Verifying Cyber-Physical Systems by Sayan Mitra

Author:Sayan Mitra
Language: eng
Format: epub
Tags: A graduate-level textbook that presents a unified mathematical framework for modeling and analyzing cyber-physical systems, with a strong focus on verification.
Publisher: MIT Press

Recall that α ⌈ (A, ∅) represents the trace of α restricted to the set of actions A and the empty set of variables (i.e., the resulting trace only has information about the timing of the actions). TTh is called the abstract model, and Thermostat is called the concrete model. The abstract model contains the behaviors of the concrete model, but has more behaviors. The abstract TTh is also simpler because it has fewer modes and constant dynamics.

Following Equation (8.1), TTh is a timing abstraction of Thermostat; it preserves the timing behavior, but not the detailed dynamics. In fact, TTh is a timed automaton, and in Chapter 9, we will see that it can be verified automatically. Equation (8.1) implies that the verified timing requirements of TTh transfer to Thermostat.

Note that the converse is not true; there are executions of TTh for which there is no corresponding execution of Thermostat. For example, an execution in which turnOn never occurs has no counterpart in ExecsThermostat. Thus, verified requirements of Thermostat would not transfer to TTh. Timing abstraction, and more generally, any abstraction relation on automata, defines a preorder on automata.

How can we prove this abstraction relation? Executions are infinite sequences of states and trajectories. Reasoning about sets of executions quickly becomes complicated. The key idea is to reason about states instead. Because two automata are involved, we have to reason about a pair of states. Mathematically, we have to work with a predicate R on VThermostat ∪ V TTh or, equivalently, a relation R ⊆ val(VThermostat) × val(V TTh). Further, we would want the relationship between the automata to hold for arbitrarily long executions, and therefore, the relation R should be inductive. Consider the relation over the states of the two automata given in Definition 8.1.

Definition 8.1.   For any pair of states x1 ∈ val(VThermostat), x2 ∈ val(V TTh), (x1, x2) ∈ R if and only if

1. x1 ⌈ loc = x2 ⌈ loc, and

2. x1 ⌈ loc = on then .

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.