Symmetry-Aware Hybrid Verification for Complex Building Information Systems

Abstract

As building information model technologies become more complex and interconnected, the validation of building information models remains critical to ensure their reliability and effectiveness in practical applications. However, most of the existing research focuses on the application of building information modeling in a single domain and lacks the collaborative validation of the overall behavior of complex dynamic systems. Therefore, how to ensure the correctness and reliability of complex building systems has become a challenging issue. To solve this problem, this paper proposes a symmetry-aware hybrid validation framework that combines Timed Automata (TA), Unified Modeling Language (UML), and AnyLogic simulation to enhance the logical correctness and practical reliability of complex building information systems; the framework inherently preserves structural and temporal symmetry between formal models and dynamic simulations, ensuring consistent validation across virtual–physical interactions. Taking the Building Information Physical Model (BIPM) as an example, the method first solves the defects of traditional methods in logical consistency and reliability validation by firstly modeling the structural model and behavioral logic of the BIPM through UML normalization, transforming the behavioral logic of the BIPM into a network of TA, and realizing the formal validation of its dynamic interaction mechanism to enhance the logical correctness and practical reliability of the complex building information system. Secondly, AnyLogic is used to map the BIPM structural model into a visual simulation model, which supports the real-time dynamic display of building system behavior and performance analysis, enhances the interpretability of the model, and provides an intuitive decision-making platform for stakeholders. Finally, an empirical study of an air conditioning system as a case study shows that the method can effectively integrate formal verification and dynamic visualization techniques, providing a scalable solution for the collaborative verification of complex building systems.

1. Introduction

In recent years, building information modeling has been one of the important technological advances in the field of civil engineering, and allows for a three-dimensional description of a building and the non-destructive transfer of building information throughout the building lifecycle [1]. Building information modeling through the sharing of data between participants at different stages of the project lifecycle can improve collaboration between the various project participants in different aspects, enabling a transition from the traditional building delivery process to an integrated workflow [2]. Building information modeling technology, represented by Building Information Modeling (BIM) [3], is experiencing significant growth in global adoption. According to industry forecasts, the global BIM market is expected to reach USD 22.1 billion by 2030, with a compound annual growth rate (CAGR) of 16.3% [4]. As a core tool for digital transformation, BIM significantly improves productivity and efficiency in the architecture, engineering, construction, and operations (AECO) industry by integrating full lifecycle project information, optimizing decision-making processes, and enhancing cross-disciplinary collaboration [5]. Studies have shown that the use of BIM technology can increase the efficiency of project teams in terms of coordination, communication, and resource management while reducing design conflicts and construction rework [6]. For example, Poirier et al. [7], in their study of 35 construction projects, documented a 75–240% increase in labor productivity due to the adoption of BIM. It is not hard to see that building information modeling technology provides key underpinning for the sustainable development of the industry.

With the rapid growth of the new demand for dynamic interaction and synergy between building virtual and reality, the technical means of building information modeling has been developed from initial BIM to digital twin (DT) [8], Geographic Information Systems (GISs) [9], and Building Information Physical Model (BIPM) [10,11]. Advances in building information modeling reflect the industry’s shift towards more integrated, real-time, and high-fidelity modeling approaches that bridge the gap between physical and virtual environments. In particular, BIPM incorporates not only the geometric and static attributes of traditional BIM but also the laws of physics and real-time interaction mechanisms, which enable dynamic interaction and accurate mapping between physical and virtual buildings.

However, as these technologies mature into complex, interconnected systems, their growing sophistication necessitates equally rigorous validation to ensure reliability in real-world applications. Existing research has mostly focused on the application of building information modeling in a single domain (e.g., structural safety analysis or energy simulation) [12,13], lacking collaborative validation of the overall behavior of complex dynamic systems. For example, the integration of a building automation system and building information modeling needs to simultaneously satisfy the precision of real-time control logic, the timing constraints of equipment response, and the fault-tolerance of sudden failures [14], whereas traditional static detection or simplified simulation is difficult to cover the complex interactions of dynamic scenarios. In addition, the fusion error of heterogeneous data from multiple sources may further amplify the bias of the simulation results and affect the decision’s credibility.

Therefore, the validation of the overall behavioral collaboration of complex building information systems, especially special building information models integrating static information, dynamic interaction mechanisms, and physical mechanisms is still a problem to be solved.

To address these challenges, this paper proposes a symmetry-aware hybrid validation framework integrating Timed Automata (TA), Unified Modeling Language (UML), and AnyLogic simulation [15]. The framework preserves structural symmetry in model representations and temporal symmetry in state transitions, ensuring consistent validation across virtual–physical interactions while enhancing both the logical correctness and practical reliability of complex building information systems. Specifically, this research takes the BIPM as a case study. First, leveraging the extensibility of UML, we define the modeling facilities for BIPM, constructing both its structural and behavioral models. These models capture the essential geometric, static, and dynamic attributes of BIPM, laying the foundation for further analysis. Second, through a model transformation algorithm, the behavioral model of BIPM is converted into a Timed Automata Network (TAN), establishing a formalized representation of BIPM. This step enables the verification of the model’s reliability and logical correctness, ensuring that the dynamic interactions and physical laws embedded in BIPM are accurately represented. Third, the structural model of BIPM is visually mapped into a simulation model based on AnyLogic, allowing for the dynamic visualization of the physical mechanisms within BIPM. Finally, to demonstrate the feasibility and effectiveness of the proposed method, this study validates the approach using an air conditioning system as a case study.

The rest of the paper is organized as follows. We review related work and present the background in Section 2. Section 3 discusses the methodology. A BIPM visualization model based on UML extensions is constructed in Section 4, and the BIPM visualization model is transformed in Section 5, and validated by an example study in Section 6. Finally, Section 7 concludes the paper.

2. Related Work and Background

2.1. Related Work

(1)

Building information modeling technology

In recent years, research in building information modeling technology has been divided into the following categories:

• BIM mainly encapsulates static information about building geometric data, spatial location, relational modeling, quality attributes, etc. [2]. BIM has a relatively mature conceptual framework.
• GISs primarily describe aspects of geospatial data such as geometric primitives (from 0 to 3 dimensions), coordinate reference systems, and topology. However, the information is usually not comprehensive and detailed enough due to the lack of fine-grained geometric and semantic information [16]. GIS technologies are usually integrated with BIM and their conceptual frameworks are relatively mature.
• DT consists of three main components: the physical world, virtual representation and virtual–real interaction, and virtual representation and virtual–real exchange interconnection [17]. However, digital twins have almost no unified information model.
• BIPM consists of three main sub-models: The basic information model, the interaction model, and the physical model. Compared with existing static BIM technologies, BIPM can dynamically interact with external entities and map the intrinsic mechanism in full fidelity [10]. In addition, BIPM integrates the information and physical domains, which requires rigorous simulation verification to ensure the credibility of the model.

For this reason, this paper proposes the simulation of the BIPM as an example to ensure the reliability of the building information system.

(2)

AnyLogic software technology

AnyLogic 8.9 [15] is a tool that supports the modeling and simulation of discrete, dynamic, multi-intelligent, and hybrid systems. It is used in a wide range of applications, including logistics, supply chain management, the manufacturing and production industries, urban planning, emergency management, and GIS information technology. For example, Zhou et al. constructed a multi-intelligence model in AnyLogic to simulate the communication and interaction between individual users, simulating the diffusion of innovation in mobile applications from the perspective of social networks [18]. Zhang et al. [19] proposed the use of AnyLogic to establish the overall traffic flow of a vertical take-off and landing airport model, analyzing the vertical take-off and landing airport operational capability, UAV latency, and surface area utilization under different operational modes and topology designs. Guo et al. [20] developed an evolutionary game model using system dynamics theory, which was simulated using AnyLogic software to analyze the impact of supply chain firms’ emission reduction decisions.

It is not difficult to see that AnyLogic can effectively describe and analyze the behavior of systems, supporting a wide range of applications such as studying system performance and behavior, optimizing system design and operation, and developing decisions and policies. BIPM is a composite of dynamic and static information and discrete and continuous models. BIPM yields complex models that are affected by a combination of multiple variables and factors, requiring complex calculations and simulations to accurately describe and predict the behavior of buildings. In addition to this, so far, for this purpose, few studies have used AnyLogic to perform simulation verification of complex models. Therefore, AnyLogic is used in this paper for the modeling and simulation verification of BIPM.

(3)

Model detection techniques

With the development of smart cities [21] and the meta-universe [22], applications such as real-time operation and maintenance of building links [23], urban digital twins [8], and mixed reality [24] have created an urgent need for dynamic real-time interactions and real mapping simulations. In this application situation, researchers are beginning to consider model detection techniques to verify system safety characteristics at the system-level design stage. For example, Benveniste and Raclet developed a hybrid automata model containing nondeterministic automata, probabilistic automata, and graphical probability models to validate probabilistic systems [25]. Shelekhov proposed a new automata-based programming language built by extending the Event-B specification language [26]. Zhang et al. [27] checked the improved file system model using the SPIN model checker and verified the absence of all serious errors. However, most of these studies have focused on the field of static systems. Some researchers have applied model detection techniques to dynamic systems; for example, Grobelna and Szcześniak proposed the use of interpreted Petri nets to convert the power system into a verifiable model and then performed formal validation using the nuXmv model checker [28]. Rehman et al. [29] developed a formal model of CP-Nets and performed formal modeling and model checking of a flood warning system. Chehida et al. [30] suggested a systematic method to generate security constraints based on the safety constraints of the cyber–physical system (CPS) and then enhanced these security constraints by security verification using model checking with UPPAAL.

Correspondingly, in the field of building information modeling, some scholars have validated the reliability of the extended BIM process model or digital twin model framework using UPPAAL [2,31]. In the field of digital twins, the available methods also include probabilistic model checking, the Z3 solver, and so on. For example, Shaikh et al. [32] used probabilistic model checking to analyze the security of the digital twin framework. Suhail et al. envisioned a blockchain-based digital twin framework and used the Z3 solver to formally model and validate it. [33] However, these methods easily suffer from the state space explosion problem. To mitigate state space explosion and improve model checking runnability when mitigating large state spaces, Do et al. [34] devised an L + 1 layer divide-and-conquer approach to lead model checking and developed sequential and parallel tools. Foughali et al. [35] successfully verified embedded real-time systems by uniting the efforts of two communities and implementing combinatorial verification to tame the size of the state space. However, the effect of time on the system has not been considered in most previous studies. In addition, to ensure the overall security of the system, the functional correctness of the models needs to be verified, but because of the semantic gap between models in the system, it is not possible to guarantee consistency between model verification and functional correctness verification.

Therefore, this study proposes a symmetric-aware hybrid validation approach to achieve collaborative validation of complex building information systems through the deep integration of TA, UML, and AnyLogic simulation. As summarized in

Table 1. Comparative analysis of existing validation methods and the proposed framework.

Study	Methodology	Strengths	Limitations of Existing Methods	Innovations of Proposed Framework
Benveniste et al. [25]	Hybrid automata	Probabilistic system validation	Limited to static systems	Dynamic systems
Shaikh et al. [32]	Probabilistic model checking	Enhanced security for DT frameworks	State space explosion issues	Symmetry-aware structural–temporal preservation
Grobelna et al. [28]	Interpreted Petri nets	Power system validation	Ignores temporal constraints	TA-based temporal logic verification
Proposed Framework	TA-UML-AnyLogic	Combines formal rigor with dynamic visualization	—	Unified validation across formal models, simulations, and physical interactions

, existing methods predominantly focus on static or single-domain validation, whereas the proposed framework addresses multi-domain dynamic interactions through symmetry principles.

2.2. Background

The overall framework of the BIPM is shown in Figure 1. The BIPM mainly consists of three sub-models: a basic information model, physical model, and interaction model. Among them, the basic information model portrays the basic static attributes such as geometry, size, and location of building entities; the physical model portrays the intrinsic mechanism law of building physical behavior, including the time-varying characteristics and functional characteristics of the basic building entities; the interaction model, which consists of a set of information–physical fusion interaction entities, including sensor entity, decision controller entity, actuator entity, and animation entity. Basic information model entities are bound to physical model entities and interaction model entities, respectively, constituting BIPM entities with dynamics, interactivity, and intelligence.

During the operation of the BIPM, the sensor entity in the BIPM interaction model receives real-time data from the physical space. On the one hand, the real-time data received by the sensor entity directly drive the animation entity in the interaction model, thus changing the operation state of the BIPM spatial entity. On the other hand, the sensor entity sends the data as input to the controller entity in the interaction model. The controller entity in the BIPM interaction model makes autonomous decisions based on the real-time data received from the sensor entity. On the one hand, the controller entity analyzes the types of physical laws and physical functions based on the data and provides the decision-making data as input to the physical model, and the physical laws are output and act on the basic information model, which, in turn, drives the animation entity to further change the operational state of the BIPM spatial entity. On the other hand, the controller entity transmits the control commands after decision-making to the actuator entity in the interaction model, and the actuator entity drives the building physical space entity and the BIPM space entity to change its motion state, thus forming a closed feedback control loop between the BIPM and the physical space.

Unlike the traditional building information model, which primarily focuses on geometric and static attributes, the BIPM integrates physical laws and real-time interaction mechanisms, enabling high-fidelity, dynamic mapping between the physical building and its virtual counterpart. This integration allows the BIPM to capture the intricate interactions and behaviors of complex building systems, such as lighting, and energy management, which are critical for modern intelligent buildings. By using the BIPM as a case study, this research addresses the limitations of conventional validation methods, which often fail to account for the dynamic and real-time nature of these systems. Furthermore, the BIPM’s ability to incorporate heterogeneous data from multiple sources, such as sensors and building automation systems, provides a comprehensive platform for testing the accuracy, reliability, and fault-tolerance of complex models. Validating the BIPM not only demonstrates the feasibility of the proposed methodology but also highlights its potential for broader application in the development and optimization of advanced building systems, ensuring their reliability and effectiveness in real-world scenarios.

2.3. Innovative Contribution

Specifically, the methodology proposed in this study offers a comprehensive and systematic approach to modeling and validating complex building information systems, with the BIPM as a case study. This study makes four main contributions:

• This paper proposes a novel framework that combines TA, UML, and AnyLogic simulation software to model and validate complex building information systems. This framework integrates formal verification with dynamic visualization, ensuring both logical correctness and practical applicability.
• By transforming the behavioral model of the BIPM into a TAN, this study enables rigorous formal verification of its dynamic interactions and physical mechanisms. This ensures the reliability and logical consistency of the BIPM, addressing a critical gap in traditional validation methods.
• This paper maps the structural model of the BIPM into a visual simulation model using AnyLogic, allowing for real-time, dynamic visualization of the building system’s behavior. This enhances the interpretability of the model and provides stakeholders with an intuitive platform to analyze system performance under various operational conditions.
• Using an air conditioning system as a case study, this study demonstrates the feasibility and effectiveness of the proposed method. This practical validation highlights the method’s potential for broader use in complex building systems.

3. Methodology

UML is a visual modeling language and a de facto standard in international industry that is easy to understand and communicate through. However, it lacks the formal semantics required for model testing, and the description of software models can only reach a semi-formal level [36]. TA has strict syntax and semantics, and can effectively support the analysis, refinement, and verification of software behavior. However, the main shortcoming of TA is that they are not intuitive enough, and it is more difficult to dynamically display dynamic system effects [37]. AnyLogic can effectively describe and analyze system behavior and supports tools for modeling and simulating discrete, dynamic, multi-intelligent, and hybrid systems [38]. However, both AnyLogic and TA are more difficult to be understood by software developers.

Given the unique advantages and complementarities of TA, UML, and AnyLogic in software modeling and model validation, this paper proposes a symmetry-aware integrated framework for enabling information system validation. As shown in Figure 2, the method consists of four main steps:

• Topological symmetry: Establish the visualization model of the building information system. Based on the established building information system and the cropped UML model, construct a building information system class diagram to describe the structural characteristics of the building information system, and construct the building information system sequence diagram to portray the behavioral characteristics of the building information system.
• Behavioral isomorphism symmetry: Convert the building information system visualized models into formal models. Define a model transformation algorithm that converts visualized building information system sequence diagrams into a network of temporal automata that are exchanged for a formal model of the building information system formal model.
• Temporal symmetry: Define the building information system’s formal validation criteria to verify the reliability of the above model. Describe the nature of the building information system using temporal logic to verify the building information system’s trustworthiness.
• Dynamic behavioral symmetry: Convert building information system visual models into simulation models. Map visual building information system class diagrams to AnyLogic-based simulation models to demonstrate physical mechanisms with dynamic visualization in building information systems.

Figure 2. Building information system verification methodology.

Figure 2. Building information system verification methodology.

4. BIPM Visual Modeling Based on UML Extension

By extending UML, this section defines the BIPM structural model—the BIPM class diagram, and the BIPM behavioral model—the BIPM sequence diagram.

4.1. BIPM Class Diagram

A class diagram is a visual description of the structure of the BIPM. This section adds BIPM modeling facilities by extending UML class diagrams and constructs a BIPM-oriented structural model—the BIPM class diagram. The detailed definition is as follows:

A BIPM class diagram model is a quaternion BIPM_A: = (C_set,R_set,A_set,S_set).

Here, C_set represents a finite set of BIPM classes, C_set = {Sensor, Controller, Actuator, Animation, Physics, Model, Environment}, and C_set, based on UML’s Class construct, is represented by the symbol 〈〈stereotype〉〉.

A_set denotes the set of BIPM attributes, A_set = {Attribute, Function}, in which the attribute is a collection of attributes of the Class itself, and the function is mainly used to display the type and attributes of each functional unit.

R_set denotes the finite set of BIPM relations, R_set = {Sensory, Driven, Input, Establish, Instruction, Actuator, Execute}, where R_set is based on UML’s Relationship construct, which represents the connection relationship between the functions of the BIPM.

S_set represents the set of constraints, where S_set = {Time, Event} are time constraints and event constraints, respectively. In this paper, we adopt the object constraint language to describe and define the constraints.

Figure 3 shows the formal description of the BIPM class diagram. Here, the BIPM class C_set is extended with the UML Class as a template to add the required constructs of the BIPM. In this paper, each unit of the realized BIPM is upgraded to a “first-order element” for description and portrayal. Further, since the BIPM is a full-fidelity mapping of the building’s physical space, which also involves a dynamic interaction process with the building’s physical space, the building’s physical environment is described separately as an independent entity. The BIPM classes themselves are composite structures that can be further generalized to specific classes. Meanwhile, the relationship between the BIPM classes is constructed by extending the UML relationship between BIPM classes to portray the interaction between the BIPM classes. The semantic description is shown in

Table 2. Semantic description of the BIPM class.

Relationship	Semantic	Description
Input	A [c];B	If the condition c in class A is satisfied, the operation in class B is performed.
Driven	A→DB	Denotes a driving relationship, where A will adjust B’s behavior according to the monitoring status.
Sensory	A→SB	Denotes a monitoring relationship, where A will detect the operational status and data of B.
Execute	A→EB	Denotes a regulating relationship, where A will adjust the parameters or behavior of B according to the control instructions.
Establish	A;B [e1]||C [e2]	If the condition e1 in class A is satisfied, the physical model of class B is established. If the condition e2 in class A is satisfied, the physical model of class C is established.
Instruction	A;B [c1]||C [c2]	If condition c1 in class A is satisfied, B instruction is sent; if condition c2 in class A is satisfied, C instruction is sent.

. The BIPM attribute A_set includes BIPM attributes and the BIPM class-specific functional attribute Function, which is the building physical space environment that can be monitored for state and operations, for which the tagged value State is added, as well as the BIPM basic information model, Model, which can only be operated on, for which the tagged value State is also added. The sensor class of objects in the BIPM interaction model is a generic term for sensors, which can have multiple sensing types, for which the tagged value Type is added to describe the sensing type. Other functions are algorithms and bounds for controllers, mechanisms for physical models, etc. The S_set constraints set defines information such as constraints required during the execution of the BIPM.

4.2. BIPM Sequence Diagram

A UML sequence diagram is used to describe the dynamic interaction between objects and portray the time sequence of messages passing between objects, which reflects the expected functions and behaviors of the system clearly and accurately. However, the UML sequence diagram is unable to reflect the active state of a single object during a certain period, making formal validation difficult. For this reason, this section extends the UML sequence diagram in both horizontal and vertical dimensions, and defines the BIPM behavioral model as the BIPM sequence diagram. Its detailed definition is as follows:

A BIPM sequence diagram is a quintuple BIPM: = (C_set, ST_set, M_set, F_set, S_set).

Here, C_set denotes the instantiation of a finite set of BIPM classes, C_set = {Sensor, Controller, Actuator, Animation, Physics, Model, Environment}.

ST_set denotes a finite set of states on an object’s lifeline, with states in the BIPM sequence diagram denoted by rectangles on the object’s lifeline.

M_set is an exhaustive set of messages, for each message m∈M.

F_set is a set of combinatorial fragments, F_set = {sim, alt, loop, para}, where the sim fragment denotes a sequential structure, whose execution condition is null; the alt fragment denotes a selective structure, whose execution condition determines the flow of the next state of the object; and the loop fragment denotes a cyclic structure, where the state loop is activated when the condition is true. The para fragment denotes a parallel structure, where the states are concurrent when the condition is true. Each fragment consists of a fragment name and an execution condition.

S_set denotes the set of constraints, and S_set = {Intra, Inter} denotes the set of constraints within and between states, respectively.

Figure 4 provides a formal description of the BIPM sequence diagram. The BIPM sequence diagram can be represented as a two-dimensional table: the horizontal dimension represents the spatial axis, denoting the set of objects participating in BIPM collaboration; the vertical dimension corresponds to the temporal axis, representing the lifelines of objects, which displays and characterizes the active state of individual objects over a specific period. Moreover, the BIPM sequence diagram also emphasizes the concepts of combined fragments and constraints. It defines sim fragments to decompose the entire BIPM sequence diagram into consecutive combined fragments, alt fragments to depict different BIPM decisions and actions, and loop fragments to represent the cyclic application of the BIPM. The constraint condition S_set is used to characterize the threshold condition for state activation, reflecting the real-time nature of the BIPM. The BIPM sequence diagram realizes the seamless integration of the UML sequence diagram and statechart. It can not only portray the interaction relationship of entities in the BIPM but also clearly describes the active state of a single entity in a cycle. Meanwhile, the BIPM sequence diagram is strictly formalized and defined, which can be easily converted into a TA model, laying the foundation for the formal validation of the BIPM.

5. BIPM Conversion

To describe the behavioral and structural properties of the BIPM, we defined the BIPM sequence diagram and class diagram above, which are image-intuitive and simple to use. However, the lack of strict formal validation, analysis, and visualization mechanisms makes it difficult to ensure the reliability of the model. For this reason, in this section, a conversion algorithm from BIPM sequence diagrams to TANs is designed, which bridges the gap between BIPM visualization models and formal models. The visualized BIPM class diagrams are also mapped to AnyLogic-based simulation models to demonstrate the physical mechanisms in the BIPM in a dynamic and visual form.

5.1. Conversion of BIPM’s UML Model to TA Model

A temporal automaton can be represented as a hexadecimal TA: = (L, l₀, S, A, E, I), where L is the set of finite positions; l₀∈L denotes the initial position; S is the set of constraints on the edge E; A is the set of all actions, including the input, output and internal actions; and E is the set of directed edges. A network consisting of multiple concurrent temporal automata is called a TAN, denoted as TAN≡TA₁||TA₂…||TAn, and each automaton is called a template (Template) in UPPAAL. This section will use this as a basis for defining the mapping of a BIPM sequence diagram, BIPM_S, into a TAN.

• The BIPM sequence diagram can be mapped as a TAN. C_set and state changes during the lifecycle can be inscribed as a TA.
• The state (State) of a BIPM sequence diagram can be mapped to a position (Location) in a temporal automaton. The set of states of the vertical axis of each object in the BIPM_S (s∈ST_set) corresponds to the set of TA positions of each automaton (l∈L), where the initial state of the vertical axis of the BIPM_S corresponds to the initial position l₀ of the TA.
• The message of the BIPM sequence diagram maps to the channel (Chan) of the TA. Each message of the BIPM_S (m∈M_set) corresponds to a pair of transmit and receive events A = ({a!|a∈Chan}∪{a?|a∈Chan}) of the TA.
• The constraint S_set of a BIPM sequence diagram corresponds to the constraint S of TA. Here, the inter-state constraint inter and the fragment constraint F_set (condition) correspond to the constraint S on the side E of TA, and the intra-state intra constraint intra corresponds to the position invariant, Invariant, of TA.
• The variables in BIPM correspond to the data variable Var and the clock variable Clock in TAN.

The conversion algorithm from the BIPM sequence diagram to TAN is given in Algorithm 1, which enables conversion from the BIPM sequence diagram to TAN. To achieve the correct operation of the TAN model, the modeler needs to perform further optimization according to the actual situation, such as using the “select” function on the edge of the TAN model to randomly simulate the dynamic changes in the parameters of the application logic and defining the required functions by using the template’s back-end function declaration function, etc., to further improve the TAN model.

Algorithm 1. The conversion algorithm from the BIPM sequence diagram to the TAN
1	//Input: BIPM Sequence Diagram;
2	//Output: Timed Automata Network.
3	Begin
4	System Declaration←Variables;
5	Channel Declaration←Mset;
6	i = 1, j = 1;
7	for i ≤ Num(Cset)
8	{t(i)∈Template←Ci ∈Cset;
9	Template Declaration(i)←Local Variable(i);
10	for j ≤ Num(STset (Ci))
11	{ Location(j)∈t(i)←STset (j)∈STset (Ci);
12	Location(j).Invariant∈←State-Invariant(i,j);}
13	(a! or a?)∈t(i)←m∈Mset;
14	t(i).guard←State-Constraint;
15	t(i).guard←Fset -Condition(part); }
16	Model Declaration←Cset;
17	End

5.2. Mapping of BIPM Class Diagram to AnyLogic Simulation Model

As a powerful simulation platform, AnyLogic provides a range of modeling tools and time-based event scheduling capabilities that enable developers to accurately create and simulate time-sensitive system behavior. With built-in state machines, timers, counters, schedules, and a simulation control center, AnyLogic can efficiently simulate the behavior of the BIPM with strict validation of its key properties. Therefore, this section will use this as a basis to define the mapping of the BIPM class diagram BIPM_A to the AnyLogic simulation model. The detailed definition is given below:

• A BIPM class diagram can be mapped to an AnyLogic simulation model, whose lifecycle state changes can be animated.
• A BIPM class C_set in a BIPM class diagram can be mapped to a corresponding object class, component, or simulation environment in AnyLogic.
• The A_set attribute set in the BIPM class diagram can be mapped to the attributes or methods of the corresponding object class in AnyLogic, where Attribute can be mapped to the attributes in the object class for describing the characteristics of the object, and Function can be mapped to the methods or functions in the object class for defining the behaviors or operations of the object.
• S_set in the BIPM class diagram can be mapped to the corresponding constraints or limitations in AnyLogic, where Time is mapped to a temporal constraint or condition, and the Event is represented as the relevant trigger condition in the simulation.

Figure 5 gives the mapping of the BIPM class diagram to the AnyLogic simulation model, which enables the conversion of the BIPM class diagram into the AnyLogic simulation model. To achieve the correct operation of the AnyLogic simulation model, the modeler needs to perform further optimizations to improve the AnyLogic simulation model according to the actual situation. This includes adjusting the parameter settings, optimizing the model structure, enhancing the user interactivity, improving the simulation efficiency, etc. The aim is to further improve the expressiveness and practicability of the AnyLogic simulation model to ensure that it can realistically and effectively simulate the complex behaviors and decision-making processes of the BIPM.

6. Case Study

In the studied BIPM, each entity in the three sub-models is an independent individual, and the individuals and sub-models communicate, interact, and make decisions with each other. At the same time, each entity in the physical space of the building is a BIPM entity. For this reason, this paper takes an air conditioner as an example to illustrate how to build a visual and formal model of the system based on the methodology of this paper, with the aid of the model checking tool UPPAAL and the simulation verification tool AnyLogic to verify the reliability and correctness of the BIPM itself.

In this study, the sensor of the air conditioning system monitors the indoor temperature changes in real time and transmits the data to the BIPM space for processing. The air conditioning controller compares the real-time indoor temperature with the target temperature, constructs a physical model of the air conditioning equipment, generates adjustment commands, and conveys them to the actuators. Accordingly, the actuator precisely controls the physical space and virtual model of the air conditioner to achieve intelligent temperature regulation.

6.1. UML Modeling of Air Conditioning BIPM

(1)

Air conditioner BIPM class diagram

In the BIPM class diagram of the air conditioning system, this section portrays the structural framework of the system and the connection relationship between the functional units. As shown in Figure 6, to achieve real-time monitoring of the room temperature, a specialized air conditioner sensor (Air conditioner sensor) is designed, which captures the ambient temperature and provides instantaneous data to the system. These data are received by the air conditioner controller (Air conditioner controller), which builds a physical model of the air conditioner (Air conditioner physics) and uses algorithms to make autonomous decisions. The results are communicated through the air conditioner actuator (Air conditioner actuator), which applies control actions to the real air conditioner in the physical space and its counterpart in the BIPM space, ensuring synchronization between the two. In addition, the introduction of air conditioner animation (Air conditioner animation) provides a vivid and dynamic visualization of the model, making the operation of the air conditioner BIPM entities clear at a glance.

(2)

Air conditioner BIPM sequence diagram

The BIPM sequence diagram of the air conditioning system describes in detail the interactions between the air conditioner BIPM entities, demonstrating the dynamic flow of the system operation. As shown in Figure 7, the loop segment (loop Sensory) represents the cyclic task of indoor temperature monitoring, where the sensors capture and deliver data from the physical space every 5 s, ensuring the system’s real-time response to environmental changes. The parallel fragment (para Action1) depicts the dual role of data delivery: on the one hand, the monitored data directly trigger the air conditioner BIPM animation entity to update the user interface in real time to reflect the air conditioner status; on the other hand, the data are transmitted to the air conditioner BIPM controller to initiate the autonomous decision-making process. Immediately after, (para Action2) demonstrates the parallel processing of data analysis and control decision-making: on the one hand, the controller constructs a physical model of the air conditioner based on the real-time monitoring data to provide a theoretical basis for precise control; on the other hand, the controller compares and analyzes the monitored temperature with the preset temperature, and based on this, it makes an autonomous decision to issue the corresponding control commands. (para Action3), on the other hand, focuses on the execution phase of the control instructions, showing how the air conditioning equipment in the physical space and the air conditioning entities in the BIPM space can be precisely controlled according to the instructions at the same time, ensuring the consistency and synchronization of the system response. The outermost layer (loop BIPM) encapsulates the control logic of the entire air conditioning BIPM, which is labeled with states (e.g., Waiting, Analyze, etc.) on the timeline of each object, portraying in detail the active state of the object during each cycle, thus providing a comprehensive understanding of the system behavior.

6.2. Formal Validation of Air Conditioning BIPM

(1)

Conversion of UML models of air-conditioned BIPM into TA model

Based on the model transformation algorithm in Section 5.1, the sequence diagram of the air conditioning BIPM is converted into a TAN. The active state of each object’s vertical axis in the air conditioning BIPM sequence diagram is mapped to a TA, as shown in Figure 8.

(a)

AirSensor TA. The sensor in the air-conditioned BIPM periodically senses the real-time indoor temperature and sends the sensed data out through the channel perception!, as shown in Figure 8a. Here, the clock command is used to generate T, modeling the dynamics of the response time.

(b)

AirController TA. The controller in the air-conditioned BIPM generates control commands based on sensor data and physical model calculations. After receiving the sensed data through the channel perception?, the channel build! sends a request to build the physical model, the physical model is received through the channel physics! and the calculation is performed. Depending on the temperature condition (Tem > 26 or Tem < 26), the corresponding control command command1! or command2! is generated, as shown in Figure 8b.

(c)

AirPhysics TA. The physics model in the air-conditioned BIPM computes the physics model based on the sensor data. After receiving the build?, it executes the build physical model physics!, as shown in Figure 8c.

(d)

AirActuator TA. The actuator in the air-conditioned BIPM is responsible for executing the appropriate action based on the received command. Once command1? or command2? are received, the corresponding action act1 or act2 is executed and the device is adjusted through the channel adjust1! or adjust2!, as shown in Figure 8d.

(e)

BAirConditioner TA, the air conditioning device of the BIPM virtual space, adjusts the state of the air conditioning of the BIPM virtual space according to the adjustment command. After receiving adjust1? or adjust2?, it performs the corresponding adjustment action, triggering an animation through the channel animation!, as shown in Figure 8e.

(f)

AirConditioner TA, an air conditioning unit for the physical space, is similarly responsible for adjusting the status of the air conditioner in response to an adjustment command. Upon receipt of adjust1? or adjust2?, the corresponding adjustment action is executed, as shown in Figure 8f.

(g)

AirAnimation TA. The animation display in the air-conditioned BIPM updates the animation state based on perception data. After receiving a perception? or animation?, it checks if there is an animation to be updated, and if so, executes the update animation, as shown in Figure 8g.

(2)

Formal validation of TA models for air-conditioned BIPM

Formal validation of an air conditioning BIPM entity: Firstly, it is necessary to combine all the TAs involved in the behavior of this air conditioning BIPM entity into a TAN. Then, the behavior of the air conditioning BIPM is simulated by the model detection tool UPPAAL, and the soft air conditioning BIPM properties are verified line by line (some of the verification results are shown in Figure 9). This paper focuses on the following property validation (as shown in Table 3):

• Security verification, which is air-conditioned BIPM object access conflict or deadlock verification. In UPPAAL, this property is described positively in the statute language as A[] not deadlock, indicating that not deadlock is always true in all reachable locations.
• Accessibility verification, which means that the final desired location is reachable. What it enquires about is whether there exists a path from the initial location to that location. For example, if you want the location where the air-conditioned BIPM entity is adjusted to be reachable, the statute language is E<>BAirConditioner.adjust.
• Consistency verification is the consistency of the order of interaction between multiple objects. It means that the occurrence of one thing triggers the response of another action. For example, once the sensor entity transmits the data, the controller entity must perform a judgment calculation, and the statute language is E<>AirSensor.end imply AirController.calculate.

Table 3. Formal validation property specifications for air-conditioned BIPM.

Classification	Description	Statute Language	Verification Results
Security Verification	No deadlock in the system	A[]not deadlock	Satisfying the property
Accessibility verification	The air-conditioned BIPM entity is adjusted The air conditioning units in the physical space are adjusted. The actuator entity adjusts the air conditioning entity.	E<>BAirConditioner.adjust E<>AirConditioner.adjust E<>AirActuator.airconditioner	Satisfying the property Satisfying the property Satisfying the property
Consistency verification	Once the sensor entity transmits the data, the controller entity must perform a judgment calculation. Once the perceptron entity transmits the data, the animation entity must carry out the updating of the state to present the state. Once the physical model is established, the controller entity must perform judgment calculations.	E<>AirSensor.end imply AirController.calculate E<>AirSensor.end imply AirAnimation.update E<>AirPhysics.model imply AirController.calculate	Satisfying the property Satisfying the property Satisfying the property

Table 3. Formal validation property specifications for air-conditioned BIPM.

Classification	Description	Statute Language	Verification Results
Security Verification	No deadlock in the system	A[]not deadlock	Satisfying the property
Accessibility verification	The air-conditioned BIPM entity is adjusted The air conditioning units in the physical space are adjusted. The actuator entity adjusts the air conditioning entity.	E<>BAirConditioner.adjust E<>AirConditioner.adjust E<>AirActuator.airconditioner	Satisfying the property Satisfying the property Satisfying the property
Consistency verification	Once the sensor entity transmits the data, the controller entity must perform a judgment calculation. Once the perceptron entity transmits the data, the animation entity must carry out the updating of the state to present the state. Once the physical model is established, the controller entity must perform judgment calculations.	E<>AirSensor.end imply AirController.calculate E<>AirSensor.end imply AirAnimation.update E<>AirPhysics.model imply AirController.calculate	Satisfying the property Satisfying the property Satisfying the property

Figure 9. Air conditioner basic information model.

Figure 9. Air conditioner basic information model.

6.3. Simulation Verification of AnyLogic-Based Air Conditioning BIPM

The AnyLogic-based BIPM verification methodology is shown in Figure 5. In AnyLogic, we use the Entity Agent to draw the appearance of the entity, including dimensions, colors, attributes, etc., to represent the basic information model of the BIPM. For the interaction model of the BIPM, we use four agents to represent the perceptron entity, controller entity, actuator entity, and animation entity, respectively. Among them, the sensor agent receives external data and drives the animation agent on the one hand and provides input to the controller agent on the other hand; the controller agent receives data from the sensor agent, builds the physical model, makes optimal decisions, and sends commands to the actuator agent; and the actuator agent executes these commands. For the physical model of the BIPM, we use events as drivers to trigger physical laws. In this way, when the data from the controller agent are received as input, the corresponding physical quantities are calculated. In addition, we set some parameters in the basic information model of the BIPM, such as temperature, controller, perceptron, actuator, animation, and so on. The parameters are bound to the interaction model and physical model so that the entity of the BIPM has the functions of autonomous perception, intelligent decision-making, real-time control, and animation display.

In the studied BIPM, each entity of three of the sub-models possesses independence, and they collaborate through autonomous communication, interaction, and decision-making processes. To demonstrate the operation mechanism of the BIPM, this paper employs Agent-based modeling technology in the AnyLogic simulation platform and cleverly integrates Java algorithms to simulate the dynamic behaviors of the BIPM, and specifically selects the air conditioning system as a case study. We first set detailed assumptions for the BIPM of the air conditioning system, and established the basic parameters and behavioral criteria of the model, laying a solid foundation for further simulation experiments and analysis of the results. Subsequently, the corresponding simulation model was constructed in AnyLogic, and the simulation output was analyzed and evaluated in depth, aiming to verify the validity of the BIPM.

(1)

Modeling assumption

To streamline the modeling effort and also to reduce the errors caused by the interference of certain factors, we make the following assumptions about the initial state and physical model of the BIPM of the air conditioner. In this paper, the assumptions and parameters of the model are designed as follows:

• We simulated the room with a length, width, and height of 5 m × 5 m × 5 m. The room has a vent with a length of 0.5 m × 0.2 m, and we assumed that there is no other heat dissipation in the room except for the vent.
• We simulated the heat source as 130 w, and we assume that there is no other heat source in the room.
• We simulated the cooling capacity of the air conditioner, and we assumed that there were no other sources of cooling in the room.
• The start time of this simulation is 00:00 and the simulation time unit is s. The total run time is more than 6000 s.
• To simplify the modeling work, we simplified the basic information model of the BIPM-based air conditioning model.
• In this analysis, the initial indoor temperature is set to 26 °C, and the air conditioner preset temperature is 20 °C.
• In this paper, to simplify the calculation of the physical model, the temperature difference (tem) is set to five stages: a > b > c > d > 0. At this time, the corresponding percentage of the cooling capacity is 100%, 75%, 50%, 25%, and 0, and the corresponding air conditioner speed (nnn) is i > j > k > l > 0.

(2)

Simulation models

The basic information model is represented by the AirConditioner agent, which mainly specifies basic and additional information about the air conditioner. The basic information of an entity usually includes its size, color, and appearance, which are usually set through AnyLogic’s own data interface. As AnyLogic’s data interface does not contain basic information about air conditioners, to streamline the modeling effort, the air conditioner model was simplified in this analysis. The air conditioner model is shown in Figure 9. The types and content of additional information can generally be customized by the modeler. In this analysis, the basic information model of the air conditioner is linked to the interaction and physical models. Thus, the AirConditioner agent mainly includes information on the sensor, controller, actuator, animation entities, and physical functions.

In the interaction model, the sensor agent receives real-time data from the physical space on the one hand and directly drives the animation entity. As shown in Figure 9, the real-time temperature in the room is received by the sensor agent, and then the real-time temperature is displayed on the main interface. On the other hand, state diagrams are constructed in the sensor agent. An internal transition in the state diagram is combined with a sendMessage function to achieve one state transition per second to obtain the indoor temperature in real time and send the real-time indoor temperature to the controller. This is shown in Figure 10.

In this analysis, the initial indoor temperature is set to 26 °C, and the air conditioner preset temperature is 20 °C. After receiving the real-time temperature transmitted by the sensor agent, the controller agent calculates the temperature difference concerning the preset temperature. The controller agent then interacts with the physical model and sends corresponding control commands to the actuator agent. The actuator agent executes the commands and adjusts the air conditioner fan speed, which is represented in the air conditioner model. The interaction diagram between the interaction and physical models is shown in Figure 11.

It is worth stating that, in this paper, to simplify the physical model calculations, the temperature difference (tem) is divided into five possible values: a > b > c > d > 0 (in the simulation, we assume that a = 6, b = 4.5, c = 3, and d = 1.5). At these points, the corresponding refrigeration capacity percentages are 100%, 75%, 50%, 25%, and 0. Correspondingly, the air conditioner speeds (nnn) are i > j > k > l > 0 (in the simulation, we assume that i = 10, j = 7.5, k = 5, and l = 2.5). In addition, the physical model also calculates the statistics of the total refrigeration capacity (totalnum+), where the refrigeration capacity is calculated as follows:

Calq = COP × P

where calq is the refrigeration capacity of the chiller, COP is the proportion of the electrical energy consumed by the chiller that is used for cooling, and P is the power of the chiller. In the simulation, we assume that cop = 3.3 and p = 2210.

This means that when the temperature difference is 6 °C, the air conditioner has a maximum cooling capacity of 100% per unit of time, and the air conditioner speed is 10. As the total cooling capacity increases, the temperature difference gradually decreases; when the temperature difference reaches 4 °C, the air conditioner has a maximum cooling capacity of 75% per unit of time, and the air conditioner speed is 7.5, and so on until the temperature difference is 0 °C. The air conditioner has a cooling capacity of 0% per unit of time, and the air conditioner speed is 0.

(3)

Simulation results and analysis

In this paper, we take an air conditioner as an example and simulate the operation mechanism of the BIPM through AnyLogic. The simulation time unit of the simulated system is s, and the simulation start time is 00:00. Combined with the form of output data from AnyLogic software, where data are available, it is analyzed mainly in terms of changes in indoor temperature, changes in cooling capacity per unit of time, and changes in total cooling capacity.

According to the settings of the BIPM mechanism, the simulated change in indoor temperature is shown in Figure 12. The results show that the initial indoor temperature is 26 °C and gradually decreases with time. As the temperature difference between the indoor temperature and the preset temperature gradually decreases, the temperature drop also gradually decreases until the indoor temperature is close to the preset temperature, and the indoor temperature ultimately reaches equilibrium close to the preset temperature, in conformity with reality.

The simulated change in the refrigeration capacity per unit time of the air conditioner is shown in Figure 13. As the change in the refrigeration capacity per unit time is defined as a range function related to the temperature difference in this paper, the temperature difference between the room temperature and the preset temperature is not zero. Thus, the result is shown as a fourth-order step function, which is in line with the simulated change in the room temperature.

The simulated change in the total refrigeration capacity of the air conditioner is shown in Figure 14. The change in the total refrigeration capacity of the air conditioner is a segmented function (four segments) with linear increments. This is in line with the change in refrigeration capacity per unit time.

It is also worth noting that the current indoor temperature is displayed in the air conditioner model in real time and that the fan speed of the air conditioner slows as the refrigeration capacity decreases.

Based on the above four analyses, it can be seen that no abnormality is found in any of the simulation results, which indicates that the proposed BIPM is correct and reliable.

7. Conclusions

To address the limitations in the multi-domain collaborative validation of complex building information systems, this paper proposes a symmetry-aware validation framework integrating TA, UML, and AnyLogic simulation. The framework systematically maintains the structural symmetry across modeling domains and the temporal symmetry of system behaviors, thereby enhancing the logical consistency and practical reliability of complex building systems. By combining theoretical modeling with simulation, the framework bridges the gap between abstract specifications and dynamic operational scenarios, enhancing the logical correctness and practical reliability of complex building systems. Specifically, there are several innovative contributions:

• The system structure and behavioral logic of the BIPM is constructed based on the UML normative modeling method, which solves the defects of the traditional method in the verification of logical consistency and dynamic interaction mechanism.
• By transforming the BIPM behavioral logic into TANs, formal validation is achieved to guarantee the rigor of the dynamic interaction mechanism.
• The AnyLogic tool maps the BIPM structural model into a visual simulation model, which supports the real-time dynamic display and performance analysis of building system behaviors, enhances the interpretability of the model, and provides an intuitive decision support platform for the stakeholders.
• An empirical study using an air conditioning system as a case study shows that the method can effectively integrate the rigor of formal verification with the engineering suitability of dynamic visualization techniques, verifying the feasibility and effectiveness of the framework in the collaborative verification of complex dynamic systems.

The whole-chain verification paradigm of ‘specification modeling—formal verification—dynamic simulation’ proposed in this study makes up for the limitation of the traditional method of disconnecting logical verification from engineering practice. Through the deep integration of UML-TA-AnyLogic, a collaborative validation framework that takes into account both theoretical rigor and practical application value is constructed, balancing formal rigor and engineering applicability; it provides scalable solutions for complex systems such as intelligent HVAC networks and adaptive building automation.

However, the work in this paper is preliminary and still has the following shortcomings: (1) Simplifications of current physical phenomena, e.g., thermal dynamics, material properties, etc., limit the fidelity of long-term simulations. (2) The presence of manual interventions in the toolchain integration hampers scalability. (3) Lack of quantitative comparative analyses with existing methods.

The initial validation of this framework focuses on logical consistency and workflow integration, and subsequent research will introduce performance benchmarking, such as model conversion efficiency, simulation fidelity, and quantitative comparisons with existing methods. In addition, future research will incorporate multi-physics field models and undertake further simulation validation to better capture real-world behavior. We will further explore semantic mapping and automated code generation to make the toolchain integration process more streamlined. Future work will further explore the application potential of the framework in cross-domain complex dynamic systems such as smart buildings and urban infrastructure, and optimize the automation level of multi-tool integration to promote the intelligent development of building information system validation technology.