Automatic Verification of a Turbogas Control System with the Murphi Verifier Enrico Tronci Computer...

Automatic Verification of a Turbogas Control System with the

Murphi Verifier

Enrico TronciComputer Science Department, University of Rome “La Sapienza”, Via Salaraia 113,

00198 Roma, Italy, tronci@dsi.uniroma1.it, http://www.dsi.uniroma1.it/~tronci

Joint work with:

G. D. Penna, B. Intrigila, I. Melatti, M. Minichino, E. Ciancamerla, A. Parisse, M. Venturini Zilli

HSCC03: Hybrid Systems: Computation and Control, Prague, The Czech Republic, April 3-5, 2003

2

Automatic Verification Game

Given: a Hybrid Systems S and an undesired state BAD (e.g. an error state)

We want to know:under which conditions, if any, our system S can reach BAD during its evolution.

3

HOW

Model Checker

System Model +

Param. Ranges+

Disturbances

Init StatesRequirements (undesired/desired states)

YesI.e. no sequence of events (states) can possibly lead to an undesired state.

CounterexampleI.e. sequence of events (states) leading to undesired state.

4

Example (Simulation 1) x(t + 1) = if x(t) <= 3 then x(t) + u(t) else x(t) – u(t), u(t) = 1, 2. x(0) = 0

0

1 3

4

1 1

2

Spec: x(t) < 5.I.e. no state with x(t) >= 5 is reachable.

Sim length: 101, 2, 1, 2, 1, 1, 2, 2, 2, 1

Spec does not fail on this run

2

1

2

2

2

21 1

5

Example (Simulation 2) x(t + 1) = if x(t) <= 3 then x(t) + u(t) else x(t) – u(t), u(t) = 1, 2. x(0) = 0

2

0

1 3

4

5

2

1 11

2 2

Spec: x(t) < 5.I.e. no state with x(t) >= 5 is reachable.

Sim length: 61, 2, 1, 2, 1, 2

Spec FAIL

6

Example (Model Checking) x(t + 1) = if x(t) <= 3 then x(t) + u(t) else x(t) – u(t), u(t) = 1, 2. x(0) = 0

2

0

1 3

4

5

2

1

21 1

11

1

2

2

2

2

Spec: x(t) < 5.I.e. no state with x(t) >= 5 is reachable.

Spec FAILSpec ok if u(t) = 0, 1.

7

A Larger Systemx(t + 1) = case x(t) – 2 + u(t) when x(t) + y(t) > 4

x(t) – 1 + u(t) when x(t) + y(t) = 4 x(t) + u(t) when x(t) + y(t) = 3 x(t) + 1 + u(t) when x(t) + y(t) = 2 x(t) + 2 + u(t) when x(t) + y(t) < 2 esac

y(t + 1) = u(t)u(t) = -1, 0, 1

0,0

1,-1

2,0

3,1

2,-1

3,0

4,1

3,-1

4,0

5,1

-1

0

1

x,y

8

Remark

• MC and Simulation have different, complementary goals.

• MC from the system model AND state X produces a sequence of stimuli (events) , if any, leading to state X. (Obstrucion: State Explosion)

• Simulation from the system model AND a sequence of stimuli (events) shows where leads (in | | steps). (Obstrucion: False Negatives).

.

9

Model Checking as State Space Exploration

Given a Finite State System S = (S, I, Next), where:S : Finite set of states;I : set of initial states;Next : function mapping a state to the set of its successors;

Visit all states that S can reach from I.

For safety properties (no bad state is reachable) the model checking problem becomes the reachability problem on the transition graph of the system to be analyzed.

10

Model Checking FlavorsExplicit

Set Reach of visited states stored in a Hash Table.Explicit approach typically works well for protocols, hybrid systems and software-like systems (i.e. asynchronous systems).Famous MC: SPIN (Bell Lab), Murphi (Stanford).

SymbolicSet Reach of visited states represented with its characteristic function f. That is f(s) = if (s is in Reach) then 1 else 0.States are bit vectors, thus f is a Boolean function. Ordered Binary Decision Diagrams (OBDDs) are used to efficiently represent and manipulate f. Symbolic approach typically works well for Hardware-like systems(i.e. synchronous systems).Famous MC: SMV (CMU), VIS (CU + Berkeley), CUDD (CU).

11

Overview

Symbolic model checkers are typically used for automatic verification of Hybrid Systems.

We present a nontrivial case study on automatic verification of a Hybrid Systems using an explicit model checker. Namely, Automatic verification with Murphi verifier of the Turbogas Control System of a 2MW Co-generative Power Plant (ICARO).

Our experimental results show that explicit model checkers (Murphi in our case) can outperform symbolic model checkers for verification of Hybrid Control Systems.

12

History•Murphi is an explicit state model checker for low level analysis of Protocols and Software-like Systems.

•Murphi has been realized Alan Hu, David Dill, Ulrich Stern, and many others from University of Stanford, USA.

•Murphi: http://sprout.stanford.edu/dill/murphi.html

•Cached Murphi has been obtained from Murphi by changing Murphi engine so as to use a cache based BFS and by adding finite precision real numbers. Cmurphi 4.2 uses a disk based BFS.

•Cached Murphi is a joint effort of the University of L’Aquila and at the University of Rome “La Sapienza”.

•Cached Murphi: http://www.dsi.uniroma1.it/~tronci

13

PLAN

• Add finite precision real numbers to Murphi. This allows easy modeling of (discrete time) Hybrid Systems.

• Build model of ICARO Turbogas Control System.

• Code model with Murphi verifier.

• Run verification experiments.

14

A Simple SystemA glimpse of Murphi input language

x(t) + d(t) when x(t) <= 3 x(t + 1) = x(t) – d(t) when x(t) > 3

d(t) = 0, 1, 2. x(0) = 0

2

0

1 3

4

5

2

1

21 1

11

1

2

2

2

2

0

0

0

0

00

15

Murphi Code

CONST -- constant declarationsMAX_STATE_VALUE : 5;

TYPE -- type declarationsstate_type : 0 .. 10; -- integers from 0 to 10disturbance_type : 0 .. 2;

VAR -- (global) variable declarations x : state_type; -- variable of type state_type

-- next state function

function next(x: state_type; d : disturbance_type): state_type;begin if (x <= 3) then return (x + d); else return (x - d); endif end;

startstate "startstate" -- define initial statex := 0; end;

-- nondeterministic disturbances -- trigger system transitions

ruleset d : disturbance_type do -- define transition rule rule "time step" true ==> begin x := next(x, d); end;end;

-- define property to be verified invariant "x less than 5" (x < MAX_STATE_VALUE);

x(t + 1) = if x(t) <= 3 then x(t) + d(t) else x(t) – d(t) ; d(t) = 0, 1, 2 ; x(0) = 0;

Spec: x(t) < 5 (FAIL). Spec: x(t) <= 5 (PASS).

16

Murphi Error Trace

Startstate startstate fired.x:0----------Rule time step, d:1 fired.x:1----------Rule time step, d:2 fired.x:3----------Rule time step, d:2 fired.The last state of the trace (in full) is:x:5----------

17

Gas Turbine System

ControllerGas Turbine(Turbogas)

Disturbances: electric users, param. var, etc

Vrot: Turbine Rotation speedTexh: Exhaust smokes TemperaturePel: Generated Electric PowerPmc: Compressor Pressure

Settings Fuel Valve OpeningFG102

Vrot, Texh, Pel, Pmc

18

Controller

MIN ADJ

Offset

Valve FG102 Opening Command

12MW

N1Gov

PowLim

ExTLim

Winner

Vrot

Pel

Pmc

Texh

Limiter

Vrot: Turbine Rotation speed

Texh: Exhaust smokes Temperature

Pel: Generated Electric Power

Pmc: Compressor Pressure

19

Cell i

+

1/s

X

X

AND

+

-

S

P

>0? Reset at u + 4kWu = min(output N1Gov, output PowLim, output ExTLim)

-

CellOutput

Kp

Ki

Winner != i?

Winner name

-10MW

10MW

B

A

A B

SAT

SAT

20

Power Limiter (PowLim)Electric Power Controller

Pel Setpoint (+2MW)

Winner

OutputPowLim

PelS

P

Celli = “Power Limiter”A = 3000kWB = 10Mw

Vrot: Turbine Rotation speed

Texh: Exhaust smokes Temperature

Pel: Generated Electric Power

Pmc: Compressor Pressure

21

N1 Governor (N1Gov)Turbine Rotation Speed Controller

1/s

XS

P

Accelleration

Deceleration

Pel

Kdr

network

Vrot

-

+Output N1 Governor

105%

Winner

Celli = “N1 Governor”A = 0B = 10MW

isle

6%

Vrot: Turbine Rotation speed

Texh: Exhaust smokes Temperature

Pel: Generated Electric Power

Pmc: Compressor Pressure

22

Exhaust Temperature Limiter(ExTLim)

Exhaust Smoke Temperature Controller

+Pmc

Offset

P

S

Winner

TexhCelli = “Exhaust Temperature Limiter”A = 0B = 10MW

Output Exhaust Temperature Limiter

Vrot: Turbine Rotation speed

Texh: Exhaust smokes Temperature

Pel: Generated Electric Power

Pmc: Compressor Pressure

23

Gas Turbine

Gas Turbine

FG102 Texh

Vrot

Pel

Disturbances: el. users, par. var, etc.

Vrot: Turbine Rotation speed

Texh: Exhaust smokes Temperature

Pel: Generated Electric Power

Pmc: Compressor Pressure

24

ModelingAll subsystems are modeled as Finite State Automata (FSA).This implies:•Time is discrete.•State values range on finite precision real numbers (namely real(4, 2): 4 digit mantissa, 2 digit exponent).

Going to discrete time brings in a sampling frequency F = 1/T.

dx(t)/dt = f(x(t), u(t))(x(t + 1) – x(t))/T = f(x(t), u(t))x(t + 1) = x(t) + T*f(x(t), u(t))

25

Gas Turbine (as seen from Controller)

Generated Electric Power:P(t + 1) = P(t) + (a1(P(t) – P0) + a2FG102(t) – a3u(t))T

Smokes Temperature: Tf(t + 1) = Tf(t) + (b1(P(t) – P0) + b2FG102(t) – b3u(t))T

Turbine Rotation Speed:V(t + 1) = V(t) + (c1(P(t) – P0) + c2FG102(t) – c3u(t))T

User demandu(t + 1) = u(t) + MAX_D_U *ud (t)*T

MAX_D_U = Max variation speed (time derivative) of user el. demand ud (t) = -1, 0, 1 (uncontrolled load disturbance)

Coefficients a, b, c computed by fitting with plant log data.

26

A Glimpse of the PI Model

Discrete Time PI:

x(t + 1) = x(t) + K *u(t)*T

PI: dx/dt = K*u(t)

27

Murphi Code for GTS: constCONST

SAMPLING_FREQ : 100.0; -- sampling frequency in Hz.

-- Max Electric Power generated (kW)MAX_ELECT_POW_GEN_ALT: 3200.0;

-- Max turbine rotation speed (percentage of max = 22500 rpm)MAX_ROT_SPEED: 130.0;

MAX_ COMPR_PRES: 14.0; -- Max compressor pressure (bar)

MAX_SMOKE_TEMP: 600.0; -- Max exhaust smokes temperature (C)

-- Max variation speed (time derivative) of user demandMAX_D_U: 10.0;

FREQ_1 : 100; -- frequency injection disturbances

kdr : 0.0019; -- multiplier

28

Murphi Code for GTS: typeTYPE

-- define our real type: -- 4 digit mantissa, 2 digit exponents, ±0.mmmm*10±nn

real_type : real(4,2);

Pow_Gen_type: real_type; -- power generator type

Rot_Speed_type: real_type; -- rot speed type

Mode_type: 1 .. 2; -- 1 isle, 2 net

-- exhaust smokes temperature typeSmoke_Temp_type: real_type;

29

Murphi Code for GTS: var

VAR

-- Generated Electric Power (kW)Power : Pow_Gen_type;

-- Turbine rotation speed (percentage of max = 22500 rpm)v_rot : Rot_Speed_type;

-- Exhaust smokes temperature (C)smokes : Smoke_Temp_type;

modality_value : Mode_type; -- 1 isle, 2 net

30

Murphi Invariants-- invariants

invariant "power ok"(Power>=1300) & (Power<=2500);

invariant "fumi ok"(smokes>=200) & (smokes<=580);

invariant "rot speed ok"(v_rot>=40) & (v_rot<=120);

31

Murphi Output OK (MAX_D_U = 10.0)

Cached Murphi Release 3.1Finite-state Concurrent System Verifier.…Progress Report:---- begin bfs level 0. …---- begin bfs level 12903. ---- begin bfs level 12904. ==========================================================================

Status:No error found.

State Space Explored:2246328 states, 6738984 rules fired in 16988.18s.Collision Rate: 1.9587522e-05.Levels Explored: 12904.

Omission Probabilities (caused by Hash Compaction):

Pr[even one omitted state] <= 4.8779e-08Pr[even one undetected error] <= 2.62273e-10Diameter of reachability graph: 12904

32

Murphi Output FAIL (Max_D_U = 25)

---- begin bfs level 0. …---- begin bfs level 1533.

The following is the error trace for the error:

Invariant "rot speed ok, morsetto:2" failed.

Startstate initstate fired.

Power:+2.000e+03 v_rot:+7.500e+01FUMI:+5.520e+02 N1_gov:+1.000e+03Pow_lim:+1.000e+03 Temp_lim:+1.000e+03valve_fg102:+1.000e-01 v:+7.500e+02N1_state:+1.000e+03 Powlim_state:+1.000e+03templim_state:+1.000e+03 minall:+1.000e+03winner:2 step_counter:0pressione:+1.200e+01 utenza:+0.000e+00modality_value:1

33

Murphi Fail (2)Rule time step, morsetto:2, modalita:2, d_pressione:0, N1_d1:0, N1_d2:0, Powlim_d:0, templim_d:0, utenza_d:-1 fired.v_rot:+7.507e+01 N1_gov:+1.100e+04Temp_lim:+6.180e+03 v:+1.050e+02N1_state:+1.004e+03 templim_state:+1.004e+03step_counter:1----------….Rule time step, morsetto:2, modalita:2, d_pressione:0, N1_d1:0, N1_d2:0, Powlim_d:0, templim_d:0, utenza_d:-1 fired.The last state of the trace (in full) is:Power:+1.627e+03 v_rot:+3.994e+01FUMI:+5.520e+02 N1_gov:+1.120e+04Pow_lim:+1.199e+03 Temp_lim:+6.380e+03valve_fg102:+1.198e-01 v:+1.050e+02N1_state:+1.202e+03 Powlim_state:+8.283e+02templim_state:+1.202e+03 minall:+1.199e+03winner:2 step_counter:34pressione:+1.200e+01 utenza:+1.250e+02modality_value:2

34

Murphi Fail (3)

End of the error trace.

=====================================================

Result:

Invariant "rot speed ok, morsetto:2" failed.

State Space Explored:

1739719 states, 5186047 rules fired in 12548.25s.Collision Rate: 0.Levels Explored: 1533.

35

Experimental ResultsMAX_D_U Reachable

StatesRules Fired

Diameter CPU (sec) Result

10.0 2,246,328 6,738,984 12904 16988.18 PASS

17.5 7,492,389 22,477,167 7423 54012.18 PASS

25 1,739,719 5,186,047 1533 12548.25 FAIL

50 36,801 109,015 804 271.77 FAIL

Results on a INTEL Pentium 4, 2GHz Linux PC with 512 MB RAM. Murphi options: -b, -c, --cache, -m350

36

Why does it work?

Here we are interested in automatic verification of a control system in a neighborhood of its setpoint.

A well designed controller keeps the whole system in a (small) neighborhood of the setpoint, thus the set of states that are reachable from the setpoint is small.

An explicit model checker, like Murphi, can exploit this fact.

Taking advantage of this fact, using a symbolic model checker may be hard. As a result, the representation of the system transition relation can be so large that we may run out of memory even before starting the reachability analysis.

Indeed this was our experience when we tried to use HyTech and SMV on our hybrid system verification problem.

37

Conclusions• Finite Precision Real Numbers can be easily added to

Murphi verifier. This allows easy modeling of hybrid systems with Murphi.

• Nontrivial case study presented: Automatic Verification of Turbogas Control System of a Co-generative Electric Power Plant (ICARO).

• Our experimental results suggest that Murphi can be effectively used for automatic verification of Hybrid Control Systems.