The Formal Analysis of Timed Systems in Practice
L'analyse formelle des systèmes temporisés en pratique
Résumé
In this thesis we propose a complete formal framework for the analysis of timed systems, with the emphasis given on the practicality of the approach. We describe timed systems in the formal model of timed automata, finite-discrete-state automata equipped with clocks in a dense-time domain. Properties of such systems are expressed in the linear-time formalism of timed Büchi automata (timed automata with acceptance conditions), or in one of the branching-time logics CTL, TCTL or \etctl. These formalisms cover a large spectrum of properties on the order of events and the timing constraints on the delays between events. We also examine other interesting properties such as deadlock and timelock freedom or reachability. We consider two types of analysis. Verification : given a system and a property, check whether the system satisfies the property. Controller synthesis : given a system and a property, find a restriction of the system which satisfies the property. These problems have been proven decidable in previous works, however, with a high (exponential) complexity, basically due to the fact that the state space is extremely large (state explosion) and has to be entirely generated and explored. To respond to the challenge of making the approach tractable, we propose methods which are efficient in practice, despite of the high worst-case theoretical complexity. Our approach is based on two key elements. First, on abstractions which reduce the concrete state space to a much smaller abstract state space, while preserving all properties of interest. Second, on efficient techniques to compute and explore the abstract state space. We define two sets of abstractions and study the properties they preserve. Time-abstracting bisimulations are equivalences which hide the quantitative aspect of time : we know that some time passes, but not how much. The stronger of these bisimulations preserves all properties of interest. Time-abstracting simulations are abstractions derived by a forward reachability analysis on the system. These abstractions preserve only linear properties. The analysis methods differ depending on the underlying abstraction(s) used. In the case of bisimulations, the approach consists in two steps : first, generate the time-abstracting quotient of the state space, then apply classical (untimed) analysis techniques to the quotient to prove properties of the concrete system. In the case of simulations, the generation of the abstract state space and the analysis are performed at the same time. This technique is called on-the-fly and can often provide fast answers without having to generate the entire (abstract) state space. We develop on-the-fly verification techniques for TBA and ETCTL. To make the verification task easier for the user, we develop techniques for extracting concrete diagnostic sequences (both finite and infinite) from the abstract sequences usually returned by the algorithms. The concrete diagnostics contain information both about the discrete state changes as well as the exact time delays during the execution. For the problem of controller synthesis, we develop an on-the-fly algorithm for untimed systems and use on the time-abstracting quotient to solve the problem in the timed setting. To put our methods to the test, we have implemented the algorithms developed in the thesis, on top of Kronos, the real-time tool-suite of Verimag. We have extended Kronos with a number of functionalities, including time-abstracting quotient generation, on-the-fly parallel composition of TA, on-the-fly TBA verification, concrete diagnostic generation and controller synthesis. We have also connected Kronos to the verification programming environment Open-Caesar, developed at INRIA and Verimag. Using Kronos, we have treated a number of non-trivial case studies, including two industrial communication protocols by CNET and Bang&Olufsen, the asynchronous electronic circuit Stari, a multimedia document authoring language developed at INRIA, a real-time scheduling example and a benchmark example for timed verification tools. The analysis results have been interesting. Sometimes we found errors in the systems and in the case of multimedia documents we managed to solve a scheduling problem using controller synthesis techniques. The performance results have been encouraging. Most of the times we managed to improve the results of previous versions of Kronos and other similar verification tools by many orders of magnitude.
Dans cette thèse nous proposons un cadre formel complet pour l'analyse des systèmes temporisés, avec l'accent mis sur la valeur pratique de l'approche. Nous décrivons des systèmes comme des automates temporisés et nous exprimons les propriétés en logiques temps-réel. Nous considérons deux types d'analyse. Vérification : étant donnés un système et une propriété, vérifier que le système satisfait la propriété. Synthèse de contrôleurs : étant donnés un système et une propriété, restreindre le système pour qu'il satisfasse la propriété. Pour rendre l'approche possible malgré la difficulté théorique des problèmes, nous proposons : Des abstractions pour réduire l'espace d'états concret en un espace abstrait beaucoup plus petit qui, pourtant, préserve toutes les propriétés qui nous intéressent. Des techniques efficaces pour calculer et explorer l'espace d'états abstrait. Nous définissons des bisimulations et simulations faisant abstraction du temps et nous étudions les propriétés qu'elles préservent. Pour les bisimulations, l'analyse consiste à générer d'abord l'espace abstrait, et ensuite l'utiliser pour vérifier des propriétés sur l'espace concret. Pour les simulations, la génération et la vérification se font en même temps (à-la-volée). Un algorithme à-la-volée est aussi développé pour la synthèse de contrôleurs. Pour aider l'utilisateur à sa compréhension du système, nous produisons des séquences diagnostiques concrètes. Nous avons implanté nos méthodes dans Kronos, l'outil d'analyse temps-réel de Verimag, et nous avons traité un nombre d'études de cas réalistes parmi lesquelles le protocole FRP-DT de réservation rapide de débit pour les réseaux ATM (dans le cadre d'une coopération scientifique avec le CNET), le protocole de détection de collisions dans un réseaux à accès multiple de Band&Olufsen, l'ordonnancement de tâches temps-réel périodiques, la cohérence et l'ordonnancement des documents multimédia, ainsi qu'un nombre d'études de cas benchmarks, telles que le protocole d'exclusion mutuelle de Fischer, les protocoles de communication CSMA/CD et FDDI.