implementability of timed controllers
play

Implementability of Timed Controllers Based on joint works with - PowerPoint PPT Presentation

Implementability of Timed Controllers Based on joint works with Karine Altisen, Patricia Bouyer, Martin De Wulf, Laurent Doyen, Jean-Fran cois Raskin, Pierre-Alain Reynier, and Stavros Tripakis Nicolas Markey Lab. Sp ecification et V


  1. Modeling the execution platform [Altisen & Tripakis, 2005] 1. Transforming A into Prog( A ). 2. Modeling the digital CPU. 3. Modeling the global clock. 4. Modeling the input/output variables. 5. Classical verification techniques on the product of those automata.

  2. Pros and cons of this approach Pros: Very expressive: the platform can be described with many details; Relies on classical techniques: the verification step is applied on standard timed automata. Existing tools can be used.

  3. Pros and cons of this approach Pros: Very expressive: the platform can be described with many details; Relies on classical techniques: the verification step is applied on standard timed automata. Existing tools can be used. Cons: Formal meaning?: if the model satisfies some property, what does it really mean? Faster is better?: we expect that a program proved to be implementable on a given platform remains implementable on a faster platform. This property fails to hold with this modeling.

  4. Outline of the talk Introduction 1 Modeling the execution platform [Altisen & Tripakis, 2005] 2 A semantical approach [De Wulf et al., 2004] 3 Conclusions 4

  5. A semantical approach [De Wulf et al. , 2004] 1. “Implementation” Semantics We consider a simple model of a platform, that repeatedly executes the following actions: store the value of the global clock; compute guards; fire one of the enabled transitions. We assume that one such loop takes at most ∆ P t.u. to execute; the global clock is updated every ∆ L t.u. � We write � A � Impl ∆ P , ∆ L for the set of executions of a timed automaton A under this semantics.

  6. A semantical approach [De Wulf et al. , 2004] 1. “Implementation” Semantics 2. Enlarged Semantics We define the enlarged semantics for timed automata, by enlarging guards on transitions by a small tolerance ∆: If � g � = [ a ; b ], then � g � AASAP = [ a − ∆ , b + ∆] . ∆ � We write � A � AASAP for the set of executions of a timed ∆ automaton A under this semantics.

  7. A semantical approach [De Wulf et al. , 2004] 1. “Implementation” Semantics 2. Enlarged Semantics We define the enlarged semantics for timed automata, by enlarging guards on transitions by a small tolerance ∆: If � g � = [ a ; b ], then � g � AASAP = [ a − ∆ , b + ∆] . ∆ � We write � A � AASAP for the set of executions of a timed ∆ automaton A under this semantics. Theorem ([DDR04]) If ∆ > 3∆ L + 4∆ P , then � A � Impl ∆ P , ∆ L ⊆ � A � AASAP . ∆

  8. A semantical approach [De Wulf et al. , 2004] We focus on safety properties for the implementation semantics: we want to ensure that an implementation will avoid bad states. � Reach ∆ ( A ) is the set of reachable states under the AASAP semantics. ∆ 1 ≤ ∆ 2 ⇒ Reach ∆ 1 ( A ) ⊆ Reach ∆ 2 ( A ) � R ( A ) = � ∆ > 0 Reach ∆ ( A ) is the set of reachable states under the AASAP semantics for any ∆ > 0.

  9. A semantical approach [De Wulf et al. , 2004] We focus on safety properties for the implementation semantics: we want to ensure that an implementation will avoid bad states. � Reach ∆ ( A ) is the set of reachable states under the AASAP semantics. ∆ 1 ≤ ∆ 2 ⇒ Reach ∆ 1 ( A ) ⊆ Reach ∆ 2 ( A ) � R ( A ) = � ∆ > 0 Reach ∆ ( A ) is the set of reachable states under the AASAP semantics for any ∆ > 0. Lemma For any timed automata A and for any set of zones B, R ( A ) ∩ B = ∅ iff ∃ ∆ > 0 . Reach ∆ ( A ) ∩ B = ∅ .

  10. An example: Standard semantics y 2 x ≤ 2 x :=0 x =0 x =1 a b c Bad y =2 y :=0 y ≥ 2 y :=0 1 x 0 1 2

  11. An example: Standard semantics y 2 x ≤ 2 x :=0 x =0 x =1 a b c Bad y =2 y :=0 y ≥ 2 y :=0 1 x 0 1 2

  12. An example: Standard semantics y 2 x ≤ 2 x :=0 x =0 x =1 a b c Bad y =2 y :=0 y ≥ 2 y :=0 1 x 0 1 2

  13. An example: Standard semantics y 2 x ≤ 2 x :=0 x =0 x =1 a b c Bad y =2 y :=0 y ≥ 2 y :=0 1 x 0 1 2

  14. An example: Standard semantics y 2 x ≤ 2 x :=0 x =0 x =1 a b c Bad y =2 y :=0 y ≥ 2 y :=0 1 x 0 1 2

  15. An example: Standard semantics y 2 x ≤ 2 x :=0 x =0 x =1 a b c Bad y =2 y :=0 y ≥ 2 y :=0 1 x 0 1 2

  16. An example: Standard semantics y 2 x ≤ 2 x :=0 x =0 x =1 a b c Bad y =2 y :=0 y ≥ 2 y :=0 1 x 0 1 2

  17. An example: Standard semantics y 2 x ≤ 2 x :=0 x =0 x =1 a b c Bad y =2 y :=0 y ≥ 2 y :=0 1 x 0 1 2

  18. An example: Standard semantics y 2 x ≤ 2 x :=0 x =0 x =1 a b c Bad y =2 y :=0 y ≥ 2 y :=0 1 x 0 1 2

  19. An example with ∆ > 0 y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2

  20. An example with ∆ > 0 y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2

  21. An example with ∆ > 0 y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2 1 − ∆ 1+∆

  22. An example with ∆ > 0 y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2 1 − ∆ 1+∆

  23. An example with ∆ > 0 y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad 2+2∆ y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2

  24. An example with ∆ > 0 y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad 2+2∆ y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2

  25. An example with ∆ > 0 y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2 1 − 3∆

  26. An example with ∆ > 0 y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2 1 − 3∆

  27. An example with ∆ > 0 y 2 2+4∆ x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2

  28. An example with ∆ > 0 y 2 2+4∆ x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2

  29. An example with ∆ > 0 y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2 1 − 5∆

  30. An example with ∆ > 0 y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2 1 − 5∆

  31. An example with ∆ > 0 y 2+6∆ 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2

  32. An example with ∆ > 0 y 2+6∆ 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2

  33. An example with ∆ > 0 y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2

  34. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2

  35. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2

  36. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2 1 − ∆ 1+∆

  37. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2 1 − ∆ 1+∆

  38. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ 2+2∆ y :=0 1 x 0 1 2

  39. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ 2+2∆ y :=0 1 x 0 1 2

  40. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2 1 − 3∆

  41. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2 1 − 3∆

  42. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ 2+4∆ y :=0 1 x 0 1 2

  43. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ 2+4∆ y :=0 1 x 0 1 2

  44. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2 1 − 5∆

  45. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2 1 − 5∆

  46. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 2+6∆ y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2

  47. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 2+6∆ y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2

  48. An example with ∆ very small y 2 x ≤ 2+∆ x :=0 x ∈ [1 − ∆;1+∆] x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 − ∆ y :=0 1 x 0 1 2

  49. Difference between � A � and R ( A ) Reach( � A � ) R ( A ) y y 2 2 1 1 x x 0 1 2 0 1 2 x ≤ 2 x :=0 x =1 x ≤ ∆ a b c Bad y :=0 y ∈ [2 − ∆ , 2+∆] y ≥ 2 y :=0

  50. An algorithm for computing R ( A ) Input: A Timed Automaton A Output: The set R ( A ) 1. build the region graph G of A ; 2. compute SCC ( G ) = the set of strongly connected components of G ; 3. J := [( q 0 )] ; 4. J := Reach ( G , J ) ; 5. while ∃ S ∈ SCC ( G ) . S �⊆ J and S ∩ J � = ∅ , J := J ∪ S ; J := Reach ( G , J ) ; 6. return( J );

  51. An algorithm for computing R ( A ) Input: A Timed Automaton A Output: The set R ( A ) 1. build the region graph G of A ; 2. compute SCC ( G ) = the set of strongly connected components of G ; 3. J := [( q 0 )] ; 4. J := Reach ( G , J ) ; 5. while ∃ S ∈ SCC ( G ) . S �⊆ J and S ∩ J � = ∅ , J := J ∪ S ; J := Reach ( G , J ) ; 6. return( J );

  52. An algorithm for computing R ( A ) Input: A Timed Automaton A Output: The set R ( A ) 1. build the region graph G of A ; 2. compute SCC ( G ) = the set of strongly connected components of G ; 3. J := [( q 0 )] ; 4. J := Reach ( G , J ) ; 5. while ∃ S ∈ SCC ( G ) . S �⊆ J and S ∩ J � = ∅ , J := J ∪ S ; J := Reach ( G , J ) ; 6. return( J );

  53. An algorithm for computing R ( A ) Input: A Timed Automaton A Output: The set R ( A ) 1. build the region graph G of A ; 2. compute SCC ( G ) = the set of strongly connected components of G ; 3. J := [( q 0 )] ; 4. J := Reach ( G , J ) ; 5. while ∃ S ∈ SCC ( G ) . S �⊆ J and S ∩ J � = ∅ , J := J ∪ S ; J := Reach ( G , J ) ; 6. return( J );

  54. An algorithm for computing R ( A ) Input: A Timed Automaton A Output: The set R ( A ) 1. build the region graph G of A ; 2. compute SCC ( G ) = the set of strongly connected components of G ; 3. J := [( q 0 )] ; 4. J := Reach ( G , J ) ; 5. while ∃ S ∈ SCC ( G ) . S �⊆ J and S ∩ J � = ∅ , J := J ∪ S ; J := Reach ( G , J ) ; 6. return( J );

  55. An algorithm for computing R ( A ) Input: A Timed Automaton A Output: The set R ( A ) 1. build the region graph G of A ; 2. compute SCC ( G ) = the set of strongly connected components of G ; 3. J := [( q 0 )] ; 4. J := Reach ( G , J ) ; 5. while ∃ S ∈ SCC ( G ) . S �⊆ J and S ∩ J � = ∅ , J := J ∪ S ; J := Reach ( G , J ) ; 6. return( J );

  56. J ⊆ R ∆ ( A ) Lemma Let A be a TA with n clocks, ∆ ∈ Q > 0 , and δ = ∆ / n. Let u be a valuation s.t. there exists a trajectory π [0 , T ] in � A � with π (0) = π ( T ) = u. Let v ∈ [ u ] ∩ B ( u , δ ) . Then there exists a trajectory from u to v in � A � ∆ . Proof: We build the new trajectory by slightly modifying the delay transitions in π . This crucially depends on the fact that all clocks are reset along the cycle. Corollary Let A be a TA and p = p 0 p 1 . . . p k be a cycle in the region graph (i.e. p k = p 0 ). For any ∆ > 0 and any x , y ∈ p 0 , there exists a trajectory from x to y.

  57. J ⊆ R ∆ ( A ) Lemma Let A be a TA with n clocks, ∆ ∈ Q > 0 , and δ = ∆ / n. Let u be a valuation s.t. there exists a trajectory π [0 , T ] in � A � with π (0) = π ( T ) = u. Let v ∈ [ u ] ∩ B ( u , δ ) . Then there exists a trajectory from u to v in � A � ∆ . Proof: We build the new trajectory by slightly modifying the delay transitions in π . This crucially depends on the fact that all clocks are reset along the cycle. Corollary Let A be a TA and p = p 0 p 1 . . . p k be a cycle in the region graph (i.e. p k = p 0 ). For any ∆ > 0 and any x , y ∈ p 0 , there exists a trajectory from x to y.

  58. J ⊇ R ∆ ( A ) Lemma Let A be a TA, δ ∈ R > 0 and k ∈ N . There exists D ∈ Q > 0 s.t. for all ∆ ≤ D, any k-step trajectory π ′ = ( q ′ 0 , t ′ 0 )( q ′ 1 , t ′ 1 ) . . . ( q ′ k , t ′ k ) in � A � ∆ can be approximated be a k-step trajectory π = ( q 0 , t 0 )( q 1 , t 1 ) . . . ( q k , t k ) in � A � with � q i − q ′ i � ≤ δ for all i. The proof involves parametric DBMs. Corollary Let A be a TA with n clocks and W regions, α < 1 / (2 n ) , and α ∆ < 2 2 W · (4 n +2) . Let x ∈ J and y s.t. there exists a trajectory from x to y in � A � ∆ . Then d ( J , y ) < α .

  59. J ⊇ R ∆ ( A ) Lemma Let A be a TA, δ ∈ R > 0 and k ∈ N . There exists D ∈ Q > 0 s.t. for all ∆ ≤ D, any k-step trajectory π ′ = ( q ′ 0 , t ′ 0 )( q ′ 1 , t ′ 1 ) . . . ( q ′ k , t ′ k ) in � A � ∆ can be approximated be a k-step trajectory π = ( q 0 , t 0 )( q 1 , t 1 ) . . . ( q k , t k ) in � A � with � q i − q ′ i � ≤ δ for all i. The proof involves parametric DBMs. Corollary Let A be a TA with n clocks and W regions, α < 1 / (2 n ) , and α ∆ < 2 2 W · (4 n +2) . Let x ∈ J and y s.t. there exists a trajectory from x to y in � A � ∆ . Then d ( J , y ) < α .

  60. Can we relax the assumption on cycles? Our algorithm does not work if we relax the “progress-cycle” constraint. For instance: y y x x 0 0 z z x =0 , x :=0 x ≤ ∆ , x :=0 y , z ≥ 1 − ∆ y = z =1 a b a b x ≤ ∆ x =0 c c x , y ≤ ∆ , z ≥ 1 − ∆ x = y =0 , z =1

  61. Can we relax the assumption on cycles? Our algorithm does not work if we relax the “progress-cycle” constraint. For instance: y y x x 0 0 z z x =0 , x :=0 x ≤ ∆ , x :=0 y , z ≥ 1 − ∆ y = z =1 a b a b x ≤ ∆ x =0 c c x , y ≤ ∆ , z ≥ 1 − ∆ x = y =0 , z =1

  62. Can we relax the assumption on cycles? Our algorithm does not work if we relax the “progress-cycle” constraint. For instance: y y x x 0 0 z z x =0 , x :=0 x ≤ ∆ , x :=0 y , z ≥ 1 − ∆ y = z =1 a b a b x ≤ ∆ x =0 c c x , y ≤ ∆ , z ≥ 1 − ∆ x = y =0 , z =1

  63. Can we relax the assumption on cycles? Our algorithm does not work if we relax the “progress-cycle” constraint. For instance: y y x x 0 0 z z x =0 , x :=0 x ≤ ∆ , x :=0 y , z ≥ 1 − ∆ y = z =1 a b a b x ≤ ∆ x =0 c c x , y ≤ ∆ , z ≥ 1 − ∆ x = y =0 , z =1

  64. Can we relax the assumption on cycles? Our algorithm does not work if we relax the “progress-cycle” constraint. For instance: y y x x 0 0 z z x =0 , x :=0 x ≤ ∆ , x :=0 y , z ≥ 1 − ∆ y = z =1 a b a b x ≤ ∆ x =0 c c x , y ≤ ∆ , z ≥ 1 − ∆ x = y =0 , z =1

  65. Can we relax the assumption on cycles? Our algorithm does not work if we relax the “progress-cycle” constraint. For instance: y y x x 0 0 z z x =0 , x :=0 x ≤ ∆ , x :=0 y , z ≥ 1 − ∆ y = z =1 a b a b x ≤ ∆ x =0 c c x , y ≤ ∆ , z ≥ 1 − ∆ x = y =0 , z =1

  66. Can we relax the assumption on cycles? Our algorithm does not work if we relax the “progress-cycle” constraint. For instance: y y x x 0 0 z z x =0 , x :=0 x ≤ ∆ , x :=0 y , z ≥ 1 − ∆ y = z =1 a b a b x ≤ ∆ x =0 c c x , y ≤ ∆ , z ≥ 1 − ∆ x = y =0 , z =1

  67. Can we relax the assumption on cycles? Our algorithm does not work if we relax the “progress-cycle” constraint. For instance: y y x x 0 0 z z x =0 , x :=0 x ≤ ∆ , x :=0 y , z ≥ 1 − ∆ y = z =1 a b a b x ≤ ∆ x =0 c c x , y ≤ ∆ , z ≥ 1 − ∆ x = y =0 , z =1

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend