Formal change impact analyses for emulated control software

Processor emulators are a software tool for allowing legacy computer programs to be executed on a modern processor. In the past emulators have been used in trivial applications such as maintenance of video games. Now, however, processor emulation is being applied to safety-critical control systems, including military avionics. These applications demand utmost guarantees of correctness, but no verification techniques exist for proving that an emulated system preserves the original system’s functional and timing properties. Here we show how this can be done by combining concepts previously used for reasoning about real-time program compilation, coupled with an understanding of the new and old software architectures. In particular, we show how both the old and new systems can be given a common semantics, thus allowing their behaviours to be compared directly.

Multi-valued control problems and mixture density network

We have proposed a novel robust inversion-based neurocontroller that searches for the optimal control law by sampling from the estimated Gaussian distribution of the inverse plant model. However, for problems involving the prediction of continuous variables, a Gaussian model approximation provides only a very limited description of the properties of the inverse model. This is usually the case for problems in which the mapping to be learned is multi-valued or involves hysteritic transfer characteristics. This often arises in the solution of inverse plant models. In order to obtain a complete description of the inverse model, a more general multicomponent distributions must be modeled. In this paper we test whether our proposed sampling approach can be used when considering an arbitrary conditional probability distributions. These arbitrary distributions will be modeled by a mixture density network. Importance sampling provides a structured and principled approach to constrain the complexity of the search space for the ideal control law. The effectiveness of the importance sampling from an arbitrary conditional probability distribution will be demonstrated using a simple single input single output static nonlinear system with hysteretic characteristics in the inverse plant model.

Probability distribution modelling to improve stability in nonlinear MIMO control

We consider the direct adaptive inverse control of nonlinear multivariable systems with different delays between every input-output pair. In direct adaptive inverse control, the inverse mapping is learned from examples of input-output pairs. This makes the obtained controller sub optimal, since the network may have to learn the response of the plant over a larger operational range than necessary. Moreover, in certain applications, the control problem can be redundant, implying that the inverse problem is ill posed. In this paper we propose a new algorithm which allows estimating and exploiting uncertainty in nonlinear multivariable control systems. This approach allows us to model strongly non-Gaussian distribution of control signals as well as processes with hysteresis. The proposed algorithm circumvents the dynamic programming problem by using the predicted neural network uncertainty to localise the possible control solutions to consider.

Responsive systems:an introduction

This paper introduces responsive systems: systems that are real-time, event-based, or time-dependent. There are a number of trends that are accelerating the adoption of responsive systems: timeliness requirements for business information systems are becoming more prevalent, embedded systems are increasingly integrated into soft real-time command-and-control systems, improved message-oriented middleware is facilitating growth in event-processing applications, and advances in service-oriented and component-based techniques are lowering the costs of developing and deploying responsive applications. The use of responsive systems is illustrated here in two application areas: the defense industry and online gaming. The papers in this special issue of the IBM Systems Journal are then introduced. The paper concludes with a discussion of the key remaining challenges in this area and ideas for further work.

Sympathetic inhibition of accommodation after sustained nearwork in subjects with myopia and emmetropia

PURPOSE. The purposes of the present study were to assess the effect of a sympathetic inhibitory pharmacologic agent, timolol maleate, on the magnitude of nearwork-induced transient myopia (NITM) and its decay in different refractive groups for an extended near task duration and to determine the proportion of the young adult population manifesting effective sympathetic access under naturalistic closed-loop viewing conditions. METHODS. Ten subjects with emmetropia and 10 with myopia were tested. They read binocularly for 1 hour at a distance of 35 to 40 cm. NITM was calculated as the difference in distance refractive state after task as compared with before task immediately after reading. All subjects received timolol maleate to block the sympathetic nervous system and betaxolol as a control agent in independent test sessions separated by at least 3 days. Forty minutes after drug instillation, the NITM measurement procedure was repeated. RESULTS. Initial NITM magnitude was larger in subjects with myopia than in subjects with emmetropia before and after timolol instillation. Furthermore, NITM magnitude in subjects with sympathetic access was increased after timolol instillation. In contrast, with the control agent betaxolol, there was no increase. NITM decay duration to baseline was increased after timolol instillation in the subjects with myopia only. Only 15% of the subjects (n = 3 subjects with myopia) demonstrated effective and significant access to sympathetic facility. CONCLUSIONS. Subjects with myopia demonstrated an increase in decay duration with timolol, thus suggesting impaired sympathetic inhibition of accommodation. This may be a precursor for myopia progression in some persons.

The design of robust protocols for distributed real-time systems

Modern distributed control systems comprise of a set of processors which are interconnected using a suitable communication network. For use in real-time control environments, such systems must be deterministic and generate specified responses within critical timing constraints. Also, they should be sufficiently robust to survive predictable events such as communication or processor faults. This thesis considers the problem of coordinating and synchronizing a distributed real-time control system under normal and abnormal conditions. Distributed control systems need to periodically coordinate the actions of several autonomous sites. Often the type of coordination required is the all or nothing property of an atomic action. Atomic commit protocols have been used to achieve this atomicity in distributed database systems which are not subject to deadlines. This thesis addresses the problem of applying time constraints to atomic commit protocols so that decisions can be made within a deadline. A modified protocol is proposed which is suitable for real-time applications. The thesis also addresses the problem of ensuring that atomicity is provided even if processor or communication failures occur. Previous work has considered the design of atomic commit protocols for use in non time critical distributed database systems. However, in a distributed real-time control system a fault must not allow stringent timing constraints to be violated. This thesis proposes commit protocols using synchronous communications which can be made resilient to a single processor or communication failure and still satisfy deadlines. Previous formal models used to design commit protocols have had adequate state coverability but have omitted timing properties. They also assumed that sites communicated asynchronously and omitted the communications from the model. Timed Petri nets are used in this thesis to specify and design the proposed protocols which are analysed for consistency and timeliness. Also the communication system is mcxielled within the Petri net specifications so that communication failures can be included in the analysis. Analysis of the Timed Petri net and the associated reachability tree is used to show the proposed protocols always terminate consistently and satisfy timing constraints. Finally the applications of this work are described. Two different types of applications are considered, real-time databases and real-time control systems. It is shown that it may be advantageous to use synchronous communications in distributed database systems, especially if predictable response times are required. Emphasis is given to the application of the developed commit protocols to real-time control systems. Using the same analysis techniques as those used for the design of the protocols it can be shown that the overall system performs as expected both functionally and temporally.

The development of hard real-time systems using a formal approach

Hard real-time systems are a class of computer control systems that must react to demands of their environment by providing `correct' and timely responses. Since these systems are increasingly being used in systems with safety implications, it is crucial that they are designed and developed to operate in a correct manner. This thesis is concerned with developing formal techniques that allow the specification, verification and design of hard real-time systems. Formal techniques for hard real-time systems must be capable of capturing the system's functional and performance requirements, and previous work has proposed a number of techniques which range from the mathematically intensive to those with some mathematical content. This thesis develops formal techniques that contain both an informal and a formal component because it is considered that the informality provides ease of understanding and the formality allows precise specification and verification. Specifically, the combination of Petri nets and temporal logic is considered for the specification and verification of hard real-time systems. Approaches that combine Petri nets and temporal logic by allowing a consistent translation between each formalism are examined. Previously, such techniques have been applied to the formal analysis of concurrent systems. This thesis adapts these techniques for use in the modelling, design and formal analysis of hard real-time systems. The techniques are applied to the problem of specifying a controller for a high-speed manufacturing system. It is shown that they can be used to prove liveness and safety properties, including qualitative aspects of system performance. The problem of verifying quantitative real-time properties is addressed by developing a further technique which combines the formalisms of timed Petri nets and real-time temporal logic. A unifying feature of these techniques is the common temporal description of the Petri net. A common problem with Petri net based techniques is the complexity problems associated with generating the reachability graph. This thesis addresses this problem by using concurrency sets to generate a partial reachability graph pertaining to a particular state. These sets also allows each state to be checked for the presence of inconsistencies and hazards. The problem of designing a controller for the high-speed manufacturing system is also considered. The approach adopted mvolves the use of a model-based controller: This type of controller uses the Petri net models developed, thus preservIng the properties already proven of the controller. It. also contains a model of the physical system which is synchronised to the real application to provide timely responses. The various way of forming the synchronization between these processes is considered and the resulting nets are analysed using concurrency sets.

A formal methodology for the verification of concurrent systems

There is an increasing emphasis on the use of software to control safety critical plants for a wide area of applications. The importance of ensuring the correct operation of such potentially hazardous systems points to an emphasis on the verification of the system relative to a suitably secure specification. However, the process of verification is often made more complex by the concurrency and real-time considerations which are inherent in many applications. A response to this is the use of formal methods for the specification and verification of safety critical control systems. These provide a mathematical representation of a system which permits reasoning about its properties. This thesis investigates the use of the formal method Communicating Sequential Processes (CSP) for the verification of a safety critical control application. CSP is a discrete event based process algebra which has a compositional axiomatic semantics that supports verification by formal proof. The application is an industrial case study which concerns the concurrent control of a real-time high speed mechanism. It is seen from the case study that the axiomatic verification method employed is complex. It requires the user to have a relatively comprehensive understanding of the nature of the proof system and the application. By making a series of observations the thesis notes that CSP possesses the scope to support a more procedural approach to verification in the form of testing. This thesis investigates the technique of testing and proposes the method of Ideal Test Sets. By exploiting the underlying structure of the CSP semantic model it is shown that for certain processes and specifications the obligation of verification can be reduced to that of testing the specification over a finite subset of the behaviours of the process.

Computer control of machines utilising independent drive mechanisms

The thesis describes an investigation into methods for the specification, design and implementation of computer control systems for flexible manufacturing machines comprising multiple, independent, electromechanically-driven mechanisms. An analysis is made of the elements of conventional mechanically-coupled machines in order that the operational functions of these elements may be identified. This analysis is used to define the scope of requirements necessary to specify the format, function and operation of a flexible, independently driven mechanism machine. A discussion of how this type of machine can accommodate modern manufacturing needs of high-speed and flexibility is presented. A sequential method of capturing requirements for such machines is detailed based on a hierarchical partitioning of machine requirements from product to independent drive mechanism. A classification of mechanisms using notations, including Data flow diagrams and Petri-nets, is described which supports capture and allows validation of requirements. A generic design for a modular, IDM machine controller is derived based upon hierarchy of control identified in these machines. A two mechanism experimental machine is detailed which is used to demonstrate the application of the specification, design and implementation techniques. A computer controller prototype and a fully flexible implementation for the IDM machine, based on Petri-net models described using the concurrent programming language Occam, is detailed. The ability of this modular computer controller to support flexible, safe and fault-tolerant operation of the two intermittent motion, discrete-synchronisation independent drive mechanisms is presented. The application of the machine development methodology to industrial projects is established.

Autonomic correlates of ocular accommodation and cardiovascular function

PURPOSE: To evaluate the hypothesis that objective measures of open- and closed-loop ocular accommodation are related to systemic cardiovascular function, and ipso facto autonomic nervous system activity. METHODS: Sixty subjects (29 male; 31 female) varying in age from 18 to 33 years (average: 20.3 +/- 2.9 years) with a range of refractive errors [mean spherical equivalent (MSE): -7.12 to +1.82 D] participated in the study. Five 20-s continuous objective recordings of the accommodative response, measured with an open-view IR autorefractor (Shin-Nippon SRW-5000), were obtained for a variety of open- and closed-loop accommodative demands while simultaneous continuous measurement of heart rate was recorded with a finger-mounted piezo-electric pulse transducer for 5 min. Fast Fourier Transformation of cardiovascular function allowed the absolute and relative power of the autonomic components to be assessed in the frequency-domain, whereas heart period gave an indication of the time-domain response. RESULTS: Increasing closed-loop accommodative demand led to a concurrent increase in heart rate of approximately 2 beats/min for a 4.0 D increase in accommodative demand. The increase was attributable to a reduction in the absolute (p < 0.05) and normalised (p < 0.001) input of the systemic parasympathetic nervous system, and was unaffected by refractive group. The interaction with refractive group failed to reach significance. CONCLUSIONS: For sustained accommodation effort, the data demonstrate covariation between the oculomotor and cardiovascular systems which implies that a near visual task can significantly influence cardiovascular behaviour. Accommodative effort alone, however, is not a sufficient stimulus to induce autonomic differences between refractive groups. The data suggest that both the oculomotor and cardiovascular systems are predominantly attributable to changes in the systemic parasympathetic nervous system.

An experimental analysis of operating conditions in cold roll-forming

A detailed literature survey confirmed cold roll-forming to be a complex and little understood process. In spite of its growing value, the process remains largely un-automated with few principles used in set-up of the rolling mill. This work concentrates on experimental investigations of operating conditions in order to gain a scientific understanding of the process. The operating conditions are; inter-pass distance, roll load, roll speed, horizontal roll alignment. Fifty tests have been carried out under varied operating conditions, measuring section quality and longitudinal straining to give a picture of bending. A channel section was chosen for its simplicity and compatibility with previous work. Quality measurements were measured in terms of vertical bow, twist and cross-sectional geometric accuracy, and a complete method of classifying quality has been devised. The longitudinal strain profile was recorded, by the use of strain gauges attached to the strip surface at five locations. Parameter control is shown to be important in allowing consistency in section quality. At present rolling mills are constructed with large tolerances on operating conditions. By reduction of the variability in parameters, section consistency is maintained and mill down-time is reduced. Roll load, alignment and differential roll speed are all shown to affect quality, and can be used to control quality. Set-up time is reduced by improving the design of the mill so that parameter values can be measured and set, without the need for judgment by eye. Values of parameters can be guided by models of the process, although elements of experience are still unavoidable. Despite increased parameter control, section quality is variable, if only due to variability in strip material properties. Parameters must therefore be changed during rolling. Ideally this can take place by closed-loop feedback control. Future work lies in overcoming the problems connected with this control.

Autonomic, biometric and oculomotor correlates of myopia in young adults

The principal work reported in this thesis is the examination of autonomic profile of ciliary muscle innervation as a risk factor in myopia development. Deficiency in sympathetic inhibitory control of accommodation has been proposed as a contributory factor in the development of late onset myopia (LOM). Complementary measurements of ocular biometry, oculomotor function and dynamic accommodation response were carried out on the same subject cohort, thus allowing cross-correlation of these factors with. autonomic profile. Subjects were undergraduate and postgraduate students of Aston University. A 2.5 year longitudinal study of refractive error progression in 40 subjects revealed the onset of LOM in 10, initially emmetropic, young adult subjects (age range 18-24 years) undertaking substantial amounts of near work. A controlled, double blind experimental protocol was conducted concurrently to measure post-task open-loop accommodative regression following distance (0 D) or near (3 D above baseline tonic accommodation) closed-loop tasks of short (10 second) or long (3 minute) duration. Closed-loop tasks consisted of observation of a high contrast Maltese cross target; open-loop conditions were imposed by observation of a 0.2 c/deg Difference of Gaussian target. Accommodation responses were recorded continuously at 42 Hz using a modified Shin-Nippon SRW-5000 open-view infra-red optometer. Blockade of the sympathetic branch of accommodative control was achieved by topical instillation of the non-selective b-adrenoceptor antagonist timolol maleate. Betaxolol hydrochloride (non-selective b1-adrenoceptor antagonist) and normal saline were employed as control agents. Retarded open-loop accommodative regression under b2 blockade following the 3 minute near task indicated the presence of sympathetic facility. Sympathetic inhibitory facility in accommodation control was found in similar proportions between LOM and stable emmetropic subjects. A cross-sectional study (N=60) of autonomic profile showed that sympathetic innervation of ciliary muscle is present in similar proportions between emmetropes, early-, and late-onset myopes. Sympathetic facility was identified in 27% of emmetropes, 21% of EOMs and 29% of LOMs.

A contingency theory perspective on the risk management control system within Birmingham City Council

In recent years the topic of risk management has moved up the agenda of both government and industry, and private sector initiatives to improve risk and internal control systems have been mirrored by similar promptings for change in the public sector. Both regulators and practitioners now view risk management as an integral part of the process of corporate governance, and an aid to the achievement of strategic objectives. The paper uses case study material on the risk management control system at Birmingham City Council to extend existing theory by developing a contingency theory for the public sector. The case demonstrates that whilst the structure of the control system fits a generic model, the operational details indicate that controls are contingent upon three core variables—central government policies, information and communication technology and organisational size. All three contingent variables are suitable for testing the theory across the broader public sector arena.

Modelling of wastewater treatment plants:how far shall we go with sophisticated modelling tools?

Several levels of complexity are available for modelling of wastewater treatment plants. Modelling local effects rely on computational fluid dynamics (CFD) approaches whereas activated sludge models (ASM) represent the global methodology. By applying both modelling approaches to pilot plant and full scale systems, this paper evaluates the value of each method and especially their potential combination. Model structure identification for ASM is discussed based on a full-scale closed loop oxidation ditch modelling. It is illustrated how and for what circumstances information obtained via CFD (computational fluid dynamics) analysis, residence time distribution (RTD) and other experimental means can be used. Furthermore, CFD analysis of the multiphase flow mechanisms is employed to obtain a correct description of the oxygenation capacity of the system studied, including an easy implementation of this information in the classical ASM modelling (e.g. oxygen transfer). The combination of CFD and activated sludge modelling of wastewater treatment processes is applied to three reactor configurations, a perfectly mixed reactor, a pilot scale activated sludge basin (ASB) and a real scale ASB. The application of the biological models to the CFD model is validated against experimentation for the pilot scale ASB and against a classical global ASM model response. A first step in the evaluation of the potential of the combined CFD-ASM model is performed using a full scale oxidation ditch system as testing scenario.