andpossiblytakinginfrequentbutdecisiveaction.inthiswork,wepresent

Transcription

1 AutomatedVehicleProtectionSystems Vericationof onthetimedi/oautomatonmodeloflynchandvaandragertoacase studyintheareaofautomatedtransit.thecasestudymodelsandveries H.B.WeinbergNancyLynchyNormanDelislez Abstract.Weapplyspecicationandvericationtechniquesbased (extendedabstract) ationandprotectionsubsystems.theoperationsystemhandlesthenormal otherautomatedtransitsystemsdividethecontrolarchitectureintooper- systemssuchasprt2000tm,asystemcurrentlybeingdevelopedat Raytheon.Duetotheirsafetycriticalnature,PRT2000TMandmany controlofvehicles.theprotectionsystemmaintainssafetybymonitoring selectedsafetypropertiesforautomatedpersonalrapidtransit(prt) 1Introduction Thispaperpresentsacasestudyintheapplicationofformalmethodsfrom computersciencetothemodelingandvericationofhybridsystems.ourgroup's vehicleseparation. bothahigh-leveltreatmentofagenericprotectionsystemandmoredetailedexaminationsofprotectionsystemsthatenforcespeedlimitsand andpossiblytakinginfrequentbutdecisiveaction.inthiswork,wepresent workisbasedonthelynch-vaandragertimedi/oautomatonmodel[1]and modeltoallowtheprecisedescriptionofcontinuousbehavior.wecallthese processofconductingthesecasestudies,weextendedthetimedi/oautomaton usesacombinationofseveralrepresentationandvericationmethods.this studies,andourgroup'slongtermgoalsappearsinthisvolume[2].inthe isthesecondinaseriesofcasestudiesundertakenbyourgroupthatfocus extensionsthehybridi/oautomatonmodel;acompleteformaldenitionofthis modelappearsinthisvolume[3]. onautomatedtransitsystems.anoverviewofourmethods,theseriesofcase ResearchsupportedanNSFGraduateFellowshipandthegrantsandcontractsbelow. Marlborough,MA partmentoftransportationcontractdtrs95g-0001-yr.8,afosr-onrcontractf ,andarpacontractsn j-4033andf c newprtsystemcalledprt2000tm.thissystemuses4-passengervehiclesthat Raytheonengineersarecurrentlyworkingonthedesignanddevelopmentofa

2 areachievedbecausethevehiclesareseparatedontheguidewaybyonlyafew fromsensorsonthevehiclesandinthetracks.animportantfeatureofthedesignisitsabsolutesafetyrequirements:forexample,vehiclesmustnevercollide aprtsystemcanprovideshorteraveragetriptimesandshorteraveragewaiting stationswithoutintermediatestops.comparedtoconventionaltransitsystems, seconds,insteadoftheminutestypicalofaconventionaltransitsystem.the vehiclesarecontrolledbyadistributednetworkofcomputers,whichreceivedata onthissystemboardatstationsandtraveldirectlytotheirdesireddestination timeswithequivalentpassengerthroughput.theseperformanceimprovements travelonanelevatedguidewaywithy-shapeddivergesandmerges.passengers andtheymustneverexceeddesignatedmaximumspeedlimits,regardlessofthe operation,avpisnotsupposedtotakeanyaction{itmerelymonitorsthebehaviorofthevehicles,awaitingsomepotentiallydangeroussituation.however, includesthepossibilitythatavocontainserrors. thebehaviorofavo,basicsafetyismaintained.notethatthisrequirement AVPmustmonitorandreactstronglyenoughtoguaranteethat,regardlessof behaviorofthecontrolsoftwareandhardware.thesestringentdesigncriteriahaveledtothecompleteseparationofsystemfunctionalityintotwoparallel becomposedofcomplexsoftwareandhardware.avpisresponsibleforemergencycontrolofvehiclesandisdesignedtobesimpleandreliable.inordinartection(avp).avoisresponsibleforthenormalcontrolofthevehiclesandcan components:automatedvehicleoperation(avo)andautomatedvehiclepro- automatedtrainsystems,includingthewashingtonmetro,themiamipeople roadandmasstransitsystemshaveevolvedtobecomemoreautomated,this divisionoflaborhasbeenretained,intheformofautomatictrainoperation andautomatictrainprotectionsystems.thisparadigmoccursinmostexisting nizedengineeringparadigmforthedesignofsafetycriticalsystems.inthe systemstoprotectagainsthumanerrorandmechanicalmalfunctions.asrail- systems.automaticsafetysystemswereaddedtohuman-controlledrailroad transportationarea,thisstructurewasinitiallyusedinthedesignofrailroad Theseparationofoperationandprotectionfunctionsisagenerallyrecog- sixties;thissystemhasbeenincontinuousactiveuseforover20yearswithno Mover,theO'HarePeopleMover,theDetroitPeopleMover,andsystemsin Toronto,Vancouver,andJacksonville.TheuseofthissplitmigratedtoautomatedvehiclesystemswiththepioneeringMorgantownPRTsysteminthelate seriousaccidents. itwillactually(eventually)reachabadvalueifnoactionistakenatthepresent receivesfrequentsensordataandtakessomeactionswhenparametersaregetting duringmerges.thesearebynomeanstheonlysafetyrulesthattheraytheon time.weviewtherelationshipbetweenavpandtherestofthesystemas toocloseto\badvalues".tooclose,ineachcase,meansthatitispossiblethat examinedoverspeedprotectionandcollisionprotectiononstraighttracksand AVPsystemenforces,buttheyareamongthemostcomplex.Ineachcase,AVP AVPsystemsuchastheonebeingdevelopedbyRaytheon.Specically,wehave Ourgoalinthispaperistoformalizethedesiredsafetypropertiesofan 2

3 usinghybridi/oautomata.first,insection2,wegiveaninformalproblem adversarial theavpsystemmustmaintainsafetydespitebyzantinefaults intherestofthesystem.interestingmodelingquestionsariseindecidingwhat theoremaboutthecorrectnessofaclassofavpsystems.intheremaining powerstheadversaryhas(itiscertainlylimitedbythebasicphysicsofmotion, nessofeachofthespecializationsisacorollaryofthegeneralcorrectnesstheorem butwhatotherlimitsarethere?)andwhatcontrolavpcanexert. ofsection3.theproofmethodsweemployarepredominantlyassertional,with functions:overspeedprotectionandsafeseparationenforcement.thecorrect- statement.next,insection3,wepresentahigh-levelmodeloftheadversarial relationshipbetweenphysicalsystemandavp.insection4,wederiveageneric sections,wespecializethisgeneralmodeltotwoexamplesofparticularavp Inthispaper,wepresentapreliminarytreatmentoftheseAVPfunctions tendedabstractwestateonlythenalresultsandomittheintermediatelemmas typesofreasoningaboutcontinuousfunctionswhereitisconvenient.inthisex- andproofs. 2InformalProblemStatement videsaconvenientframeworkfortheproofs,whileallowingtheuseofstandard operationalreasoningusedincertainindividualcaseswithininductiveproofs, usuallyfordescribingthephysicsofthesystem.theinductivestructurepro- Aprotectionsystemisasubsystemthatmonitorsthephysicalstateforhazards system.forthisreason,avowillnotevengureinourmodels;rather,we bemademorecomplexbyintroducingdelaysanduncertaintyintotheturn sequence;however,inthispaperwewillconsideronlythesimpleturnsequence theadversarychoosessomeevolutionforthephysicalsystem.thegamecan relyonthecorrectfunctioningofothercomputersystems,suchastheavo andanadversarythatcontrolsthephysicalsystem.thegameproceedsby turns oneachturnavpreceivessensorinformation,takessomeaction,and thatresultsfromreliable,periodic,andtimelycommunication.avpcannot andavertsmishaps.theproblemcanbeviewedasa\game"betweenavp willassumethatavpcanbesureonlythatthesystemwillnotexceedits inherentphysicallimitationsandthosespecicallyimposedbyavpitself.in theinterestofmakingprotectionsystemsrobust,designerskeepthemsimple; insteadofhavingcomplexcontrolabilities,protectionsystemsdependonlyon thecorrectfunctioningofafewdecisiveemergencycommands.weformalize typicallythisrequiresmanualinterventionandwedonotmodelitinthispaper. thisnotionoflimited,simpleemergencycontrolsbydeningthepowersofavp tobemonotonicallyconstraining. course,inarealsystemsomemethodtoreversetheactionisnecessary,but assumptionmeansthat,onceengaged,thebrakecannotbedisengaged.of actionavailabletoavpistoactivateanemergencybrake;ourmonotonicity By\constraining",wemeanthatAVPcommandsdonotenablesomebe- By\monotonic",wemeanthattheactionAVPtakesisirreversible.Atypical 3

4 haviorthatwaspreviouslyunavailable,butrathersimplylimitthepossiblebehaviorsofthesystem.forexample,ifavehiclecanexertacertainbrakingforce Inthissection,wepresentanabstractmodelofagenericphysicalsystem.The achievethatforcewithoutthecommand.intermsofthegame,theadversary usuallylosesthem. 3GenericPhysicalSystem cannotgainnewabilitiesastheresultofactionstakenbyavp infactit inresponsetoacommandtobrake,thenitisreasonabletobelievethatitcan modelisabstractbecauseitdoesnotspecifyanyparticularpropertiesforthe physicalsystem,noteventhattherearevehiclesortracks.wealsodene wewritesa physicalsystem,anddenecorrectnessforanavps. 3.1Notation LetP(S)denotethesetofallsubsetsofanarbitrarysetS.Givenanautomaton, notation,presentaformalhybridi/oautomaton(hioa)descriptionofthe mishaptobecorrect.thissectionisorganizedasfollows:weintroducesome whatitmeansforanavpsubsystem(avps)responsibleforavertingagiven intheautomaton.similarly,wesay\s0isreachablefroms"andwrites!s0tomeanthatdiscreteactionainstatescanleadtostates0 istheconstantfunctionwhosevalueisbeverywhere.ifrisapredicateonthe deneextensionsoffmappingp(a)!b,andoverloadthesymbolfsothat itreferstobothfunctions.iff:a!bandwewritefbforb2b,thenf \s0isr-reachablefroms"andwrites insandendsins0.ifrisapredicateonstatesofanautomaton,thenwesay sandrholdsonallstatesintheexecutionfragment.foranyf:a!b,we tomeanthatthereexistsanexecutionfragmentoftheautomatonwhichbegins Rs0tomeanthats0isreachablefrom f:xistheprojectionoffontothevariablex.whendeningthetrajectorysetof valuationsofsomesubsetqofthevariablesofanautomaton,thenweextend anautomatonweusethesymbolwtoquantifyoverallthepossibletrajectories astateofanautomatonandxisavariableofthatautomaton,thens:xisthe valueofthevariableinstates.iffisafunctiontostatesofanautomaton,then andthesymboliforthedomainofw.thetrajectoriesofanautomatonareall ittostatessoftheautomatonviaprojection:f(s)ifandonlyiff(sdq).ifsis thewwhatsatisfytheconditionsgiveninthetrajectorysetdenition. 3.2PhysicalSystemAutomata propertiesthatitmustsatisfy.therestrictionsongpareoftwotypes:wespecifygp'ssignatureandgiveanaxiomthatgpmustsatisfy.ourspecication TheGPAutomaton:WedonotdeneGPexplicitlybutrathergiveasetof Thephysicalsystemismodeledasthreeautomata:GP(genericplant),sensor, andactuator. 4

5 theaxiomformalizesthenotionofconstraint. ofthesignaturedescribestherelationshipbetweengpandothercomponents; GPtoitslocalstate inotherwords,thestateminustheconvariable. WedenoteasinglestateofGPbyp.Furthermore,Pdenotesasetofstates;P denotesthesetofallstates.weusepdltodenotetheprojectionofastateof partitionofthemintothreegroups:input,output,andinternal.gphasexactly timevariablenow.gpmayhavearbitraryinput,output,andinternalactions. havearbitraryoutputvariables,exceptthattheymustincludetheusualcurrent oneinputvariablecon(discussedbelow);ithasnointernalvariables;anditmay Theinputvariableconmodelsthecurrentconstraintsetimposedonthe ThesignatureofanHIOAconsistsofitsstatevariablesandactionsanda tionsystemaremodeledasasetofconstraints,c.thevariablecontakesvalues overp(c). physicalsystembytheprotectionsystem'sactuators.thepowersoftheprotec- TheGPmustalsosatisfythefollowingaxiom: ConstraintAxiomForallp;q2P,ifpdL=qdLandp:conq:con then: 1.Forallp02Pandforalldiscreteactionsa,ifpa acertainconstraint,thenthesamelocalstateisreachableunderanyweaker Theaxiomsaysthatifalocalstateisreachableinonesteportrajectoryunder 2.Forallclosedtrajectoriesw:[0;t]!P,ifw(0)=pand suchthaty(0)=q,ydl=wdl,andy:conq:con. p0dl=q0dlandq:con=q0:con. w:conp:conthenthereexistsatrajectoryy:[0;t]!p p:con=p0:con,thenthereexistsq02psuchthatqa!p0and constraint.aconsequenceofthisaxiomisasimilarconditioninvolvingmultistepexecutionsinsteadofjustsinglesteps. Thesensorandactuatorautomata:Duetospaceconsiderationswedo notpresentthesesimpleautomata,butmerelydescribetheminformally.the Attimezeroandeverytimeunitsthereafter,thesensoroutputsthisentire sensorautomatonhasallofgp'sstatevariablesasinputs.fixaconstant.!q0, convenient. whereivariesoversomeindexsetofthesources.weomitthesubscriptswhen the\monotonic"partofmonotonicallyconstraining,i.e.thesetofactiveconstraintsnevershrinks.notethattocomposemultipleautomatawithconstrain outputactions,wewillrequireaseparateconstrain(c)iactionforeachsource bytheavps;theseconstraintsaccumulateinconviasetunion.thiscaptures statepthroughthediscreteactionsnapshot(p). Theactuatorautomatonhasinputactionsconstrain(C)forCCand outputvariablecon.theinputactionsmodelthesequenceofconstraintsadded 5

6 WedeneanAVPStobeanautomatonwithnoinputoroutputvariables 3.3DenitionofAVPS oftheconstrainactionsandassumethatsubscriptsareassignedinawaythat twocompatibleavpssyieldsanavps.wewillusuallyignorethesubscripting makestheavpsswewishtocomposecompatible. fsnapshot(p)jp2pgandthesetofoutputactionsisfconstrain(c)ijc mayhavearbitraryinternalvariablesandinternalactions.thecompositionof andexactlythefollowinginputandoutputactions:thesetofinputactionsis alsoqualify(i.e.weaken)theclaimofcorrectnessofanavpsbysayingthat as\bad":thesearethestatesthattheavpsissupposedtoprotectagainst.we Candi2NgwhereNisanitesubsetofN.ThesetNallowsforanAVPSto becomposedofmultipleautomatathatoutputtheconstrainaction.anavps oflocalstatesandremainsinacertain(possiblydierent)setoflocalstates. theavpsonlyprotectsagainstbadstateswhengpstartsoutinacertainset WedeneanotionofcorrectnessforanAVPS.Wecharacterizecertainstates dependenceamongavpss. sitionofavpss.therstaddressesindependentavpss;thesecond,aone-way IfRorSisjust\true"thenweomitit. ALLthatbeginsinanSstateandcontainsonlyRstatesleadstoabadstate. AavertsbadinGPstartingfromSunderinvariantR,whennoexecutionof letallbethecompositionofgp,sensor,actuator,anda.wedenethat Thisdenitionofcorrectnessleadstotwousefultheoremsaboutthecompo- LetAbeanAVPS;letbad,S,andRbepredicatesonthelocalstateofGP; Theorem3.1IfAVPSsA1andA2arecompatible,A1avertsbad1inGPstart- Theorem3.2IfAVPSsA1andA2arecompatible,A1avertsbad1inGPstartingfromS1underinvariantR1,andA2avertsbad2inGPstartingfromS2 underinvariantr2,thena1jja2avertsbad1_bad2ingpstartingfroms1^s2 pleavpscalledprotectorandbelowapredicatesafe,suchthatprotector FixpredicatesbadandRonthelocalstateofGP.InFigure1,wegiveanexam- automatonreceiveseachsnapshotandimmediatelyrespondswithanappropriateconstraint.theheartofprotectoristhepairoffunctionscandfuture C:P!P,whereCC,denedby tosetsofstatesasfollows:c(p)=fp0jp2pandp0=c(p)g ThisfunctionmimicstheeectonGPofaconstrain(C)action.Weextendit C(p)=p0wherep0dL=pdLandp0:con=p:con[C. 4AGenericProtectionSystem:protector underinvariant:bad1^r2,thena1jja2avertsbad1_bad2ingpstartingfrom S1^S2underinvariantR1^R2. andthepredicatenext-safe.thesearedenedasfollows: avertsbadingpstartingfromsafeundertheinvariantr.theprotector 6

7 tick:p!,denedbytick(p)future(;p) Thedenitionofnext-saferequiressomeauxiliaryfunctions: future:(r0+1)p!,denedby ThisfunctionreturnsthesetofstatesR-reachablefrompintimeorless.Ifpis ThisfunctionreturnsthesetofstatesR-reachablefromstatepinttimewith astatereportedinasnapshotaction,thenthisfunctionreturnsthesetofstates theconinputvariableheldconstant.weextendthefunctiontosetsofstatesas R-reachablefromstatepuptoandincludingthetimeofthenextsnapshot.We future(t;p)fp0j(p follows:future(t;p)=sp2pfuture(t;p) Rp0withconconstant)^(p0:now p:nowt)g Giventheseauxiliaryfunctionswedenethesafepredicatewhichisnecessary bothforthedenitionofnext-safeandastherestrictionontheinitialstates panic:p!,denedbypanic(p)future(1;c(future(0;p))) extendpanictosetsofstates:panic(p)=sp2ppanic(p) straintsareappliedbeforeanytimepasses.notethattheinneruseoffuture allowssomediscreteactionstooccurbeforethefullconstraintsetisapplied.we ThisfunctionsreturnsthesetofallstatesR-reachablefromstatepifallcon- extendittosetsofstates:tick(p)=sp2ptick(p) moretimepasseswouldavoidallr-reachablebadstatesfortherestofthe evolutionofthesystem. safe:p!bool,denedbysafe(p):bad(panic(p)) Axiom,thisisequivalenttosayingthatapplyingalltheconstraintsbeforeany moretimepasses,itcanavoidr-reachablebadstates.becauseoftheconstraint ofgp.asafestateisonewhereiftheprotectionsystemcanactbeforeany thesystemwillbesafefromnowuptoandincludingthattime.everynext-safe theprotectionsystemtakesnoactionuntilthetimeofthenextsnapshot,then arereportedinasnapshotaction,inwhichcaseanext-safestateisonewhereif nowuptoandincludingthattime.usuallyweareexaminingthestatesthat stateisitselfasafestate.astatewhichissafebutnotnext-safeishazardous. next-safe:p!bool,denedbynext-safe(p)safe(tick(p)) protectionsystemtakesnoactionfortime,thenthesystemwillbesafefrom Finally,wedenethenext-safepredicate.Anext-safestateisonewhere,ifthe Weextendsafetosetsofstatesasfollows:safe(P)Vp2Psafe(p) Weextendnext-safetosetsofstatesasfollows: sucienttoguaranteethesafetyofthesystemuntilthenextsnapshot.thisidea Thiscompletesthedenitionofprotector. trollersthatsendweakerconstraintsetsthanthecompletesetwhenpossible. straintset.suchacontrollerwouldcorrectlyavertbadstatesifthesystemstarts inasafestate.however,weareinterestedinlessrestrictivecontrollers,i.e.con- AnAVPSmayndweakerconstraintsetsbytestingwhetheracandidatesetis Onecanimaginea\trivial"AVPSthatimmediatelyappliestheentirecon- next-safe(p)vp2pnext-safe(p) iscapturedbythenext-safestates:ourprotectoravpsidentieshazardous statesandimposesanyconstraintthatconvertsthemtonext-safestates.an \optimal"versionwouldchoosetheweakestpossibleconstraint. Duetospaceconsiderationswegiveonlythenalresult: 7

8 Variables:Internal:send2P(C)[fnoneg,initiallynone Transitions: Figure1protectorautomatondescription Actions:Input:snapshot(p),wherep2P snapshot(p) E:send:=C,whereCC ifanyexists;otherwisec=c. suchthatnext-safe(c(future(0;p)))holds, Output:constrain(C),whereCC Trajectories: Theorem4.1AVPSprotectoravertsbadinGPstartingfromsafeunder w:sendnone constrain(c) E:send:=none Pre:send=C AVPSthatstopsvehiclesfromexceedingaspeedlimitprovidedthattheydonot inthissection,weassumeasingleglobalspeedlimit.themodelofthephysical collide.inanactualsystem,speedlimitsmayvaryfromoneregiontoanother; 5Example1:Overspeed Inthissection,wepresentamodelofnvehiclesonasingleinnitetrackandan invariantr. enforcesthespeedlimitforonevehicle. for1inimplementstheabstractprotectorautomatonofsection3and AVPScalledos-prot-solo,onecopyforeachvehicle.Eachos-prot-soloi onallvehicles.thisavpsisthecompositionofnseparatecopiesofanother system,calledvehicles,conformstotherestrictionsonthegpautomatonof Section3.WedeneanAVPS,calledos-prot,whichenforcesthespeedlimit variablesmodel(amongotherthings)theposition,velocity,andaccelerationof abilitytoorderavehicleorsetofvehiclesto\emergencybrake";theunspecied eachvehicle;thetrajectoriesmodelthemotionofthevehicles,withinphysical variables,trajectories,anddiscreteactionsofgp.theconstraintsmodelavp's Section3.Theseinclude:thebadstates;theconstraintsetC;theunspecied constraints;thereareinternaldiscreteactionsofthephysicalsystemthatmodel thepossibilitythatvehiclesstopsuddenly. Wedescribeindetailthoseaspectsofthemodelwhichwereonlyabstractin rectnessreliesonthefactthatthenewversionsareconservativeapproximations sectionwillinsteadbedenedintermsofthecurrentstate.theproofofcor- oftheabstractversions. initionsofthepredicatesofsection3.thepredicatesofsection3weredened intermsofthepossiblefuturestatesofgp;theanalogouspredicatesinthis TogiveanimplementationoftheAVPS,wewillintroduceclosedformredef- 8

9 1in.Thesearetheposition,velocity,andaccelerationofeachvehicle. wherecmin<0<cmax.furthermore,whenbrakingthevehicleshaveexactly Theaccelerationofavehicleisboundedaboveandbelow:xi2[cmin;cmax], Figure2.Eachvehicleismodeledwiththreevariables,xi,_xi,andxi,foriwhere 5.1Plant:vehicles Therearenvehiclesmodeledinasingleautomatoncalledvehiclesdescribedin accelerationandthebrakingaccelerationreectsaconservativeestimateofthe eectivenessofthevehicles'brakingsystems.thevelocityisalsorestricted modelstheinstantaneousstoppingofavehicle asifithitabrickwall. tobenon-negative.theconstraintsetisc=f1;:::;ng.wheni2con,this meansthatvehicleiisemergencybraking.aninternalactioncalledbrick-wall xi=cbrake,wherecmin<cbrake<0.thedierencebetweentheminimum isextendedtosetsofstatesinasimilarwaytobad;asetofstatesisoverspeed Thispredicateistheinstantiationofthebadpredicatefromthegenericcase.It ifanyelementofthesetisoverspeed. theoverspeed\bad"predicateis: overspeed:p!bool,denedbyoverspeed(p)9ip:_xi>_cmax statesinwhichavehicleexceedsthemaximumvelocity_cmax.moreformally, Wemustspecifythebadstatesfortheoverspeedprotector:thesearethe vehicle.wedenethevehicle-wise\bad"predicateoverspeed-soloitobe WecanbuildanAVPSforoverspeedprotectionfromasingleAVPSforeach 5.2ProtectionSystem:os-prot-soloi andos-next-safe-soloiwhichareanalogoustosafeandnext-safe.they automatondenitiontobecompletewemustgivedenitionsforos-safe-soloi tains:overspeed-soloi.itisaspecialcaseofprotectorofsection4.forthe dene\safe"and\next-safe"predicatesthatonlytesteachvehicleseparately. areextendedtosetsofstatesinthesamemannerassafeandnext-safe. os-safe-soloi:p!bool,denedbyos-safe-soloi(p):overspeed-soloi(p) os-next-safe-soloi:p!bool,denedbyos-next-safe-soloi(p) _xi>_cmax.toconstructthecorrespondingsinglevehicleprotectionsystem,we Thiscompletesthedenitionofos-prot-soloi.Letos-safebetheconjunctionofos-next-safe-soloiforalli.Letos-protbethecomposition ofos-prot-soloiforalli. startingfromos-safe-soloi. Corollary5.1AVPSos-prot-soloiavertsoverspeed-soloiinvehicles Thisresultcanbeprovedbyshowingthattheautomataofthissectionare (_xi_cmax cmax) Figure3showsos-prot-soloi,anexampleprotectionsystemwhichmain- os-safe. aspecializationofthoseofsection3andapplyingtheorem4.1. Corollary5.2AVPSos-protavertsoverspeedinvehiclesstartingfrom ThisresultfollowsfromCorollary5.2andTheorem3.1. 9

10 Transitions:Input:conf1;:::;ng,thedynamic-typeisconstantfunctions Variables:Output:xi;_xi;xi2Rforalli2f1;:::;ng Figure2vehiclesautomatondescription Actions:Internal:brick-wall(i)foralli2f1;:::;ng Trajectories: E:stoppedi:=true xi:=_xi:=0stoppedi,boolean,foralli2f1;:::;ng,allinitiallyfalse thefunctionw:xiisintegrable forallt2iwheret6=0 ifw(t):stoppedithenw(t):xi=0 w(t):xi=w(0):xi+rt0w(s):_xids w(t):_xi=w(0):_xi+rt0w(s):xids 0w(t):_xi elseifi62conthenw(t):xi2[cmin;cmax] w(t):stoppedi=w(0):stoppedi elseifw(t):_xi=0thenw(t):xi=0 Figure3os-prot-soloiautomatondescription(subscriptiomitted) elsew(t):xi=cbrake Actions:Input:snapshot(p),whereprangesoverthestatesofvehicles Variables:Internal:booleansend2P(C)[fnoneg,initiallynone Transitions: snapshot(p) E:ifos-next-safe-solo(p)then elsesend:=fig send:=; Output:constrain(C)forCC Trajectories: w:sendnone constrain(c) E:send:=none Pre:send=c 10

11 vehicles.thisavpscanapplythesameconstraintsandreceivesthesame tem,herewemodelacollisionprotectionsystemforthesamephysicalsystem, snapshotinformationasthatsection'sos-prot.however,thecollisionprotectorofthissection,calledcl-prot,isaninstantiationofthegenericprotector fromsection3. ThissectionissimilartoSection5;insteadofanoverspeedprotectionsystionsystemreliesontheoverspeedprotectionsystem.AsinSection5theprotec- 6Example2:SafeSeparationonaSingleTrack denethepredicatecollidewhichtestsiftheextentsoftwovehiclesoverlap. minimumallowableseparationbetweenvehicles;thisincludesthelengthofthe sectionoftrackoccupiedbythevehicle.thepositiveconstantclencapturesthe vehicleplusanydesiredextramarginspeciedbythesystemdesigner.nowwe piessomedistanceonthetrackgivenbytheextentfunction: extent:r!p(r),denedbyextent(x)=[x;x+clen] Ittakesasanargumentthecurrentpositionofavehicleandmapsittothe Themishapwewishtoavoidisthattwovehiclescollide.Eachvehicleoccu- thenx:x,x:_x,x:stopped,andx:brakereferrespectivelytotheelementsofthe collide:p!bool,denedbycollide(p) conguration.ifpisastateofvehicles,weusep:xitodenotetheconguration typerrboolboolwhichrepresentrespectively:position,velocity,whether tionandveauxiliaryfunctions.acongurationxofavehicleisa4-tupleof thevehicleisstoppedandwhetherthevehicleisbraking.ifxisaconguration cl-next-safepredicates.todenethemwerstintroducesomeusefulnotatector.themainideasarecapturedinthedenitionsofthecl-safeand Duetospaceconsiderationswedonotpresentcl-prot,thecollisionpro- 9i9j(i6=j)^(extent(p:xi)\extent(p:xj)6=;) cl-fast-vel(x)isthemaximumvelocityachievableintime(asincl-fast-dist). ofvehiclei. cl-safe-dist(x)isthedistanceinfrontofavehiclethatthevehicle\owns";that cl-stop-dist(_x)isthedistancerequiredtostopavehiclewithspeed_xassumingcbrake cl-fast-dist(x)isthemaximumdistanceavehiclewithcongurationxcantravel intimeunits,assumingmaximumaccelerationandcorrectoverspeedprotec- immediately.iftheownershipsoftwovehiclesoverlapthenthestateisnotsafe. is,thelengthofthevehicleplusthedistancethatitmighttravelevenifbraked deceleration. cl-next-safe-dist(x)isthedistanceinfrontofavehiclethatthevehicle\claims"; astateisnext-safeifthereisnoclaimoverlap.thestrategyofcl-protisto Formaldenitionsofthesefunctionsandofthecl-safeandcl-next-safe brakethetrailingvehiclewhentwovehicleshaveaclaimoverlap. predicatesappearsintable1.astateissafeifthereisnoownershipoverlap; Wegiveonlythenalresults:11 thenthestateisnotnext-safe. thatis,thelengthofthevehiclesplusthedistancethatitmighttravelifleft unbrakedfortimeunitsandthenbraked.iftheclaimsoftwovehiclesoverlap

12 Table1Functionsusedinthedenitionofcl-prot. cl-fast-dist(x)=8><>:0 cl-stop-dist(_x)= _x2 cl-fast-vel(x)=8><>:0 _xt+12cbraket2; _xt+12cmaxt2+_cmax( t); wheret=min(;_cmax _x wheret=min(; _x cbrake)if:stoppedandbrake cmax)otherwise ifstopped ifstopped cl-next-safe-dist(x)=clen+cl-fast-dist(x) cl-safe-dist(x)=clen+cl-stop-dist(_x) min(_cmax;_x+(cmax))otherwise max(0;_x+(cbrake))if:stoppedandbrake cl-next-safe(p)8i8ji6=jimplies[xi;xi+cl-next-safe-dist(xi)] cl-safe(p)8i8ji6=jimplies[xi;xi+cl-safe-dist(xi)] and[xj;xj+cl-safe-dist(xj)]aredisjoint and[xj;xj+cl-next-safe-dist(xj)]aredisjoint +cl-stop-dist(cl-fast-vel(x)) cl-safeunderinvariant:overspeed. Corollary6.1AVPScl-protavertscollideinvehiclesstartingfrom 7ConclusionsandFutureWork Corollary6.2Thecompositionofos-protandcl-protaverts (overspeed_collide)invehiclesstartingfromos-safeandcl-safe. ThisfollowsfromTheorem3.2andCorollaries5.2and6.1. ThisfollowsfromTheorem4.1. InthisworkwehavedemonstratedhowhybridI/Oautomatontechniquescan beappliedtothespecicationandvericationofaverygeneralautomated transitproblem.thespecicationtechniqueinvolvesrenementofanabstract model.theproofstructurepermitsextensivereuseofreasoning.compositional 12

13 propertiesareexploitedtoyieldahierarchicaldecompositionoftheprotection systemthatreectsthedependenciesamongcriticalcomponents. asynchronously. liketoexaminelessidealizedcases,includingcaseswherethecommunication isunreliableand/ordelayedandwherevehiclesensorinformationisreported Thistreatmentofprotectionsystemsisapreliminarycasestudy.Wewould revealedthatthemaximumspeedattainablebyavehicleisstrictlygreaterthan theprotectionsystem.forexample,theformalizationoftheoverspeedprotector tohandlelatenciesanduncertaintiesduetodiscretesamplingandschedulingof theminimumspeedwhichtheprotectionsystemconsidersahazard.thisprecise system,especiallybecauseothercomponentsofthesystemsuchasthecollision ofnext-safeexposedimportantsafetycriteriathatledtopracticalmethods characterizationoftheoverspeedprotectoriscriticaltothesafeoperationofthe PRTsystemunderdevelopmentatRaytheon.Inparticular,theformalization Theformalizationpresentedinthispaperhasalreadyhadaninuenceonthe protectionsystemrelyonguaranteesmadebytheoverspeedprotectionsystem. system thisformalizesthedependenceofcollisionprotectiononoverspeed vehicles;conversely,thecollisionprotectionsystemcontrolsthespeedlimited automatatoformalizethesedependencies:toyieldaspeedlimitedsystem,we vehicle thisformalizestheindependenceofoverspeedprotectionforseparate composethephysicalsystemwithasetofoverspeedprotectors,oneforeach treeanalysistoidentifypossiblecausesofeachsystemhazardandrelatedde- pendenciesamongsystemcomponents.inourwork,weusecompositionof tionalsafetyanalysis.forexample,safetyengineerstypicallyperformafault- Webelievethetechniquesdevelopedinthispapercomplementmoretradi- fault-tree. protection.webelieveamorecomprehensivetreatmentinthisstyleofallthe protectionsubsystemswouldasaby-productyieldasignicantsubtreeofthe References developageneraltheoreticalframeworkforspecifying,verifying,andanalyzing transitsystems. Acknowledgments:WethankSteveSpielmanandVictorLuchangcoforhelpfuldiscussionsandEkaterinaDolginovforacarefulreadingofthemanuscript. Thistreatmentoftransitsystemsoverallisaworkinprogress.Ourgoalisto [3]NancyLynch,RobertoSegala,FritsVaandrager,andH.B.Weinberg.HybridI/O [1]NancyLynchandFritsVaandrager.Forwardandbackwardsimulations{Part [2]NancyLynch.Modellingandvericationofautomatedtransitsystems,usingtimed automata.thisvolume. automata,invariantsandsimulations.thisvolume. II:Timing-basedsystems.TechnicalMemoMIT/LCS/TM-487.c,Laboratoryfor April1995.ToappearinInformationandComputation. ComputerScience,MassachusettsInstituteofTechnology,Cambridge,MA02139, 13