This paper is a study of decompositional proof techniques applied to the ver-iication of a model of a real world hybrid system, an aircraft landing gear. We present a formal description of these techniques (taken from Halwbachs et.al. 5]) and look at two ways of applying them. We discover, and correct , a aw in the theory, but conclude ultimately that when dealing with a plant-controller combin...

We describe our experience with modeling the landing gear system of an aircraft using the formal speci cation language Fiacre. Our model takes into account the behavior and timing properties of both the physical parts and the control software of this system. We use this formal model to check safety and real-time properties on the system but also to nd a safe bound on the maximal time needed for...

This paper presents a solution to the landing gear system case study using Event-B and Rodin. We study the whole system (both the digital part and the controlled part). We use feature augmentation to build an abstract model of the whole system and structural refinement to detail more specifically the digital part. The required safety properties are formalised and proved. We propose a specific a...

In the recent decades the number of spacecraft visiting asteroids and comets has risen. But only a few of them entered into an orbit of these small bodies and even only two had physical contact to the surface. The ESA mission Rosetta is on the way to meet the comet 67P/Churyumov-Gerasimenko in May 2014. Once in orbit the spacecraft will release the small lander Philae which is supposed to land ...

Formal veriication of safety and timing properties of engineering systems is only meaningful if based on models which are systematically derived. In this paper we report on our experience using switched bond graphs for the modelling of hardware components in hybrid systems. We present the basic ideas underlying bond graphs in general and switched bond graphs in particular. Switched bond graphs ...