U PPAAL - Present and Future Gerd Behrmann 1 , Alexandre David 2 , Kim G. Larsen 1 , M. Oliver M¨ oller 3 , Paul Pettersson 2 , Wang Yi 2 1 Aalborg University, 2 Uppsala University, 3 BRICS ª Arhus Outline: 1 Model-checking Timed Automata 2 Internal Optimizations 3 Applications: Protocols & Controllers 4 Extensions of the Modeling Language 1 CDC’01 6 D EC 2001 M. O LIVER M ¨ OLLER : UPPAAL – P RESENT AND F UTURE
Collaborators @ UPPsala @ AALborg Wang Yi Kim G. Larsen Johan Bengtsson Arne Skou Paul Pettersson Carsten Weise Fredrik Larsson Kª are J. Kristoffersen Alexandre David Gerd Behrmann Tobias Amnell Thomas Hune M. Oliver M¨ Elena Fersmann oller @ many other places David Griffioen, Ansgar Fehnker, Frits Vandraager, Klaus Havelund, Theo Ruys, Pedro DArgenio, J-P Katoen, J. Tretmans, Judi Romijn, Ed Brinksma, Franck Cassez, Magnus Lindahl, Francois Laroussinie, Patricia Bouyer, Augusto Burgueno, H. Bowmann, D. Latella, M. Massink, G. Faconti, Kristina Lundqvist, Lars Asplund, Justin Pearson, ... 2 CDC’01 6 D EC 2001 M. O LIVER M ¨ OLLER : UPPAAL – P RESENT AND F UTURE
U PPAAL : Model checking Timed Automata x == 5 C A B count == 3 x ≤ 5 count : = count+1 D clock x; int count network of timed automata template mechanism discrete data types committed locations arrays forward state-space hand-shake synchronization exploration urgency 3 M. O LIVER M ¨ CDC’01 6 D EC 2001 OLLER : UPPAAL – P RESENT AND F UTURE
Symbolic Transitions n x > 3 y := 0 m 4 CDC’01 6 D EC 2001 M. O LIVER M ¨ OLLER : UPPAAL – P RESENT AND F UTURE
Symbolic Transitions y 1 <= x <= 4 1 <= y <= 2 n x x > 3 y := 0 m 5 CDC’01 6 D EC 2001 M. O LIVER M ¨ OLLER : UPPAAL – P RESENT AND F UTURE
Symbolic Transitions y y 1 <= x <= 4 1 <= x 1 <= y <= 2 1 <= y delays to n -2 <= x-y <= 3 x x x > 3 y y := 0 x m 6 M. O LIVER M ¨ CDC’01 6 D EC 2001 OLLER : UPPAAL – P RESENT AND F UTURE
Symbolic Transitions y y 1 <= x <= 4 1 <= x 1 <= y <= 2 1 <= y delays to n -2 <= x-y <= 3 x x x > 3 y y 3 < x 1 <= y intersects to -2 <= x-y <= 3 y := 0 x x y 3 < x 1 <= y m -2 <= x-y <= 3 x 7 M. O LIVER M ¨ CDC’01 6 D EC 2001 OLLER : UPPAAL – P RESENT AND F UTURE
Symbolic Transitions y y 1 <= x <= 4 1 <= x 1 <= y <= 2 1 <= y delays to n -2 <= x-y <= 3 x x x > 3 y y 3 < x 1 <= y intersects to -2 <= x-y <= 3 y := 0 x x y y 3 < x 1 <= y 3 < x projects to m y = 0 -2 <= x-y <= 3 x x 8 M. O LIVER M ¨ CDC’01 6 D EC 2001 OLLER : UPPAAL – P RESENT AND F UTURE
Sets of Clock-Evaluations y − x ≤ 0 1 ≤ x < 3 ∧ y ≤ 2 ∧ y − x ≤ 0 regions: smallest distinguishable sets zones: convex unions of regions representing (unions of) zones: DBMs, CDDs, DDDs, ... y 2 -3 x z 3 -2 0 difference-bounded matrices canonical static 9 M. O LIVER M ¨ CDC’01 6 D EC 2001 OLLER : UPPAAL – P RESENT AND F UTURE
Sets of Clock-Evaluations y − x ≤ 0 1 ≤ x < 3 ∧ y ≤ 2 ∧ y − x ≤ 0 regions: smallest distinguishable sets zones: convex unions of regions representing (unions of) zones: DBMs, CDDs, DDDs, ... y -4 2 -2 -3 1 8 -8 x z 3 3 2 -2 8 0 difference-bounded matrices canonical static 10 M. O LIVER M ¨ CDC’01 6 D EC 2001 OLLER : UPPAAL – P RESENT AND F UTURE
Sets of Clock-Evaluations y − x ≤ 0 1 ≤ x < 3 ∧ y ≤ 2 ∧ y − x ≤ 0 regions: smallest distinguishable sets zones: convex unions of regions representing (unions of) zones: DBMs, CDDs, DDDs, ... y x -4 [1 ; 2) [2 ; 3] 2 -2 -3 1 8 y y -8 x z 3 [ 0 ; 2 ] [ 0 ; 2 ] y - x 3 2 -2 8 ( oo ; -1 ] 0 difference-bounded matrices clock difference diagrams canonical non-canonical static flexible 11 CDC’01 6 D EC 2001 M. O LIVER M ¨ OLLER : UPPAAL – P RESENT AND F UTURE
Engineering Improvements Dec ’96 - Sept ’98 Philips Protocol with Collision Handling 300 Start-up of TDMA Protocol Fischer’s Protocol 250 200 Time (s) 150 100 50 0 2.00 2.04 2.08 2.12 2.16 2.19 Version 12 CDC’01 6 D EC 2001 M. O LIVER M ¨ OLLER : UPPAAL – P RESENT AND F UTURE
Internal Optimizations × committed locations (to reduce interleavings) × active clock reduction × variation of search order × local reduction (compact DBM representation) × global reduction (remove covered states from Passed ) ≈ convex hull over-approximation [safe] ≈ bit-state hashing [sound] ... and of course: a lot of software engineering! 13 M. O LIVER M ¨ CDC’01 6 D EC 2001 OLLER : UPPAAL – P RESENT AND F UTURE
Benchmarks (without optimizations) 50 dacapo_sim 45 fischer5 audio_big 40 bando 35 30 Time (s) 25 20 15 10 5 0 1999 2000 2001 date 14 CDC’01 6 D EC 2001 M. O LIVER M ¨ OLLER : UPPAAL – P RESENT AND F UTURE
Benchmarks (with optimizations) 50 dacapo_sim 45 fischer5 audio_big 40 bando ’’ 35 ’’ 30 Time (s) ’’ ’’ 25 20 15 10 5 0 1999 2000 2001 date 15 M. O LIVER M ¨ CDC’01 6 D EC 2001 OLLER : UPPAAL – P RESENT AND F UTURE
Architecture of U PPAAL GUI Editor Simulator Verifier Engine command line .xml .ta file file 16 M. O LIVER M ¨ CDC’01 6 D EC 2001 OLLER : UPPAAL – P RESENT AND F UTURE
Communication Protocols Protocol Actor ) ( Actor model model req? ack? UPPAAL Model of Actor I Model of Actor II Model model- check Termination Time Bounds Deadlock-Freedom 17 CDC’01 6 D EC 2001 M. O LIVER M ¨ OLLER : UPPAAL – P RESENT AND F UTURE
Case Studies: Protocols Philips Audio Protocol [HS95, CAV95, RTSS95, CAV96] Collision-Avoidance Protocol [SPIN95] Bounded Retransmission Protocol [TACAS97] Bang & Olufsen Audio/Video Protocol [RTSS97] TDMA Protocol [PRFTS97] Lip-Synchronization Protocol [FMICS97] Multimedia Streams [DSVIS98] ATM ABR Protocol [CAV99] ABB Fieldbus Protocol [ECRTS2k] IEEE 1394 Firewire Root Contention [STTT’01] 18 M. O LIVER M ¨ CDC’01 6 D EC 2001 OLLER : UPPAAL – P RESENT AND F UTURE
Composing the Embedded System Model Plant Controller continous Program sensors Task discrete Task actuators Task (automatic) (user-supplied) UPPAAL Model Model of Environment Model of Tasks 19 M. O LIVER M ¨ CDC’01 6 D EC 2001 OLLER : UPPAAL – P RESENT AND F UTURE
Case Studies: Controllers Gearbox Controller [TACAS98] Bang & Olufsen Power Controller [RTPS99,FTRTFT2k] SIDMAR Steel Production Plant [RTCSA99, DSVV2k] Real-Time RCX Control-Programs [ECRTS2k] RCX Production Cell (2000) Experimental Batch Plant [ICDCS’01] Saab Car Locking System [RT-TOOLS’01] 20 M. O LIVER M ¨ CDC’01 6 D EC 2001 OLLER : UPPAAL – P RESENT AND F UTURE
Extensions of the Modeling Language ◮ Stopwatch extension ◮ Probabilistic timed automata ◮ Hierarchical timed automata ◮ Parameters on clock constraints ◮ Cost-Optimal timed automata ◮ Executable timed automata 21 CDC’01 6 D EC 2001 M. O LIVER M ¨ OLLER : UPPAAL – P RESENT AND F UTURE
Hierarchical U PPAAL Use hierarchical timed ToIdle? ToInhibited? ToTriggered? On automata: Inhibited Triggered inIdle Self Inhibited Self Triggered Ventricular Ventricular Idle Refractory Refractory listening == 1 Pacing Pacing t ≤ 0 VSense! t ≤ DELAY AFTER V Waiting Waiting t := 0 listening == 0 t := 0 t == noncritical heartstop AVI entry V VPace? t := 0 Atrial Ventricular t == delay after V t := 0 t ≤ noncritical heartstop APace? entry A FLATLINE t==RefTime Refractory t==Pulse_Width Refractory VPace? RefractDone? VPace! t == delay after A t:=0 t:=0 t := 0 RefractDone! t ≤ DELAY AFTER A A_Pacing A_Pacing t ≤ 0 S t==senseTime X Waiting Waiting APace? sense? APace! t:=0 x:=0 V_Sense? V_Sense! Sensed x<=0 Human Heart inAVI ToAVI? commandedOff! commandedOn! ToOn? ToOff? Off ALLOW_SWITCH_OFF == 1 toTriggered! PrgrmmrRdmENTRYtrprgrmmrsm3? Pacemaker toInhibited! Random PrgrmmrMdswtchENTRYtrprgrmmrsm3? PrgrmmrIdlENTRYtrprgrmmrsm3? triggerVar1 := triggerVar1 + 1 Idle IDLE triggerVar1 := triggerVar1 - 1 xtSglNR3? triggerVar1 := triggerVar1 + 1 PROGRAMMER_TIME == MODE_SWITCH_DELAY PROGRAMMER_TIME <= MODE_SWITCH_DELAY commandedOff! PROGRAMMER_TIME :=0, triggerVar1 := triggerVar1 - 1 ALLOW_SWITCH_OFF == 1 Modeswitch ModeswitchDelay toIdle! PROGRAMMER_TIME :=0, triggerVar1 := triggerVar1 - 1 ALLOW_SWITCH_OFF == 1 commandedOn! PROGRAMMER_TIME :=0, triggerVar1 := triggerVar1 - 1 toInhibited! PROGRAMMER_TIME :=0, triggerVar1 := triggerVar1 - 1 toTriggered! PROGRAMMER_TIME :=0, triggerVar1 := triggerVar1 - 1 Medic toAVI! PROGRAMMER_TIME :=0, triggerVar1 := triggerVar1 - 1 22 CDC’01 6 D EC 2001 M. O LIVER M ¨ OLLER : UPPAAL – P RESENT AND F UTURE
Flattened Version of the Pacemaker HTA model # XML tags 564 1191 U PPAAL model − → # proper control locations 35 45 − → Parameters: REFRACTORY_TIME = 50 • SAFETY: SENSE_TIMEOUT = 15 A[] ¬ heart stops • LIVENESS: DELAY_AFTER_V = 50 DELAY_AFTER_A = 5 A[] Vcontract => A<> Acontract MODE_SWITCH_DELAY = 66 E.g. for MODE_SWITCH_DELAY = 65 , A[] ¬ heart stops is violated 23 M. O LIVER M ¨ CDC’01 6 D EC 2001 OLLER : UPPAAL – P RESENT AND F UTURE
Recommend
More recommend
