UppaalTigaUsermanualGerdBehrmann1AgnesCougnard1AlexandreDavid1Emmanue - PDF document

1 UppaalTigaUser-manualGerdBehrmann1,Agne
UppaalTigaUser-manualGerdBehrmann1,AgnesCougnard1,AlexandreDavid1,EmmanuelFleury2,KimG.Larsen1,DidierLime31CISS,AalborgUniversity,Aalborg,Denmark2LaBRI,Bordeaux-1University,CNRS(UMR5800),Talence,France3IRCCyN,EcoleCentraledeNantes,CNRS(UMR6597),Nantes,FranceAbstract.UppaalTigaisatooltoperformautomaticsynthesisofcontrollersfortimedsystems.Thisdocumentistheuser-manualofUp-paalTigabutshouldbereadjointlywiththeUppaaltutorial[BDL04].1IntroductionTigaispartoftheUppaaltoolboxforvericationofreal-timesystemswhichprovidesseveralvericationtoolssuchas:Uppaal1[BDL04](Real-timeVer-ication),Cora2[BLR05](Real-timeScheduling),TROn3[LMN05](OnlineReal-timeTesting),Tiga4(TimedGames),CoVer5(Test-caseGeneration)andTimes6(SchedulabilityAnalysis).Tigaisimplementingarealon-the-\ryalgorithmtosynthesizewinningstrate-gies[LS98,CDF+05].Sinceourrstprototypein2005[CDF+05],Tigahasim-provedofseveralordersofmagnitudeandisnowreadytodealwithindustrialcasestudies.Moreover,allthefeaturesofUppaalarenowsupportedallowingtheusertohavearichspecicationlanguage(integervariables,templates,arrayofvariables,...)tocreateitsmodels.OurinputmodelsarespeciedthroughanetworkofTimedGameAu-tomata[MPS95](TGA)whereedgesaremarkedeithercontrollableoruncontrollable(seeFig.1).Thisdenesatwoplayersgamewithononesidethecontroller(masteringthecontrollableedges)andontheothersidetheenvironment(mas-teringtheuncontrollableedges).WinningconditionsofthegamearespeciedthroughTCTLformulae.Bynow,Tigasupportsbothreachabilityandsafetygames.Givenamode

2 landwinningconditions,Tigaisabletosayif'
landwinningconditions,Tigaisabletosayif'yes'or 123456 'no'thereisastrategyforthecontrollertowinthegameandcanprovidethestrategyasanoutputifasked(option-t0). L0 L1 L2 L3 L4 Goal x x x� x x1;x:=0 xFig.1.AnexampleofTimedGameAutomaton.Thegraphicaluser-interfacehasbeenaugmentedtodealwithgamesmodels.Amongotherthings,thesimulatorallowstheusertoplayagainstthestrategiessynthesizedbyTigainordertogivetheunderstandingofwhatthestrategyis.Thisuser-manualiscoveringthespecicitiesofTigacomparedtotheba-sicUppaaltool.Itis,then,stronglyadvisedtostartwiththeUppaaltuto-rial[BDL04]toknowaboutthebasicsofUppaalbeforereadingthisdocument.Werstdeneourgamemodel(section2)andhowtospecifygames(sec-tion3),thenweexplainwhatarestrategies,howtoqueryforacontrollerahowtoplaywithitandhowtointerpretresults(section4).2TimedGameModelOurformalismisbasedonnetworksofTimedGameAutomata(TGA)asde-scribedin[CDF+05,MPS95].Givenanetworkoftimedgameautomatawedenetwotypesofgames,namelyreachabilityandsafetygames.Thissectionbrie\ryre-callsthedenitionofnetworksoftimedgameautomata,reachabilityandsafetygamesandthenotionofstrategyoveragame.Wesupposeherethatthereaderisalreadyfamiliarwithtimedautomataasdenedin[BDL04].2.1TimedGameAutomataLetCbeanitesetofreal-valuedvariablescalledclocks.Wenote(C)thesetofrectangularconstraints'generatedbythegrammar:'::=xkj''wherek,xCand2f;;&#x;0.4;䍕 ;g.ATimedGameAutomaton(TGA)isatimedautomatonasdenedin[BDL04]suchthatA=(L;l0;C;Act;E;I)withitssetofactionsActActccActupar-titionedintocontrolla

3 ble(Actc)anduncontrollable(Actu)actions.
ble(Actc)anduncontrollable(Actu)actions.Listheset2 oflocations,l0Ltheinitiallocation,ELActB(C)2CLthetran-sitionsoftheautomatonandI:L!B(C)thelocationinvariants.Fig.1.givesanexampleofatimedgameautomaton.ThesemanticsofatimedautomatonA=(L;l0;C;Act;E;I)isdenedasalabelledtransitionsystemhS;s0;!iwhereSLRCisthesetofstates,s0=(l0; 0)istheinitialstate(where 0isaclockvaluationinwhicheveryclockvalueis0)andSfR00ActgSisthetransitionrelationsuchthat:{(l;u)d!(l;ud)ifd0:0d0dud0jI(l){(l;u)a!(l0;u0)ife=(l;a;g;r;l0)Es.t.ujandu0=[r0]uandu0jI(l0).TimedgameautomatacanbecomposedintonetworksoveracommonsetofactionsandclocksconsistingofntimedgameautomataAi=(Li;li0;C;Act;Ei;Ii)wherethesetofactionsoverthenetworkisgivenby ActActActandissuchthat Act Actc Actuwhere ActcActcfActc[fggand Actu Actn Actc.Notethatthiswayofdeningcontrollableanduncontrollableactionsonthenetworkgivesprecedencetotheenvironmentoverthecontroller.Wealsonotealocationofthesystemasavector l=(l1;:::;ln).WeextendtheinvariantfunctionssuchthatI( l)=inIi(li).Andwewrite l[l0i=li]todenotethevectorwheretheithelementliof lisreplacedbyl0i.SemanticsofanetworkofntimedgameautomataAi=(Li;li0;C;Act;Ei;Ii)isdenedasatransitionsystemhS;s0;!iwhereS(L1


Ln)RCisthesetofstates,s0=( l0; 0)where l0=(l10;:::;ln0),istheinitialstateandSfR0 ActgSisthetransitionrelationsuchthat:{( l;u)d!( l;ud)ifd0:0d0dud0jI( l);{( l;u)(a;)!( l0;u0)ifla;g;r!l0s.t.ujandu0=[r0]uandu0jI( l);{( l;u)(ai;aj)!( l0[li=l0i;lj=l0j];u0)ifliai!;gi;ri!l0iandljaj?;gj;

4 rj!l0js.t.ujijandu0=[riirj0]uandu0
rj!l0js.t.ujijandu0=[riirj0]uandu0jI( l0).2.2TheModellingLanguageDeningatimedgameautomataisachievedthroughasupersetoftheUppaalmodellinglanguage.Theonlyadditiontotheoriginallanguagearethepossibilitytodene\uncontrollable"transitions.Eitherthroughthegraphicaluserinterface(seeFig.2,ontheleft)usingtheedgeinterface,orthroughthetalanguageusingthe\-u-�"keyword(seeFig.2,ontheright).Notethattransitionsareassumedtobe\controllable"bydefaultandthatprioritiesontransitionsaresimplyignoredwhensynthesizingstrategies.3SpecifyingGamesAgameisgivenbyanetworkoftimedgameautomata(A=(Ai)i�0)specifyingtherulesofthegameandaformula(')specifyingwinningconditionsdeningthesetofstatesthatshouldbereached/avoidedinordertowin/losethegame.3 processMain(){clockx;stateL0{xL1,L2,L3,L4,goal;initL0;L0&#x=2},;&#x-524;&#x.902;-L1{guardxL0&#x=1;};&#x,000;-u-L2{guardxx=0;},L0
as;&#xsign;&#x-524;&#x.910;-u-L4{guard
as;&#xsign;&#x-524;&#x.910;x1;},L1
as;&#xsign;&#x-524;&#x.910;-goal{guard
as;&#xsign;&#x-524;&#x.910;x=2;},L1
as;&#xsign;&#x-524;&#x.910;-u-L2{guardxL2
},;-L3{},L3
},;-L1{guardxsystemMain;Fig.2.TigaGUIandXTGAsyntaxexamples3.1WinningGamesWinningagamecanonlybeachievedifthelasttransitionleadingtothegoalstateiscontrollable.Forexample,theautomatononFig.3.(a)iswinning,onthecontrarytheautomatonontheFig.3.(b)islosing.Intuitivelythisisbecausetheopponentcandecidetostayintheinitialstateforeverwithouttakingthetransitionleadingtothegoalstateandletthecontrollerwithnootherchoibut

5 itsown.(a)Win! Init Goal (b)Lose! Init G
itsown.(a)Win! Init Goal (b)Lose! Init Goal Fig.3.BasicExamplesofWinning(a)andLosing(b)TimedGameAutomata.Theuseofinvariantsmightforcetheopponenttoact,thiscanbesimulatedthroughanimplicitcontrollableedgeaddedwhentheupperlimitoftheinvariantisreached.Wewillcallthisimplicitextratransitionaforcedtransition.Forexample,theautomatononFig.4.(a)showstheoriginalmodel,theautomatononFig.4.(b)makestheforcedtransitionexplicitmakingitclearwhythemodeliswinning7.Finally,theautomatononFig.4.(c)cannotbeaddedaforcedtransitionbecausethereisalreadyapossiblecontrollablebehaviorwhentheautomatonhittheinvariantthereforethismodelisdeclaredaslosing. 7Notethatforcedtransitionsarealwayscontrollable.4 (a)[5]Win! Init Goal ,(b)[5]Win! Init Goal ==5 (c)[5]Lose! Init Goal Fig.4.Basicexamplesofforcedtransition:winningmodel(a),equivalentmodelwiththeimplicittransitionmadeexplicit(b)andalosingmodel(c).Finally,whendealingwithsynchronizationandinvariantssomeapparentlystrangebehaviorsmightoccurs.Indeedforcedtransitionsmightappearincom-ponentsandbesynchronizedwithothers.Therulebeingtolocallyaddforcedtransitionstoeachcomponentandthentocomposethemalltogether.OnFig.5.(a)wecanseetheoriginalmodeloftwosynchronizedautomata,onFig.5.(b)theforcedtransitionmadeexplicitandnallyonFig.5.(c)thefullcompositionofthemodel(withtheexplicitforcedtransition).(a)Win!k[5] Inita Goal Initb a==0 a=1,(b)Win!k[5] Inita Goal Initb a==0 a=1 a==0^==5 ,(c)Win![5] Inita;b Goal a==0 a==0^==5 a=1Fig.5.Exampleofsynchronisationwithforcedtransitions:orig

6 inalmodel(a),forcedtransitionmadeexplici
inalmodel(a),forcedtransitionmadeexplicit(b),completeproductwithforcedtransitionmadeexplicit.3.2Winning/LosingConditionsSpecifyingthegamestillrequirestodenewhatarethewinningconditions.ThisisdonethroughaslightlymodiedversionoftheUppaalquerylanguage.GivenatimedgameautomatonA,asetofgoalstates(win)and/orasetofbadstates(lose),bothdenedbyclassicalUppaalstateformulae,fourtypesofwinningconditionscanbeissued.Forallofthem,thegameistondacontrollablestrategysuchthatAsupervisedbyensuresthatthecontroller:{PureReachability:\mustreachwin" control:A&#x-0.3;䄃瀀win{StrictReachabilitywithAvoidance(Until):\mustreachwinandmustavoidlose" control:A[not(lose)Uwin]5 {WeakReachabilitywithAvoidance(WeakUntil):\shouldreachwinandmustavoidlose" control:A[not(lose)Wwin]{PureSafety:\mustavoidlose" control:A[]not(lose)Note:Formulaenotprexedby\control:"aresolvedasinusualUppaal.Also,theoperatorsA[pUq]andA[pWq]areTigaspecicandarenotsupportedbyUppaal.Examples:{control:A�.13;隂Main.goal{control:A[]notMain.L4{control:A[notMain.L4WMain.goal]{control:A[Main.x2UMain.goal]{control:A[not(Main.goalandMain.x�.13;隂2)U(Main.goal)]3.3PartiallyCooperativeGamesPartiallycooperativegamesaredenedbythefactthattherearenowinningstrategybutreachingamaximalpartitionwithwinningstrategycanbedonewithsomehelpfromyouropponent.Onceinsidethemaximalpartition,youcanenforcesomeconditionwhateverdecidetheoponnent.OnFig.6,themaximalpartitionisthegraypartandinordertoreachitthecontrollerhastorelyontheenvironmenttodosomemovesinhisfavor.

7 Init E&#x-0.3;䄃瀀 control:Fig.6.Repr
Init E&#x-0.3;䄃瀀 control:Fig.6.Representationof'.Thesyntaxofthisformulaisgivenby:{PartialCooperation:\mustsatisfy'withtheleasthelpfromtheenvironment" E&#x-0.3;䄃瀀control:6 4StrategySynthesisA(controllable)strategyisafunction:LRC0Actc[fgthatconstantlygivesinformationastowhatthecontrollershoulddoduringthecourseofthegame.Inagivensituation,thestrategycouldsuggestthecontrollertoeither\doaparticularcontrollableaction"or\donothingatthispointintime()".Astrategyissaidtobeawinningstrategyifthecontrollersupervisedbythestrategyalwayswinthegamewhateveractionsarechosenbytheenvironment.4.1ExistenceofaStrategyBydefault,Tigarstcheckwhetherthereisornotawinningstrategyforthetimedgamegivenawinningcondition.OntheexamplegivenFig.7,awinningstrategycanbeextractedforallthespeciedwinningconditionsexceptforthefthone.Notethatitisalwaysbettertostartaskingforexistencebecausetprocessofstrategyextractionisquitedemandinganditwouldbeuselesstorunsuchcomputationwhenthestrategycannotbefound.#shell�verifytgaconcur05-1.{xml,q}Optionsfortheverification:GeneratingnotraceSearchorderisbreadthfirstUsingconservativespaceoptimisationSeedis1156870160StatespacerepresentationusesminimalconstraintsystemsVerifyingproperty1atline5--Propertyissatisfied.Verifyingproperty2atline11--Propertyissatisfied.Verifyingproperty3atline17--Propertyissatisfied.Verifyingproperty4atline23--Propertyissatisfied.Verifyingproperty5atline29--PropertyisNOTsatisfied.Verifyingproperty6atline35--Propertyissatisfied. Fig.7.TGAsynthesisex

8 ampleandtheTigaGUI4.2StrategyExtraction(
ampleandtheTigaGUI4.2StrategyExtraction(Option-t0ThecommandlinetoolverifytgaintheTigapackagecanoutputastrategyforeachgivenwinningconditionwhenusedwiththe\-t0"option.Ifnosuch7 strategyexists,thedualstrategycanthenbecomputedbyTiga8.Theextrac-tionofastrategycanbetriggeredthroughasetofoptionsspecictotheTigaengine:-t0|1|2�.13;著Generatediagnosticinformationonstderr.0:Sometraceandoutputsomestrategy-c0|1�.13;著Printcompactstrategy0:Printonestrategyforeachdiscretestate1:DumpBCDDstrategyforeachtransitionAnexampleofsuchoutputisgivenfortheconcur05-1.xmlexampleonFig.8withtheoptions\-t0-c0".State:(Main.L0)Whileyouarein(Main.x)wait.Whenyouarein(Main.x==1),taketransition
,-5;%.9;᠀Main.L0-Main.L1{x1,tau,1}State:(Main.L1)Whileyouarein(1&&Main.x)||(Main.x)wait.Whenyouarein(2)taketransition&#x=Mai;&#xn.x,;Main.L1-Main.goal{x&#x=Mai;&#xn.x,;=2,tau,1}State:(Main.L2)Whenyouarein(Main.x)taketransition&#x=1,0;Main.L2-Main.L3{1,tau,1}State:(Main.L3)Whenyouarein(Main.x==1),taketransition&#x=1,0;Main.L3-Main.L1{x1,tau,1}Whileyouarein(Main.x)wait.Fig.8.StrategySynthesizedforfor\control:�AMain.goal".4.3TimeOptimalStrategiesOnemaywantnot'anystrategy'butthemosttimeecientTigacannd.{TimeOptimality:\mustreachwinwithinlessthanu-gtimeunitsandmustavoidlose" control t*(u,g):A[not(lose)Uwin] 8Weplantoaddanoption\"(dual)tocomputeautomaticallythedualstrategy.8 Fig.9showsanexampleofuseofcontrol t*(u,g),whereonlythewinningpathsthatcanreachthewinninglocationwithinuareacceptedthusallowingtoforgeawi

9 nningstrategybasedonthisnewwinningcondit
nningstrategybasedonthisnewwinningconditions.Pleasenotethatthestrategythatyouplayinthesimulatorhasallitsstatesconstrainedbyu. Init WinWin Win u g Fig.9.Usingthe t*(u,g):A[pUq]expression.ProvidedthatTigastoponsomewinning-strategyforourproperty,wecangiveanalwaysterminatingapproximationalgorithmtorenetherstwinningstrategy.Indeed,startwithubeingtheminimumtimeneededtoreachthewinningstateonthestrategyoutputtedbyTigaandwith=0.Then,increaseuntilyoureacha0suchthat0givesawinningstrategyand0+1doesnotordonotterminate.ThiswillprovideyouwiththebeststrategyTigacangiveyou(ifnottheoptimalone).Moreover,theuandexpressioncanbemademorecomplexthanconstants.Indeed,itacceptsthefullC-likeUppaalsyntaxwiththelimitationsthatuisevaluatedonceatthebeginningsoitshouldnotdependonthecurrentstateorcontainclockconstraints,andisevaluatedonthecurrentstatebutmustbeside-eectfree,whichisnoclockconstraintshereaswell.Anadequateusageofthefunctiontime2goal()(quantifyingthetimeleftbeforereachinganygoalstate)canhelpalotwhensearchingforanoptimalstrategy.Theformulawoulbe:control t*(u,time2goal()).Whereubeingtheresultofanonconstrainedsearchforstrategyperformedbefore.Thetime2goal()partwillhelpheretoprunealotofnon-optimalbehaviorandwillhelptoreachtimeoptimality.4.4ConcreteGameSimulatorAnewfeaturesinceUppaalTiga0.11istheconcretesimulator.Upto0.10,thesimulatorwasasymbolicone,youcannowsimulateyoursystembasedonconcretetracethatyouchooseorthatyoucanrandomelyrethroughtthe"Random"button.Concretesimulatorhelpyoutoselectatransitiontore

10 andthenatwhattimeitwillbered.The"transi
andthenatwhattimeitwillbered.The"transitionselection"areaisaclickableareawhereverticalaxisdisplaystheactivetranstionatthislocationandhorizontalaxisdisplaysthetimeatwhichthetransitionwillbered.Byclickinginavalidzone9 Fig.10.TigaconcretesimulatorwithhighlightsonTransitionselection,Timeselec-tion,RunHistoryandHeatbar.withinthisareamakeyouselectaprecisetransitionandtimeforthistransition.Thetimeselectedisdisplayedinthe"TimeSelection"area.Twonewgraphicalelementsarealsoappearinginthenewconcretesimulator.Oneisthe"RunHistory"areawhichallowaquicknavigationinthehistoryoftherunthatyouexplore.Thegraypartofanhistoryitemvisualizethetimeelapsedwithinthisstate.Finally,theotherelementisthe"HeatBar"allowingtovisualizetheactivity(rateofactionstakenoverthetime).Moreblueitis,colderyouarebywaitingalotinstates.Morereditis,hotteryouarebyperformingalotofactionsinshorttime.Theconcretesimulatorisextremelyusefulatdebugtimetounderstandwhyawinningconditioncannotbemet.Playingagainstthedualstrategyallowtotestintuitivestrategiesortodiscovertacticsusedbytheenvironmenttodefeatthecontroller.5Conclusion&FurtherWorksTigaisalreadyfullyfunctionalandprovideafullsupportofalltheUppaalfeaturesplusanextendedquerylanguagetospecifywinningconditions.Tigaisabletodetectstrategyexistenceandtosynthesizeitatwill.Aninteractivesimu-latoralsoallowtheusertotryoutthestrategyofthecontrollerorthestrategyof10 theopponent.Moreover,severalindustrialcasestudies[DJLR07,CDL07,LC04]havebeenconductedwithsuccess.In[DJLR07],thesynthesiscapabilityof

11 thetoolhasbeencombinedwithSimulinkandRea
thetoolhasbeencombinedwithSimulinkandReal-TimeWorkshoptoprovideacompletetoolchainforsynthesis,simulation,andautomaticgenerationofproductioncode.ThisworkhasbeenperformedincollaborationwiththecompanySkovA/Sspecializinginclimatecontrolsystemsusedformodernpigandpoultrystables.Tigahasalsobeenusetocheckforsimulationbetweentimedautomataandtimedgameautomata[CDL07].Giventwotimedautomata,thetoolcacheckifonesimulatestheotherandsimilarlyfortimedgameautomatawitapplicationsforcontrollersynthesiswithpartialobservability.ThistechniquehasbeenappliedtothecompositionalvericationoftheZeroConfprotocol[GVZ06].OurtoolisbeingusedintheAMAESproject9,aFrenchnationalprojecton'AdvancedMethodsforAutonomousEmbeddedSystems'.TigahasbeenappliedforcontrollingtheautonomousrobotDala[LC04]inchargeoftakingpicturesandtransmittingthembacktoEarthduringlimitedtransmissionwindows.Itisdesirableinsuchcontrolproblemstooptimizethemovestosavepower.Inthenearfutureweplantoimproveeciencyofthestate-spaceexplorationagainandtolookatpartialobservabilityandfocusonmoreandmorereal-lifeproblems.References[BDL04]G.Behrmann,A.David,andK.G.Larsen.ATutorialonUppaal.InProc.of4thInt.SchoolonFormalMethodsfortheDesignofComputer,Communication,&SoftwareSystems(SFM-RT04),number3185inLNCS,pages200{236.Springer,2004.[BLR05]G.Behrmann,K.G.Larsen,andJ.I.Rasmussen.PricedTimedAutomata:DecidabilityResults,AlgorithmsandApplications.InProc.of3rdInter-nationalSymposiumFormalMethodsforComponentsandObjects(FMCO2004),volume3657ofLNCS,pages162{182,Leiden,TheNeth

12 erlands,November2005.Springer.[CDF+05]F.
erlands,November2005.Springer.[CDF+05]F.Cassez,A.David,E.Fleury,K.G.Larsen,andD.Lime.EcientOn-the-\ryAlgorithmsfortheAnalysisofTimedGames.InProc.of16thInt.Conf.onConcurrencyTheory(CONCUR'05),volume3653ofLNCS,pages66{80.Springer,2005.[CDL07]T.Chatain,A.David,andK.G.Larsen.PlayingGameswithGames.InSubmittedtoCAV'07,2007.[DJLR07]A.David,J.J.Jessen,K.G.Larsen,andJ.I.Rasmussen.GuidedCon-trollerSynthesisforClimateControllerUsinguppaal-tiga.InSubmittedtoCAV'07,2007.[GVZ06]B.Gebremichael,F.W.Vaandrager,andM.Zhang.Analysisofthezeroconfprotocolusinguppaal.InProceedings6thAnnualACM&IEEEConferenceonEmbeddedSoftware(EMSOFT2006),pages242{251,2006. 9http://www-verimag.imag.fr/krichen/AMAES/11 [LC04]S.Lemai-Chenevier.IxTeT-eXeC:Planication,reparationdeplanetcontr^oled'executionavecgestiondutempsetdesressources.PhDthesis,InstitutNationalPolytechniquedeToulouse,2004.[LMN05]K.G.Larsen,M.Mikucionis,andB.Nielsen.OnlineTestingofReal-TimeSystemsUsingUPPAAL:StatusandFutureWork.InInProc.ofPerspectivesofModel-BasedTesting,number04371inDagstuhlSemi-narProceedings,Dagstuhl,Germany,2005.InternationalesBegegnungsundForschungszentrumfurInformatik(IBFI).[LS98]X.LiuandS.Smolka.SimpleLinear-TimeAlgorithmforMinimalFixedPoints.InProc.26thConf.onAutomata,LanguagesandProgramming(ICALP'98),volume1443ofLNCS,pages53{66.Springer,1998.[MPS95]O.Maler,A.Pnueli,andJ.Sifakis.OntheSynthesisofDiscreteControllersforTimedSystems.InProc.12thSymp.onTheoreticalAspectsofComputerScience(STACS'95),volume900,pages229{242.Springer,19