没有合适的资源?快使用搜索试试~ 我知道了~
Timed Automata: Semantics, Algorithms and Tools
5星 · 超过95%的资源 需积分: 10 7 下载量 105 浏览量
2010-09-29
18:34:34
上传
评论
收藏 371KB PDF 举报
温馨提示
试读
42页
This chapter is to provide a tutorial and pointers to results and related work on timed automata with a focus on semantical and algorithmic aspects of verification tools
资源推荐
资源详情
资源评论
Timed Automata: Semantics, Algorithms and Tools
Johan Bengtsson and Wang Yi
Uppsala University
Email: {johanb,yi}@it.uu.se
Abstract. This chapter is to provide a tutorial and pointers to results and related
work on timed automata with a focus on semantical and algorithmic aspects of
verification tools. We present the concrete and abstract semantics of timed au-
tomata (based on transition rules, regions and zones), decision problems, and
algorithms for verification. A detailed description on DBM (Difference Bound
Matrices) is included, which is the central data structure behind several verifica-
tion tools for timed systems. As an example, we give a brief introduction to the
tool UPPAAL.
1 Introduction
Timed automata is a theory for modeling and verification of real time systems. Exam-
ples of other formalisms with the same purpose, are timed Petri Nets, timed process
algebras, and real time logics [BD91,RR88,Yi91,NS94,AH94,Cha99]. Following the
work of Alur and Dill [AD90,AD94], several model checkers have been developed with
timed automata being the core of their input languages e.g. [Yov97,LPY97]. It is fair
to say that they have been the driving force for the application and development of the
theory. The goal of this chapter is to provide a tutorial on timed automata with a focus
on the semantics and algorithms based on which these tools are developed.
In the original theory of timed automata [AD90,AD94], a timed automaton is a finite-
state Büchi automaton extended with a set of real-valued variables modeling clocks.
Constraints on the clock variables are used to restrict the behavior of an automaton, and
Büchi accepting conditions are used to enforce progress properties. A simplified ver-
sion, namely Timed Safety Automata is introduced in [HNSY94] to specify progress
properties using local invariant conditions. Due to its simplicity, Timed Safety Au-
tomata has been adopted in several verification tools for timed automata e.g. UPPAAL
[LPY97] and Kronos [Yov97]. In this presentation, we shall focus on Timed Safety Au-
tomata, and following the literature, refer them as Timed Automata or simply automata
when it is understood from the context.
The rest of the chapter is organized as follows: In the next section, we describe the syn-
tax and operational semantics of timed automata. The section also addresses decision
problems relevant to automatic verification. In the literature, the decidability and unde-
cidability of such problems are often considered to be the fundamental properties of a
computation model. Section 3 presents the abstract version of the operational semantics
based on regions and zones. Section 4 describes the data structure DBM (Difference
Bound Matrices) for the efficient representation and manipulation of zones, and opera-
tions on zones, needed for symbolic verification. Section 5 gives a brief introduction to
the verification tool UPPAAL. Finally, as an appendix, we list the pseudo-code for the
presented DBM algorithms.
2 Timed Automata
A timed automaton is essentially a finite automaton (that is a graph containing a finite
set of nodes or locations and a finite set of labeled edges) extended with real-valued
variables. Such an automaton may be considered as an abstract model of a timed sys-
tem. The variables model the logical clocks in the system, that are initialized with zero
when the system is started, and then increase synchronously with the same rate. Clock
constraints i.e. guards on edges are used to restrict the behavior of the automaton. A
transition represented by an edge can be taken when the clocks values satisfy the guard
labeled on the edge. Clocks may be reset to zero when a transition is taken.
The first example Fig. 1(a) is an example timed automaton. The timing behavior of
the automaton is controlled by two clocks
and
. The clock
is used to control the
self-loop in the location loop. The single transition of the loop may occur when
.
Clock
controls the execution of the entire automaton. The automaton may leave start
at any time point when
is in the interval between 10 and 20; it can go from loop to
end when
is between 40 and 50, etc.
start
loop
end
x:=0, y:=0
10<=y<=20
enter
40<=y<=50
y:=0
leave
x==1
x:=0
work
10<=y<=20
y:=0
start
y<=20
loop
y<=50
end
y<=20
x:=0, y:=0
10<=y
enter
40<=y
y:=0
leave
x==1
x:=0
work
10<=y
y:=0
(a) (b)
Fig.1. Timed Automata and Location Invariants
Timed Büchi Automata A guard on an edge of an automaton is only an enabling con-
dition of the transition represented by the edge; but it can not force the transition to
be taken. For instance, the example automaton may stay forever in any location, just
idling. In the initial work by Alur and Dill [AD90], the problem is solved by introduc-
ing Büchi-acceptance conditions; a subset of the locations in the automaton are marked
as accepting, and only those executions passing through an accepting location infinitely
often are considered valid behaviors of the automaton. As an example, consider again
the automaton in Fig. 1(a) and assume that end is marked as accepting. This implies
that all executions of the automaton must visit end infinitely many times. This imposes
implicit conditions on start and loop. The location start must be left when the value
of
is at most 20, otherwise the automaton will get stuck in start and never be able to
enter end. Likewise, the automaton must leave loop when
is at most 50 to be able to
enter end.
Timed Safety Automata A more intuitive notion of progress is introduced in timed safety
automata [HNSY94]. Instead of accepting conditions, in timed safety automata, loca-
tions may be put local timing constraints called location invariants. An automaton may
remain in a location as long as the clocks values satisfy the invariant condition of the
location. For example, consider the timed safety automaton in Fig. 1(b), which corre-
sponds to the Büchi automaton in Fig. 1(a) with end marked as an accepting location.
The invariant specifies a local condition that start and end must be left when
is at
most 20 and loop must be left when
is at most 50. This gives a local view of the
timing behavior of the automaton in each location.
In the rest of this chapter, we shall focus on timed safety automata and refer such au-
tomata as Timed Automata or simply automata without confusion.
2.1 Formal Syntax
Assume a finite set of real-valued variables
ranged over by
etc.standing for clocks
and a finite alphabet
ranged over by
etc.standing for actions.
Clock Constraints A clock constraint is a conjunctive formula of atomic constraints of
the form
or
for
and
. Clock
constraints will be used as guards for timed automata. We use
!"#$
to denote the set of
clock constraints, ranged over by
%
and also by
&
later.
Definition 1 (Timed Automaton) A timed automaton
'
is a tuple
(*)
,+.-,/0132
where
–
)
is a finite set of locations (or nodes),
–
+4-
)
is the initial location,
–
/65
)879!:".;$<7=7?>A@B79)
is the set of edges and
–
10C
)
ED
!"#$
assigns invariants to locations
We shall write
+GFIH JIH KLMNDO+QP
when
(
+R
%
RST+QPU2
/
.
As in verification tools e.g. UPPAAL [LPY97], we restrict location invariants to con-
straints that are downwards closed, in the form:
or
where
is a natural
number.
Concurrency and Communication To model concurrent systems, timed automata
can be extended with parallel composition. In process algebras, various parallel com-
position operators have been proposed to model different aspects of concurrency (see
e.g. CCS and CSP [Mil89,Hoa78]). These algebraic operators can be adopted in timed
automata. In the UPPAAL modeling language [LPY97], the CCS parallel composition
operator [Mil89] is used, which allows interleaving of actions as well as hand-shake
synchronization. The precise definition of this operator is given in Section 5.
Essentially the parallel composition of a set of automata is the product of the automata.
Building the product automaton is an entirely syntactical but computationally expensive
operation. In UPPAAL, the product automaton is computed on-the-fly during verifica-
tion.
2.2 Operational Semantics
The semantics of a timed automaton is defined as a transition system where a state or
configuration consists of the current location and the current values of clocks. There are
two types of transitions between states. The automaton may either delay for some time
(a delay transition), or follow an enabled edge (an action transition).
To keep track of the changes of clock values, we use functions known as clock assign-
ments mapping
to the non-negative reals
. Let
denote such functions, and use
%
to mean that the clock values denoted by
satisfy the guard
%
. For
?
, let
denote the clock assignment that maps all
to
"
$
, and for
S05
, let
S
D
denote the clock assignment that maps all clocks in
S
to 0 and agree with
for the other clocks in
S
.
Definition 2 (Operational Semantics) The semantics of a timed automaton is a tran-
sition system (also known as a timed transition system) where states are pairs
(
+N
2
,
and transitions are defined by the rules:
–
(
+R
2
D
(
+N
2
if
=
1
"
+
$
and
"
$
1
"
+
$
for a non-negative real
0
–
(
+R
2
J
D
(
+*PQ
P 2
if
+
FIH JIH K
, DO+*PQ
9%
P
S
D
and
P
1
"
+*P
$
2.3 Verification Problems
The operational semantics is the basis for verification of timed automata. In the follow-
ing, we formalize decision problems in timed automata based on transition systems.
Language Inclusion A timed action is a pair
"
$
, where
is an action taken by
an automaton
'
after
time units since
'
has been started. The absolute time
is called a time-stamp of the action
. A timed trace is a (possibly infinite) sequence of
timed actions
"
$ "
I$
4"
$
where
for all
.
Definition 3 A run of a timed automaton
'
(Q)
+#-,/0132
with initial state
(
+#-
- 2
over a timed trace
"
$ "
$ "
I$
is a sequence of transitions:
(
+
-
-
2
D
J
D
(
+
2
D
J
D
(
+
2
D
J
D
(
+
2
satisfying the condition
for all
.
The timed language
"*' $
is the set of all timed traces
for which there exists a run of
'
over
.
Undecidability The negative result on timed automata as a computation model is that
the language inclusion checking problem i.e. to check
"*' $
5
"Q! $
is undecidable
[AD94,ACH94]. Unlike finite state automata, timed automata is not determinizable in
general. Timed automata can not be complemented either, that is, the complement of
the timed language of a timed automaton may not be described as a timed automaton.
The inclusion checking problem will be decidable if
!
in checking
"*' $
5
"Q! $
is
restricted to the deterministic class of timed automata. Research effort has been made
to characterize interesting classes of determinizable timed systems e.g. event-clock au-
tomata [AFH99] and timed communicating sequential processes [YJ94]. Essentially,
the undecidability of language inclusion problem is due to the arbitrary clock reset. If
all the edges labeled with the same action symbol in a timed automaton, are also labeled
with the same set of clocks to reset, the automaton will be determinizable. This covers
the class of event-clock automata [AFH99].
We may abstract away from the time-stamps appearing in timed traces and define the
untimed language
! #"$&%
"Q' $
as the set of all traces in the form
'
for which
there exists a timed trace
"
(
$ "
I$ "
$
in the timed language of
'
.
The inclusion checking problem for untimed languages is decidable. This is one of the
classic results for timed automata [AD94].
Bisimulation Another classic result on timed systems is the decidability of timed
bisimulation [Cer92]. Timedbisimulation is introducedfor timed process algebras [Yi91].
However, it can be easily extended to timed automata.
Definition 4 A bisimulation
)
over the states of timed transition systems and the al-
phabet
+*
, is a symmetrical binary relation satisfying the following condition:
for all
"
-,
,
$0
.)
, if
,
0/
D
,
P
for some
1
2*
and
,
P
, then
,
3/
D
,
P
and
"
4,
P
,
P
$<
5)
for some
,
P
.
剩余41页未读,继续阅读
资源评论
- xingyang59092013-07-07很不错的资源
seekingdreams
- 粉丝: 0
- 资源: 1
上传资源 快速赚钱
- 我的内容管理 展开
- 我的资源 快来上传第一个资源
- 我的收益 登录查看自己的收益
- 我的积分 登录查看自己的积分
- 我的C币 登录后查看C币余额
- 我的收藏
- 我的下载
- 下载帮助
安全验证
文档复制为VIP权益,开通VIP直接复制
信息提交成功