Christian Ellen

Modeling options for demand side participation of thermostatically controlled loads

Residential thermostatically controlled loads (TCLs) have potential for participation in electricity markets. This is because we can control a large group of these loads to achieve aggregate system behavior such as providing frequency reserves while ensuring the control actions are non-disruptive to the end users. A main challenge in controlling aggregations of TCLs is developing dynamical system models that are simple enough for optimization and control, but rich enough to capture the behavior of the loads. In this work, we propose three classes of models that approximate aggregate TCL dynamics. We analyze these models in terms of their accuracy and computational tractability. The models demonstrate a progression from models that help us analyze and predict TCL population behavior to those that help us develop large-scale automatic control strategies. Specifically, we demonstrate how formal methods from computer science and optimal control can be used to derive bounds on model error, guarantees for trajectory tracking, and algorithms for price arbitrage. We find that the accuracy of the analytic results decreases as TCL parameter heterogeneity is introduced. Thus, we motivate further development of analytical tools and modeling approaches to investigate realistic TCL behavior in power systems.

Statistical model checking for stochastic hybrid systems involving nondeterminism over continuous domains

Behavioral verification of technical systems involving both discrete and continuous components is a common and demanding task. The behavior of such systems can often be characterized using stochastic hybrid automata, leading to verification problems which can be formalized and solved using stochastic logic calculi such as stochastic satisfiability modulo theory (SSMT). While algorithms for discharging proof obligations in SSMT form exist, their applicability is limited due to the computational complexity, which often increases exponentially with the number of quantified variables. Recently, statistical model checking has been successfully applied to stochastic hybrid systems, thereby increasing the size of the system for which verification problems is tractable. However, being based on randomized simulation, these methods usually cannot handle non-determinism. In previous work, we have deviated from the usual approach of simulating the model and rather proposed a statistical method for SSMT solving which, being based on statistical AI planning algorithms, can also treat non-determinism over a finite domain. Here, we extend this previous work to the case of continuous domains. In particular, using ideas from noisy optimization, we adaptively build up a decision tree recording the findings and guiding further exploration, thereby favoring the currently most promising sub-domain. The non-determinism is resolved by translating the satisfaction problem into an optimization problem, thereby computing both optimistic and pessimistic bounds on the probability of satisfaction. At each stage of the evaluation process, we show how to obtain confidence statements about the probability of satisfaction for the overall SSMT formula, including reliable estimates on the optimal resolution of any non-deterministic choice involved.

Detecting Consistencies and Inconsistencies of Pattern-Based Functional Requirements

The formal specification of functional requirements can often lead to inconsistency as well as unintended specification, especially in the early stages within the development process. In this paper, we present a formal model checking approach which tackles both of these problems and is also applicable during the requirements elicitation phase, in which no component model is available. The presented notion of consistency ensures the existence of at least one possible run of the system, which satisfies all requirements. To avoid trivial execution traces, the ”intended” functional behavior of the requirements is triggered. The analysis is performed using model checking. More specifically, to reduce the overall analysis effort, we apply a bounded model checking scheme. If the set of requirements is inconsistent the method also identifies a maximal sub-set of consistent requirements. Alternatively, a minimal inconsistent sub-set can be computed. The approach is demonstrated on a railway crossing example using the BTC Embedded Specifier and the iSAT model checker.

Formal Synthesis and Validation of Inhomogeneous Thermostatically Controlled Loads

This work discusses the construction of a finite-space stochastic dynamical model as the aggregation of the continuous temperature dynamics of an inhomogeneous population of thermostatically controlled loads (TCLs). The temperature dynamics of a TCL is characterized by a differential equation in which the TCL status (ON, OFF) is controlled by a thresholding mechanism, and which displays inhomogeneity as its thermal resistance changes in time according to a Poisson process. In the aggregation procedure, each TCL model in the population is formally abstracted as a Markov chain, and the cross product of these Markov chains is lumped into its coarsest (exact) probabilistic bisimulation. Quite importantly, the abstraction procedure allows for the quantification of the induced error. Assuming that the TCLs explicitly depend on a control input, the contribution investigates the problem of population-level power reference tracking and load balancing. Furthermore, for the corresponding closed-loop control scheme we show how the worst case performance can be lower bounded statistically, thereby guaranteeing robustness versus power-tracking when the underlying assumption on the inhomogeneity term is relaxed.

Sequence Diagram Test Case Specification and Virtual Integration Analysis using Timed-Arc Petri Nets

In this paper, we formally define Test Case Sequence Diagrams (TCSD) as an easy-to-use means to specify test cases for components including timing constraints. These test cases are modeled using the UML2 syntax and can be specified by standard UML-modeling-tools. In a component-based design an early identification of errors can be achieved by a virtual integration of components before the actual system is build. We define such a procedure which integrates the individual test cases of the components according to the interconnections of a given architecture and checks if all specified communication sequences are consistent. Therefore, we formally define the transformation of TCSD into timed-arc Petri nets and a process for the combination of these nets. The applicability of our approach is demonstrated on an avionic use case from the ARP4761 standard.

A recipe for tool interoperability

Typical engineering and verification workflows for safety-relevant systems are performed with many different tools. For such workflows safety standards like the automotive ISO 26262 require traceability of all V&V-related work products. Therefore, efficient tool-integration, while ensuring all traceability needs for functional safety, is a highly relevant topic for industrial domains. Recent research projects like CESAR have addressed this topic by reusing tools and methods for different workflows in the context of requirements and systems engineering as well as verification and validation. This reuse is done in a Reference Technology Platform (RTP) with common services and a common understanding of exchanged information based on an Interoperability Specification (IOS). Recently, OSLC is discussed for such an IOS. The open question is how tools are connected efficiently and how traceability is ensured. This document provides a guideline on how to use the IOS for engineering workflows performed with different tools based on OSLC. We call it recipe. The recipe was developed in the MBAT project. It considers a systematic definition of semantic concepts for an IOS ensuring traceability and the level of granularity required to perform workflows with a set of tools.

Confidence bounds for statistical model checking of probabilistic hybrid systems

Model checking of technical systems is a common and demanding task. The behavior of such systems can often be characterized using hybrid automata, leading to verification problems within the first-order logic over the reals. The applicability of logic-based formalisms to a wider range of systems has recently been increased by introducing quantifiers into satisfiability modulo theory (SMT) approaches to solve such problems, especially randomized quantifiers, resulting in stochastic satisfiability modulo theory (SSMT). These quantifiers combine non-determinism and stochasticity, thereby allowing to represent models such as Markov decision processes. While algorithms for exact model checking in this setting exist, their scalability is limited due to the computational complexity which increases with the number of quantified variables. Additionally, these methods become infeasible if the domain of the quantified variables, randomized variables in particular, becomes too large or even infinite. In this paper, we present an approximation algorithm based on confidence intervals obtained from sampling which allow for an explicit trade-off between accuracy and computational effort. Although the algorithm gives only approximate results in terms of confidence intervals, it is still guaranteed to converge to the exact solution. To further increase the performance of the algorithm, we adopt search strategies based on the upper bound confidence algorithm UCB, originally used to solve a similar problem, the multi-armed bandit. Preliminary results show that the proposed algorithm can improve the performance in comparison to existing SSMT solvers, especially in the presence of many randomized quantified variables.

MTBF Inconsistency Analysis on Inferred Product Breakdown Structures

This article describes our current work on the combination of an ontology-based knowledge representation and formal analysis procedures. We use formalized system engineering knowledge and partial architectural information (induced by a set of requirements) to formalize natural language requirements and to identify inconsistencies based on this formalization. Our analysis combines requirements specified by patterns and an ontology-based product breakdown structure. As an example, we identify inconsistencies between Mean Time Between Failure (MTBF) specifications of systems and their subsystems.

Automatic transition between structural system views in a safety relevant embedded systems development process

It is mandatory to design safety relevant embedded systems in multiple structural system views. A typical example is the usage of a functional and technical system representation. A transition between these system views not only comprises the allocation of components but also copes with multiple design aspects and constraints that need to be transferred to the target perspective. Optimization goals regarding arbitrary design artifacts complicate this problem. In this paper we present a novel comprehensive approach integrating common allocation techniques together with a partial design generation in a system wide process to optimize complex system view transitions. We demonstrate our approach using the CESAR design methodology. The original system models and requirements are used as input for our procedure and the results are directly applied to the same models.