Modelling of System Properties in a Modelica Framework

Transcription

1 Modlling of Systm Proprtis in a Modlica Framwork Audry Jardin Danil Bouskla Thuy Nguyn Nancy Rul EDF R&D, STEP Dpartmnt 6 quai Watir, 784 CHATOU Cdx, FRANCE audry.jardin@df.fr danil.bouskla@df.fr nancy.rul@df.fr Eric Thomas Laurnt Chastant Dassault-Aviation 78 quai Marcl Dassault Cdx 3, St CLOUD Cdx, FRANCE ric.thomas@dassault-aviation.com laurnt.chastant@dassault-aviation.com Raphaël Schonig Sandrin Lombé Dassault-Systèms ru Marcl Dassault, VELIZY-VILLACOUBLAY Cdx, FRANCE raphal.schonig@3ds.com sandrin.lomb@3ds.com Abstract In ordr to improv th nginring procsss and spcially th corrsponding vrification and validation phass, this articl dals with th modling of systm proprtis in a Modlica framwork. Th trm proprty is intndd hr to b gnric and rfrs to a systm rquirmnt or limitation as wll as a validity domain of a modl. Th choic of th Modlica languag is justifid by a dsir to us its quation-basd fatur to modl systm proprtis in an unambiguous and xplicit way. Bsids, choosing only on formalism to dscrib th systm proprtis and th physical quations of th modl should as th xprssion of th modl validity domains. Aftr having introducd svral thortical concpts to formally dscrib a systm proprty, th dvlopmnt of a ddicatd library is xplaind and illustratd on an industrial xampl takn from th aronautics domain. Som chcks of systm proprtis ar thus prformd by co-simulating bhavioral and proprtis modls. Finally, som xtnsions of th Modlica languag ar advocatd in ordr to improv th applicability rang and fficincy of proprtis modling for complx systms, and spcially to incras th rigor of thir validations by nabling formal proofs. Kywords: Modlling;Chcking;Proprty;Modlica. Introduction Th study of prformanc and safty is today of prim intrst whn dsigning complx systms. At ach stag of th dsign cycl, nginrs should chck th conformanc of thir tchnical choics with rspct to th initial spcifications. In such a Vrification & Validation (V&V) procss, th modling and th vrification of systm proprtis ar thus a ky activity. Thy nabl to validat th chosn implmntation of th systm but thy also as th capitalization on th knowldg of th systm. Formalizing th rquirmnts allows to nhanc th documntation of th nginring procsss by kping track of dsign improvmnts, modl rfinmnts, changs in th safty/oprational xpctations, and so on. Th difficulty of such a V&V approach lis, howvr, in th fact that, if som tchniqus and languags xist today to handl systm proprtis, thy oftn involv spcific modls diffrnt from th rfrnc nginring modl (i.. th modl commonly usd to prdict th physical bhavior of th systm, that is th bhavioral modl). Such htrognity may lad to som rrors and thus to flaws in th proof of safty or prformanc. Th modling and th chcking of systm proprtis concrn industris in charg of th dsign of nw

2 products (.g. automotiv, arospac) as wll as th ons rsponsibl for th opration of long-lif products and facd to rtrofit du to som matrial obsolscnc and changs in oprational constraints (.g. nrgy producrs). Th proprtis modl and th rfrnc nginring modl should thus apply for a systm involving svral physical domains. For th bhavioral modl, th incrasingly us of th non-propritary Modlica languag []-[2] in various industris tstifis of th Modlica fficincy to convnintly dscrib multi-physics bhaviors. Bsids, thanks to its quation-basd and acausal faturs, th Modlica languag appars wll-suitd to build modls rusabl and adaptabl to th diffrnt stps of th nginring cycl. Th objctiv of this articl is thus to study to what xtnt th proprtis of a systm can b modld and chckd in a Modlica framwork. A similar approach is currntly ongoing, within th ITEA2 OpnProd projct [3], by linking a Modlica bhavioral modl to a UML proprtis modl [4]. It actually implis th dvlopmnt of th socalld ModlicaML UML profil [5]-[6]. Howvr th work prsntd hr has bn prformd within th ITEA2 EuroSysLib projct [7] via a collaboration btwn EDF, Dassault Aviation, Dassault Systèms and DLR. It taks a diffrnt point of viw in th sns that th modling and th chcking of systm proprtis ar studid in a fully Modlicabasd nvironmnt. This choic can b xplaind by a dsir to rus: - th quation-basd fatur of Modlica to modl proprtis in a mor formal way; - th sam formalism as th on chosn to dscrib th physical quations of th modls in ordr to as th xprssion of thir validity domains (which ar actually a spcific kind of proprty). Sction 2 clarifis th concpt of proprty with no rfrnc mad to th way it can b implmntd in Modlica. It dfins what is a proprty and sums up th diffrnt typs of proprtis. It also spcifis th usrs rquirmnts rgarding proprtis modling, chcking and visualization. Sction 3 aims at formalizing th way a proprty can b modld. Lik in a formal Proprty Spcification Languag [8], th ida is to introduc som thortical concpts spcially usful to xprss a proprty in an unambiguous and xplicit form. Som notions lik spac/tim locator, stat and vnt ar dpictd and a list of oprators to build svral typs of systm proprtis is givn and illustratd on ralistic xampls. Sction 4 focuss on th tchnical implmntation of ths concpts in Modlica. Th dvlopmnt of a ddicatd library is xplaind and illustratd on an industrial xampl takn from th aronautics domain. Th assssmnt of som systm proprtis is in particular mad by simulation using Dymola [9]. Sction 5 advocats th xtnsion of th Modlica languag in ordr to improv th applicability rang and fficincy of proprtis modling for th validation of complx systms. 2 Proprtis modling and chcking As mntiond abov, th following sub-sctions ar intndd to st up th framwork of th study. Indpndntly of th way it can b implmntd in Modlica, thy ar intndd to clarify th concpt of modling and chcking proprtis and to show its potntial us in an industrial contxt. Notions lik a proprtis modl or a bhavioral modl ar in particular introducd. 2. What is a proprty? Dfinition : A proprty is an xprssion that spcifis a condition that must hold tru at givn tims and placs. It rsults in a Boolan variabl stating whthr th proprty is satisfid or not. A proprty may thus spcify: - an allowd oprating domain th systm must not lav for safty rasons; - an oprational domain whr, for instanc, th systm opration is optimizd for prformanc; - th validity domain of a modl outsid of which th corrsponding bhavioral quations ar no longr valid; - Exampl: Som ralistic proprtis can b formulatd in a txtual form such as: - Th powr plant should volv in an allowd (tmpratur, prssur)-domain; - Cavitation should nvr happn in a pump componnt; - Th charactristics of th pump ar only valid for a givn rang [ Q ;Q 2 ] of flow rats. - Diffrnt catgoris of proprtis may actually b distinguishd. A first typology may b drawn dpnding whthr th proprtis ar associatd with

3 th systm, a sub-systm or a componnt. But, th proprtis may also b classifid dpnding on th kind of xpctations. Two main kinds of proprtis may howvr b highlightd: - a first kind whr th proprtis charactriz th xpctations of th dsignr but also th limitations of th chosn systm, subsystms and componnts. Ths proprtis ar xprssd indpndntly from any bhavioral modl; - a scond kind whr th proprtis dfin som validity domains and ar thus attachd to spcific bhavioral modls. Ths proprtis do not blong to th dsignr rquirmnts. Thy only rflct how th dsignr rprsnts th implmntation of its systm. From th tool and languag prspctiv, modling systm and componnts proprtis and xprssing validity domains ar howvr ssntially similar. For th sak of simplicity, th trm of proprty will thn b usd all along th papr to rfr to any rquirmnt/limitation th nginr wants to xprss on its systm/sub-systm/componnt or on its modl/sub-modl. 2.2 Uss of proprtis modling Th modling and th chcking of proprtis may b usd in an industrial contxt to vrify and validat ach stag of th systm dvlopmnt cycl, in particular: - to nhanc th documntation of th systm rgarding th dscription of th xpctd bhavior as wll as th dscription of th assumptions mad during th modling of its bhavior. This may in particular b usful to as th capitalization and th transmission of knowldg; - to improv th nginring procsss by xprssing th rquirmnts in an xplicit and unambiguous form and by kping track of any volutions du to dsign improvmnts, to changs in oprational xpctations, to modl rfinmnts Onc th proprtis hav bn modld, a sris of tsts can thn b prformd: - to chck th cohrnc and th compltnss of th rquirmnts (.g. by formal proofs and consistncy chcks); - to vrify th conformanc of th dsignd systm with rspct to th initial spcifications (.g. by simulating both th proprtis modl and th bhavioral modl); - to validat th Instrumntation & Control (I&C) part of a procss on th basis of th srvics it should provid to th physical procss, during th spcification phas, and aftr th programming phas using hardwar-in-th-loop; - to support advancd modling approachs lik scnarios simulating squntial changs of diffrnt oprating mods (.g. simulation of a systm ntring a dysfunctional mod). 2.3 Distinction btwn a bhavioral quation and a proprty xprssion Bhavioral quations dscrib a potntial implmntation of th systm at th dsign phas, or how th systm actually works during opration. Thy ar basd on physical or mpirical laws. Proprtis dfin what th systm should guarant, or in othr words what is th validity domain of th systm s bhavior. Thy can also b usd to dfin th validity domain of th modl usd to rprsnt th systm s bhavior. Exampl: Lt us considr a valv. A bhavioral quation can b P( t) = k / ρ Q ( t) (whr P( t) is 2 th prssur loss across th valv, ρ is th fluid dnsity, k is th prssur loss cofficint of th valv and Q ( t) is th mass flow rat through th valv) whras a proprty can b For all t, P( t) should b gratr than Pmin to avoid cavitation. This distinction is important bcaus bhavioral quations and proprtis ar fundamntally diffrnt: - Thy corrspond to diffrnt objctivs: bhavioral quations dscrib how th systm actually works (.g. th dynamics of th systm) whras proprtis dfin what th systm should do (.g. which srvics it should provid, th prscribd opration domain.); - Thy ar of diffrnt naturs: bhavioral quations dfin systm charactristics which ar always localizd to a spcific part of th systm, whras proprtis dfin systm charactristics which may b global in tim or spac, in th sns that thy can constrain variabls across svral priods of tim and diffrnt locations; - Thy involv diffrnt xprtis: writing bhavioral quations rquirs xprtis in physical systm modling, whras dfining proprtis rquirs xprtis in systm opration; - Thy hav diffrnt lifcycls: th dfinition of proprtis occurs during th rquirmnt phas, whras th modling of th systm s

4 bhavior occurs during th dsign phas. For instanc, proprtis may captur th currnt safty ruls, whil bhavioral quations may dscrib th currnt bhavior of th systm undr opration. Th impact of th volution of safty ruls on th opration of th systm may b assssd by modifying th proprtis and chcking thm against th currnt systm s bhavior. Invrsly, th complianc of systm s modifications wrt. th currnt safty ruls can b chckd by comparing th modifid bhavioral quations wrt. th currnt systm s proprtis. 2.4 Rquirmnts on proprtis modling A proprty has to b: - in intraction with th bhavioral modl of th systm (sinc its satisfaction dpnds on th volution of th systm); - transparnt wrt. th dynamic volution of th systm (should not influnc th volution of th systm); - cohrnt with th bhavioral modl by not implying a too low lvl of dtails (proprtis should not rfr to charactristics that ar not dpictd in th bhavioral modl); - radabl for th sak of documntation and transmission of knowldg; - undrstandabl to as th intrprtation of its potntial failur. Th modlling of proprtis must thn b in accordanc with ths diffrnt axioms and an adquat data modl has to b stablishd in particular to guarant th transparncy of th proprtis modl towards th bhavioral modl. Nominal mod Systm Sub-systm Sub-systm 2 Wintr mod Proprtis Modl Physical Modl I&C Modl Bhavioural Modl Non - Human Environmnt Human Intractions Figur : Data modl for modling th systm bhavior, th volution of its nvironmnt and th proprtis th systm must guarant So as to bound th proprtis modl with th bhavioral modl in such a way that thy rmain dissociatd, w suggst hr to physically sparat ths two kinds of modls in two kinds of fils. Such a data modl (Figur ) thus corrsponds to a modl organizd in thr diffrnt parts: - th nvironmntal modl whr th charactristics and th volution of th systm nvironmnt ar spcifid. This part may in particular b usd to st th inputs of th simulation and so to spcify som scnarios (.g. introduction of som componnt failurs, simulation of a sris of oprator intrvntion, ) - th bhavioral modl whr th intrinsic charactristics and th volution of th systm ar dscribd with bhavioral quations. In othr words, this part corrsponds to th physical modling of th procss and its I&C part; - th proprtis modl whr th xpctd srvics of th systm and th validity domain of th bhavioral modl ar dpictd. In ordr to nsur th fact that th proprtis modl should b only an obsrvr of th bhavioral modl, th thr parts of this data modl must communicat with ach othr such that: - th proprtis modl and th bhavioral modl may accss th data dscribd in th nvironmntal modl (th proprtis as wll as th bhavior of th systm may actually chang dpnding on th volution of th systm nvironmnt); - th proprtis modl may accss th data dscribd in th bhavioral modl in ordr to valuat whthr th dynamic volution of th physical procss and its I&C part stay within th bounds of th prscribd proprtis domain, but it cannot snd any data to influnc th bhavioral modl. Bsids, in ordr to as th rading and th construction of th proprtis modl, it may b hlpful to organiz it into a hirarchy. Dpnding on th modlr xpctations, this hirarchy may b basd: - on th architctur of th studid systm; - on th diffrnt stats of th studid systm and its nvironmnt; - or on a combination of th systm architctur and th diffrnt stats (as in Figur ). A hirarchy basd on th systm architctur may b usful in particular whn th architctur of th systm changs and th modlr has thn to rmov or to add som proprtis rlatd to som spcific subsystms or componnts. On th othr hand, a hirarchy basd on th stats of th systm and of its nvironmnt may add furthr information on how th systm should bhav (th dscription of ths stats

5 givs in gnral a bttr insight into th diffrnt oprating mods). In practic, sinc a diffrnt proprtis modl can b built for ach oprating mod, svral proprtis modls can b associatd with th sam bhavioral modl. An advancd data modl has thus bn imagind to nabl th handling of such a situation. As shown in Figur 2, our suggstion is to add a statchart modl [] whr th diffrnt stats of th systm and of its sub-systms and componnts ar dscribd. Th main ida is thn that th statchart modl is viwd as a suprvisor: it may accss th data of th bhavioral modl, dcid in which stats th systm oprats and slct th appropriat proprtis modl. Nominal mod Wintr mod Slction of th adquat proprtis modl Proprtis Modl Statchart Modl Nominal modl Dysfunctional modl Bhavioural Modl Slction of th adquat bhavioral modl Non - Human Environmnt Human Intractions Figur 2: Advancd data modl for switching proprtis modls and bhavioral modls With th sam point of viw, it may also b usful to associat svral bhavioral modls with th sam systm. For instanc, if th objctiv is to anticipat th physical bhavior of th systm whn a fault occurs and to vrify whthr th corrsponding bhavior rmains in a saf domain, it may b hlpful to switch, during th simulation, btwn a modl dscribing a nominal bhavior and anothr modl dscribing a dysfunctional bhavior of th systm. For this particular us, th advancd data modl of Figur 2 can b adaptd in such a way that th statchart modl may: - accss th rsults obtaind from th assssmnt of th proprtis to dtct if th validity domain of th activ bhavioral modl has bn crossd; - activat, if ndd, anothr bhavioral modl with an appropriat validity domain. In such application, lt us not howvr that vn if th sam statchart modl suprviss svral proprtis and bhavioral modls, th hirarchy of th proprtis may not ncssarily corrspond to th hirarchy of th bhavioral modls. 2.5 Rquirmnts concrning th chcking, th visualization and th analysis of a proprty Th qustion now is to study to what xtnt th proprtis and th bhavioral modls should b coupld togthr to chck whthr th proprtis ar satisfid or not. Two kinds of chcks may b imagind: a static chck by formal proof and a dynamic chck by simulation. Chcks by formal proof can b usd to vrify th cohrnc: () btwn th proprtis thmslvs (.g. to vrify that proprtis ar compatibl btwn thmslvs and do not dfin mistaknly mpty oprating domains); (2) btwn th proprtis and th bhavioral modl (.g. to chck that th bhavioral quations ar mathmatically compatibl with th proprtis). Complmntarily, chcks by simulation can b usd to vrify th proprtis all along a givn scnario such as th Virtual Vrification mthod suggstd in []. Chcks by formal proof rquir that proprtis and bhavioral modls ar dscribd using high lvl formal dclarativ languags such as Modlica. Chcks by simulation rquir th dfinition of scnarios with possibl occurrncs of dysfunctional mods, injction of faults, changs bcaus of human intractions, and so on. Bsids, to hlp th analyst undrstand th rasons of proprtis violations, diagnostics tools should b providd, such as: - gnration of alarm whn a proprty is violatd: a pop-up may appar during th simulation as soon as th non-vrification of a proprty is dtctd; - chang of componnt s visual aspct: th color of a componnt may chang whn its corrsponding proprtis ar not satisfid; - dition of a log fil: to rcap all th proprtis violations and to signal at first glanc whn and whr th problms hav appard; - proprtis filtring: th analyst may nd to mak a distinction btwn safty proprtis and proprtis indicating som pr-alarms, optimal oprating domains, constraints avoiding damags, and so on. Th possibility to tag th proprtis with adquat flags may, for instanc, b considrd. This list is howvr far to b xhaustiv, for instanc on can also imagin th possibility to introduc som indicators lik th probability of a proprty s failur.

6 3 Thortical concpts usd for proprtis modling By dfinition and similarly to th Bhavior Enginring approach [2], a proprty can b xprssd undr th gnric form: [Whr][Whn][What]. Exampl: Th avoidanc of pump cavitation can b xprssd by: [In Pump][for vry instant whn th pump oprats][th fluid prssur at th inlt should b gratr than a minimum valu]. To mt on of th rquirmnts which is to formaliz th xprssion of th proprtis, th main ida of th following sub-sctions is namly to dscrib th concpts rlatd to th gnric form of a proprty. In mor dtails, ths sub-sctions dscrib what ar th attributs of a proprty (i.. what rfr to th whr, whn and what trms), what thy imply (i.. what kinds of objcts ar usd) and how thy can b built (i.. which oprators ar usd to construct such attributs). In ordr to st up a clar thortical framwork, th following paragraphs ar still voluntarily indpndnt of any ddicatd languag. Th implmntation in a Modlica nvironmnt is studid in Sction Attributs of a proprty As alrady statd, a proprty may b xprssd undr th gnric form [Whr][Whn][What]. Whr is a spac locator that spcifis which part of th systm is concrnd by th proprty. Th spac locator spcifis a subst of vrywhr. It may involv a family of componnts (.g. all th pumps), a spcific componnt (.g. pump n 2), a part of a componnt (.g. a spcific sgmnt of a pip), a subst of objcts that ar in a givn stat or that ar satisfying a givn condition (.g. all th componnts whos tmpratur xcds 24 C). It may also b a subst or a combination of othr spac locators. Whn is a tim locator to indicat at which instants th proprty has to b satisfid. Th tim locator is a subst of always. It may involv a tim instant rfrring to all th occurrncs of a spcific vnt (.g. whn a pump starts), a tim priod during which a givn condition holds tru (.g. as long as th pump oprats), a sliding tim intrval whn a givn proprty nds to b satisfid only most of th tim (.g. for no mor than 3 minuts ovr any priod of 2 hours). It can also b a combination of svral tim locators. What rfrs to th condition th systm should guarant (or th assumption th modl should satisfy in th cas of a validity domain). It consists in an xprssion that can b valuatd and which rsults in a Boolan variabl stating whthr th proprty is satisfid or not. Bcaus of th varity of proprtis, conditions can involv physical variabls and/or stats probd at spcific tim instants or during spcific tim priods. Thy may also imply vnts, or vn a combination of ths svral kinds of objcts with som spac and tim locators. 3.2 Typs of objcts implid in th attributs of a proprty As shown abov, a proprty may ntirly b dfind by th association of a spac locator, a tim locator and a condition to b satisfid. Du to th complxity of th systms and th diffrnt typs of proprtis th dsignr is intrstd in, ths attributs hav to dal with numrous kinds of objcts such as: - instancs of modls (.g. Pump, SnsorMT8 ); - gomtric data (.g. sgmnt[.2.8] of Pip3); - physical variabls and/or paramtrs of diffrnt physical typs; - stats of th systm, sub-systms and componnts (.g. sinc th xpctd srvics ar oftn dpnding on th diffrnt oprating mods, a proprty may concrn a componnt only whn it is not in a dysfunctional stat); - vnts that charactriz xtrnal stimuli of th systm (.g. human intrvntion, volution of th systm s nvironmnt) or intrnal changs of th sub-systms and thir componnts (.g. fault during a valv opning); - combinations of instancs of modls, gomtric dtails, physical variabls, stats and vnts built thanks to som spcific oprators (.g. Pump and Pump2, for vry instant whr Pump oprats, all pumps xcpt Pump3 ). Th two following paragraphs dfin in mor dtails what w man by th notions of stat and vnt which may b lss naturally intuitiv. Th concpt of oprator to build adquat proprtis attributs is thn studid in Sction Stat Dfinition 2: A stat is a discrt variabl that charactrizs an aspct of a systm, a sub-systm or a componnt. It can tak its valus only within a fi-

7 nit st of numratd valus. It is dfind according to a spcific point of viw on th systm. Exampl: Stats may corrspond to diffrnt oprating mods (.g. maintnanc/normal opration), oprating conditions (.g. cold wintr/hot summr), physical bhaviors (.g. pump/turbin mod) A stat may hav on (or svral) attachd sub-stat variabl(s) and th sam systm, sub-systm or componnt may hav multipl indpndnt stats. As xplaind abov, th notion of stat can also hlp to organiz th proprtis and th bhavioral modls into a hirarchy Evnt Dfinition 3: An vnt is an objct that is gnratd at a givn tim instant to signal th occurrnc of a fact. It carris at last two pics of information: th dat and th class of th vnt. Th formr indicats whn th chang has occurrd whil th lattr dfins what has happnd. An vnt has no duration and dos not charactriz what ar th consquncs of th chang on th systm bhavior. Exampl: Th starting of a motor may gnrat an vnt. In som cass, sub-classs of th vnt concpt may b cratd to provid furthr information such as a probability distribution, a frquncy of apparanc, and so on. A distinction may also b mad dpnding on th location of th chang. For instanc, intrnal vnts ar rlatd to th volution of som variabls in th bhavioral modls whil xtrnal vnts corrspond to changs in th systm s nvironmnt. Th introduction of th vnt concpt can spcially b usd to dfin som simulation scnarios with injctions of faults, control or prturbation actions. 3.3 Oprators to build proprty attributs An oprator is dfind hr as a function that constructs an objct as output givn on or svral objcts as inputs. Inputs and outputs may b of th sam typ, or of diffrnt typs. Oprators ar of prim importanc to build spac/tim locators or vn conditions: - whn a simpl obsrvation of th variabls availabl in th bhavioral modl is not sufficint to dscrib what th systm should guarant or whn th modl is valid (.g. whn a bhavioral modl involvs only a mass flow rat variabl and th corrsponding proprty is xprssd in trms of volum flow rat, an oprator has to b usd to prform th unit convrsion); - or whn it is asir to xprss it as a function or a combination of othr attributs. Oprators may b classifid dpnding on th typs of thir inputs and outputs. From th analysis of industrial nds basd on EDF and Dassault-Aviation us-cass, som oprators hav bn idntifid as particularly usful, such as: - arithmtical oprators and usual functions: +, -, *, π, cosinus, absolut valu, ; - logical oprators: and, or, ; - st oprators: all, in, œ, (cration of a st),» (sts union), (sts intrsction), card ( ) (cardinal of a st), S (complmnt of a st), \ (subtraction of a subst), ; - oprators on tim and vnts: for, whn, whil, always, nvr, dlay btwn two vnts, duration of a tim priod, count of th numbr of vnts, vnts synchronization; - ddicatd oprators: >, <,, (thrsholds), Õ, à (domain inclusion), D (ramp), A (accumulation), frq ( ) (frquncy). Among this (non-xhaustiv) list, som oprators rfr to wll-known concpts in mathmatics or computr programming, whil othr corrspond to oprators mor spcific to th modling of proprtis for physical systms. Th aim of th following sctions is to giv a bttr insight into ths ddicatd oprators by furnishing thir mathmatical dscription and illustrating thir uss. Thir implmntation in Modlica will thn b furthr discussd in Sction Thrshold oprator Dfinition 4: Th thrshold oprator dfins a lowr (or an uppr) limit that a variabl should not xcd. This oprator may b usd to build a tim locator or a condition. Exampls: In th cas of an hat xchangr, an xtrnal lakag may appar if th prssur and th tmpratur both xcd givn maximum valus. An intrnal lakag may also occur if th numbr of cycls is suprior to a spcific limit. Air baring can b dstructd if its rotational spd crosss a maximum valu. If th Mach numbr is suprior to a spcific limit, th modl of an air pip may prdict prssur losss with lss confidnc.

8 3.3.2 Domain inclusion oprator Dfinition 5: Th domain inclusion oprator dfins a continuous and dlimitd ara that variabls should not go byond. It can b sn as th gnralization of th thrshold oprator to th multi-variabl cas. This oprator may b usd to build a condition. Th dlimitd ara may b dfind by a st of givn valus or an analytical xprssion. Exampls: Figur 3 shows diffrnt (prssur ratio, rducd airflow) domains for a cntrifugal comprssor: th grn ara stands for th nominal oprating domain whras th orang and th rd ons dnot rspctivly th rstrictd and th dstructiv domains. Figur 3: Exampl of a (prssur ratio, rducd airflow)-map for a cntrifugal comprssor Oprator for monitoring a rat of chang Dfinition 6: Th ramp oprator can b dfind both on intnsiv and xtnsiv variabls. For an G i t (rsp. xtnsibl variabl intnsiv variabl ( ) G ( t) ), it provids th volution of G i ( t) (rsp. G ( t) ) pr tim unit during th tim priod [ t ] such as: ( G, t t ) i, ( G, t t ), G = i G = G ( t ) G ( t ) t t i ( t ) G ( t ) ( t ) ( t t ),t Exampls: In a hating systm, th tmpratur incras should not xcd 3 C pr hour. Th powr should not incras mor than 2% pr hour. For an aircraft, th cabin altitud rat of chang should corrspond to crtain prssur bump duration (Figur 4). Figur 4: Exampl of a (cabin altitud rat of chang, prssur bump duration)-map to nsur passngr comfort in an aircraft Oprator for monitoring a tim intgration Dfinition 7: Th accumulation oprator is rlvant for xtnsiv variabl only. For an xtnsiv variabl t, its accumulation during th tim priod G ( ) [ ] t is dfind such that:,t (, t t ) = G ( t ) G ( t ) = Φ ( G ) A G, whr Φ ( G ) = g dnsity; k A ρ g dnots th variabl ( t) k t t k dt ν da; ρ is th mass G pr mass unit and ν is th vlocity through th surfac A of th control volum. Exampls: This oprator can b usd to monitor th cumulativ radioactiv dos which is mittd by a sub-systm in a powr plant. It may also prvnt a complt clogging of a cold hat xchangr by stting up th condition t y MassAirFlow t AirHumidit dt should b infrior to a givn valu of mass Oprator for monitoring oscillations Dfinition 8: Th frquncy oprator allows to quantify th tim priod btwn th occurrnc of som idntical vnts. Exampls: For a rgulating valv, th frquncy of its control signal should not xcd, for instanc, Hz during mor than 3 sconds in ordr to avoid any impact on th valv s Man Tim Btwn Failur. 3.4 Construction of a proprty To rcap th thortical concpts introducd abov, w can stat that a proprty can b formally dscribd as th association of thr attributs (namly a spac locator, a tim locator and a condition to b

9 satisfid) which ar built through spcific oprators from objcts providd by th bhavioral modl(s). Th following xampls srv as an illustration on how a proprty xprssd in a txtual form may b rformulatd in a formal mannr. Through som combination procsss, thy also show how complx proprtis may b ntirly dscribd from th short list of formal concpts prviously dscribd. Exampls: To avoid th Pump cavitation, th prssur at th inlt should b gratr than a minimum valu [In Pump] [for all t stat = oprating] [condition P(t) > P min ]. To nsur th prformanc of th cooling systm, at last two pumps should b oprating [In Cooling- Systm] [Always] [condition cardinal (st (Pump stat = oprating) ) 2]. To avoid th turbin whl rosion, no liquid watr should ntr at th inlt during mor than 3 minuts [In Turbin][Always][condition duration (Inlt- Watr.stat = liquid) 3 minuts]. 4.. Purpos of th library Th aim of th library is to mak chcks on parts of an architctur dfind by a Modlica bhavioral modl. Its particular faturs ar th following: - It nabls chcks during simulations, gts and stors information in cas of dtctd dfct for actions (.g. stops th simulation and starts th nxt on according to spcifid critria); - It nabls rus of th proprtis by paramtrizing thm according to th potntial uss of th modl (.g. mission profil, spcific boundary or nvironmntal conditions ), stors th proprtis in a catalog for rus; - It nabls dysfunctional analysis: chck of proprtis must not influnc modl simulation (.g. potntial chang of tim stp coming from proprtis valuation must not lad to an unwantd dcras of rsults accuracy). But, proprtis could b usd to chang th bhavior of modls with dfct (dtctd by proprtis obsrvrs). In this cas modls should b modld with diffrnt bhaviors which could b activatd on dmand (with currntly smooth chang btwn bhaviors du to th chang of th quation structur). Th major particularity is that chcks ar not don as post-procssing, but on th fly at run-tim Us-Cas: Environmntal Control Systm (ECS) Th simpl ECS usd for tsting proprtis is dfind by two main parts: () th Cold Air Unit (CAU), mad of pips, hat xchangrs, comprssors and turbins, and which controls air charactristics providd to th cabin and bays; (2) th bld, which provids air from th ngins to th CAU (Figur 5). 4 Modling of proprtis in a Modlica framwork First, a Modlica library ddicatd to th modling of proprtis that has bn dvlopd during th EuroSysLib projct is prsntd and illustratd on an industrial us-cas. Thn, th currnt limitations of this library ar discussd. Finally, a rational for a Modlica languag xtnsion to support proprtis chcking by formal proof is givn. 4. Modling of proprtis with a ddicatd Modlica library Figur 5: Cold Air Unit and Bld of th Environmntal Control Systm Th ECS must b compliant with many rquirmnts. Ths rquirmnts ar classifid according to 6 catgoris:. thrshold monitoring, which dals with crossing of thrshold (s paragraph 3.3. for xampls of proprtis on th hat xchangr, air baring and pips);

10 2. oprating domain monitoring, which mainly dals with conditions rgarding th location of coupl of valus (or mor) insid a dfind ara or insid a volum. Currntly only rquirmnts rgarding 2D ara is dfind hr, but conditions with mor than two dimnsions could occur (s paragraph for xampl of allowd domains for a comprssor); 3. rat of chang monitoring, which dals with conditions with drivativs (s paragraph for critria concrning th cabin altitud rat of chang); 4. accumulation monitoring, which dals with conditions with intgration (s paragraph for xampl of a condition to prvnt th clogging of th xchangr); 5. oscillation monitoring, which dals with conditions basd on oscillation charactrizations (occurrncs, frquncis) (s paragraph for th xampl of a rgulating valv); 6. monitoring with spac/tim locators, which tst conditions linkd to location of componnts or vnts (s paragraph 3.4 for th xampl of a proprty to avoid turbin whl rosion) Structur of th library Th prsntd library is currntly ddicatd to th ECS us-cas (with bhavioral componnts dvlopd by Dassault-Aviation) and proprtis obsrvrs. This us-cas appars hr as a library dividd into two main parts (Figur 6):. A gnric part, calld ProprtyObsrvation. It contains: a. xampls, spcially modls from DLR, which propos two ways (a dirct link or a bus) for conncting th proprtis to th ECS modl. b. th ECS modl using th scond typ of proprtis connction sinc it appars as th most gnralizd and radabl way for complx systms involving numrous proprtis. 2. A scond part which contains us-cass. It is split into modls and rquirmnts: a. Th modls ar hr focusd on an ECS systm simulatd with dry or moist air; b. Th proprtis ar a collction of spcific proprtis built as gnrically as possibl and classifid into svral typs of proprtis. Figur 6: Th two main parts of th library 4..4 Procss for proprtis modling and chcking Conncting modls to proprtis Whn a systm must b chckd rgarding its complianc with rquirmnts, a good procss is to intgrat th modl insid a virtual tst bnch by xtnding it. In this way th modl can b chckd according to svral sts of rquirmnts. An xpandabl bus calld RquirmntBus is addd to th modls by drag and drop from th library. Rquirmnts or sts of rquirmnts ar thn connctd to th RquirmntBus. Paramtrs of th rquirmnts can b adjustd according to th analysis. All valus which must b providd by th modl ar thn automatically availabl on th bus.

11 Hirarchical dcomposition of proprtis Rquirmnts may b complx with many lmnts. Thrfor putting all rquirmnts at th sam lvl may b cumbrsom. Figur 7: ECS us-cas All th ncssary intrfacs must thn b dfind on by on using componnts calld Modlica.Blocks.Sourcs.RalExprssion from th Modlica Standard Library. Th componnt RalExprssion must b linkd to a variabl in th modl as in Figur 8 for th cabin prssur. Figur 8: Exampl of valu of a componnt RalExprssion Whn conncting th componnt, a window appars for mapping variabl slctions (Figur 9). It allows th usr to slct which variabl must b mappd to th componnt RalExprssion. Figur 9: Window apparing for conncting RalExprssion to input variabl within Rquirmnts Figur : Rquirmnts for a hat xchangr A simpl xampl on th ECS hat xchangr is shown in Figur whr th proprtis ar composd of thr main conditions: - chckcycldcondition: counts th numbr of prssur cycls sn by th hat xchangr and sts a warning whn this numbr is uppr a thrshold; - chckmchanicalstrngth: computs an quivalnt strss within th hat xchangr and compars it to an allowd maximum strss; - chckicingcondition, chckdicingcondition and chckhxwatr: chck icing and dicing conditions, and th amount of watr insid th hat xchangr. Typically, if th mass of watr is abov a limit, th hat xchangr could b partially cloggd and th simulation could b not valid if th bhavioral modl is not adaptd to this particular situation. Whn attaining this oprating condition, it is intrsting to continu th simulation with th proprly modifid bhavioral modl to analyz th consquncs of bing outsid of th nominal domain (dysfunctional analysis). Ths rquirmnts stand for th hat xchangr but all th typs of proprtis dfind in Sction 3 hav bn invstigatd within th complt ECS us-cas.

12 In fact, many othr proprtis obsrvrs could b addd and if w considr obsrvrs of othr componnts or sub-systms it sms to b cumbrsom to put thm all in th sam viw. Thrfor th library has bn nhancd to support hirarchical dcomposition of proprtis. In particular a componnt calld UpprLvl has bn introducd to transmit th rsult as an OR function of its inputs Unit tst for a hat xchangr Proprtis componnts hav bn tstd with spcifid inputs to chck that thir bhaviors wr corrct. Figur shows diffrnt proprtis stats for a hat xchangr. During simulation, th visual indicator stays grn as long as no dfct is dtctd (stat ). Whn a dfct occurs, th dg of th indicator turns to rd (stat 2) and gos back to grn as soon as th dfct dtction disappars. To kp th mmory of a dfct dtctd during th simulation, anothr outsid rd squar is addd and rmains until th nd of th simulation (stat 3). (a) Stat (b) Stat 2 (c) Stat 3 Figur : Warning indicators of a st of proprtis For a dtaild analysis, it is possibl to accss th intrnal warning indicators of ach proprty as shown in Figur 2. Figur 2: Intrnal warning obtaind at th lowr lvl of rquirmnts (dtaild lvl) It is also possibl to invstigat mor dply what has happnd by plotting all variabls of intrst. 5 Formal modling of proprtis with Modlica languag xtnsions Th prvious sction has shown that th dvlopmnt of a ddicatd Modlica library is fficint to modl th main proprtis implid in th ECS industrial us-cas. Two currnt limitations hav howvr to b mntiond. Firstly, vn simpl proprtis cannot b modld as soon as thy imply spac or tim locators. Exampls : Currntly th following proprtis cannot b modld. [In Turbin] [Always] [condition duration (InltWatr.stat = liquid) 3 minuts] [In CoolingSystm] [Always] [condition cardinal (st (Pump stat = oprating)) 2]. Scondly, vn if th proprtis library faturs th all main oprators ndd to modl proprtis, it only supports th construction of th proprtis in a block-diagram way: many componnts must b connctd to form on simpl proprty. This approach is quit in contradiction with th Modlica spirit as it mphasizs a graphical modling approach ovr a formal quation modling approach. Thrfor, it dos not comply with th fundamntal rquirmnts for th formal dscription of proprtis. This lads to svral potntial limitations, such as th impossibility to chck proprtis by static proofs, or th impractical association of validity domains to bhavioural quations. As for th modling of th physical bhaviors, a formal (i.. an quation-basd) approach prsnts numrous advantags to modl proprtis (Figur 3).

13 Bhavioural modling Proprtis modling Stat-quation for phi Stat-quation for p m Output-quation Block-diagram modling modl DCmotor paramtr Ral R=8.; paramtr Ral L=.; paramtr Ral kc=.3; paramtr Ral J m=.8; paramtr Ral b m =.; Ral phi, p m, w m; Ral u=; quation dr(phi) = -R*phi/L-kc*p m /J m +u dr(p m) = kc*phi/l b m*p m/j m w m= p m/j m nd DCmotor; Formal modling proprty SRI paramtr Ral RampQmax=; paramtr Domain domainqt= [5,25;38,25;5,3355;38,3355]; Ral Q, T; quation ramp(q)< RampQmax; domainmonitoring(q,t,domainqt); nd SRI; A formal xprssion nhancs rus and lgibility Figur 3: Advantag of a formal (quation-basd) approach for bhavioral and proprtis modls A formal dscription allows to: - provid xplicit and unambiguous spcification of proprtis and thus avoid som potntial misundrstandings and mistaks; - nhanc th lgibility and so th rus of th proprtis modls; - improv th tst covrag by automating th chcking procdurs; - nabl som static tsts (i.. tsts prformd without any simulation) on th cohrnc and th compltnss of th proprtis. - associat validity domains to bhavioural - quations, and prform various chcks on thm. Exampls: For a modl whr th two proprtis [In Pump][Always][condition P(t) > P min ] (to avoid pump cavitation) and [Always][condition P(t) < P max ] (to guarant th flow dirction of radioactiv laks) should b satisfid, a first chck should nsur that thr is no contradiction btwn th numrical valus of P min and P max. In anothr modl, if th two following proprtis [For C < T < 5 C][condition ] and [For 22 C < T < 38 C][condition ] should b fulfilld, on may wondr if thr is som incompltnss in th rquirmnts and what should happn whn th tmpratur is btwn 5 C and 22 C. Hnc modling th proprtis with an quationbasd approach will giv th possibility to prform formal transformations and vrifications on both th proprtis and bhavioral modls. This will contribut gratly to improv systm validation by incrasing th covrag and th rigor of th vrifications. Th us of Modlica for that purpos may only b don by introducing nativly in th languag th concpts of spac/tim locators and ddicatd oprators. 6 Conclusions In ordr to improv th V&V procss, this articl dals with th modling and chcking of systm proprtis. Th study is mad within a fully Modlica-basd framwork and ncompasss with th trm proprty th modlling of any rquirmnt/limitation th nginr wants to xprss on its systm/subsystm/componnt or on its modl/submodl. Imagind as complmntary to th ModlicaML approach, modlling systm proprtis dirctly in Modlica is justifid hr as a dsir to: () us an quation-basd languag to xprss th proprtis in an unambiguous way; (2) choos a formalism closd to th on usd for xprssing th physical quations in ordr to as th formulation of th validity domains of th modls. Aftr having introducd som thortical concpts to formally dscrib a proprty, som rquirmnts hav bn listd on how th proprtis and th bhavioural modls should communicat to chck virtually whthr th proprtis ar satisfid or not. Th dvlopmnt of a Modlica library ddicatd to th modlling of proprtis has thn bn xplaind and illustratd on an industrial xampl takn from th aronautics domain. Evn if svral oprators hav bn spcially built to covr th most typs of proprtis, two currnt limitations hav howvr to b raisd: () vn simpl proprtis cannot b modld as soon as thy imply som spac or tim locators; (2) th proprtis ar actually modld in a block-diagram way which is inconsistnt with th ambition of prforming formal proofs. Furthr work has thn to b invstigatd to mak up for ths aspcts and concrt proposals should b mad to introduc nativly in th Modlica languag th concpts of spac/tim locators and ddicatd oprators. Acknowldgmnts This work was partially supportd by th pan- Europan ITEA2 program and th Frnch govrnmnt through th EuroSysLib projct. Rfrncs [] Information availabl on th Modlica Association wb sit:

14 [2] P. Fritzson, Principls of Objct-Orintd Modling and Simulation with Modlica 2., Wily IEE Prss, 944 pags, Fbruary 24. [3] Information availabl on th OpnProd wb sit: [4] Information availabl on th official UML wb sit: [5] W. Schamai, P. Fritzson, C. Pardis, A. Pop, Towards Unifid Systm Modling and Simulation with ModlicaML: Modling of Excutabl Bhavior Using Graphical Notations, in Procdings of th 7 th Modlica Confrnc, Como, Italy, Sptmbr 2-22, 29. [6] W. Schamai, Modlica Modling Languag (ModlicaML): A UML Profil for Modlica, tchnical rport in Computr and Information Scinc, n 29:5, Linköping Univrsity Elctronic Prss, 49 pags, 29. [7] Information availabl on th EuroSysLib wb sit: [8] Proprty Spcification Languag Rfrnc Manual, Accllra tchnical rport, USA, Jun 24. [9] Dymola softwar, Dassault Systèms, information availabl at: [] D. Harl, Statcharts: A visual formalism for complx systms, in Scinc of Computr Programming, 8(3):23-274, Jun 987. [] W. Schamai, P. Hll, P. Fritzson, C. Pardis, Virtual Vrification of Systms Dsign against Systm Rquirmnts A Mthod Proposal, in Procdings of th 3 rd Intrnational Workshop on Modl Basd Architcturing and Construction of Embddd Systms (ACES 2), in conjunction with MODELS 2, Oslo, Norway, Octobr 4, 2. [2] T. Myrs, P. Fritzson, R.G. Dromy, Samlssly Intgrating Softwar & Hardwar Modlling for Larg-Scal Systms, in Procdings of th 2 nd Intrnational Workshop on Equation-Basd Objct-Orintd Modling Languags and Tools (EOOLT 28), Paphos, Cyprus, July 8, 28. [3] Eurosyslib swp7. DGT683B Dysfunctional Us Cass and Usr Rquirmnts, 2. [4] EuroSysLib swp7. DGT2468 Proprtis Evaluation Rport, 2. [5] EuroSysLib swp7. Proprtis Modling, 2.