ECDAR Composition of Real-Time Specifications — Revisited Kim Guldstrand Larsen Aalborg...

ECDAR Composition ofReal-Time

Specifications— Revisited

Kim Guldstrand LarsenAalborg University, DENMARK

Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan

Observations

Kim G Larsen 2

Observational Equivalence – Revisited

Kim G Larsen 3

TemporalLogic ofActions

Calculus of CommunicatingSystems

Need for sound compositional specification formalisms

supporting step-wise development and design of

concurrent real-time systems

Kim G Larsen 4Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan

Context Dependent Bisimulation

Modal Transition Systems

Probabilistic MTSInterval Markov Chains

Timed MTS

UPPAAL

Parameterized MTSWeighted MTS

Dual-Priced MTSModal Contracts

ECDAR2011

Constraint Markov Chains 2010

APAC2012

Bisimulation

CWBTAU

Timed MTS

UPPAAL

ECDAR2011

APAC2012

Bisimulation

CWBTAU

Specification Theory

SpecImpsat

sat) Spec,(Imp, SPF

Formalism ionSpecificat

Imp: set of implementationsLabelled Transition Systems

}SsatI:I{|S|

Refi nement:

S T iff |S| |T|

Ø |T||S|

Ø |S|

:yConsistenc

Spec: set of specifications

Operations on Specifications

Structural Composition: Given S1 and S2 construct S1 par S2 such that

| S1 par S2 | = |S1| par |S2| · should be precongruence wrt par to allow for

compositional analysis !

Logical Conjunction: Given S1 and S2 construct S1ÆS2 such that

|S1 ÆS2| = |S1|Å|S2|

Quotienting: Given overall specification T and component

specification S construct the quotient specification T\S such that

S par X · T iff X · T\S

MTS is an automata-based specification formalism

MTS allow to express that certain actions may or must happen in their implementation

MTS supports all the required operations on specifications (conjunction, parallel composition, quotienting).

Applications in component-based software development, interface theories, modal abstractions and program analysis.

[L. & Thomsen 88Boudol & L. 90]

Example – Tea-Coffee Machines

cointea coffee cointea coffee

cointea coffee

cointeacoin

Specifications

Refinement

Implementations

coin coincoffee

MTS Definition

An MTS is a triple (P,, }) where P is a set of states and µ } µ P£ Act £ P

If = } then the MTS is an implementation.

R µ P£ P is a modal refinement iff whenever (S,T)2R then i) whenever S-a->} S’ then T-a->}T’ for some T’ with (S’,T’)2 R ii) whenever T-a-> T’ then S-a-> S’ for some S’ with (S’,T’)2 R

We write S ≤mT whenever (S,T)2R for some modal refinement R.

Example – Tea-Coffee Machines

cointea coffee cointea coffee

cointea coffee

cointea coin coincoffee

Specifications

Refinement

Implementations

≤≤

≤tea

MTS Operators

s1 || s2

s1\ s2

SynchronousParallel Composition

Quotienting

Conjunctions1 Æ s2

Refinment & Consistency Checking arePTIME-complete

Timed MTS

UPPAAL

ECDAR2011

APAC2012

Bisimulation

CWBTAU

SEMANTICS:

(A,x=0) – 3.14 (A,x=3.14) - a? (B,x=3.14) (A,x=0) - 5.23 (A,x=5.23) - a? (B,x=5.23) (ERROR, x=5.23)

Extended

Kim G Larsen 14

ClocksChannelsNetworksInteger variablesStructure variables, clocks, channelsUser defined types and functíons

Timed Automata

int UT (int X, int Y){ return (X+1)*Y;}

const int N = 10;const int D = 30;const int d = 4;typedef int[0,N-1] id_t;

broadcast chan rec[N];broadcast chan w[N];

Extended

ClocksChannelsNetworksInteger variablesStructure variables, clocks, channelsUser defined types and functíons

Kim G Larsen 15

Real-Time version of Milner’s Scheduler

reci+1

Kim G Larsen 16

Simulation & Verification

A[] not Env.ERROR

A[] forall (i:id_t) forall (j:id_t) ( Node(i).Token and Node(j).Token imply

i==j) Kim G Larsen 17

Compositional Verification

SubSpec1

SubSpec2

SubSpec3

A[] not Env.ERROR

A[] forall (i:id_t) forall (j:id_t) ( Node(i).Token and Node(j).Token imply

i==j) Kim G Larsen 18

Timed MTS

UPPAAL

ECDAR2011

APAC2012

Bisimulation

CWBTAU

Timed MTS, Refinements & Implementations

[CAV93] Karlis Cerans, Jens Chr. Godskesen, Kim Guldstrand Larsen: Timed Modal Specification - Theory and Tools. CAV 1993[EMSOFT02] Luca de Alfaro, Thomas A. Henzinger, Mariëlle Stoelinga: Timed Interfaces. EMSOFT 2002

An ImplementationInconsistent

Timed Game Automata & Synthesis

Problems to be considered:- Does there exist a winning strategy?- If yes, compute one (as simple as possible)

controllable

uncontrollable

Kim G Larsen 21

Computing Winning States

Kim G Larsen 22

Backwards Fixed-Point Computation

Reachability GamesBackwards Fixed-Point Computation

Theorem:The set of winning states is obtained as the least fixpoint of the function: X a p(X) [ Goal

cPred(X) = { q2Q | 9 q’2 X. q c q’}uPred(X) = { q2Q | 9 q’2 X. q u q’}Predt(X,Y) = { q2Q | 9 t. qt2X and 8 s·t. qs2YC }

p(X) = Predt[ X [ cPred(X) , uPred(XC) ]

Definitions

YPredt(X,Y)

Kim G Larsen 23

Decidability of Timed Games

Theorem [AMPS98,HK999]Reachability and safety timed games are decidable and EXPTIME-complete. Futhermore memoryless and ”region-based” strategies are sufficient.

Theorem [AM99,BHPR07,JT07]Optimal-time reachability timed games are decidable and EXPTIME-complete.

Algorithm [CDFLL05,BCDFLL07]Efficient ”zone-based”, on-the-fly synthesis algorithm for (optimal-time) rechability and safety timed games. (UPPAAL Tiga)

[AM99] Asarin, Maler: As soon as possible: time optimal control for timed automata. HSCC99.[BHPR07] Brihaye, Henziunger, Prabhu, Raskin: Minimum-time reachability in timed-games. ICALP07.[JT07] Jurdzinski, Trivedi: Rechability-time games on timed automata. ICALP07.[CDFLL05] Cassez, David, Fleury, Larsen, Lime: Efficient On-the-Fly Algorithms for the Analysis of Timed Games. CONCUR 2005[BCDFLL07] Behrmann, Cougnard, David, Fleury, Larsen, Lime: UPPAAL-Tiga: Time for Playing Games! CAV 2007

Kim G Larsen 24

Timed I/O Aut.: A Modern University

coinpub

Machine Researcher

Administration

grantpatent

UNIVERSITY

Input: control. (required)Output: uncontrol. (allowed)

Kim G Larsen 25

Overall Specification

coin pub

Machine Researcher

Administration

grantpatent

grant patent

Kim G Larsen 26

Timed I/O Transition Systems

oiActand

StActStwhere

:TIOTS

Time determinism(d )

s ' ' ' ' ' '

I nput enabledness

if s and s s then s s

f or all s and i

touch?

Output Urgency

I ndependent Progress

whenever

then s implies d

Either d s

or d o s

''''''s

)Act(amDeterminisa ssthenssandsif a

Implementations

Kim G Larsen 27

Refinement =Timed Alternating Simulation

Intuition:S leaves less choices than T for an implementation.

SISsatI

Definition

:|T| |S|thenTSWhenever

Theorem

Theorem:

Whenever |S| |T| then S T

T'S'withT'TthenS'Siii.

T'S'withT'TthenS'Sii.

T'S'withS'SthenT'Ti.

TIOGA.beTandSLet

Kim G Larsen 28

Refinement (example)

T'S'withT'TthenS'Siii.

T'S'withT'TthenS'Sii.

T'S'withS'SthenT'Ti.

TIOGA.beTandSLet

Kim G Larsen 29

Timed Game

TSwithTTthenSSiii

TSwithTTthenSSii

TSwithSSthenTTi

TIOGAbeTandSLet

Refinement as a Game

……

not A · B

iffAxB sat control: A<> Error

not A · B

iffAxB sat control: A<> Error

IA : IB

Ai,Bj Cl,Dm

FORMATS09Optimized Refinement Algorithm

Timed I/O Automata

refuter

verifier

Kim G Larsen 30

Refinement in ECDAR

Kim G Larsen 31

More Refinement .. In ECDAR

coin pub

Machine Researcher

Administration

grantpatent

grant patent

· ?????

Kim G Larsen 32

Consistency

Consistency:

Does there exist I such that

S1 S3S2

Kim G Larsen 33

Consistency

p(X) = Err [ Predt[ X [ iPred(X) , oPred(XC) ]

{ | . . } d os d s o s

Theorem A specificiation (state) s is inconsistentiff

s 2 ¹X. ¼(X)

Definitions

Pruned Version

Kim G Larsen 34

Conjunction, SÆT

……

gi Æ uj

hl Æ vm

pmri [ tj

IA Æ IB

sl [ pm

Theorem SÆT · S SÆT · T (U·S) and (U·T) ) U · (SÆT)

Kim G Larsen 35

Conjunction, Ex.

S Æ T

ClearlyInconsistent !

Kim G Larsen 36

Composition, S|T

1 21 10

1 2 1 2

1 21 1

1 2 1 2

1 21 1 2 2

1 2 1 2

1 1 2 2

1 2 1 2

s s s s

s s s sa

s s s s

s s s sd

s s s s

| ' ' | '

| ' ' | 'Classical rules for

Composition of I/O transitionSystems

Theorem

If A1 · B1 and A2· B2 then A1|A2 · B1|B2

Theorem

If A1 · B1 and A2· B2 then A1|A2 · B1|B2

coin? pub!

Machine Researcher

Kim G Larsen 37

Quotienting, T\S

oS!…

oX!kiqi

oX?wjæj

Kim G Larsen 38

Quotienting, T\S

oS!…

oX!kiqi

oX?wjæj

Æ : IB

§ UNI

IB Æ : IAi?

Ci\ Dj

: H ,vj

qi ,æj

Ei\ Fj

gi,uj i?

ri ,tj

Ai\ Bj

T\SKim G Larsen 39

Quotienting, T\S

oS!…

oX!kiqi

oX?wjæj

Æ : IB

§ UNI

IB Æ : IAi?

Ci\ Dj

: H ,vj

qi ,æj

Ei\ Fj

gi,uj i?

ri ,tj

Ai\ Bj

Theorem

(S | X) · T iff X · (T\S)

T\SKim G Larsen 40

Quotienting, ”Application”

coin pub

Machine Researcher

Administration

grantpatent

grant patent

Specification

coin pub

Machine Researcher

Spec \ Adm

Spec\Adm

Kim G Larsen 41

Compositional Refinement Checking

… ·C1 C2 CnC3

…C2 CnC3

S \ C1

·iffP( S \ C1 )

iff …CnC3

·P( P(S C1) \C2 )

iff … …

Andersen: Partial MC & Laroussinie, L.: CMC Tool

Kim G Larsen 42

Assume-Guarantee

Guarantee Assumption

A>>G = (A | G) \ A

Kim G Larsen 43

Properties (A | G) · ¸

(A | A>>G )

A>>G ¸ G

A · A’ ) A>>G ¸ A’>> G

G · G’ ) A>>G · A>>G’

Assume-Guarantee Reasoning

A1, G1 A2, G2

Proof Rule: A>>G ¸ ( A1>>G1 | A2>>G2 )

Kim G Larsen 44

FASE’12: Moving from Specifications to Contracts in Component-Based Design

Milner’s Scheduler Compositionaly

reci+1

Find SSi and verify:

1. N1· SS1

2. SS1 | N2 · SS2

3. SS2 | N3 · SS3

… …n. SSn-1 | Nn · SSn

n+1. SSn | N0 · SPEC

SPECKim G Larsen 45

reci+1

Find SSi ……

No new rec[1]! untilrec[i+1]?

After rec[1]? then rec[i+1]!within [d*i,D*i]

Kim G Larsen 46

rec[1]! occurs with> N*d time sep.

reci+1

Take SSi = (A1 & A2)>>G

Kim G Larsen 47

reci+1

Take SSi = (A1 & A2)>>G

Kim G Larsen 48

Experiments

Kim G Larsen 49

References

LICS88: Kim Guldstrand Larsen, Bent Thomsen: A Modal Process Logic. EMSOFT 2002: Luca de Alfaro, Thomas A. Henzinger, Mariëlle Stoelinga: Timed

Interfaces.

FMCO’09: Methodologies for Specification of Real-Time Systems Using Timed I/O Automata

WADT’10: An Interface Theory for Timed Systems ATVA’10: ECDAR: An Environment for Compositional Design and Analysis of Real

Time Systems HSCC’10:Timed I/O Automata: A Complete Specification Theory for Real-time

Systems STTT’12: Compositional verification of real-time systems using Ecdar

QEST’10: Compositional Design Methodology with Constraint Markov Chains QEST’11: APAC: A Tool for Reasoning about Abstract Probabilistic Automata FASE’12: Moving from Specifications to Contracts in

Component-Based Design FMSD’13:: Weighted modal transition systems. Sci. Comput. Prg ‘14: A modal specification theory for components with data.

www.cs.aau.dk/~adavid/ecdar www.cs.aau.dk/~adavid/tiga

www.uppaal.comKim G Larsen 50

Timed TLA

UPPAAL ECDAR ?

UPPAAL

APAC2012

Congratulation !!

ECDAR Composition of Real-Time Specifications — Revisited Kim Guldstrand Larsen Aalborg...

Documents

Aalborg Universitet Oresund Link case study Larsen, Jacob ...vbn.aau.dk/files/17004559/Part2DraftFinalGuideandCaseStudiesWeb... · Larsen, Jacob Norvig Published in: Study on voluntary

Aalborg Universitet Oresund Link case study Larsen, Jacob ......Aalborg Universitet Oresund Link case study Larsen, Jacob Norvig Published in: Study on voluntary arrangements for collaborative

Modelling and Analysis of Real Time Systems Kim Guldstrand Larsen

Brian Nielsen Kim Guldstrand Larsen Arne Skou

OVERVIEW OF EXISTING TEACHING MATERIALproftrac.eu/fileadmin/prof_trac/2017/4TtT/02_TtT... · 1 OVERVIEW OF EXISTING TEACHING MATERIAL Olena Kalyanova Larsen Associate professor Aalborg

Aalborg Universitet Kompendium i Vandløbshydraulik Larsen ... · 6 Torben Larsen: Kompendium i Vandløbshydraulik – foreløbig udgave – 01-10-2017 hvor G er kraften rettet lodret

Aalborg Universitet Den Anerkendende Idrætsforening Larsen, … · Larsen, Kenneth Kruse DOI (link to publication from Publisher): 10.5278/vbn.phd.med.00107 Publication date: 2018

Aalborg Universitet Oresund Link case study Larsen, Jacob Norvig · Oresund Link case study Larsen, Jacob Norvig Published in: Study on voluntary arrangements for collaborative working

On the Usability of Spoken Dialogue Systems Presentation of Ph.D. thesis by Lars Bo Larsen Aalborg University, Sep. 12, 2003

1 Verification Options & Beyond Reachability or how to make UPPAAL perform better and more Kim Guldstrand Larsen BRICS@Aalborg

Aalborg Universitet The Break Strand, Anete Mikkala ... · Jens Larsen, founder Old Friends Industries, advisory board member Material Storylab, Aalborg University info@oldfriendsindustries.com

Gerd Behrmann Kim Larsen BRICS & Aalborg Universitypeople.cs.aau.dk/~adavid/RTSS05/uppaal-intro.pdf · Gerd Behrmann Kim Larsen BRICS & Aalborg University ... Clocks clock x1, x2,

Aalborg City of Aalborg Thomas Kastrup-Larsen Our vision is to make Aalborg a global, desirable and competitive city of knowledge and industry

LCA-profiler for bygningsdele · 2014. 7. 9. · Henning Larsen Architects Rambøll. Intro Kataloget er blevet til i et samarbejde mellem Statens Byggeforskningsinstitut, Aalborg

1 Modelling and Validation of Real Time Systems Kim Guldstrand Larsen Paul Pettersson BRICS@Aalborg

Symbolic Reachability and Beyound or how UPPAAL really works Kim Guldstrand Larsen BRICS@Aalborg

Energistyring og -optimering i Intelligente Bygninger af Kim Guldstrand Larsen og Arne Skou, CISS, AAU

CLASSICCLASSIC Modelling Specification - … · Modelling, Specification, and Verification Kim Guldstrand Larsen using UPPAAL CLASSICCLASSIC. Modelling ... Robots Cruise Control ABS

UCb Symbolic Reachability and Beyound or how UPPAAL really works Kim Guldstrand Larsen BRICS@Aalborg

Aalborg Universitet Borkum Riffgrund Larsen, Brian Juul ...vbn.aau.dk/ws/files/48626491/borkum_riffground.pdf · 2005 Document Version Early version, also known as pre-print ... uo!llsod