Software systems are complicated, and the scientific and engineering methodologies for software development are relatively young. Cyber-physical systems are now in every corner of our lives, and we need robust methods for handling the ever-increasing complexity of their software systems. Model-Driven Development is a promising approach to tackle the complexity of systems through the concept of abstraction, enabling analysis at earlier phases of development. In this paper, we propose a model-driven approach with a focus on guaranteeing safety using formal verification. Cyber-physical systems are distributed, concurrent, asynchronous and event-based reactive systems with timing constraints. The actor-based textual modeling language, Rebeca, with model checking support is used for formal verification. Starting from structured requirements and system architecture design the behavioral models, including Rebeca models, are built. Properties of interest are also derived from the structured requirements, and then model checking is used to formally verify the properties. This process can be performed in iterations until satisfaction of desired properties are ensured, and possible ambiguities and inconsistencies in requirements are resolved. The formally verified models can then be used to develop the executable code. The Rebeca models include the details of the signals and messages that are passed at the network level including the timing, and this facilitates the generation of executable code. The natural mappings among the models for requirements, the formal models, and the executable code improve the effectiveness and efficiency of the approach.

中文翻译：

---

致力于安全关键的网络物理系统软件的验证驱动迭代开发

软件系统很复杂，并且软件开发的科学和工程方法还比较年轻。网络物理系统现在已经进入我们生活的每个角落，我们需要强大的方法来处理其软件系统日益增长的复杂性。模型驱动开发是一种通过抽象概念解决系统复杂性的有前途的方法，可以在开发的早期阶段进行分析。在本文中，我们提出了一种模型驱动的方法，重点是使用形式验证来保证安全。网络物理系统是具有时序约束的分布式，并发，异步和基于事件的反应性系统。基于角色的文本建模语言Rebeca具有模型检查支持，可用于形式验证。从结构化需求和系统架构设计开始，构建了行为模型，包括Rebeca模型。感兴趣的属性也从结构化需求中得出，然后使用模型检查来正式验证属性。此过程可以迭代执行，直到确保满足所需属性为止，并解决了需求中可能存在的歧义和不一致性。经过正式验证的模型可用于开发可执行代码。Rebeca模型包括在网络级别传递的信号和消息的详细信息（包括时序），这有助于生成可执行代码。需求模型，形式模型和可执行代码之间的自然映射提高了该方法的有效性和效率。