Robustness in Timed Automata: Analysis, Synthesis, Implementation - PowerPoint PPT Presentation

Robustness in Timed Automata: Analysis, Synthesis, Implementation Ocan Sankur PhD Thesis Defense LSV, Ecole Normale Sup´ erieure de Cachan May 24, 2013 Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 1 / 28

Real-Time Systems Systems whose behaviors depend on real-time constraints, such as Robots, Car, train, airplane components, Biomedical systems (e.g. insuline pump), ... Developing correct real-time systems is difficult: formal verification Model-checking ? | = is reachable Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 2 / 28

Robustness Model-checking is often used to validate abstract designs. Verify Implement Model Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 3 / 28

Robustness Model-checking is often used to validate abstract designs. Verify Implement Model Model ≈ Implementation? Model: Implementation: Abstract, simplified measurement errors, Idealized: perfect unexpected input, measurements and hardware errors... timings Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 3 / 28

Robustness Model-checking is often used to validate abstract designs. Verify Implement Model Model ≈ Implementation? Model: Implementation: Abstract, simplified measurement errors, Idealized: perfect unexpected input, measurements and hardware errors... timings Robustness The ability of a system to resist to errors upto some bound. Goal: Add robustness to model-checking of real-time systems. Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 3 / 28

Real-Time System Example: Producer-Consumer ... frame 1 frame 2 frame 3 frame 4 frame 5 frame 6 enc 1 enc 2 enc 3 enc 4 enc 5 t 0 2 4 6 8 10 Components are abstracted as periodic events Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 4 / 28

Real-Time System Example: Producer-Consumer ... frame 1 frame 2 frame 3 frame 4 frame 5 frame 6 enc 1 enc 2 enc 3 enc 4 enc 5 t 0 2 4 6 8 10 Components are abstracted as periodic events Property : No buffer overflow. Model-checking : � Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 4 / 28

Real-Time System Example: Producer-Consumer ... frame 1 frame 2 frame 3 frame 4 frame 5 frame 6 enc 1 enc 2 enc 3 enc 4 t 0 2 4 6 8 10 Assume that the implementation of the encoder is slightly slower due to unexpected workload, wrong hardware specification, etc. Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 4 / 28

Real-Time System Example: Producer-Consumer ... frame 1 frame 2 frame 3 frame 4 frame 5 frame 6 enc 1 enc 2 enc 3 enc 4 t 0 2 4 6 8 10 Overflow Assume that the implementation of the encoder is slightly slower due to unexpected workload, wrong hardware specification, etc. Under the slightest enlargement , the system is incorrect. The system is not robust to small increases in execution times. Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 4 / 28

Real-Time System Example: Scheduling Scenario 0 1 2 3 4 5 6 7 A D E M 1 C B M 2 with the constraints: A → B , C → D , E . 1 A , D , E must be scheduled on machine M 1 , 2 B , C must be scheduled on machine M 2 , 3 C starts no sooner than 2 time units, Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 5 / 28

Real-Time System Example: Scheduling Scenario 0 1 2 3 4 5 6 7 A D E M 1 C B M 2 with the constraints: A → B , C → D , E . 1 A , D , E must be scheduled on machine M 1 , 2 B , C must be scheduled on machine M 2 , 3 C starts no sooner than 2 time units, Goal: Analyse a work-conserving scheduling policy on a given scenario ( work-conserving: no machine is idle if a task is waiting for execution) Property : All tasks terminate in 6 time units Model-checking : � Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 5 / 28

Real-Time System Example: Scheduling Scenario 0 1 2 3 4 5 6 7 A D E M 1 C B M 2 This cannot be an outcome of an algorithm (not work-conserving). � Unexpectedly � : duration of A is reduced to 1 . 999 Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 5 / 28

Real-Time System Example: Scheduling Scenario 0 1 2 3 4 5 6 7 8 A D E M 1 B C M 2 � Unexpectedly � : duration of A is reduced to 1 . 999 The best scheduling in this case takes 7 . 999 time units. The system is not robust to small decreases in execution times. Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 5 / 28

Real-Time System Example: Scheduling Scenario 0 1 2 3 4 5 6 7 8 A D E M 1 B C M 2 � Unexpectedly � : duration of A is reduced to 1 . 999 The best scheduling in this case takes 7 . 999 time units. The system is not robust to small decreases in execution times. Next: Timed automata formalism to model real-time systems. Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 5 / 28

Timed Automata Timed automata = Finite automata + Analog clocks. [Alur and Dill 1994] x ≤ 2 , b , x ← 0 x = 1 , a , y ← 0 ℓ 0 ℓ 1 ℓ 2 y ≥ 2 , c , y ← 0 Runs: time delays + discrete actions y ( ℓ 0 , 0 , 0) 2 1 0 x 0 1 2 Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 6 / 28

Timed Automata Timed automata = Finite automata + Analog clocks. [Alur and Dill 1994] x ≤ 2 , b , x ← 0 x = 1 , a , y ← 0 ℓ 0 ℓ 1 ℓ 2 y ≥ 2 , c , y ← 0 Runs: time delays + discrete actions y 1 ( ℓ 0 , 0 , 0) → ( ℓ 0 , 1 , 1) − 2 1 0 x 0 1 2 Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 6 / 28

Timed Automata Timed automata = Finite automata + Analog clocks. [Alur and Dill 1994] x ≤ 2 , b , x ← 0 x = 1 , a , y ← 0 ℓ 0 ℓ 1 ℓ 2 y ≥ 2 , c , y ← 0 Runs: time delays + discrete actions y 1 a ( ℓ 0 , 0 , 0) − → ( ℓ 0 , 1 , 1) − → ( ℓ 1 , 1 , 0) 2 1 0 x 0 1 2 Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 6 / 28

Timed Automata Timed automata = Finite automata + Analog clocks. [Alur and Dill 1994] x ≤ 2 , b , x ← 0 x = 1 , a , y ← 0 ℓ 0 ℓ 1 ℓ 2 y ≥ 2 , c , y ← 0 Runs: time delays + discrete actions y 1 a ( ℓ 0 , 0 , 0) − → ( ℓ 0 , 1 , 1) − → ( ℓ 1 , 1 , 0) 0 . 6 → ( ℓ 1 , 1 . 6 , 0 . 6) b − − − → ( ℓ 2 , 0 , 0 . 6) 2 1 0 x 0 1 2 Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 6 / 28

Timed Automata Timed automata = Finite automata + Analog clocks. [Alur and Dill 1994] x ≤ 2 , b , x ← 0 x = 1 , a , y ← 0 ℓ 0 ℓ 1 ℓ 2 y ≥ 2 , c , y ← 0 Runs: time delays + discrete actions y 1 a ( ℓ 0 , 0 , 0) − → ( ℓ 0 , 1 , 1) − → ( ℓ 1 , 1 , 0) 0 . 6 → ( ℓ 1 , 1 . 6 , 0 . 6) b − − − → ( ℓ 2 , 0 , 0 . 6) 2 1 0 x 0 1 2 Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 6 / 28

Timed Automata Timed automata = Finite automata + Analog clocks. [Alur and Dill 1994] x ≤ 2 , b , x ← 0 x = 1 , a , y ← 0 ℓ 0 ℓ 1 ℓ 2 y ≥ 2 , c , y ← 0 Runs: time delays + discrete actions y 1 a ( ℓ 0 , 0 , 0) → ( ℓ 0 , 1 , 1) − − → ( ℓ 1 , 1 , 0) 0 . 6 → ( ℓ 1 , 1 . 6 , 0 . 6) b 1 . 8 − − − → ( ℓ 2 , 0 , 0 . 6) − − → 2 ( ℓ 2 , 1 . 8 , 2 . 4) c → ( ℓ 1 , 1 . 8 , 0) − 1 0 x 0 1 2 Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 6 / 28

Timed Automata Timed automata = Finite automata + Analog clocks. [Alur and Dill 1994] x ≤ 2 , b , x ← 0 x = 1 , a , y ← 0 ℓ 0 ℓ 1 ℓ 2 y ≥ 2 , c , y ← 0 y Theorem - [Alur & Dill 1994] 2 Checking the existence of a run reaching a location, or satisfying a 1 B¨ uchi condition is PSPACE-comp. 0 x ◮ Efficient algorithms and tools. 0 1 2 Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 6 / 28

Robustness in Timed Automata The semantics is idealistic Convenient for modeling and verification but not realistic: Clocks are perfectly continuous and can be read exactly Discrete actions are instantaneous No lower bounds on time between consecutive actions (infinite frequency) ◮ How does a timed automaton perform under different assumptions? ◮ Timed automaton (Design) ↔ Real-world system (Implementation)? Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 7 / 28

Robustness in Timed Automata The semantics is idealistic Convenient for modeling and verification but not realistic: Clocks are perfectly continuous and can be read exactly Discrete actions are instantaneous No lower bounds on time between consecutive actions (infinite frequency) ◮ How does a timed automaton perform under different assumptions? ◮ Timed automaton (Design) ↔ Real-world system (Implementation)? In this thesis: Study of robustness in different models of perturbations of timings. Several methodologies to develop robust systems with timed automata. Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 7 / 28

Overview Guard Enlargement 1 Robustness Analysis Robust Implementation Robust Controller Synthesis Guard Shrinking 2 Robustness Analysis The Shrinktech Tool Robust B¨ uchi Acceptance Ocan Sankur (ENS Cachan) Robustness in Timed Automata May 24, 2013 8 / 28

Overview Guard Enlargement 1 Robustness Analysis Robust Implementation Robust Controller Synthesis Guard Shrinking 2 Robustness Analysis The Shrinktech Tool Robust B¨ uchi Acceptance