[Paper Review] Platform-Based Design Methodology and Modeling for Aircraft Electric Power Systems

Pierluigi Nuzzo, John B. Finn+2 more|arXiv (Cornell University)|Nov 24, 2013

Formal Methods in Verification15 references3 citations

TL;DR

This paper proposes a platform-based design (PBD) methodology for aircraft electric power system (EPS) supervisory control protocols, using SysML for high-level specification and Simulink for hybrid modeling to enable virtual prototyping. The approach supports design space exploration, formal verification of safety and real-time constraints, and iterative refinement, demonstrated by successfully detecting and correcting a timing violation in a BPCU controller design through simulation-driven validation.

ABSTRACT

In an aircraft electric power system (EPS), a supervisory control unit must actuate a set of switches to distribute power from generators to loads, while satisfying safety, reliability and real-time performance requirements. To reduce expensive re-design steps in current design methodologies, such a control problem is generally addressed based on minor incremental changes on top of consolidated solutions, since it is difficult to estimate the impact of earlier design decisions on the final implementation. In this paper, we introduce a methodology for the design space exploration and virtual prototyping of EPS supervisory control protocols, following the platform-based design (PBD) paradigm. Moreover, we describe the modeling infrastructure that supports the methodology. In PBD, design space exploration is carried out as a sequence of refinement steps from the initial specification towards a final implementation, by mapping higher-level behavioral models into a set of library components at a lower level of abstraction. In our flow, the system specification is captured using SysML requirement and structure diagrams. State-machine diagrams enable verification of the control protocol at a high level of abstraction, while lowerlevel hybrid models, implemented in Simulink, are used to verify properties related to physical quantities, such as time, voltage and current values. The effectiveness of our approach is illustrated on a prototype EPS control protocol design.

Motivation & Objective

• To address the lack of formal specification and early verification in traditional aircraft EPS design, which leads to costly redesigns and delays.
• To reduce reliance on heuristic, experience-driven design by introducing a rigorous, model-based methodology for supervisory control protocol development.
• To enable systematic design space exploration and virtual prototyping of EPS control protocols through abstraction layers and component reuse.
• To integrate formal verification of safety and real-time constraints across multiple modeling levels, from SysML state machines to Simulink hybrid models.
• To demonstrate the effectiveness of the methodology through a prototype BPCU controller design with automated detection and correction of timing violations.

Proposed method

• Modeling system requirements using SysML requirement and structure diagrams to capture functional and non-functional constraints.
• Representing control logic via state-machine diagrams in SysML for high-level functional verification and simulation.
• Implementing hybrid physical-cyber models in Simulink using the SimPowerSystems library to simulate voltage, current, and timing dynamics.
• Using event-driven simulation and model checking (e.g., NuSMV) to verify safety properties such as switch operation order constraints.
• Integrating hardware timing parameters (e.g., clock frequency) into Simulink models to assess real-time performance.
• Applying iterative refinement by analyzing simulation traces and counterexamples to correct design flaws, such as premature switch closure.

Experimental results

Research questions

• RQ1 How can a platform-based design methodology improve the early verification and validation of aircraft EPS supervisory control protocols?
• RQ2 To what extent can SysML and Simulink be effectively combined to model and verify both functional and physical system behaviors in EPS control?
• RQ3 Can formal verification techniques detect and guide correction of timing-related safety violations in EPS switch control?
• RQ4 How does the integration of multiple abstraction levels (SysML, Simulink) support design space exploration and component reuse?
• RQ5 What is the computational feasibility of verifying complex safety and real-time constraints using this multi-model approach?

Key findings

• The methodology successfully detected a critical timing violation in the initial BPCU design, where switch C3 was closed before the current through C2 decayed to a safe threshold.
• After refining the design to include current monitoring and a deterministic delay, the final Simulink simulation confirmed correct transient behavior with no violation of safety requirement R1.
• Model checking of the SysML state machine verified safety properties in under one second using NuSMV, enabling efficient functional validation.
• Simulation of the full hybrid model with 10 µs step size took approximately 60 seconds for a 2-second transient, demonstrating acceptable computational cost for real-time performance analysis.
• Sequence diagram comparison between specification and simulation in IBM Rational Rhapsody confirmed design correctness and enabled automated trace validation.
• The approach enabled early detection of design flaws, reducing reliance on late-stage prototyping and costly rework.