SAT-based Abstraction Refinement for Real-time Systems Stephanie - - PowerPoint PPT Presentation

▶

sat based abstraction refinement for real time systems

SAT-based Abstraction Refinement for Real-time Systems Stephanie - - PowerPoint PPT Presentation

Apr 09, 2023 96 likes •779 views

SAT-based Abstraction Refinement for Real-time Systems Stephanie Kemper 1 e Platzer 2 , 3 Andr 1 Centrum voor Wiskunde en Informatica, Software Engineering, Amsterdam, The Netherlands 2 University of Oldenburg, Department of Computing Science,

slide-1

SLIDE 1

SAT-based Abstraction Refinement for Real-time Systems

Stephanie Kemper1 Andr´ e Platzer2,3

1Centrum voor Wiskunde en Informatica, Software Engineering, Amsterdam, The

Netherlands

2University of Oldenburg, Department of Computing Science, Germany 3Carnegie Mellon University, Pittsburgh, PA, USA

Third International Workshop on Formal Aspects of Component Software (FACS’06)

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 1 / 18

slide-2

SLIDE 2

Motivation

Failures in embedded systems: disastrous Safety critical systems must work correctly Single components, and their composition Responses in time Timed Systems: difficult to check (state explosion) Abstraction Refinement to cope with

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 2 / 18

slide-3

SLIDE 3

Overview

TA Represent Abstract Unfold[k] SAT–solver Concretise FOCI Refine s not reachable in k steps s reachable

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 3 / 18

slide-4

SLIDE 4

Timed Automata

TA Represent Abstract Unfold[k] SAT–solver Concretise FOCI Refine s not reachable in k steps s reachable

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 3 / 18

slide-5

SLIDE 5

Timed Automata

Example (Intelligent Light Controller)

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ Semantics = All possible traces

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 4 / 18

slide-6

SLIDE 6

Timed Automata

Example (Intelligent Light Controller)

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ Semantics = All possible traces

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 4 / 18

slide-7

SLIDE 7

Timed Automata

Example (Intelligent Light Controller)

ff

(> 0) light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ Semantics = All possible traces

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 4 / 18

slide-8

SLIDE 8

Timed Automata

Example (Intelligent Light Controller)

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ Semantics = All possible traces

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 4 / 18

slide-9

SLIDE 9

Timed Automata

Example (Intelligent Light Controller)

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ Semantics = All possible traces

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 4 / 18

slide-10

SLIDE 10

Timed Automata

Example (Intelligent Light Controller)

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ Semantics = All possible traces

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 4 / 18

slide-11

SLIDE 11

Timed Automata

Example (Intelligent Light Controller)

ff

light (> 0) bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ Semantics = All possible traces

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 4 / 18

slide-12

SLIDE 12

Timed Automata

Example (Intelligent Light Controller)

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ Semantics = All possible traces

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 4 / 18

slide-13

SLIDE 13

Timed Automata

Example (Intelligent Light Controller)

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ Semantics = All possible traces

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 4 / 18

slide-14

SLIDE 14

Timed Automata

Example (Intelligent Light Controller)

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ Semantics = All possible traces

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 4 / 18

slide-15

SLIDE 15

Timed Automata

Example (Intelligent Light Controller)

ff

light bright x ≤ δ (> 0) press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ Semantics = All possible traces

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 4 / 18

slide-16

SLIDE 16

Timed Automata

Example (Intelligent Light Controller)

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ Semantics = All possible traces

details Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 4 / 18

slide-17

SLIDE 17

Timed Automata: Systems

Synchronisation step (or zero delay) Internal step (or zero delay) Delay step s1 s2 s3 s4 s5 s6 a a τ

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 5 / 18

slide-18

SLIDE 18

Timed Automata: Systems

Synchronisation step (or zero delay) Internal step (or zero delay) Delay step s1 s2 s3 s4 s5 s6 a a τ

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 5 / 18

slide-19

SLIDE 19

Timed Automata: Systems

Synchronisation step (or zero delay) Internal step (or zero delay) Delay step s1 s2 s3 s4 s5 s6 (= 0) a a τ

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 5 / 18

slide-20

SLIDE 20

Timed Automata: Systems

Synchronisation step (or zero delay) Internal step (or zero delay) Delay step s1 s2 s3 s4 s5 s6 a a τ

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 5 / 18

slide-21

SLIDE 21

Timed Automata: Systems

Synchronisation step (or zero delay) Internal step (or zero delay) Delay step s1 s2 s3 s4 s5 s6 (= 0) (= 0) a a τ

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 5 / 18

slide-22

SLIDE 22

Timed Automata: Systems

Synchronisation step (or zero delay) Internal step (or zero delay) Delay step s1 s2 s3 s4 s5 s6 a a τ

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 5 / 18

slide-23

SLIDE 23

Timed Automata: Systems

Synchronisation step (or zero delay) Internal step (or zero delay) Delay step s1 s2 s3 s4 s5 s6 (> 0) (> 0) (> 0) a a τ

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 5 / 18

slide-24

SLIDE 24

Representation

TA Represent Abstract Unfold[k] SAT–solver Concretise FOCI Refine s not reachable in k steps s reachable

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 5 / 18

slide-25

SLIDE 25

Representation: Basic Components

TA formula state s s0, s1, s2, . . .: TA at s in step i clock x x0, x1, x2, . . .: Time where x was last reset value of clock x zt - xt

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 6 / 18

slide-26

SLIDE 26

Representation: Basic Components

TA formula state s s0, s1, s2, . . .: TA at s in step i clock x x0, x1, x2, . . .: Time where x was last reset value of clock x zt - xt time value z x zt - xt

why zt? Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 6 / 18

slide-27

SLIDE 27

Representation: Transitions

Action transition:

s0 x < 1 s1 a, x < 2 y := 0

s0t ∧ s1t+1 ∧ at ∧ (zt − xt < 2) ∧ (zt = zt+1) ∧(xt+1 = xt) ∧ (yt+1 = zt+1) Delay transition:

s0 x < 1 s1 a, x < 2 y := 0

s0t ∧ s0t+1 ∧ (zt < zt+1) ∧ (xt = xt+1) ∧(yt = yt+1) ∧ ¬at ∧ ¬bt Transition choice:

s0 x < 1 s1 a, x < 2 y := 0

(s0t ∧ s1t+1 ∧ . . .)∨ (s0t ∧ s0t+1 ∧ . . .)

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 7 / 18

slide-28

SLIDE 28

Representation: Automaton

Transition choice:

s0 x < 1 s1 a, x < 2 y := 0

(s0t ∧ s1t+1 ∧ . . .)∨ (s0t ∧ s0t+1 ∧ . . .) Mutual exclusion: ¬(s0t ∧ s1t) s0t → (zt − xt < 1) ¬(at ∧ bt) ∧ ¬(at ∧ τt) ∧ ¬(bt ∧ τt) Initial constraints:

s0 x < 1

s00 ∧ (z0 = 0) ∧ (x0 = 0) ∧ (y0 = 0)

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 8 / 18

slide-29

SLIDE 29

Representation: Automaton

Transition choice:                                          ϕ(A)

s0 x < 1 s1 a, x < 2 y := 0

(s0t ∧ s1t+1 ∧ . . .)∨ (s0t ∧ s0t+1 ∧ . . .) Mutual exclusion: ¬(s0t ∧ s1t) s0t → (zt − xt < 1) ¬(at ∧ bt) ∧ ¬(at ∧ τt) ∧ ¬(bt ∧ τt) Initial constraints:

s0 x < 1

s00 ∧ (z0 = 0) ∧ (x0 = 0) ∧ (y0 = 0)

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 8 / 18

slide-30

SLIDE 30

Representation: Parallel Systems

ϕ(A1 A2 . . . An) = ϕ(A1) ∧ ϕ(A2) ∧ . . . ∧ ϕ(An) ▽

! Product automaton representation is linear! Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 9 / 18

slide-31

SLIDE 31

Unfolding

TA Represent Abstract Unfold[k] SAT–solver Concretise FOCI Refine s not reachable in k steps s reachable

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 9 / 18

slide-32

SLIDE 32

Unfolding: Timed Automata

ϕ(A)0/t ϕ(A)1/t ϕ(A)2/t . . . ϕ(A)k/t ∧ s ϕ(A)k

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 10 / 18

slide-33

SLIDE 33

Unfolding: Timed Automata

ϕ(A)0/t ϕ(A)1/t ϕ(A)2/t . . . ϕ(A)k/t ∧ s Step 1

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 10 / 18

slide-34

SLIDE 34

Unfolding: Timed Automata

ϕ(A)0/t ϕ(A)1/t ϕ(A)2/t . . . ϕ(A)k/t ∧ s Step 1 Step 2

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 10 / 18

slide-35

SLIDE 35

Unfolding: Timed Automata

ϕ(A)0/t ϕ(A)1/t ϕ(A)2/t . . . ϕ(A)k/t ∧ s Step 1 Step 2 Step 3

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 10 / 18

slide-36

SLIDE 36

Unfolding: Timed Automata

ϕ(A)0/t ϕ(A)1/t ϕ(A)2/t . . . ϕ(A)k/t ∧ s Step 1 Step 2 Step 3 Step k

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 10 / 18

slide-37

SLIDE 37

Unfolding: Timed Automata

ϕ(A)0/t ϕ(A)1/t ϕ(A)2/t . . . ϕ(A)k/t ∧ s Step 1 Step 2 Step 3 Step k ϕ(A)k

Model of ϕ(A)k = Trace of A of length k

details Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 10 / 18

slide-38

SLIDE 38

Abstraction

TA Represent Abstract Unfold[k] SAT–solver Concretise FOCI Refine s not reachable in k steps s reachable

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 10 / 18

slide-39

SLIDE 39

Abstraction: Idea

More possible behaviour = less constraints Abstract system safe conrete system safe Approach: Fewer symbols in ϕ(A) (more efficient) Abstraction by Merging Omission: α(ϕ(A))

details Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 11 / 18

slide-40

SLIDE 40

Abstraction by Merging Omission: Example

Example (Abstraction by Omission)

AS = {x}

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 12 / 18

slide-41

SLIDE 41

Abstraction by Merging Omission: Example

Example (Abstraction by Omission)

AS = {x}

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 12 / 18

slide-42

SLIDE 42

Abstraction by Merging Omission: Example

Example (Abstraction by Omission)

AS = {x}

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 12 / 18

slide-43

SLIDE 43

Abstraction by Merging Omission: Example

Example (Abstraction by Merging)

γ(light) = on γ(bright) = on

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 12 / 18

slide-44

SLIDE 44

Abstraction by Merging Omission: Example

Example (Abstraction by Merging)

γ(light) = on γ(bright) = on

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 12 / 18

slide-45

SLIDE 45

Abstraction by Merging Omission: Example

Example (Abstraction by Merging)

γ(light) = on γ(bright) = on

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ

n

x ≤ δ press, x ≤ 3

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 12 / 18

slide-46

SLIDE 46

Concretisation

TA Represent Abstract Unfold[k] SAT–solver Concretise FOCI Refine s not reachable in k steps s reachable

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 12 / 18

slide-47

SLIDE 47

Concretisation: Idea

Translate abstract counterexample into concrete system

α(ϕ(A)) α(ϕ(A)) α(ϕ(A)) α(ϕ(A)) α(ϕ(A))

ff0
ff1 ∧ press1
n2 ∧ press2
n3 ∧ press2
n4

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 13 / 18

slide-48

SLIDE 48

Concretisation: Idea

Translate abstract counterexample into concrete system

α(ϕ(A)) α(ϕ(A)) α(ϕ(A)) α(ϕ(A)) α(ϕ(A)) ϕ(A) ϕ(A) ϕ(A) ϕ(A) ϕ(A)

ff0
ff1 ∧ press1
n2 ∧ press2
n3 ∧ press2
n4
ff0 ∧ . . .
ff1 ∧ press1 ∧ . . .

(light2∨bright2) ∧ press2 ∧ . . . (light3∨bright3) ∧ press3 . . . (light4∨bright4) ∧ . . .

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 13 / 18

slide-49

SLIDE 49

Refinement using Craig Interpolants

TA Represent Abstract Unfold[k] SAT–solver Concretise FOCI Refine s not reachable in k steps s reachable

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 13 / 18

slide-50

SLIDE 50

Craig Interpolants: Definition

Definition (Craig Interpolant)

For | = ¬(A ∧ B), Craig interpolant C iff | = A → C (Over-approximation of prefix) | = ¬(C ∧ B) (Under-approximation of neg. suffix) Contains only common symbols (Only relevant information)

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 14 / 18

slide-51

SLIDE 51

Refinement using Craig Interpolants

ff0 ∧ . . .
ff1 ∧ press1 ∧ . . .

(light2∨bright2) ∧ press2 ∧ . . . (light3∨bright3) ∧ press3 . . . (light4∨bright4) ∧ . . .

ϕ(A) ϕ(A) ϕ(A) ϕ(A) ϕ(A) Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 15 / 18

slide-52

SLIDE 52

Refinement using Craig Interpolants

ff0 ∧ . . .
ff1 ∧ press1 ∧ . . .

(light2∨bright2) ∧ press2 ∧ . . . (light3∨bright3) ∧ press3 . . . (light4∨bright4) ∧ . . .

ϕ(A) ϕ(A) ϕ(A) ϕ(A) ϕ(A)

true light2 bright3

ff4

false

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 15 / 18

slide-53

SLIDE 53

Refinement using Craig Interpolants

ff0 ∧ . . .
ff1 ∧ press1 ∧ . . .

(light2∨bright2) ∧ press2 ∧ . . . (light3∨bright3) ∧ press3 . . . (light4∨bright4) ∧ . . .

ϕ(A) ϕ(A) ϕ(A) ϕ(A) ϕ(A)

true light2 bright3

ff4

false Unconcretisable!

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 15 / 18

slide-54

SLIDE 54

Refinement using Craig Interpolants

ff0 ∧ . . .
ff1 ∧ press1 ∧ . . .

(light2∨bright2) ∧ press2 ∧ . . . (light3∨bright3) ∧ press3 . . . (light4∨bright4) ∧ . . .

ϕ(A) ϕ(A) ϕ(A) ϕ(A) ϕ(A)

true light2 bright3

ff4

false Unconcretisable! Ill-abstracted!

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 15 / 18

slide-55

SLIDE 55

Abstraction Refinement

TA Represent Abstract Unfold[k] SAT–solver Concretise FOCI Refine s not reachable in k steps s reachable

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 15 / 18

slide-56

SLIDE 56

Preliminary Experimental Results

Strategy Complete Run Hereof: SAT solver calls Hereof: Last Iteration TGC 1/2k 16 : 889 14 : 594 8 : 163 TGC 1/3k 15 : 651 13 : 081 5 : 445 TGC 1/4k 11 : 312 9 : 665 6 : 665 Optimised TGC 1/2k 16 : 631 14 : 334 7 : 866 Optimised TGC 1/3k 16 : 957 14 : 439 6 : 423 Optimised TGC 1/4k 11 : 063 9 : 451 6 : 279 Intelligent Light 1/2k 2 : 596 0 : 568 Intelligent Light 1/3k 1 : 467 0 : 388 Intelligent Light 1/4k 0 : 843 0 : 201

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 16 / 18

slide-57

SLIDE 57

Future Work

Performance comparison to case studies Logarithmic encoding for states Performance improvements using pseudo-boolean constraints and isomorphy inference Better heuristics

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 17 / 18

slide-58

SLIDE 58

Conclusion

Abstraction refinement for real-time systems Bounded model checking with SAT and linear arithmetic representation Uniform abstraction in logic Linear parallel composition

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 18 / 18

slide-59

SLIDE 59

Timed Automata: Semantics

Example (Intelligent Light Controller)

ff

light bright x ≤ δ press, x := 0 press, x ≤ 3 press, x > 3 press τ, x = δ

(off, [x = 0]) 2 → (off, [x = 2])

press

→ (light, [x = 0]) 2.5 → (light, [x = 2.5])

press

→ (bright, [x = 2.5]) δ−2.5 → (bright, [x = δ]) τ → (off, [x = δ])

back Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 14 / 18

slide-60

SLIDE 60

Unfolding: Example

Example (“Reduced” Intelligent Light Controller)

ff

light bright

B B B B B B B B B B @ (off0 ∧ light1) ∨1 C C C C C C C C C C A B B B B B B B B B B @ (off1 ∧ light2) ∨1 C C C C C C C C C C A (light0 ∧ off1) ∨ (light1 ∧ off2) ∨ (light0 ∧ bright1) ∨ (light1 ∧ bright2) ∨ (bright0 ∧ off1) ∨ ∧ (bright1 ∧ off2) ∨ ∧ . . . (bright0 ∧ off1) ∨ (bright1 ∧ off2) ∨ (off0 ∧ off1) ∨ (off1 ∧ off2) ∨ (light0 ∧ light1) ∨ (light1 ∧ light2) ∨ (bright0 ∧ bright1) (bright1 ∧ bright2)

back Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 15 / 18

slide-61

SLIDE 61

Abstraction by Merging Omission: Details

α(L) =      L if conts(L) ∩ (AS ∪ Σ) = ∅ γ(L) if conts(L) ∩ Σ = ∅, L positive true

therwise

back Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 16 / 18

slide-62

SLIDE 62

Representation of Clock Values: zt - xt

Consider (unconditioned) delay transition in state s0.

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 17 / 18

slide-63

SLIDE 63

Representation of Clock Values: zt - xt

Consider (unconditioned) delay transition in state s0. With z: s0t ∧ s0t+1 ∧ ∧(xt+1 = xt) ∧ (yt+1 = yt) ∧ (zt+1 > zt)

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 17 / 18

slide-64

SLIDE 64

Representation of Clock Values: zt - xt

Consider (unconditioned) delay transition in state s0. With z: s0t ∧ s0t+1 ∧ ∧(xt+1 = xt) ∧ (yt+1 = yt) ∧ (zt+1 > zt) Without z: s0t ∧ s0t+1 ∧ ∧(xt+1 − xt = at) ∧ (yt+1 − yt = at) ∧ (at > 0)

back Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 17 / 18

slide-65

SLIDE 65

Representation of Clock Values: zt - xt

Nine steps, consider only clocks. Average of 15 executions:

Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 18 / 18

slide-66

SLIDE 66

Representation of Clock Values: zt - xt

Nine steps, consider only clocks. Average of 15 executions: # clocks with z without z factor 5 0.040s 1.30s 32 6 0.045s 2.04s 45 7 0.050s 3.00s 60 10 0.055s 8.50s 150

back Stephanie Kemper, Andr´ e Platzer SAAtRe FACS06 18 / 18