robustness and implementability of timed automata martin de wulf laurent doyen nicolas markey...

Robustness and Robustness and Implementability of Timed Implementability of Timed

AutomataAutomata

Martin De WulfMartin De Wulf

Laurent DoyenLaurent Doyen

Nicolas MarkeyNicolas Markey

Jean-François RaskinJean-François Raskin

Centre Fédéré en Vérification

FORMATS-FTRTFT 2004 – Sep 24FORMATS-FTRTFT 2004 – Sep 24thth - Grenoble - Grenoble

MotivationMotivation

• Embedded Controllers… are difficult to develop (concurrency, real-time, continuous environment, ...).

… are safety critical.

Use formal models + Verification:

Timed Automata andReachability Analysis

Timed Automata

closed guard

reset

Location

Transition

2a

0:a

2b

0:b

1:a0:b

A

Clocks: {a,b}

ObjectivesObjectives

• From a verified model, generate (automatically) a correct implementation

• Using classical formalism (e.g. timed automata)

• …but interpreting the model in a way that guarantees the transfer of the properties from model to implementation3x

Robustness and ImplentationRobustness and Implentation

Model

•Perfect continuous clocks

•Instantaneous synchronisations

•Reaction time = 0

•Digital clocks

•Delayed synchronisations

•Reaction time > 0

Implementation

vs.

Correct model

Correct implementatio

n

??

Timed Automata: SemanticsTimed Automata: Semantics

Classical

Perfect clocks

Rate:

Guard:

1/ dtdx

][ iff | gvgv

Imprecise clocks

Rate:

Guard:

]1,1[/ dtdx

][ iff | gvgv

],[][ babxa ],[][ babxa

00][A Enlarge

dvs.

][A

Shortcut:

0][:][ AA 0][:][ AA

From Model to ImplementationFrom Model to Implementation

>0 Reach([A´]) Bad =

Timed automaton A is implementable [DDR04] if

Reach([A]) Bad =

Timed automaton A is correct if

which is equivalent to

>0 Reach([A´]) Bad =

RobustnessRobustness

No ! (see example)

•Is it always the case that ?

>0 Reach([A]) = Reach([A])

•How to compute ?

>0 Reach([A])

• [Pur98] gives an algorithm for

>0 Reach([A])

• We show that >0 Reach([A]) = >0 Reach([A])

An example showing thatAn example showing that

Reach([A]) >0 Reach([A])

2a

0:a

2b

0:b

1:a0:b

a

b

10

1

2

2

ExampleExample

2a

0:a

2b

0:b

a

b

10

1

2

2

1:a0:b

Classical Semantics

ExampleExample

2a

0:a

2b

0:b

1:a0:b

a

b

10

1

2

2 Classical Semantics

ExampleExample

2a

0:a

2b

0:b

1:a0:b

a

b

10

1

2

2

AReach

Classical Semantics

ExampleExample

2a

0:a

2b

0:b

1:a0:b

a

b

10

1

2

2 Enlarged Semantics

ExampleExample

2a

0:a

2b

0:b

1:a0:b

a

b

10

1

2

2

Enlarged Semantics

ExampleExample