[Paper Review] Mars 2.0: A Toolchain for Modeling, Analysis, Verification and Code Generation of Cyber-Physical Systems

Bohua Zhan, Xiong Xu+5 more|arXiv (Cornell University)|Mar 5, 2024

Simulation Techniques and ApplicationsDecision Sciences3 citations

TL;DR

Mars 2.0 is a formally verified toolchain for cyber-physical systems that integrates AADL and Simulink/Stateflow into a unified graphical modeling framework, translates models to Hybrid CSP (HCSP) for formal simulation and verification using Isabelle/HOL and HHLPy, and generates correct-by-construction C and SystemC code, ensuring end-to-end correctness through formally proven transformations.

ABSTRACT

We introduce Mars 2.0 for modeling, analysis, verification and code generation of Cyber-Physical Systems. Mars 2.0 integrates Mars 1.0 with several important extensions and improvements, allowing the design of cyber-physical systems using the combination of AADL and Simulink/Stateflow, which provide a unified graphical framework for modeling the functionality, physicality and architecture of the system to be developed. For a safety-critical system, formal analysis and verification of its combined AADL and Simulink/Stateflow model can be conducted via the following steps. First, the toolchain automatically translates AADL and Simulink/Stateflow models into Hybrid CSP (HCSP), an extension of CSP for formally modeling hybrid systems. Second, the HCSP processes can be simulated using the HCSP simulator, and to complement incomplete simulation, they can be verified using the Hybrid Hoare Logic prover in Isabelle/HOL, as well as the more automated HHLPy prover. Finally, implementations in SystemC or C can be automatically generated from the verified HCSP processes. The transformation from AADL and Simulink/Stateflow to HCSP, and the one from HCSP to SystemC or C, are both guaranteed to be correct with formal proofs. This approach allows model-driven design of safety-critical cyber-physical systems based on graphical and formal models and proven-correct translation procedures. We demonstrate the use of the toolchain on several benchmarks of varying complexity, including several industrial-sized examples.

Motivation & Objective

• Address the challenge of integrating heterogeneous modeling of physical systems, software, and system architecture in safety-critical cyber-physical systems (CPS).
• Overcome limitations of standalone AADL (lacks continuous dynamics) and Simulink/Stateflow (lacks architectural modeling) by unifying them into a single graphical modeling framework.
• Enable formal verification and correct-by-construction code generation for CPS designs to ensure reliability and safety.
• Provide formal correctness guarantees for model transformations from AADL⊕S/S to HCSP and from HCSP to C/SystemC via semantic consistency proofs.
• Support industrial-scale CPS development with end-to-end tooling from high-level design to verified low-level implementation.

Proposed method

• Integrate AADL and Simulink/Stateflow into a unified graphical modeling language, AADL⊕S/S, for modeling functionality, physical dynamics, and system architecture.
• Automatically translate AADL⊕S/S models into Hybrid CSP (HCSP), a formal language extended with ordinary differential equations for hybrid systems.
• Simulate HCSP processes using a dedicated HCSP simulator to validate dynamic behavior.
• Verify HCSP models using the Hybrid Hoare Logic prover in Isabelle/HOL and the automated HHLPy prover for enhanced verification coverage.
• Generate C and SystemC code from verified HCSP models using a formally proven translation process based on approximate bisimulation.
• Ensure correctness of transformations via formal proofs: semantic consistency between AADL⊕S/S and HCSP, and between HCSP and generated C/SystemC code.

Experimental results

Research questions

• RQ1 How can AADL and Simulink/Stateflow be effectively combined into a single, unified modeling framework for cyber-physical systems?
• RQ2 Can the translation from AADL⊕S/S to HCSP be formally proven correct to ensure semantic fidelity?
• RQ3 Can formal verification of hybrid system behavior be effectively supported using HCSP and automated/interactive theorem proving?
• RQ4 Can C and SystemC code be automatically generated from verified HCSP models with formal guarantees of correctness?
• RQ5 How does the Mars 2.0 pipeline compare in behavior and correctness to prior approaches in real-world CPS benchmarks?

Key findings

• The Mars 2.0 toolchain successfully supports end-to-end development of safety-critical CPS, from AADL⊕S/S modeling to verified C/SystemC code generation.
• The transformation from AADL⊕S/S to HCSP is formally proven correct, preserving the semantics of the original model.
• The transformation from HCSP to C code is proven correct via approximate bisimulation, ensuring behavioral fidelity between the formal model and generated implementation.
• The generated C code (3500–4000 lines) reflects detailed behaviors of the original ACCS model, unlike prior work (Zhan et al., 2019) which lacked such bisimulation guarantees.
• Simulation results of the generated C code closely match the HCSP model simulation (blue line) and the prior work (Zhan et al., 2019), confirming behavioral consistency and correctness.
• The toolchain was validated on industrial-sized benchmarks, including an adaptive cruise control system (ACCS), demonstrating its scalability and practicality.