Robust Model-Checking of Timed Automata Ocan Sankur 1 2 March - September 2010 (Joint work with Patricia Bouyer-Decitre 2 and Nicolas Markey 2 ) 1 ´ Ecole Normale Sup´ erieure, Paris 2 LSV, CNRS & ´ Ecole Normale Sup´ erieure de Cachan Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 1 / 15
Timed Automata (TA) Timed automata = Finite automata + Clocks. [Alur and Dill 1994] Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 2 / 15
Timed Automata (TA) Timed automata = Finite automata + Clocks. [Alur and Dill 1994] Clocks grow continuously, all at the same rate. They are used to (de)activate the transitions of the automaton and can be reset when taking a transition. Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 2 / 15
Timed Automata (TA) Timed automata = Finite automata + Clocks. [Alur and Dill 1994] Clocks grow continuously, all at the same rate. They are used to (de)activate the transitions of the automaton and can be reset when taking a transition. a: x ≤ 2 / x := 0 c: x = 0& y ≥ 2 q 0 q 1 error start b: y ≥ 2 / y := 0 Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 2 / 15
Timed Automata (TA) Timed automata = Finite automata + Clocks. [Alur and Dill 1994] Clocks grow continuously, all at the same rate. They are used to (de)activate the transitions of the automaton and can be reset when taking a transition. a: x ≤ 2 / x := 0 c: x = 0& y ≥ 2 q 0 q 1 error start b: y ≥ 2 / y := 0 Exact semantics of TA Given a TA A , the the exact semantics of A is denoted by � A � . Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 2 / 15
Timed Automata (TA) Timed automata = Finite automata + Clocks. [Alur and Dill 1994] Clocks grow continuously, all at the same rate. They are used to (de)activate the transitions of the automaton and can be reset when taking a transition. a: x ≤ 2 / x := 0 c: x = 0& y ≥ 2 q 0 q 1 error start b: y ≥ 2 / y := 0 Exact semantics of TA Given a TA A , the the exact semantics of A is denoted by � A � . A run of � A � is as follows. ( q 0 , ( x = 0 , y = 0)) Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 2 / 15
Timed Automata (TA) Timed automata = Finite automata + Clocks. [Alur and Dill 1994] Clocks grow continuously, all at the same rate. They are used to (de)activate the transitions of the automaton and can be reset when taking a transition. a: x ≤ 2 / x := 0 c: x = 0& y ≥ 2 q 0 q 1 error start b: y ≥ 2 / y := 0 Exact semantics of TA Given a TA A , the the exact semantics of A is denoted by � A � . A run of � A � is as follows. ( q 0 , ( x = 0 , y = 0)) 1 . 7 − − → ( q 0 , ( x = 1 . 7 , y = 1 . 7)) Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 2 / 15
Timed Automata (TA) Timed automata = Finite automata + Clocks. [Alur and Dill 1994] Clocks grow continuously, all at the same rate. They are used to (de)activate the transitions of the automaton and can be reset when taking a transition. a: x ≤ 2 / x := 0 c: x = 0& y ≥ 2 q 0 q 1 error start b: y ≥ 2 / y := 0 Exact semantics of TA Given a TA A , the the exact semantics of A is denoted by � A � . A run of � A � is as follows. ( q 0 , ( x = 0 , y = 0)) 1 . 7 → ( q 0 , ( x = 1 . 7 , y = 1 . 7)) a − − − → ( q 1 , ( x = 0 , y = 1 . 7)) Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 2 / 15
Timed Automata (TA) Timed automata = Finite automata + Clocks. [Alur and Dill 1994] Clocks grow continuously, all at the same rate. They are used to (de)activate the transitions of the automaton and can be reset when taking a transition. a: x ≤ 2 / x := 0 c: x = 0& y ≥ 2 q 0 q 1 error start b: y ≥ 2 / y := 0 Exact semantics of TA Given a TA A , the the exact semantics of A is denoted by � A � . A run of � A � is as follows. ( q 0 , ( x = 0 , y = 0)) 1 . 7 → ( q 0 , ( x = 1 . 7 , y = 1 . 7)) a − − − → ( q 1 , ( x = 0 , y = 1 . 7)) 0 . 5 − − → ( q 1 , ( x = 0 . 5 , y = 2 . 2)) Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 2 / 15
Timed Automata (TA) Timed automata = Finite automata + Clocks. [Alur and Dill 1994] Clocks grow continuously, all at the same rate. They are used to (de)activate the transitions of the automaton and can be reset when taking a transition. a: x ≤ 2 / x := 0 c: x = 0& y ≥ 2 q 0 q 1 error start b: y ≥ 2 / y := 0 Exact semantics of TA Given a TA A , the the exact semantics of A is denoted by � A � . A run of � A � is as follows. ( q 0 , ( x = 0 , y = 0)) 1 . 7 → ( q 0 , ( x = 1 . 7 , y = 1 . 7)) a − − − → ( q 1 , ( x = 0 , y = 1 . 7)) 0 . 5 → ( q 1 , ( x = 0 . 5 , y = 2 . 2)) b − − − → ( q 0 , ( x = 0 . 5 , y = 0)) . . . Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 2 / 15
Model-Checking Timed Automata Model-checking : Given a TA A , decide whether all runs of � A � verify some property P , written A | = P . Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 3 / 15
Model-Checking Timed Automata Model-checking : Given a TA A , decide whether all runs of � A � verify some property P , written A | = P . where P is a LTL formula (such as a safety or liveness property). Theorem (Alur and Dill 1994) Model-checking timed-automata against LTL formulae is PSPACE -complete. Industrial applications: audio/video, communication protocols, ... Existing model-checking tools: Uppaal, Kronos, ... Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 3 / 15
Implementability of Timed Automata Problem: The exact semantics of timed automata makes unrealistic assumptions: → 0 . 00001 a → b Systems have instant reaction time, − − − − − − → . clocks are infinitely precise. “ x ≤ k ”. Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 4 / 15
Implementability of Timed Automata Problem: The exact semantics of timed automata makes unrealistic assumptions: → 0 . 00001 a → b Systems have instant reaction time, − − − − − − → . clocks are infinitely precise. “ x ≤ k ”. [De Wulf, Doyen and Raskin 2004] introduced the enlarged semantics of A , parameterized by δ > 0, taking into account these problems. � A � δ is obtained by relaxing all constraints by δ , i.e. each constraint of the form x ≤ k x ≥ k . Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 4 / 15
Implementability of Timed Automata Problem: The exact semantics of timed automata makes unrealistic assumptions: → 0 . 00001 a → b Systems have instant reaction time, − − − − − − → . clocks are infinitely precise. “ x ≤ k ”. [De Wulf, Doyen and Raskin 2004] introduced the enlarged semantics of A , parameterized by δ > 0, taking into account these problems. � A � δ is obtained by relaxing all constraints by δ , i.e. each constraint of the form becomes x ≤ k + δ x ≥ k − δ. Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 4 / 15
Implementability of Timed Automata Problem: The exact semantics of timed automata makes unrealistic assumptions: → 0 . 00001 a → b Systems have instant reaction time, − − − − − − → . clocks are infinitely precise. “ x ≤ k ”. [De Wulf, Doyen and Raskin 2004] introduced the enlarged semantics of A , parameterized by δ > 0, taking into account these problems. � A � δ is obtained by relaxing all constraints by δ , i.e. each constraint of the form becomes x ≤ k + δ x ≥ k − δ. ◮ This corresponds to the (over-approximation of the) implementation of A in a simple micro-processor model, with finite precision and a nonzero reaction time. Fast micro-processor ⇔ small δ . Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 4 / 15
Robustness of Timed Automata - 2 For δ = 0 . 1, � A � δ is defined by, a: x ≤ 2 . 1 / x := 0 c: x ≤ 0 . 1& y ≥ 1 . 9 q 0 q 1 start error b: y ≥ 1 . 9 / y := 0 Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 5 / 15
Robustness of Timed Automata - 2 For δ = 0 . 1, � A � δ is defined by, a: x ≤ 21 / x := 0 c: x ≤ 1& y ≥ 19 q 0 q 1 start error b: y ≥ 19 / y := 0 There is an equivalent timed automaton obtained by changing the scale of time (multiplying all constants by 10) - For fixed δ , � A � δ is the exact semantics of a timed automaton. Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 5 / 15
Robustness in Timed Automata - 3 Robust model-checking Given A and a property P , does � A � δ verify P for some δ > 0? If it does, we write A | ≡ P . Ocan Sankur (ENS & ENS Cachan) Robust Model-Checking of Timed Automata September 7, 2010 6 / 15
Recommend
More recommend
