3 27--26 main 27--7 Snoncontent 2 27--9 Sdcpreview 3 27--26 Scontent Content Real- Systems Lecture 3: Duration Calculus I 27--26 Dr. Bernd Westphal Albert-Ludwigs-Universität Freiburg, Germany Symbols predicate and function symbols state variables and domain values global (or logical) variables State Assertions Terms rigid terms intervals remarks 4/39 3 27--26 main 3 27--26 main Content Introduction Observables and Evolutions Duration Calculus (DC) Semantical Correctness Proofs DC Decidability DC Implementables PLC-Automata d Automata (TA), Uppaal Networks of d Automata Region/Zone-Abstraction TA model-checking Extended d Automata Undecidability Results obs : D(obs) hobs, i,t hobs, i,t... Automatic Verification......whether a TA satisfies a DC formula, observer-based Recent Results: d Sequence Diagrams, or Quasi-equal Clocks, or Automatic Code Generation, or... Duration Calculus: Syntax Overview 23/49 2/39 5/39 3 27--26 Sdcoverview 3 27--26 main Duration Calculus: Preview gas valve ame sensor Duration Calculus is an interval logic. Formulae are evaluated in an (implicitly given) interval. ignition Strangest operators: almost everywhere Example: G (Holds in a given interval[b,e] iff the gas valve is open almost everywhere.) G,F,I,H :,} DefineL :,} asg F. chop Example: ( I ; I ; I ) = (Ignition phases last at least one time unit.) integral Example: 6 = L 2 (At most 5% leakage time within intervals of at least 6 time units.) Duration Calculus: Overview We will introduce four syntactical categories (and abbreviations): (i) Symbols: }} (ii) State Assertions: P ::= X = d P P P2 (iii) Terms: θ ::= x l P f(θ,...,θn) (iv) Formulae: F ::= p(θ,...,θn) F F F2 x F F ;F2 (v) Abbreviations:, P, P t, P t, F, F 27/3 3/39 6/39
3 27--26 Sdcsymb 3 27--26 main Duration Calculus: Symbols Same Game: Function Symbols true,false,=,<,>,,, f,g, X,Y,Z, d, x,y,z, We assume a set of function symbols to be given, typical elementsf,g. Each function symbolf has an arityn N; shorthand notation: f/n. A functionsymbolf/n is called a constant if and only ifn =. In the following, we assume the following function symbols: constants: i/ for eachi N, binary (i.e.n = 2): +,. The semantics of an n-ary function symbol f is a function from R n to R, denoted ˆf, i.e. ˆf : R n R. For constants (arityn = ) we have ˆf R. Examples: ˆ = R, 27 ˆ = 27 R, ˆ+ : R R R, ˆ+(a,b) = a+b, ˆ+(,2) = 3. /39 Semantics Syntax 7/39 3 27--26 Sdcsymb 3 27--26 Sdcsymb Symbols: Predicate Symbols }} true,false,=,<,>,,, f,g, X,Y,Z, d, x,y,z, We assume a set of predicate symbols to be given, typical elements. Each predicate symbolp has an arityn N; shorthand notation: p/n. A predicatesymbolp/n is called a constant if and only ifn =. In the following, we assume the following predicate symbols: constants: true,false. binary (i.e.n = 2): =, <, >,,. Semantical domains: truth values B = tt,ff}, and real numbers R. The semantics of an n-ary predicate symbol p is a function from R n to B, denoted ˆp, i.e. ˆp : R n B. For constants (arityn = ) we have ˆp B. Examples: true ˆ = tt, false ˆ = ff, ˆ= : R R B, ˆ=(a,b) = tt, iffa = b, ˆ=(a,b) = ff, iffa b. ˆ=(3,7) = ff, ˆ=(2,2) = tt. One More To better distinguish syntax from semantics, we could choose to work with the following symbols for natural numbers: Syntax: zero,one,two,...,twentyseven,... (all with arity) Semantics: zero ˆ = R, one ˆ = R, two ˆ = 2 R,..., ˆ twentyseven = 27 R,... /39 8/39 Semantics Syntax 3 27--26 Sdcsymb 3 27--26 Sdcsymb Once Again: Syntax vs. Semantics Predicate symbols are principally freely chosen, we could also consider the following ones: / /3 geq/2 To semantically work with a predicate symbol, we need to define a meaning. One possible choice: ˆ : R B tt, ifa N and digit sum ofa equals27 ˆ (a) = ff, otherwise ˆ : R R R B tt, ifax ˆ (a,b,c) 2 +bx+c = has at least one solution = ff, otherwise ˆ geq : R R B geq(a,b) ˆ = tt, ifa b ff, otherwise One More To better distinguish syntax from semantics, we could choose to work with the following symbols for natural numbers: Syntax:,,2,...,27,... (all with arity) Semantics: ˆ = R, ˆ = R, ˆ2 = 2 R,..., 27 ˆ = 27 R,... 9/39 2/39
H G I F t 3 27--26 Sdcsymb 3 27--26 Sdcsymb Symbols: State Variables and Domain Values true,false,=,<,>,,, f,g, X,Y,Z, d, x,y,z, We assume a set Obs of state variables or observables, typical elements X,Y,Z. Each statevariable X has a finite (semantical) domaind(x) = d,...,dn}. A state variable with domain,} is called boolean observable. For each domaind,...,dn} of a state variable in Obs we assume symbolsd,...,dn with ˆdi = di, i n. Example: state variable F ( flame sensor ), domain D(F) =,}, symbols,withˆ = N,ˆ = N. state variable T ( traffic D(T) = symbols red, green with with red D(T), = green D(T). lights ), domain red,green}, red ˆ = green ˆ Example: Evolutions vs. Interpretation of State Variables π : obs = H,obs2 = G,obs3 = I,obs3 = F π(t) = (,,,), I(H)(t) = HI(t) = π(t) =, I(I)(t) = II(t) = π(t) 3 =, I : Obs ( D): H G I F 3/39 6/39 3 27--26 Sdcsymb 3 27--26 Sdcsymb Interpretation of State Variables The last semantical domain we consider is the set of points in time, mostly, = R + (continuous / dense), sometimes = N (discrete time). The semantics of a state variable is time-dependent. It is given by an interpretationi, i.e. a mapping I : Obs ( D), D = D(X), X Obs assigning to each state variablex Obs a function I(X) : D(X) such thati(x)(t) D(X) denotes the value thatx has at timet. For convenience, we shall abbreviate I(X) to XI. Predicate / Function Symbols vs. State Variables Note: The choice of function and predicate symbols introduced earlier, i.e. true,false,=,<,>,,,,,..., +, and their semantics, i.e. ˆ true is the truth valuett B, ˆ= : R 2 B is the equality relation on real numbers, ˆ is the (real) number zero from R, ˆ+ : R 2 R is the addition function on real numbers, is fixed throughout the lecture. The choice of observables and their domains depends on the system we want to describe. 4/39 7/39 3 27--26 Sdcsymb 3 27--26 Sdcsymb Evolutions over vs. Interpretation of State Variables Let Obs = obs,...,obsn} be a set of state variables. Evolution (over time) of Obs: π : D(obs) D(obsn). Interpretation ofobs: I : Obs ( D). Both,π andi, represent the same timed behaviour if, for allt, I(obsi)(t) = π(t) i, i n, or π(t) = (I(obs)(t),...,I(obsn)(t)) = (obsi(t),...,obsni(t)). Symbols: Global Variables true,false,=,<,>,,, f,g, X,Y,Z, d, x,y,z, We assume a set GVar of global (or logical) variables, typical elements x,y,z. The semantics of a global variable is given by a valuation, i.e. a mapping V : GVar R assigning to each global variablex GVar a real numberv(x) R. We useval to denote the set of all valuations, i.e.val = (GVar R). Global variables are fixed over time in system evolutions. 5/39 8/39
3 27--26 Sdcstass 3 27--26 Sdcsymb Symbols: Overview Syntax Semantics predicate symbols true,false,=,<,>,, ˆ true = tt B, ˆ= : R 2 B function symbols f/n,g ˆf : R n R state variables X,Y,Z I(X) : D(X) domain values d ˆd D(X) global variables x,y,z V(x) R State Assertions: Syntax The set of state assertions is defined by the following grammar: P ::= X = d P P P2 where X Obs is a state variable, d denotes a value fromx s domain, We shall use P,Q,R to denote state assertions. Here,,, =,, and are like keywords (or terminal symbols) in programming languages. Abbreviations: We shall writex instead ofx = ifx is boolean, i.e. ifd(x) =,}, Assume the usual precedence: binds stronger than Define, =, as usual. 9/39 22/39 3 27--26 Sdcstass 3 27--26 main Duration Calculus: State Assertions State Assertions: Examples P ::= X = d P P P2 Observables F,G, D(F) =,}, D(G) =,,2}. F = F (F = ) F G G = 2, F = 2 F = G F = G = F = G = (F = G = ), ( F) = G =, ( F = ) G = 2/39 23/39 3 27--26 Sdcstass 3 27--26 Sdcoverview Duration Calculus: Overview We will introduce four syntactical categories (and abbreviations): (i) Symbols: }} (ii) State Assertions: P ::= X = d P P P2 (iii) Terms: θ ::= x l P f(θ,...,θn) (iv) Formulae: F ::= p(θ,...,θn) F F F2 x F F ;F2 (v) Abbreviations:, P, P t, P t, F, F State Assertions: Semantics The semantics of state assertion P is a function I P :,}, i.e.,i P (t) denotes the truth value ofp at timet. The valuei P (t) is defined inductively over the structure ofp : I (t) =, I (t) =,, ifxi = d I X = d (t) =, otherwise, I P (t) = I P (t), ifi P (t) = I P2 (t) = I P P2 (t) =, otherwise, 2/39 24/39
3 27--26 Sdcoverview 3 27--26 Sdcstass State Assertions: Notes If X is a boolean observer. the following equalities hold: I X (t) = I X = (t) = I(X)(t) = XI(t). I P is also called interpretation ofp. We shall writepi as a shorthand notation. Here, the state assertionsandare treated like boolean values (likett andff), it will become clear in a minute, why,is a better choice thantt andff. Duration Calculus: Overview We will introduce four syntactical categories (and abbreviations): (i) Symbols: }} (ii) State Assertions: P ::= X = d P P P2 (iii) Terms: θ ::= x l P f(θ,...,θn) (iv) Formulae: F ::= p(θ,...,θn) F F F2 x F F ;F2 (v) Abbreviations:, P, P t, P t, F, F 25/39 28/39 3 27--26 Sdcterm 3 27--26 Sdcstass State Assertions: Example Interpretation I of boolean observables G and F : GI FI.2 2 3 4 Consider state assertionl := G F. LI(.2) =, because LI(2) =, because Interpretation of L as timing diagram: LI.2 2 3 4 Terms: Syntax Duration terms (or DC terms, or just terms) are defined by the following grammar: θ ::= x l P f(θ,...,θn) where x is a global variable fromgvar, P is a state assertion, and f a function symbol (of arityn). l and are like keywords (or terminal symbols) in programming languages. l is called length operator, is called integral operator. Notation: we may write function symbols in infix notation as usual, i.e. we may writeθ +θ2 instead of+(θ,θ2). 26/39 29/39 3 27--26 Sdcterm 3 27--26 main Duration Calculus: Terms Terms: Syntax Duration terms (or DC terms, or just terms) are defined by the following grammar: θ ::= x l P f(θ,...,θn) where x is a global variable fromgvar, P is a state assertion, and f a function symbol (of arityn). l and are like keywords (or terminal symbols) in programming languages. l is called length operator, is called integral operator. Notation: we may write function symbols in infix notation as usual, i.e. we may writeθ +θ2 instead of+(θ,θ2). Definition. [Rigid] A term without length and integral operators is called rigid. 27/39 29/39
3 27--26 Sdcterm 3 27--26 Sdcterm Towards Semantics of Terms: Intervals Letb,e be points in time s.t.b e. Then[b,e] denotes the closed intervalx b x e}. We use Intv to denote the set of closed intervals in the time domain, i.e. Intv := [b,e] b,e }. Closed intervals of the form[b,b] are called point intervals. Terms: Is the Semantics Well-defined? e So,I P (V,[b,e]) is PI(t)dt but does the integral always exist? b IOW: is there a PI which is not (Riemann-)integrable? Yes. For instance, ift Q PI(t) =, ift / Q To exclude such functions, DC considers only interpretations I satisfying the following condition of finite variability: For each state variablex and each interval[b,e] there is a finite partition of[b,e] such that the interpretation XI is constant on each part. Thus a functionxi is of finite variability if and only if, on each interval[b,e], the function XI has only finitely many points of discontinuity. 3/39 33/39 3 27--26 Sdcterm 3 27--26 Sdcterm Terms: Semantics The semantics of a termθ is a function I θ : Val Intv R, that is,i θ maps a pair consisting of a valuation and an interval to a real number. I θ (V,[b,e]) is called the value (or interpretation) ofθ under interpretationi and valuationv in the interval[b,e]. The valuei θ (V,[b,e]) is defined inductively over the structure ofθ: I x (V,[b,e]) = V(x), I l (V,[b,e]) = e b, e I P (V,[b,e]) = PI(t)dt, b I f(θ,...,θn) (V,[b,e]) = ˆf(I θ (V,[b,e]),...,I θn (V,[b,e])), Terms: Remarks Remark 2.5. The semanticsi θ of a term is insensitive against changes of the interpretation I at individual time points. More formally: LetI,I2 be interpretations ofobs such thati(x)(t) = I2(X)(t) for allx Obs and allt \t,...,tn}. ThenI θ (V,[b,e]) = I2 θ (V,[b,e]) for all termsθ and intervals[b,e]. Remark 2.6. The semanticsi θ (V,[b,e]) of a rigid term does not depend on the interval[b,e]. 3/39 34/39 3 27--26 Sdcterm 3 27--26 Sdcterm Terms: Example V(x) = 2. LI 2 3 4 Consider the termθ = x L. I θ (V,[.5,3.25])= I (x, L) (V,[.5,3.25]) =ˆ ( I x (V,[.5,3.25]), I L (V,[.5,3.25]) ) =ˆ ( V(x), I L (V,[.5,3.25]) ) =ˆ ( 2, I L (V,[.5,3.25]) ) ( 3.25 ) =ˆ 2, LI(t)dt =ˆ ( 2,.25 )= 2.25= 25.5 I θ (V,[.5,.5]) = Syntax / Semantics Overview Syntax Semantics predicate symbols true,false,=,<,>,, ˆ true = tt B, ˆ= : R 2 B function symbols f/n,g ˆf : R n R state variables X,Y,Z I(X) : D(X) domain values d ˆd D(X) global variables x,y,z V(x) R state assertions P I P :,} I P (t),} terms θ I θ : Val Intv R I θ (V,[b,e]) R 32/39 35/39
3 27--26 main 3 27--26 Scontent Content Symbols predicate and function symbols state variables and domain values global (or logical) variables State Assertions Terms rigid terms intervals remarks References Olderog, E.-R. and Dierks, H. (28). Real- Systems - Formal Specification and Automatic Verification. Cambridge University Press. 36/39 39/39 3 27--26 Sttwytt Tell Them What You ve Told Them... State assertions over state variables (or observables), and predicate symbols are evaluated at points in time. The semantics of a state assertion is a truth value. Terms are evaluated over intervals and can measure the accumulated duration of a state assertion, measure the length of intervals, and use function symbols. The semantics of a term is a real number. The value of rigid terms is independent from the considered interval. The semantics of terms is insensitive against changes at finitely many points in time. 37/39 3 27--26 main References 38/39