Model Checking of Real-time Systems and the Uppaal Tool

1
Model Checking of Real-time Systems and the
Uppaal Tool

• by
• Manuel Brandozzi

Software Reliability Presentation Nov. 28, 2001
2
Introduction to Real Time Systems Model Checking

• Real time systems have to provide time guarantees
• Examples safety critical systems, multimedia
  systems

3
Traditional Model Checkers are Not Enough !

• Based on Finite State Automata and Linear
  temporal logic
• FSA dont allow time constraints on states or
  transitions
• LTL doesnt handle real time

4
So, what can we use to model real time systems?

• Timed FSA
• FSA U Clocks
• State (l,u)
• Transitions atomic actions, delay actions

5
Clocks

• Start at 0 and proceed at the same rate
• Can be tested
• Can be reset
• Clock constraints
• x n, or x-y n

6
Timed FSA

• Formal definition
• ltN, I, D, K, Vgt
• D is a relation included in
• N X B(C) X A X 2C X N

7
A Simple Timed Automaton

• Complex real time systems may be modeled as
  networks of timed automata

8
Lv, a Dense Time Logic

• All the formulas that can be expressed by

• We interpret them over an extended state lts,vgt

9
Model Checking Algorithms

• Clock assignments are grouped into regions
• u1v1 in the same region of u2v2 gt they satisfy
  the same formulas
• Model checking ? verifying the formulas on the
  FSA corresponding to the extended state semantics
  of the timed automaton

10
Uppaal

• Developed by Uppsala University, Sweden and
  Aalborg University, Denmark
• Model checking engine
• Graphical user interface

11
The Model Checking Engine

• Attacks state space and region space explosion
• Can verify safety, bounded liveness and
  reachability properties
• Can provides diagnostic traces

12
The User Interface

• System editor
• Simulator
• Verifier

13
System editor
14
Simulator
15
Verifier
16
Landing Control Example

• Distributed real time controller
• Planes have to land eventually
• The landing times have to be at least 3 min. from
  each other
• Troubled plane has precedence

17
Timed automaton template
18
Formal Specifications

• Req. 1
• Altgt (P1.Landed and P2.Landed)
• Req. 2
• A (P1.Landed and P2.Landed) imply (ygt3 or
  zgt3)

19
Revised Automaton