1. Anaïs GUIGNARD LURPA, ENS Cachan Validation of logic controllers from event observation in a closed-loop system Réunion VACSIM - 14 Octobre 2014

2. Validation of logic controllers Réunion VACSIM - 14 Octobre 2014 Validation : Am I building the right product ? [Boehm,79] : Software engineering: R&D trends and defense needs, Research directions in software technology, 1979 Implemented controller 2 Motivation

3. Usual techniques Using a model of the controller: Model-checking Simulation Using an implemented controller: Conformance test Closed-loop validation Réunion VACSIM - 14 Octobre 2014 3 Motivation

4. Validation techniques with real controller Conformance test: Closed-loop validation: Réunion VACSIM - 14 Octobre 2014 Specification model Closed-loop system Closed-loop system model Comparizon 4 Motivation

5. Validation techniques with real controller Conformance test: Closed-loop validation: ProsCons Whole behavior tested according to a defined objective Adapted to safety properties Isolated from the controller Length of the test sequence ProsCons Controller coupled to the plant State of space to validate reduced Adapted to reachability properties Plant of simulated plant required No a priori knowledge of the reachable state of space Réunion VACSIM - 14 Octobre 2014 5 Motivation

6. Field of application Objective of this work: A new method for controllers validation based on closed-loop system observation Some assumptions: Specification model is complete and deterministic The controller is a black-box Only input and output variables of the controller can be observed Observation performed by copying inputs and outputs read and sent by the controller Réunion VACSIM - 14 Octobre 2014 6 Motivation

7. Observation inside the controller Controller Plant or a Observer + Analyzer Verdict OK or KO Réunion VACSIM - 14 Octobre 2014 7 Method overall

8. Closed-loop validation Réunion VACSIM - 14 Octobre 2014 Accepted languages 8 Method overall

9. Closed-loop system language Accepted languages Réunion VACSIM - 14 Octobre 2014 9 Method overall

10. End of observation criterion How to know when all the language has been observed ? One valid observed I/O ↔ a transition in the specification model Transitions fired in the specification model can be counted End of observation when no more new transitions occurs Inspired from [Klein, 05] : Identification of DES for fault detection purposes, PhD Thesis, 2005 Réunion VACSIM - 14 Octobre 2014 10015050 Number of transitions Observation step 10 Method overall

11. Closed-loop system model How to build the correct model of the closed-loop system ? Transitions fired in the specification model can be counted The closed-loop system model is included in the specification model in term of states and transitions Each fired transitions in the specification model is also a transition of the closed-loop model 10015050 Number of transitions Observation step Réunion VACSIM - 14 Octobre 2014 11 Method overall

12. Detection of invalid controller A valid controller means: A controller that behaves as specified In other words: The I/O sequences observed from the controller coupled to its plant can be reproduced in the specification model An invalid behavior can then be detected: If an I/O value cannot be reproduced by the specification model If the observed I/O corresponds to a transition of the specification model, then it is a transition of the closed-loop system model Else, the controller is invalid Réunion VACSIM - 14 Octobre 2014 12 Method overall

13. Specification model Réunion VACSIM - 14 Octobre 2014 1 3 2 [e],[j],[k], [l],[m],[n], [o],[p] / [A] [j],[k],[l], [m],[n], [o],[p] / [A] [e],[f],[j],[k], [l],[m],[n], [o],[p] / [A] [a],[i] / [B] [i] / [B] [a],[i] / [B] [b],[c],[d],[f],[g],[h] / [C] [b],[c], [d],[g],[h] / [C] [a],[b],[c],[d],[e], [f],[g],[h] / [C] 5 Inputs 2 Outputs 13 Basic example

14. Construction of the closed-loop model Réunion VACSIM - 14 Octobre 2014 Number of transitions Observation step 1 3 2 [e] / [A] [i] / [B] [a] / [B] [g] / [C] [a] / [C] [g] / [C] 1 3 2 [e],[j],[k], [l],[m],[n], [o],[p] / [A] [j],[k],[l], [m],[n], [o],[p] / [A] [e],[f],[j],[k], [l],[m],[n], [o],[p] / [A] [a],[i] / [B] [i] / [B] [a],[i] / [B] [b],[c],[d],[f],[g],[h] / [C] [b],[c], [d],[g], [h] / [C] [a],[b],[c],[d],[e], [f],[g],[h] / [C] [c] / [C] 14 Basic example

15. Final closed-loop system model Réunion VACSIM - 14 Octobre 2014 10015050 Number of transitions Observation step 1 3 2 [e],[j],[k], [l] / [A] [j],[k],[l] / [A] [e],[f],[j],[k], [l] / [A] [a],[i] / [B] [i] / [B] [a],[i] / [B] [b],[c],[d],[f],[g],[h] / [C] [b],[c], [d],[g],[h] / [C] [a],[b],[c],[d],[e], [f],[g],[h] / [C] 15 Basic example

16. Non valid behavior = not in the specification model Case of a non-valid implementation Réunion VACSIM - 14 Octobre 2014 1 3 2 [e],[j],[k], [l],[m],[n], [o],[p] / [A] [j],[k],[l], [m],[n], [o],[p] / [A] [e],[f],[j],[k], [l],[m],[n], [o],[p] / [A] [a],[i] / [B] [i] / [B] [a],[i] / [B] [b],[c],[d],[f],[g],[h] / [C] [b],[c], [d],[g],[h] / [C] [a],[b],[c],[d],[e], [f],[g],[h] / [C] 16 Basic example

17. Experimental platform Industrial type process 141 inputs-outputs. 4 stations Test Feeding Stock Transformation Réunion VACSIM - 14 Octobre 2014 17 Experimental application

18. Acquisition method Process: PLC stores a copy of its I/O values Cyclic retrieval of values by a Python code (Modbus communication protocol) Off-line (in our case) analysis of the stored sequence 11001100 1110000 01001100 0001000 00001100 0001000 10001100 0001000 10001100 1110000 10011100 1001000 Plant + I/O remote modules Controller Computer Ethernet Réunion VACSIM - 14 Octobre 2014 18 Experimental application

19. Case of study Prehension system of 4 th station Chosen because of the lack of temporisations Rotation system Pliers Conveyor of 3 rd station Conveyor of 4 th station Réunion VACSIM - 14 Octobre 2014 19 Experimental application

20. Specification model 1 2 3 4 5 6 7 8 9 Réunion VACSIM - 14 Octobre 2014 20 Experimental application

21. Results Number of transitions Observation step Réunion VACSIM - 14 Octobre 2014 21 Experimental application

22. Conclusion and perspectives A new method for controllers validation: Coupled with the plant Guaranteed for the whole observed behavior Produces a formal model of the closed-loop system Perspectives: Validation of temporal properties Resilience to synchronization and desynchronization phenomena Réunion VACSIM - 14 Octobre 2014 22

23. Validation of logic controllers from event observation in a closed-loop system Réunion VACSIM - 14 Octobre 2014 Thank you for your attention Do you have any question ? 23