and international research personnel have proposed certain methods and have verified the CPS attribute, and these methods mainly are divided into two types: model testing and theorem proving.Because it is abstract that CPS is not suitable for carrying out finite state of equal value, and because the limitation of digital approximation, the model testing method is more suitable for testing puppet rather than tests true for CPS.And, also exist a lot of problems for most of theorem proving methods.Such as mode μ calculation, this calculation to a special system, can only obtain finite information, as in propositional dynamic logic, uses the abstract movable a of unknown effects, and b, c come the behavior of explicitly descriptive system.Yet because the not intellectual of activity effect, this method can't be represented some typical C PS, like the dynamic of train control system or aircraft anti-collision system.

Differential sequential dynamic logic (dTL) is a kind of effective ways that are used for stipulations and checking CPS attribute.It uses combination process that CPS is carried out modeling, with the dTL formula CPS attribute is carried out stipulations, then with dTL calculation checking CPS attribute.DTL has considered the sequential behavior of CPS the CPS attribute being carried out stipulations and when checking, that is to say the mixing mark of its taking into account system and be not only end-state.As the combination process of dTL operation model the discrete transition of system and transition continuously are combined into the structuring control program, these programs are used the operational character of Kleene algebraically regular expression style.The differential equation in the combination process must be that this characteristic that can separate makes that the combination process ability to express is limited in polynomial arithmetic; And the differential equation that is used for CPS is dynamically carried out continuously modeling nearly all is a non-trivial, and this also just causes combination process to be not suitable for CPS is carried out modeling.Thereby the scope of the dTL CPS that can handle only to be confined to the corresponding differential equation be this type CPS system that can separate in polynomial expression,

Summary of the invention

The present invention uses the differential algebra program as operation model, and dTL is extended to DATL.The differential algebra program has made full use of the problem of finding the solution that the differential invariant is avoided the non-trivial differential equation, so DATL can carry out stipulations and checking to complicated more CPS attribute.

Technical matters: the purpose of this invention is to provide a kind of CPS attribute verification method based on DATL, use the method, can verify the CPS attribute of complicacy, whether certain attribute of strict theoretically proof CPS satisfies.Compare with differential sequential dynamic logic (dTL); The present invention can handle complicated more CPS attribute validation problem; Requiring the differential equation in its operation model like dTL must all be can separate in the polynomial expression; And DATL has utilized the differential invariant to avoid finding the solution the problem of the differential equation dexterously, makes DATL can not prove the correctness of attribute formula through finding the solution the differential equation.

Technical scheme: the present invention proposes a kind of CPS attribute verification method, be mainly used in CPS is carried out system modelling, attribute stipulations and attribute checking based on DATL.

The CPS attribute verification method concrete steps based on DATL that the present invention proposes are following:

Step 1). analyze CPS to be verified, to its modeling, obtain the operation model α of system with the differential algebra program,

Step 2). the attribute that analysis will be verified, to its stipulations, stipulations become the form of DATL formula with DATL; Shape such as ψ → [α] φ, wherein ψ representes precondition, [α] is the mode of operation model α; Expression is for the end-state of all execution tracks of α, and is the sequential operation symbol, expression any time or free position; [α] representes any intermediateness for all execution tracks of α, and certain constraint that φ indicates to satisfy.Whole formula ψ → [α] φ representes that if initial time ψ sets up for any intermediateness on all execution tracks of α, constraint φ sets up so,

Step 3). use the calculus of sequent of DATL, combine the rule of the calculation among the DATL, step 2) in DATL formula ψ → [α] φ of obtaining carry out reasoning and verify; Reasoning process is each rule of using; Derive a formula, then, reuse a rule induction and go out another formula; So carry out

Step 4). if the reasoning in the step 3) is derived axiom ax at last or is finished with *, and then reasoning process finishes, and the attribute that verify satisfies, verify,

Step 5). if the last derivation of the reasoning in the step 3) does not go out axiom ax or can not finish with *, and this method can not draw the conclusion whether attribute satisfies so,

Step 6). finish checking.

Beneficial effect: through the security of a concrete CPS instance-aircraft anti-collision system is verified; Show the present invention can verify dTL the CPS attribute that can not verify; And than the additive method except that dTL; DATL has also considered the sequential behavior of CPS, has verified the sequential attribute of CPS.

Description of drawings

Fig. 1 is to use the general flow chart of differential algebra sequential dynamic logic checking CPS.

Fig. 2 is the involved train control system figure of step 1) example in the embodiment.

Fig. 3 is all inference rule synoptic diagram of DATL, and wherein rule [J], < J>◇, [D], < D>◇ are cores of the present invention.

Figure a is an aircraft anti-collision system synoptic diagram.

Figure b is calculus of sequent process 1 synoptic diagram.

Figure c is calculus of sequent process 2 synoptic diagram.

Figure d is calculus of sequent process 3 synoptic diagram.

Embodiment

Below in conjunction with accompanying drawing and embodiment the present invention is further specified as follows:

Step 1). the CPS system that analysis will be verified, use the differential algebra program that system is carried out modeling, obtain the operation model α of system.Wherein, the definition of differential algebra program is as follows:

Differential algebra program (DAP) is the minimal set of following recursive definition:

6) if J is the DJ constraint, J is DAP so;

7) if D is the DA constraint, D is DAP so;

8) if α, β ∈ DAP, (α ∪ β) ∈ DAP so;

9) if α, β ∈ DAP, (α so; β) ∈ DAP;

10) if α ∈ is DAP, (α so ^*) ∈ DAP.

The DJ constraint is the minimal set of following recursive definition:

7) atomic formula of DJ constraint is the DJ constraint;

8) if A is the DJ constraint, then

also is the DJ constraint;

9) if A; B is the DJ constraint; Then (A ∧ B); (A ∨ B), (A → B),

also is the DJ constraint;

10) if A is the DJ constraint, then

also is the DJ constraint;

11) have only limited number of time ground application 1)-4) symbol string that constitutes is only the DJ constraint;

12) the intrafascicular approximately assignment statement x:=θ of regulation DJ can not appear in the scope of

.

The atomic formula of DJ constraint is the set as giving a definition:

3) assignment statement x:=θ is the atomic formula of DJ constraint, wherein x=(x ₁, x ₂..., x _n), x ₁, x ₂..., x _nBe respectively the individual variable symbol, θ=(θ ₁, θ ₂..., θ _n), θ ₁, θ ₂..., θ _nIt is respectively the item of DJ constraint;

4) establish R (x ₁, x ₂..., x _n) be the n unit predicate symbol of DJ constraint, t ₁, t ₂..., t _nBe n item of DJ constraint, then claim R (t ₁, t ₂..., t _n) be the atomic formula of DJ constraint.

The item of DJ constraint is the minimal set of following recursive definition:

4) individual constant symbol, individual variable symbol are the items of DJ constraint;

5) if Be the n-ary function symbol, t ₁, t ₂..., t _nBe the item of n DJ constraint, then

It is the item of DJ constraint;

6) item of all DJ constraints all is that limited number of time uses 1), 2) obtain.

The definition of DA constraint:

DA constraint be defined in ∑ ∪ ∑ ' on the first order logic formula; Wherein ∑ is the set of state variable, function and predicate relation; ∑ ' be the set of the derivative x ' of state variable x in the ∑; And ∑ ' in symbol x ' can not appear in the scope of

the intrafascicular approximately state variable x of DA might change that and if only if the intrafascicular approximately x of appearance ' of DA.

Suppose to have a CPS-train control system; This system is used to realize can not bump between any two trains, and specific strategy is: a lot of distributed RBC of control center are arranged in the system, each RBC be responsible for this zone in train mutual; And distribute in this zone one on each train and move and authorize MA; I.e. one section safety traffic distance, each train must be observed MA constantly, promptly must remain on constantly in the safety traffic distance.When initial; Train is in free travel phase-far stage, and when train driving was put ST to certain, train was to one section new MA of RBC request; If RBC has agreed the MA request of train; Train just gets into the next MA stage so, and if RBC has refused the MA request of train, train is put SB place at the latest forwardly and is begun to brake so.The distance of supposing train driving is z, and the MA distance that train is corresponding is m, and some SB is s to the distance of MA terminal point, and the present invention uses the differential algebra program to its modeling so, can obtain operation model α:

α ≡ (ctrl; Drive) ^*, wherein ctrl ≡ (? M-z≤s; A:=-b) ∪ (? M-z>=s; A:=A), drive ≡ τ :=0; (z '=v, v '=a, τ '=1&v>=0 ∧ τ≤ε).

Above-mentioned model representation: carry out ctrl earlier, carry out drive again, and then carry out ctrl, and then drive, so circulation is carried out.Wherein, ctrl representes if m-z≤s, and then degree of will speed up a is changed to-b, and this moment, train slowed down with acceleration-b, if ε, then degree of will speed up is changed to A, and this moment, train quickened with acceleration A; It is 0 that drive representes to put earlier time τ, and train is followed differential equation z '=v more then, and what v '=a, τ '=1&v>=0 ∧ τ≤ε represented dynamically goes, and ε representes this stage of train ε chronomere of going at most.

Step 2). use DATL that the CPS attribute that will verify is carried out stipulations, obtain the DATL formula.The form shape of DATL formula such as ψ → [α] φ; Wherein ψ representes precondition, and [α] is the mode of operation model α, and expression is for the end-state of all execution tracks of α; is the sequential operation symbol; Expression any time or free position, [α] representes any intermediateness for all execution tracks of α, and certain constraint that φ indicates to satisfy.Whole formula ψ → [α] φ representes that if initial time ψ sets up for any intermediateness on all execution tracks of α, constraint φ sets up so.

In the step 1), example uses DATL to system modelling through train control system is analyzed; Obtained operation model α, on this basis, if the security of checking train control system; Be that any two trains can not bump,, can know through analyzing train control system; If each train is all followed " all right sailing in its mobile mandate MA of any time ", so just can draw any two trains and can not bump.Therefore, the train control system security stipulations that can use DATL to verify are following:

ψ→[α]□z≤m

Be ψ → [(ctrl; Drive) ^*] z≤m

Step 3). use the calculus of sequent of DATL, combine the rule of the calculation among the DATL, step 2) in DATL formula ψ → [α] φ of obtaining carry out reasoning and verify; Reasoning process is each rule of using, and derives a formula, then; Reuse a rule induction and go out another formula; So carry out, to the last derive axiom ax, the inverse process of whole reasoning at this moment is exactly the proof procedure of formula.All inference rules of DATL are in Fig. 3.

On the basis of inference rule, DATL is just like drawing a conclusion:

If 1. regular shape like

below inference rule also set up:

be Γ wherein; Δ is formula arbitrarily, and J is the discrete collection that jumps.

If 2. regular shape like

below inference rule also set up:

be Γ wherein; Δ is formula arbitrarily, and J is the discrete collection that jumps.

Step 2) example in has provided the DATL formulate form of train control system security attribute, verify the train control system security attribute, the DATL formula that only needs the checking stipulations to obtain.Verify as follows:

Verify ψ → [(ctrl; Drive) ^*] z≤m, if the present invention can verify 1. ψ → φ, 2. φ → [(ctrl; Drive) ^*] φ, 3. φ → z≤m, wherein φ is an invariant, is illustrated in the variable of always all setting up in the operational process of system.

Make invariant φ ≡ v ²≤2b (m-z) ∧ b＞0 ∧ A>=0 makes preliminary examination condition ψ ≡ φ ≡ v ²1.≤2b (m-z) ∧ b＞0 ∧ A>=0 then sets up; Because v ²>=0, so v ²≤2b (m-z) ∧ b＞0 ∧ A>=0 → z≤m also sets up, and then 3. sets up; Use the calculus of sequent of DATL to verify 2. below, as follows:

Calculus of sequent process 1

Calculus of sequent process 2

Calculus of sequent process 3

Above-mentioned calculus of sequent 1,2,3rd, checking formula φ [(ctrl; Drive) ^*] detailed process that φ sets up, wherein, process 1 is a main procedure, and process 2 is the continuous of process 1 with process 3, and calculation is from process 1 beginning, and first step service regeulations ind obtains

Wherein α representes operation model (ctrl; Drive),

Expression is for operation model (ctrl; Drive) any variable of lining; The second step service regeulations Obtain φ → [ctrl; Drive] φ; The 3rd step service regeulations → r obtains φ [ctrl; Drive] φ; The 4th step service regeulations [; ], obtain φ [ctrl] [drive] φ; The 5th step service regeulations [D] obtains φ [ctrl] [drive] φ; The 6th step was used two rules [∪], and ∧ r has obtained two φ of branch<a:=-b>[drive] φ and φ [? M-z>=s; A:=A] [drive] φ, the calculation of left branch finishes with * in process 2 at last; The right branch service regeulations [? ], → r obtains φ, m-z>=s<a:=A>[drive] φ, φ, m-z>=s<a:=A>The calculation process of [drive] φ is in process 3, and process 2 is the same with process 1 with process 3, uses a rule to obtain a formula at every turn, and then uses a rule to obtain another formula, knows at last and finishes with *, the meaning that expression is obviously set up; Obtaining at last of process 3 This is the constraint that the calculus of sequent process obtains, and expression needs only Set up the conclusion φ in the process 3 then, m-z>=s<a:=A>[drive] φ sets up, then conclusion φ the [(ctrl in the process 1; Drive) ^*] φ establishment.So far, φ [(ctrl; Drive) ^*] φ obtained proof, and derives φ [(ctrl; Drive) ^*] precondition set up of φ To sum up process 1,2,3 can draw as long as

Set up, so φ [(ctrl; Drive) ^*] just establishment of φ, comprehensively 1. 2. 3. can draw formula ψ → [(ctrl again; Drive) ^*] z≤m establishment, here

So the security of train control system has obtained checking, promptly any two trains can not bump at any time.

Step 4). if the reasoning in the step 3) is derived axiom ax at last or is finished with *, and then reasoning process finishes, and the attribute that verify satisfies, verify,

Step 5). if the last derivation of the reasoning in the step 3) does not go out axiom ax or can not finish with *, and this method can not draw the conclusion whether attribute satisfies so,

Step 6). finish checking.

For the great ability based on the CPS attribute verification method of differential algebra sequential dynamic logic is described; The present invention has chosen the aircraft anti-collision system more complicated more than train control system; Use differential algebra sequential dynamic logic DATL that the security of aircraft anti-collision system is verified that detailed step is following:

Step 1). labor aircraft anti-collision system, as follows:

Some airplane flights are arranged in the air, and their flight dynamically available one group of differential equation is represented.(*) flight of wherein any two airplane x of expression and y is dynamic, wherein (x ₁, x ₂, x ₃), (y ₁, y ₂, y ₃) represent the three-dimensional coordinate of aircraft x and aircraft y respectively; (d ₁, d ₂, d ₃), (e ₁, e ₂, e ₃) represent aircraft x and y respectively at the x axle, y axle, the axial speed of z; ω with

Represent aircraft x and y angular velocity in the horizontal direction respectively; A and b represent aircraft x and the y acceleration in vertical direction respectively.

If the distance between a certain moment aircraft x and the aircraft y is worth p less than certain, so just think that x and y have the danger that collides.At this moment, aircraft x, y should take certain strategy to avoid colliding.As scheme shown in a, the coordinate of known aircraft x is (x ₁, x ₂, x ₃), exist a unique plane α parallel through this point with ground level, in like manner, through point (y ₁, y ₂, y ₃) exist a unique plane β parallel with ground level.Aircraft y is projected to plane α go up (ignoring aircraft size itself), obtain a y ', this moment is round circle1 of certain existence on the α of plane, and the center of circle is made as c, and the three-dimensional coordinate of c is (c ₁, c ₂, x ₃), and put x and put y ' on circle, as shown in Figure 1.In like manner on the β of plane, have a round circle2, the center of circle is c ', and the three-dimensional coordinate of c ' is (c ₁, c ₂, y ₃), and some y is on circle.At this moment, the aircraft anti-collision system can be described as, and when the distance of aircraft x and y was worth p less than certain, the heading that aircraft x and y incite somebody to action in plane α and plane β was respectively separately changed into round circle1 and the tangential direction of justifying circle2.Dynamic flight a period of time according to the differential equation shown in (#) (annotates: because aircraft x and aircraft y are in whole collision avoidance process in plane α and plane β then; Highly be constant; So (#) omitted the differential equation of describing height), so far, the collision avoidance process finishes.Aircraft has got into the free flight state again.If after a period of time, run into the danger that collides once more, take same collision avoidance strategy to get final product.

With the differential algebra program the whole process of aircraft flight is carried out modeling here, institute's established model is trm ^*, wherein * representes to repeat trm, trm concrete as (～), and trm comprises 3 stages: the free flight stage (representing with free); The course change stage (suppose this moment in stage completion, do not consider time delay, represent) with tang; The limited flight stage, (with respect to free flight, promptly aircraft flight must satisfy dynamic F (ω, 0; 0) ∧ G (ω, 0,0)).Wherein, φ representes the distance of aircraft x and aircraft y more than or equal to p, d:=ω (x-c) ^⊥Be d ₁ω (the x of :=- ₂-c ₂), d ₂:=ω (x ₁-c ₁) write a Chinese character in simplified form e:=ω (y-c) ^⊥Be e ₁ω (the y of :=- ₂-c ₂), e ₂:=ω (y ₁-c ₁) write a Chinese character in simplified form.

Step 2). the operation model that has drawn the aircraft anti-collision system in the step 1) is trm ^*, use DATL to the aircraft anti-collision system security carry out stipulations, obtain DATL formula ψ ≡ φ → [trm ^*] φ.

Step 3). the security of aircraft anti-collision system is the validity of aircraft collision avoidance strategy, verify the security of anti-collision system, just verifies the validity of collision avoidance strategy.Step 2) be DATL formula ψ ≡ φ → [trm in the security attribute stipulations ^*] φ, this formula is represented that φ sets up and is contained [trm ^*] φ also sets up.[trm ^*] φ sets up and to be illustrated in differential algebra program trm ^*Any execution route on all states under φ all set up.Just, formula ψ represent if the distance of two airplanes more than or equal to p, then at trm ^*Any time of carrying out, the distance of this two airplane is still more than or equal to p.Just, if under the original state, the distance of two airplanes is more than or equal to p; After free flight after a while,, then carry out the collision avoidance strategy if distance equals p; And then free flight, in whole process, the distance that always all satisfies two airplanes is more than or equal to this constraint of p.

Calculus of sequent with DATL proves formula ψ below:

At first, the present invention lists the rule that the calculation process will be used, and is as follows,

As scheme shown in the b, the present invention is write as formula ψ the form φ → [trm that is suitable for calculus of sequent ^*] φ, service regeulations → r obtains φ [trm then ^*] φ, in like manner re-use rule [*] with [; ] obtain φ [trm ^*] [free] [tang] [F (ω, 0,0) ∧ G (ω, 0,0)] φ.Because F (ω, 0,0) ∧ G (ω, 0,0) is the DA constraint, so service regeulations [D] obtains φ [trm ^*] [free] [tang] [F (ω, 0,0) ∧ G (ω, 0,0)] φ.Similar, successively service regeulations [; ], [] gen, [DR '],

Obtain φ [trm ^*] (true), this formula is obviously set up, so the left branch calculation of figure b finishes, represent with *.And the right branch φ [tang of figure b calculation process; F (ω, 0,0) ∧ G (ω, 0,0)] φ service regeulations [] gen obtains two branches: φ [tang] (φ ∧ T) and φ ∧ T [F (ω, 0,0) ∧ G (ω, 0,0)] φ, wherein T is the differential invariant, can obtain through the Fixed-Point Algorithm among the DATL, tries to achieve

Figure c and figure d are the continuous of figure a calculation process 1, just scheme the right branch of a.Figure c the calculation process be similar to figure b, successively service regeulations [; ];

[:=]; ∧ r, ax finishes with * at last.

Figure d left branch has used regular DI to obtain

Wherein, α ≡ F (ω, 0,0) ∧ G (ω, 0,0),

Expression

TF ' _{(ω, 0,0) ∧ G (ω, 0,0)}Be

Write a Chinese character in simplified form, the expression with the x among the T ' ₁', x ₂', d ₁', d ₂', y ₁', y ₂', e ₁', e ₂' replace to d respectively ₁, d ₂,-ω d ₂, ω d ₁, e ₁, e ₂,-ω e ₂, ω e ₁

T′≡(d ₁-e ₁)′＝-ω(x ₂-y ₂)′∧(d ₂-e ₂)′＝ω(x ₁-y ₁)′

≡d′ ₁-e′ ₁＝-ω(x′ ₂-y′ ₂)∧d′ ₂-e′ ₂＝ω(x′ ₁-y′ ₁)，

T′ _{F(ω，0，0)∧G(ω，0，0)}≡-ωd ₂+ωe ₂＝-ω(d ₂-e ₂)∧ωd ₁-ωe ₁＝ω(d ₁-e ₁)≡true。

In like manner,

φ′ _{F(ω，0，0)∧G(ω，0，0)}≡(2(x ₁-y ₁)(x ₁-y ₁)′+2(x ₂-y ₂)(x ₂-y ₂)′+2(x ₃-y ₃)(x ₃-y ₃)′≥0) _{F(ω，0，0)∧G(ω，0，0)}

≡(2(x ₁-y ₁)(x′ ₁-y′ ₁)+2(x ₂-y ₂)(x′ ₂-y′ ₂)+2(x ₃-y ₃)(x′ ₃-y′ ₃)≥0) _{F(ω，0，0)∧G(ω，0，0)}

≡2(x ₁-y ₁)(d ₁-e ₁)+2(x ₂-y ₂)(d ₂-e ₂)+2(x ₃-y ₃)(0-0)≥0

≡2(x ₁-y ₁)(d ₁-e ₁)+2(x ₂-y ₁)(d ₂-e ₂)≥0

Because T ≡ d-e=ω (x-y) ^⊥≡ d ₁-e ₁=-ω (x ₂-y ₂) ∧ d ₂-e ₂=ω (x ₁-y ₁),

So,

φ′ _{F(ω，0，0)∧G(ω，0，0)}≡2(x ₁-y ₁)(-ω(x ₂-y ₂))+2(x ₂-y ₂)ω(x ₁-y ₁)＝0≥0

≡true

So two branches of the calculation process of figure d all finish with *.

To sum up, above-mentioned calculation process verification formula ψ ≡ φ → [trm ^*] correctness of φ, just verified the security of aircraft anti-collision system.

Step 4). because the calculus of sequent in the step 3) finishes with axiom ax or with * at last, so aircraft anti-collision system security attribute has obtained checking, whole verification process finishes.

Rule [J], < J>◇, [D], the proof of < D>◇ is following:

Proof: according to the different structure of J, we are proof rule [J] inductively.

1) as J-shaped such as x:=θ, we need proof

dTL to provide proof.

2) as J-shaped such as θ ₁>=θ ₂, we need proof

Be known v ' φ and

V ' [θ ₁>=θ ₂] the φ establishment, demonstrate,prove v ' [θ ₁>=θ ₂] φ establishment,

The conclusion that makes then will prove becomes σ ' φ

And $\mathrm{\&sigma;}=\{\left(\hat{v}\right):\mathrm{Val}(v,{\mathrm{\&theta;}}_1)\&GreaterEqual;\mathrm{Val}(v,{\mathrm{\&theta;}}_2)\}\&cup;\{(\hat{v},\widehat{\mathrm{\&Lambda;}}):\mathrm{Val}(v,{\mathrm{\&theta;}}_1)＜\mathrm{Val}(v,{\mathrm{\&theta;}}_2)\},$

If val (v, θ ₁)>=val (v, θ ₂), then The conclusion that proves becomes

Promptly

V ' φ, and known v ' φ sets up, and must demonstrate,prove,

If val (v, θ ₁)＜val (v, θ ₂), then The conclusion that proves is obviously set up.

To θ ₁=θ ₂, θ ₁≤θ ₂, θ ₁＜θ ₂, θ ₁＞θ ₂Situation in like manner can demonstrate,prove.

3) When the J-shaped like?

We need to prove?

Mark semanteme by the DJ constraint thirdly can be known:

iff? and?

That?

iff?

and?

Promptly

iff

must demonstrate,prove.

4) When the J-like?

we need to prove?

Similarly 3) permit.

5) When the J-shaped like?

We need to prove?

Semantic the 5th of mark by the DJ constraint can be known:

iff?

I.e.

iff

Promptly

must demonstrate,prove.

6) When the J-shaped like?

We need to prove?

Semantic the 6th of mark by the DJ constraint can be known:

iff?

I.e.

iff

iff?

Promptly iff

must demonstrate,prove.

7) we need proof

wherein like

when J-shaped; Middle x replaces with arbitrary value θ with

in

expression

Semantic the 7th of mark by the DJ constraint can be known:

iff is for all possible vx;

arranged set up

I.e.

iff

I.e.

iff

Promptly

iff must demonstrate,prove.

8) we need proof

wherein like

when J-shaped;

expression with in x replace in like manner 7 with certain value θ) can demonstrate,prove.

To sum up 1) to 8) can know that

sets up.

Proof: according to the different structure of J, we are proof rule < J>◇ inductively.

1) as J-shaped such as x:=θ, we need proof

DTL has provided proof ^[1].

2) as J-shaped such as θ ₁>=θ ₂, we need proof Be known v ' φ perhaps

V '<θ ₁>=θ ₂>φ sets up, and demonstrate,prove v '<θ ₁>=θ ₁>◇ φ sets up,

The conclusion that makes then will prove becomes σ ' ◇ φ

And $\mathrm{\&sigma;}=\{\left(\hat{v}\right):\mathrm{Val}(v,{\mathrm{\&theta;}}_1)\&GreaterEqual;\mathrm{Val}(v,{\mathrm{\&theta;}}_2)\}\&cup;\{(\hat{v},\widehat{\mathrm{\&Lambda;}}):\mathrm{Val}(v,{\mathrm{\&theta;}}_1)＜\mathrm{Val}(v,{\mathrm{\&theta;}}_2)\},$

If val (v, θ<sub >1</sub>)>=val (v, θ<sub >2</sub>), then<img file="BSA00000600517300144.GIF" he="55" img-content="drawing" img-format="GIF" inline="no" orientation="portrait" wi="215" />V ' in the precondition<θ<sub >1</sub>>=θ<sub >2</sub>>φ becomes v ' φ, so precondition v ' φ or v '<θ<sub >1</sub>>=θ<sub >2</sub>>φ sets up and is equivalent to v ' φ establishment, and the conclusion that will prove becomes<img file="BSA00000600517300145.GIF" he="56" img-content="drawing" img-format="GIF" inline="no" orientation="portrait" wi="241" />Be v ' φ, and known v ' φ set up, and must demonstrate,prove;

If val (v, θ ₁)＜val (v, θ ₂), then

The conclusion that proves is obviously set up.

To θ ₁=θ ₂, θ ₁≤θ ₂, θ ₁＜θ ₂, θ ₁＞θ ₂Situation in like manner can demonstrate,prove.

3) When the J-shaped like?

We need to prove?

Mark semanteme by the DJ constraint thirdly can be known:

iff?

and?

That?

iff?

and?

Promptly

iff

must demonstrate,prove.

4) When the J-like?

we need to prove?

Similarly 3) permit.

5) When the J-shaped like? We need to prove?

Semantic the 5th of mark by the DJ constraint can be known:

iff?

I.e. iff

Promptly iff

must demonstrate,prove.

6) When the J-shaped like?

we need to prove?

Semantic the 6th of mark by the DJ constraint can be known:

iff?

I.e.

iff

iff?

Promptly

iff

must demonstrate,prove.

7) we need proof

wherein like

when J-shaped; Middle x replaces with arbitrary value θ with in

expression

Semantic the 7th of mark by the DJ constraint can be known:

iff is for all possible vx;

arranged set up

I.e.

iff

I.e.

iff

Promptly

iff

must demonstrate,prove.

8) we need proof

wherein like

when J-shaped; expression with

in x replace in like manner 7 with certain value θ) can demonstrate,prove.

To sum up 1) to 8) can know that sets up.

Proof: suppose

and then have a mark

first σ=v, and

had

Can know for position (0 of σ existence by ; η); η ∈ [0; R],

arranged

D to being defined on [0, η] sets up.

∵

again

∴?

∴?

∴?

must demonstrate,prove.

Proof: suppose

Known?

is equivalent to?

is equivalent to

∵?

∴?

∴?

∴?

∴?

∴

< D>◇ φ must demonstrate,prove.

Claims (4)

1. the CPS attribute verification method based on differential algebra sequential dynamic logic is characterized in that, with differential algebra sequential dynamic logic DATL information physics emerging system CPS is carried out system modelling, attribute stipulations and attribute checking, comprises the steps:

Step 1) is analyzed CPS to be verified, to its modeling, obtains the operation model α of system with the differential algebra program;

Step 2) analyze the CPS attribute that will verify, to its stipulations, stipulations become the form of DATL formula with DATL; This form is shape such as ψ → [α] φ, wherein:

ψ representes precondition; [α] is the mode of operation model α, and expression is for the end-state of all execution tracks of α; is the sequential operation symbol, expression any time or free position; [α] representes any intermediateness for all execution tracks of α; Certain constraint that φ indicates to satisfy; Whole formula ψ → [α] φ representes that if initial time ψ sets up for any intermediateness on all execution tracks of α, constraint φ sets up so;

Step 3) is used the calculus of sequent of DATL; In conjunction with the calculation among DATL rule, to step 2) in DATL formula ψ → [α] φ of obtaining carry out the reasoning checking, reasoning process is: use a calculation rule at every turn; Derive a formula; Then, reuse a calculation rule induction and go out another formula, so carry out;

If axiom ax is derived in the reasoning in the step 4) step 3) at last, then reasoning process finishes, and the attribute that verify satisfies, and verifies;

If the last derivation of the reasoning in the step 5) step 3) does not go out axiom ax, this CPS attribute verification method based on differential algebra sequential dynamic logic can not draw the conclusion whether attribute satisfies so,

Step 6) finishes checking.

2. according to the said method of claim 1; It is characterized in that for DATL; Said step 2) in to the stipulations of CPS attribute; When stipulations, consider the sequential behavior of CPS; The sequential behavior is represented with

or ◇ in the DATL formula; Wherein ◇ is corresponding with

, representes a certain moment or a certain state.

3. according to the said method of claim 1, it is characterized in that the calculus of sequent in the said step 3) for DATL; The characteristics of this calculation are the formula from proving; Use the progressively reasoning of calculation rule, up to deriving axiom ax, and the inverse process of whole reasoning is exactly the proof procedure of this formula.

4. according to the said method of claim 1, it is characterized in that in the said step 1) that the differential algebra program defines as follows:

A, differential algebra program DAP are the minimal set of following recursive definition:

1) if J is the DJ constraint, J is DAP so;

2) if D is the DA constraint, D is DAP so;

3) if α, β ∈ DAP, (α ∪ β) ∈ DAP so;

4) if α, β ∈ DAP, (α so; β) ∈ DAP;

5) if α ∈ is DAP, (α so ^*) ∈ DAP;

B, DJ constraint are the minimal set of following recursive definition:

1) atomic formula of DJ constraint is the DJ constraint;

2) if A is the DJ constraint, then also is the DJ constraint;

3) if A; B is the DJ constraint; Then (A ∧ B); (A ∨ B), (A → B),

also is the DJ constraint;

4) if A is the DJ constraint, then

also is the DJ constraint;

5) have only limited number of time ground application 1)-4) symbol string that constitutes is only the DJ constraint;

6) the intrafascicular approximately assignment statement x:=θ of regulation DJ can not appear in the scope of ;

The atomic formula of c, DJ constraint is the set as giving a definition:

1) assignment statement x:=θ is the atomic formula of DJ constraint, wherein x=(x ₁, x ₂..., x _n), x ₁, x ₂..., x _nBe respectively the individual variable symbol, θ=(θ ₁, θ ₂..., θ _n), θ ₁, θ ₂..., θ _nIt is respectively the item of DJ constraint;

2) establish R (x ₁, x ₂..., x _n) be the n unit predicate symbol of DJ constraint, t ₁, t ₂..., t _nBe n item of DJ constraint, then claim R (t ₁, t ₂..., t _n) be the atomic formula of DJ constraint;

The item of d, DJ constraint is the minimal set of following recursive definition:

1) individual constant symbol, individual variable symbol are the items of DJ constraint;

2) if

Be the n-ary function symbol, t ₁, t ₂..., t _nBe the item of n DJ constraint, then

is the item of DJ constraint;

3) item of all DJ constraints all is that limited number of time uses 1), 2) obtain.

The definition of e, DA constraint:

DA constraint be defined in ∑ ∪ ∑ ' on the first order logic formula; Wherein ∑ is the set of state variable, function and predicate relation; ∑ ' be the set of the derivative x ' of state variable x in the ∑; And ∑ ' in symbol x ' can not appear in the scope of

the intrafascicular approximately state variable x of DA might change that and if only if the intrafascicular approximately x of appearance ' of DA.

The semantic τ of mark (α) of definition 8 (mark of DAP is semantic) .DAP α is the set of all possible mark of α, and recursively definition is as follows:

iff

wherein J represent DJ constraint; According to the different structure of J, can be divided into following several kinds of situation again:

1)

iff?val(ω，x)＝val(v，θ).

2)

iff?val(v，θ ₁)≥val(v，θ ₂).

3)

iff

and

are true.

4)

iff established or

established.

5) iff is not established.

6)

iff

is not established or

established.

7)

Iff has for all possible vx

Set up, wherein v _xExpression is except the value of x, and the value of the state variable among the value of all the other state variables and the v is identical.

8)

Iff is for certain v _x, have

Set up.

2.

is a differential enhanced situation stream; For ζ ∈ [0 arbitrarily; R] (duration r>=0);

arranged and for all variable z that can not changed by D,

arranged here D represent the DA constraint.

3.τ(α∪β)＝τ(α)∪τ(β).

4. τ (α; β)={ σ ο ζ: σ ∈ τ (α), ζ ∈ τ (β) is when σ ο ζ has been defined }, wherein, σ=(σ ₀, σ ₁, σ ₂...) and ζ=(ζ ₀, ζ ₁, ζ ₂...) and combination be defined as

5. τ (α ^*)=∪ _{N ∈ N}τ (α ⁿ), n>=1 o'clock wherein, α ^N+1:=(α ⁿα), and α ¹:=α, α ⁰:=(? True).

Images