Modelling Real-Time Systems. Henrik Ejersbo Jensen Aalborg University

Transcription

1 Modelling Real-Time Systems Henrik Ejersbo Jensen Aalborg University

2 Hybrid & Real Time Systems Control Theory Plant Continuous sensors actuators Task TaskTask Controller Program Discrete Computer Science Task Eg.: Pump Control Air Bags Robots Cruise Control ABS CD Players Production Lines Real Time System A system where correctness not only depends on the logical order of events but also on their timing

3 Timed Automata Intelligent Light Control press press Press Off Light Bright Press WANT: if press is issued twice quickly then the light will get brighter; otherwise the light is turned off.

4 Timed Automata Intelligent Light Control press X:=0 X<=3 Press press Off Light Bright Press X>3 Solution: Add real-valued clock x

5 Timed Automata (Alur & Dill 1990) n Clocks: x, y Guard Boolean combination of comp with integer bounds Action used for synchronization x<=5 & y>3 a x := 0 m Transitions Reset Action performed on clocks State ( location, x=v, y=u ) where v,u are in R ( n, x=2.4, y= ) a ( m, x=0, y= ) e(1.1) ( n, x=2.4, y= ) ( n, x=3.5, y= )

6 (Henzinger et al, 1992) Timed Safety Automata = Timed Automata + Invariants n x<=5 Clocks: x, y Location Invariants x<=5 & y>3 a x := 0 Transitions ( n, x=2.4, y= ) e(3.2) e(1.1) ( n, x=2.4, y= ) ( n, x=3.5, y= ) m y<=10 g4 g1 g2 g3 Invariants ensure progress!!

7 Clock Constraints

8 Timed (Safety) Automata

9 Timed Automata: Example guard location reset

10 Timed Automata: Example guard location reset

11 Timed Automata: Example x 3

12 Timed Automata: Example x 3

13 Timed Automata: Example

14 Timed Automata: Example

15 Light Switch push y 9 click push

16 Light Switch push click y 9 push Switch may be turned on whenever at least 2 time units has elapsed since last turn off

17 Light Switch push click push Switch may be turned on whenever at least 2 time units has elapsed since last turn off Light automatically switches off after 9 time units.

18 clock valuations: state: Semantics Semantics of timed automata is a labeled transition system where ( S, ) action transition delay Transition V ( C) v : C R ( l, v) where l L and v V ( C) S { ( l, v) v V ( C) and l L a ( l, v) g( v) ( l, v) and d Inv( l)( v ( l', v' ) v' ( l, v d' ) v[ r] d) 0 iff iff whenever } and g a r l l Inv( l' )( v' ) d' d R 0

19 Semantics: Example 9)... 0,, ( 9) 3), ( 9, ( 3) 3,, ( ) 0,, ( ), ( 0), ( 3.5), ( 0), ( 3) ( y x off y x on y x on y x on y x on y x on y x off y x off click push push push push click 9 y

20 Uppaal Network of timed automata Timing requirement Uppaal No! Debugging Information Yes Uppsala (6 persons), Aalborg (10 persons), papers, 6 invited talks/tutorials 9 industrial case studies (or

21 Timed Automata in UPPAAL Networks of Timed Safety Automata + urgent actions + urgent locations (i.e. zero-delay locations) + committed locations (i.e. zero-delay and atomic locations) + data-variables (integers with bounded domains) + arrays of data-variables + guards and assignments over data-variables and arrays...

22 Networks of Timed Automata + Integer Variables + arrays. l1 m1 x>=2 i==3 a! y<=4 a. Two-way synchronization on complementary actions. x := 0 i:=i+4 Closed Systems! l2 m2 Example transitions (l1, m1,, x=2, y=3.5, i=3,..) tau (l2,m2,..,x=0, y=3.5, i=7,..) 0.2 (l1,m1,,x=2.2, y=3.7, I=3,..) If a URGENT CHANNEL

23 Timed Automata in UPPAAL clock assignments x : n clock assignments i : Expr Expr :: n Expr Expr Expr Expr Expr Expr* Expr Expr / Expr ( g d i i[ Expr] Expr : Expr) n x<=5 x<=5 & y>3 a x := 0 m y<=10 g4 g1 g2 g3 location invariants inv :: x n x n inv, inv g :: g g c d clock natural number and g c g d g, g :: x n x y n :: Expr op Expr {,,,,} op {,,,,,!} clock guards data guards

24 Urgent Channels urgent chan hurry; Informal Semantics: There will be no delay if transition with urgent action can be taken. Restrictions: No clock guard allowed on transitions with urgent actions. Invariants and data-variable guards are allowed.

25 Urgent Locations Click Urgent in State Editor. Informal Semantics: No delay in urgent location. Note: the use of urgent locations reduces the number of states in a model, and thus the complexity of the analysis.

26 Committed Locations Click Committed in State Editor. Informal Semantics: No delay in committed location. Next transition must involve automata in committed location. Note: the use of committed locations reduces the number of states in a model, and allows for more space and time efficient analysis.

27 Urgent and Committed Locations committed m n x a! 2 urgent p q a ( m p, x 2.5 ( m p, x ( n q, x 0) 2.5) a ( n r, x 2.5) 2.5) d o x : 0 r ( o ( o q, x r, x 0) 0) d ( n q, x 2.5 d) ( o q, x 2.5 d)

28 UPPAAL Specification Language A[] p (A<> p) AG p (also AF p) E<> p (E[] p) EF p (also EG p) process location data guards clock guards p::= a.l gd gc p and p p or p not p p imply p ( p ) deadlock(only for AG,EF)

29 CTL, Derived Operators possible![]! in LTL inevitable <> in LTL EF p AF p p p p p

30 CTL, Derived Operators potentially always!<>! in LTL always [] in LTL AG p p EG p p p p p p p p p p

31 Uppaal Demo

32 Exercise: The Coffee Machine Person Machine takes time to brew time-out if coffee not taken before time-limit cof Start coin! y:=0 Wait1 y<=3 y=3 pub! Go pub Observer complain if more than 8 time-units between two consecutive publ. coin Ready cof y:=0 Wait2 y<=2 y=2 Design Machine and Observer