PhD Dissertation Yusi Ramadian Advisor : Luigi Palopoli
Co‐advisor : Alessandro Cimatti
Parametric
Real
‐
Time
System
Feasibility
Analysis
Using
Parametric
Timed
Automata
Real
‐
Time
System
Applications
•
A
computer
based
system,
which
produces
results
to
inputs
complying
with
some
temporal
constraints
Main
Research
Idea
3
Real Time System Design Process
Correct and Robust
Real Time System
Feasibility Analysis on
Parametric Real Time
System
Parameters
Parameter1 Parameter2
•
Parametric
Timed
Automata
(PTA)
definition
and
representation
of
Real
Time
System
•
Parametric
Verification
of
Temporal
Properties
(PVTP)
method
•
Implementation
in
tool
Quinq
•
Application
in
case
problems
:
– periodic task system [RTSS08],
– heterogeneous system [ETFA10],
– collaboration with Modular Performance Analysis Toolbox
(MPA) [CASES11].
Contribution
of
PhD
research
•
Motivation
– Real time system design
– Example scenario
– Problem Statement
•
Solution
– Parametric Timed Automata
– Parametric Verification of Temporal Property Method
•
Implementation
in
Quinq
– Architecture
– Demo
•
State
of
the
art
•
Conclusion
Presentation
Outline
•
Safety
consideration
•
Manufacturing
consideration
•
Variability
in
environment
and
run
‐
time
Æ
Need
for
formalization
of
design
process
The
Importance
of
CORRECT
&
ROBUST
Real
Time
System
Design
Process
•
Design
&
Modelling
– Activation pattern
– Timing properties
– Scheduling Algorithm
•
Robustness
&
Parameter
Tuning
– Assign values
– Evaluate system
robustness w.r.t to
parameters
Page 7
Functional Specification Architecture Design Functional Design
Mapping on RTS
RTS Model Design Parameter Environment Exogenous Parameter Parametric Feasibility Analysis
Correct and Robust RTS
Schedulability Region
•
Motivation
– Real time system design
– Example scenario
– Problem Statement
•
Solution
– Parametric Timed Automata
– Parametric Verification of Temporal Property Method
•
Implementation
in
Quinq
– Architecture
– Demo
•
State
of
the
art
•
Conclusion
Presentation
Outline
Sensitivity
Analysis
:
Example
Scenario
Page 9
11
9
11
2
?
0
5
10
15
20
25
30
Task
1
Task
2
Parameters Task 1 Task 2
Period 20 30
Deadline 20 30
Computation Time 11 12
•
Classical
scheduling
theory
Æ
system
failure
Task
system
is
not
schedulable
•
Solution
‐ Stronger machine (Hardware solution)
‐ Tweaking offset..
Sensitivity
Analysis
:
Example
Scenario
Discussion
#1
Sensitivity
Analysis
:
Region
of
Schedulability on
Offsets
Page 11 1 3 5 7 9 11 13 15 17
0 3 5 7 9 11 13 15 17 19
Parameters Task 1 Task 2
Period 20 30
Deadline 20 30
Computation
Time
11 12
Offset 0 0
Parameters Task 1 Task 2
Period 20 30
Deadline 20 30
Computation
Time
11 12
Offset ? ?
O2
Sensitivity
Analysis:
Corrected
Scenario
Page 12 Page 12
11
5
11
7
0
5
10
15
20
25
30
Task
1
Task
2
9
Parameters Task 1 Task 2
Period 20 30
Deadline 20 30
Computation Time 11 12
Offset 0 0
Parameters Task 1 Task 2
Period 20 30
Deadline 20 30
Computation Time 11 12
Parameters Task 1 Task 2
Period 20 30
Deadline 20 30
Computation Time
11 12
Offset 5 0
Parameters Task 1 Task 2
Period 20 30
Deadline 20 30
Computation Time
? ?
Offset 5 ?
Sensitivity
Analysis:
Example
Scenario
Discussion
#2:
Robustness
Page 13 1 3 5 7 9 11 13 15 17 19
0 3 5 7 9 11 13 15 17 19
C2
C1
21 23 25 27 29System robustness = ?
O2 – O1 = 10 O2 – O1 = 8
Requirement conclusion #1:
We want to find out :the schedulability regions in the space of parameters
Æ
most robust design for our real-time systems
Sensitivity
Analysis
•
System
model
not
in
classical
RTS
•
Examples:
– System with buffers
– Complex activation
pattern
– Heterogeneous,
distributed system
– Flexible deadline
(e.g. Firm Deadline)
Sensitivity
Analysis:
Example
Scenario
Discussion
#3:
•
Requirement
conclusion
#2
Sensitivity
analysis
for
general
real
‐
time
system
Sensitivity
Analysis
•
Motivation
– Real time system design
– Example scenario
– Problem Statement
•
Solution
– Parametric Timed Automata
– Parametric Verification of Temporal Property Method
•
Implementation
in
Quinq
– Architecture
– Demo
•
State
of
the
art
•
Conclusion
Presentation
Outline
•
Problem
1
:
Sensitivity
Analysis:
Formal
problem
definition
Page 18
Task 1 System S
Task 2 … Task n
P :{P1, P2, … Pn}
P2 P1
R
Scheduling
•
Problem
2
:
Sensitivity
Analysis:
Formal
problem
definition
Page 19
Task 1 System S
Task 2 … Task n
P :{P1, P2, … Pn}
P2 P1
R
•
Motivation
– Real time system design
– Example scenario
– Problem Statement
•
Solution
– Parametric Timed Automata
– Parametric Verification of Temporal Property Method
•
Implementation
in
Quinq
– Architecture
– Demo
•
State
of
the
art
•
Conclusion
Presentation
Outline
•
Timed
automata
with
parameters
extension
•
Main
differences:
– Parameters
– Auxiliary variables
– General update statement
Parametric
Timed
Automata
•
Allow
complex
activation
pattern
Real
Time
System
in
PTA:
Activation
Pattern
Page 22
Activation
depending on
other tasks
Activation
depending on
environment
Wait
for
offset
Wait
for Q2
Wait
for
event Wait
for Q1
Clock≤O1
Release τ1 Clock=O1 Clock:= 0
Release τ2 Clock=Q2 Clock:= 0
Release τ2 Clock=Q2 Clock:= 0
Release τ3
Event_e = True Clock:= 0
Release τ1 Clock=Q1
Clock:= Clock – Q2
Clock≤Q2 Clock≤Q1
Activation
depending
on time Avoiding
restrictive 0
offset General
Real
Time
System
in
PTA:
Feasibility
Checker
Page 23
Idle Check
Busy
Error Release τ1
Clock_x:=0 r:= C1
Release τ1 Clock_x:=0 r:= C1
Clock_x=r
Clock_x=D1 ∧
Clock_x≤ r
Clock_x=r
Release τ1 Clock_x:=0
r:= r + C1–Clock_x Release τ1
Release τ1 r:= r + C1 Parameter
Auxiliary
•
PTA
:
•
Feasibility
region
R:
Sensitivity
Analysis
via
PTA
Page 24
•
Current
state
variables
V:
Discrete
vars D:
Location,
transitions
as
boolean
Continuous
vars X:
Clocks
and
other
variables
as
real
•
Symbolic
model
of
PTA
:
set
of
constraints
on
boolean and
real
variables
•
Examples:
Loc
iÆ
x
‐
y
≤
O1
Trans
iÆ
(x
≥
C1)
∧
(x’
=
C1+x)
∧
(y’
=
y)
Symbolic
representation
of
PTA
•
Look
only
for
counterexample
made
of
k‐
states
•
BMC(
k
):
•
I(V
0)
∧
R(V
0,V
1)
∧
…
∧
R(V
k‐1,V
k)
∧
Error(V
k)
•
Completeness
of
the
solution
is
not
guaranteed
•
Complementing
method
:
inductive
reasoning
Bounded
Model
Checking
(BMC)
Page 26
S0 S1 … Sk
…
•
Motivation
– Real time system design
– Example scenario
– Problem Statement
•
Solution
– Parametric Timed Automata
– Parametric Verification of Temporal Property Method
•
Implementation
in
Quinq
– Architecture
– Demo
•
State
of
the
art
•
Conclusion
Presentation
Outline
•
Verification
on
reachability problem
using
BMC:
An error trace for every found counterexample
•
Alternatively,
error
trace
can
be
searched
via
non
‐
parametric
model
checker
•
An
error
trace
π
:
PTVP
algorithm
intuition:
Search
for
an
error
trace
Page 28
•
Along
with
the
trace,
an
assignment
for
the
parameters
that
validate
the
trace
is
produced
PTVP
algorithm
intuition:
An
error
trace
π
P2
?
P1
Γ
Page 29
•
By
processing
the
trace,
the
surrounding
region
of
parameters
that
make
the
trace
true
is
identified
•
…And
we
rule
this
region
out
from
the
next
search
PTVP
algorithm
intuition:
Sensitivity
analysis
to
an
error
trace
Page 30
P2
?
P1
Γ
•
Feasibility
region
:
found
by
iteratively
bounding
the
parameter
space
from
the
unschedulability regions
PTVP
algorithm
intuition:
Schedulability region
31
P2
P1
Γ
L1 L2
…
ErrorFinal
Parametric
Verification
of
Temporal
Properties
(PVTP)
Algorithm
Page 32
Error Trace Search
Sensitivity Analysis
Region Exclusion
•
Given
Polyhedron
in
the
space
of
clocks
and
parameters
Poly{P,
X}
•
Obtain
Poly{P}
<
‐
>
∃
X,
Poly
{P,
X}
Æ
Existential
Quantifier
Elimination
Sensitivity
Analysis
•
Motivation
– Real time system design
– Example scenario
– Problem Statement
•
Solution
– Parametric Timed Automata
– Parametric Verification of Temporal Property Method
•
Implementation
in
Quinq
– Architecture
– Demo
•
State
of
the
art
•
Conclusion
Presentation
Outline
•
Based
on
NuSMV3
symbolic
model
checker
with
underlying
MathSAT SMT
solver
•
Main
functionalities
:
– Input handling
– PVTP algorithm implementation
– Completion check
– Output handling
•
Components
– Sensitivity add‐on
– High level periodic system analysis
– Search optimization
– Model checker drivers
– Graph generator
•
Blackbox components
:
UPPAAL,
JUNT,
existelim
Implementation
in
Quinq
Architecture
Page 36
Input Handling
PVTP
Implementation
Output handling
NuSMV3 UPPAAL
RTS Model
Input
Handling
37
Input
Handling
NuSMV Model
Periodic System Input UPPAAL Model
Automatic Periodic
Analysis JUNT
Input
via
UPPAAL
Model
Page 38
UPPAAL Model
NuSMV Model (Parametric) JUNT
Parametric
Model
Generator Parameters
NuSMV Model (Non‐Parametric)
•
Point
of
Considerations:
– Integer vs Real domain
– Array data structure
– Clocks
Architecture
Page 39
Input Handling
PVTP
Implementation
Output handling
NuSMV3 UPPAAL
RTS Model
Parametric
Verification
of
Temporal
Property
Implementation
40
Error Trace
Search
Sensitivity
Analysis PVTP
Implementation
NuSMV Model
Feasibility
PTVP
Algorithm
Implementation
Page 41
Error Trace Search
Error Trace NuSMV Model
Non–parametric
search Parametric
search
Non
‐
Parametric
Search
Page 42
Search Point
Generator
Trace Replication Trace Translation
Error Trace
UPPAAL Model+Parameters
Non–parametric search UPPAAL
Sensitivity
Analysis
:
Implementation
Page 43
Trace
Extraction
After Processing Constraint Processing
Parametric Constraints Model + Error Trace
Sensitivity Analysis
Polyhedral region in
clocks and variables
space
Polyhedral region in
Constraint
Processing
Page 44
Reorder
expression Constraint Processing
Case Handling
Equality Constraint
Propagation Existelim
•
Motivation
– Real time system design
– Example scenario
– Problem Statement
•
Solution
– Parametric Timed Automata
– Parametric Verification of Temporal Property Method
•
Implementation
in
Quinq
– Architecture
– Demo
•
State
of
the
art
•
Conclusion
Presentation
Outline
•
Previously
Illustrated
example:
2
periodic
tasks
system
with
3
parameters
•
S
=
{task1,
task2}
•
Periodic
tasks
:
T1=D1=20,
T2=D2=30
•
Offset
:
O1
=
0
•
Parameters
:
– Computation time: C1 , C2
– Offset : O2
DEMO
•
Offset2
=
1
Demo:result
•
Offset2
=
5
•
Offset2
=
8
•
Motivation
– Real time system design
– Example scenario
– Problem Statement
•
Solution
– Parametric Timed Automata
– Parametric Verification of Temporal Property Method
•
Implementation
in
Quinq
– Architecture
– Demo
•
State
of
the
art
•
Conclusion
Presentation
Outline
Tool Flexible
RTS
Expression System
known
apriori
Inference Point
Number of
Parameters
Feasibility Region
Bini ‐ ‐ ‐ ‐ No limit 9
MAST ‐ ‐ ‐ 9 ‐ ‐
SMART 9 * 9 ‐ No limit* 9
IMITATOR 9 * ‐ 9 2 9
QUINQ 9 9 ‐ ‐ No limit* 9
Sensitivity
Analysis
Tools
•
Motivation
– Real time system design
– Example scenario
– Problem Statement
•
Solution
– Parametric Timed Automata
– Parametric Verification of Temporal Property Method
•
Implementation
in
Quinq
– Architecture
– Demo
•
State
of
the
art
•
Conclusion
Presentation
Outline
•
PTA
representation
Æ
flexible
activation
pattern
,
general
RTS
presentation
•
PVTP
algorithm
Æ
General
method
to
obtain
feasibility
region
•
Implemented
in
Quinq with
applications
on
some
example
cases
•
Edge
on
comparison
with
other
tools:
– Flexible RTS representation
– No reference point input needed
– Whole region of schedulability result
Conclusion
•
Does
there
exist
k
such
that
the
following
formula
is
unsatisfiable
•
if
unsatisfiable
and
BMC(
k
)
unsatisfiable
then
error
state
unreachable
K
‐
Induction
52
Error
S0 S1 … Sk‐1
Error Error Error
Sk
