Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/36—Prevention of errors by analysis, debugging or testing of software
  • G06F11/3604—Analysis of software for verifying properties of programs
  • G06F11/3608—Analysis of software for verifying properties of programs using formal methods, e.g. model checking, abstract interpretation

Definitions

• the invention relates to a method and a system for generating from the specification in a formal language of a dreaded behavior, automatically generating an observer agent, called monitor, capable, online, for an arbitrary duration and without loss of performance , to report any occurrence of said dreaded behavior specified during the operation of a system likely to produce this behavior. It allows the automatic generation of specified behavior detectors in metric linear time logic, with bounded memory, capable of operating online and for an arbitrarily long time. It is used in particular for the control and monitoring of simulated systems or even physical systems. It also makes it possible to carry out on-line diagnostics of control-command systems, monitoring of environments in home automation or robotics. It is also implemented for the proof of properties on finished executions / simulation. Different industries are concerned by the invention, such as: transport, telecom, Internet service, robotics and home automation industries.
• proof techniques based on algebraic specifications. These techniques, if they make it possible to deal with complex, algorithmic functions, are not completely automatic.
• the dedicated tools are proof assistants and the subtle part of the evidence is entrusted to qualified experts.
• model-checking is completely automatic, but has the disadvantage of being limited to the treatment of a class of simple models, oriented control flow (without algorithms) .
• the models analyzed by the "model-checking" technique must be limited in size. Otherwise, the tools consume memory space resources and computing time inaccessible in practice.
• a formal monitoring tool is therefore a tool that accepts as input an expression specifying a dreaded behavior and outputs a monitor capable of detecting the occurrence of the dreaded behavior.
• a formal monitoring approach there are mainly two formal monitoring approaches known to the Applicant.
• the behavior of a system model or a physical system is represented by the evolution over time of a certain number of characteristic variables.
• the behavior of a body in solid state physics, is characterized by the evolution of its characteristic variables such as its position, its speed, its acceleration, its kinetic moment, etc. Proposal.
• Proposal refers to any expression that refers to the characteristic variables of the system and may be true or false.
• the speed of the body k is 10 m / s”
• the speed of the body k is strictly positive
• the term "proposition” designates any linguistic expression, relating to the characteristic variables of a system, which can be either true or false. Instantaneous.
• a snapshot gives the Boolean value of the defined propositions for a certain system. More formally we will speak of a snapshot relative to a set A of propositions to designate any pair (v, t) composed of a valuation v of the propositions of A and a date t (where t is element of the set of reals R).
• evaluation of the propositions of A we mean any application of A in ⁇ 0,1 ⁇ , that is to say say an element of ⁇ 0,1 ⁇ A.
• a process is used relative to a set A of propositions to designate any sequence indexed by the natural numbers of snapshots relating to A.
• a process is therefore an application of S in I A where S c N, is an initial segment of N (for all i GS, if i> 0 then i -1 e S).
• the first snapshot will have a date that we will call Origin. In the examples we will often choose 0 as the value for T_edge.
• a process is therefore intuitively a sort of "movie" of how the system works.
• 2.3. 1 and u are elements of ⁇ 0,1 ⁇ . They denote the opening or closing of the interval on terminals Ib and ub. If I is 0 the interval is open on its lower bound Ib, closed if I is 1. Idem for u which specifies the opening / closing on the upper bounded ub
• the quadruplet (0, 4.32, 6.21, 1) represents the same interval as noted] 4.32, 6.21].
• i.l, i.lb, i.ub and i.u denote the parameters mentioned above. So, for example, if i is] 4.32, 6.21] then:
• a validity list is a list whose elements are well-formed intervals of the set of realities R, all disjoint, arranged in ascending (chronological) order.
• the notation (h, i 2 , ..., in) will be used to designate a validity list containing the intervals H, i 2 , ... i n -
• the chronological order means that if i k and i k + 1 are two consecutive intervals of a validity list we still have ik ⁇ ik + i-
• ([0, 2.43 [, [3.27, 5.04]) is a validity list that contains two intervals, [0, 2.43 [ and [3.27, 5.04]. They are arranged in ascending or chronological order.
• a validity list is by destination attached to an expression and allows to define, over a given time range, the dates when this expression is true and the dates when it is false, by conforming to the following convention: the dates that are within the intervals of the validity list are the dates when the expression is true; outside these intervals the expression is false.
• connection on the left The connection of a validity list
• the left of a validity list L is the result of the connection of L to the right of L '.
• the object of the present invention relates to a method and a system for remedying at least the imperfections of the aforementioned methods.
• the invention particularly relates to a method for automatically generating, from the formal specification of a feared behavior written in metric linear time logic, an automatic agent, called monitor, with bounded memory, capable of analyzing "on-line" the simulating a system model or the operation of a physical system to detect the occurrence of the specified dreaded behavior.
• the method can therefore be used in the design phases to analyze a model, or in the test phases to analyze the operation of the realized system.
• the present invention is based on the use of a formal language for specifying dreaded behaviors and a method for transforming any expression of this language into a powerful monitor, operating online, with no time limit.
• the object of the present invention relates to a method for generating a detector of feared behaviors specified in metric linear time logic of a system whose behavior is to be monitored, characterized in that it comprises at least the following steps: implemented by a processor (steps on which we will come back later in the description):
• ⁇ :: p
• Option 1 Origin - ⁇ .rel_cert - Option 2: sup (Origin, Origin - ⁇ .rel_cert)
• the invention also relates to a system for generating a detector of dreaded behaviors specified in linear temporal logic.
• metric with bound memory, characterized in that it comprises at least the following elements: An input receiving one or more parameter (s) characteristic (s) of the state of the system to monitor, and a clock H indicating the date acquisition of this parameter (s), A processor adapted to perform the steps of the method according to the invention using the measured parameter (s) and the associated date, A suitable memory storing the current snapshot storing the validity lists LV determined by the implementation of the method for the main formula and its sub-formulas, where one or more outputs emitting a signal S corresponding to the information contained in the validity list for the main formula and transmit said signal.
• FIG. 1 is a block diagram of the method according to the invention and FIG. 1B is an example of a system architecture enabling it to be implemented,
• FIG. 2 a representation of the notion of process
• FIG. 3 an algorithm for calculating the validity list of a proposition or of a formula called a purely Boolean formula
• FIGS. 4, 5, 6A and 6B illustrate the calculation of the validity list of a formula according to those of its sub-formulas
• Figure 7A the illustration of the calculation of the certainty date of a formula according to that of its sub-formula (for the unary operator on the future)
• Figure 7B illustrates the calculation of the certainty date of a formula according to that of its sub-formulas (for the binary operator on the past)
• FIG. 8A illustration of the definition of a zone of influence taken into account for the implementation of the method according to the invention
• Figure 9 an example of application for monitoring the behavior of a mass-spring system.
• FIG. 1A is a block diagram of an example of the method according to the invention comprising a system 1 whose behavior is to be observed, a time clock H making it possible to determine the date on which a snapshot was acquired, a processor that will process the data coming from the system to be monitored, for example a variable observed at a given moment and which will be able to evaluate the value of the propositions where this variable appears, to then calculate the validity lists attached to these propositions then the validity lists more complex formulas up to the validity list of the main formula specifying the dreaded behavior.
• FIG. 1 B is shown an exemplary system according to the invention which comprises the system 1 whose behavior is monitored.
• the system includes one or more sensors 10 for determining the value of each parameter representative of the monitored behavior. For example, it is possible to have a temperature sensor and check if a temperature proposal is true. Examples are given below.
• the sensor or sensors of the parameters equipping the system 1 are connected to a device 11 comprising an input 12 and a processor 13 which will process the different data and a memory 14 storing the current snapshot and the validity lists of each formula.
• the device 11 also comprises an input 15 receiving a clock specifying a date associated with a measured parameter.
• the processor 13 will deliver via one or more outputs 16i a signal Sc containing data allowing, for example:
• the signal obtained is transmitted to a device for generating an alarm and / or to a system control or regulation system under the supervision of a monitor generated by the method according to the invention.
• the system whose behavior is monitored may be a model executed in simulation. This model can be very complex and / or large because the monitor generated according to the invention does not depend on the internal structure of this model. In this case the method can be considered as a model debugging technique.
• the system can also be a device or a physical system which one wishes to control the behavior in operation and in particular to check its behavior. The process can then be considered as a subset of a larger control system.
• the system according to the invention can be applied as a device making it possible to detect errors in the operation of a system, better known as the "debugger" of simulated systems, or as a monitor of physical systems for detecting malfunctions thereof. this in any industrial field (transport, home automation, robotics).
• a monitor according to the invention consists in particular of several elements which will be explained below.
• the concepts of process, proposal, validity list and snapshot have been defined previously.
• One of the elements entering the generation of the monitor is the notion of validity list which is represented for example in Figures 4, 5, 6A, 6B.
• the way in which a validity list can be deduced from a process is illustrated as follows. For this purpose, we examine the information that is delivered by a process to an observer or a sensor or monitoring device within a process. For this observer, the information delivered by a snapshot of the process remains until the snapshot following the i + i refreshes this information.
• the information delivered by a snapshot of date t is equal to t 'where t' is the date of the next snapshot. If the last snapshot of the process has the date z, this principle makes it possible to define the validity of a proposition on any date of the interval [0, z] and thus a validity list on this range.
• the steps of creating a validity list for the proposition p such as would be an observer placed in front of the process of Figure 2 are carried out below.
• the process starts at 0 where snapshot I is refreshed.
• It adds to the list of validity of p a first interval is [0.0, 0.0].
• the validity list of p is therefore ([0.0, 0.0]).
• the snapshot is refreshed in 1, py is always true.
• the date value is 1.71.
• the process extends the previous validity interval.
• the list becomes ([0.0, 1.71]).
• Any proposition p is associated with a boolean variable p. val and a variable list variable p.LV ("LV" for validity list). It is p.LV which represents the validity list for p. If I is a snapshot, then l.t is the date that I and l.p give to the truth value I assigns to proposition p. The algorithm is described by the diagram shown in Figure 3.
• the first step, step 20, is a step of initializing the values of p. val and p.LV.
• the variable p.val is initialized to false and the variable p.LV is initialized by the empty list.
• the next step, step 21, is a refresh standby state of snapshot I. When this refresh occurs the algorithm goes to step 22 where the value of l.p is tested. If the truth value of l.p is true (is 1) the method tests, step 23, the value of p.val. If p.val is true then, step 24, the process extends the last interval of p.LV up to and including (closed interval on the value l.t). If the value p.val is false (worth 0) then, step 25, the process adds at the end of p.LV the new interval [l.t, l.t].
• step 22 If, on the other hand, in step 22, lp is false, then the method tests p.val. If p.val is true, step 26, then the process extends the last interval of p.LV up to and excluding lt (open on lt) (step 28). If p.val is false, then the process leaves p.LV unchanged (step 27). Following steps 24, 25, 27 and 28, the method assigns p.val the value of lp (step 29). Then the process returns to the refresh standby step 21 of I, the calculation continuing as long as the process is kept running. As such, there is no stopping condition for this computation algorithm since it is waiting for a new snapshot. It can nevertheless be easily modified if the indication that a snapshot is the last is available.
• the return to step 21 would be subject to the condition that the submitted snapshot is not the last.
• the stopping condition will be determined by a strategy of using the complete method, that is to say by a strategy of exploitation of the validity lists.
• the method can generate a simple monitor, for a language restricted to the proposals.
• a first example of implementation of the method is given without limitation, for a dreaded behavior specified by a single proposal. In this example, it is proposed to generate a monitor to observe the bank account of a customer, posing as dreaded behavior that the balance is negative in other words that the proposal (balance ⁇ 0) is true at a given moment .
• the process is considered relative to the set ⁇ (balance ⁇ 0) ⁇ .
• the method then consists of the following algorithm: 1 - Allocate a boolean variable denoted I. (balance ⁇ 0) to store the value of (balance ⁇ 0) and a variable lt of real type to store the refresh date
• ⁇ :: p
• the direct sub-formulas of a formula are those placed directly under its operator. For example, for -i ⁇ it is ⁇ . For ⁇ i U [ a , b] ⁇ 2 it is ⁇ 1 and ⁇ 2 .
• • ⁇ .val is a Boolean variable associated with ⁇ . It is initialized to 0.
• Figure 4 illustrates the calculation of the validity list of -i ⁇ knowing that of ⁇ .
• the principle is as follows: two successive intervals i and i + 1 of ⁇ give rise to an interval for -i ⁇ which inserts between i and i + 1. (See Appendix 1 for a more detailed description).
• the validity list of ⁇ i ⁇ ⁇ 2 depends on those of ⁇ i and ⁇ 2 .
• the principle is: if h is an interval of ⁇ i and i 2 is an interval of ⁇ 2 and hni 2 ⁇ 0, then hni 2 is an interval of ⁇ ⁇ ⁇ ⁇ 2 . (See Appendix 1 for a more detailed description).
• Figure 5 illustrates how an interval of F [a , b] ⁇ is produced as a function of an existing interval in the validity list of ⁇ . If i is an interval of ⁇ we deduce that the interval (i ⁇ [-b, -a]) contains the validity dates for F [a , b] ⁇ according to the data of i. Indeed, let us choose a date t of i ⁇ [-b, -a]. Is ⁇ actually true in [t + a, t + b]? In other words, does [t + a, t + b] cut i? Suppose this is not the case.
• the set i 2 is itself a set of dates that validate ⁇ 1 U [a , b] ⁇ 2 -
• the interval i 2 must therefore also be adjoint to ( ⁇ 1 U [ a , b] ⁇ 2 ) .LV.
• the validity list of P [a,>] ⁇ depends only on the first interval of the validity list of ⁇ . If it exists and is of the form [u, v] then the validity list of P [a , > ] ⁇ is composed of the single interval [u + a, ⁇ [.
• the calculation of the validity list uses a non-recursive algorithm based on the height of the formulas.
• the certainty window will be, for any formula ⁇ , the interval [T_origin - Cert ( ⁇ ), lt - Cert ( ⁇ )].
• the certainty window will be, for any formula ⁇ , interval [sup (Origin, (Origin - Cert ( ⁇ ))), lt - Cert ( ⁇ )].
• F [a , b ] P can be determined only until r - b. Indeed consider a date t ⁇ r - b. So t + b ⁇ r. Can the validity of F [ab ] p be determined in t? According to the definition of this operator this can be determined if the validity of p is certain on any date of [t + a, t + b]. Now this is the case since having t + b ⁇ r and a ⁇ b, it follows that all the dates of p on [t + a, t + b] are lower than r and therefore the validity of p known for each.
• each sub-formula ⁇ of the principal is assigned a real variable named ⁇ .abs_cert intended to store the absolute certainty date of ⁇ .
• ⁇ .abs_cert intended to store the absolute certainty date of ⁇ .
• the initialization depends on an option. For ⁇ this variable ⁇ .abs_cert will be initialized either to (option 1) T_edge -
• FIG. 8A illustrates the zone of influence for F [a , b] ⁇ .
• the last snapshot is I 'while the precedent is I.
• w of F [a , b] ⁇ is therefore] lt - (F [a! b] ⁇ ) .rel_cert, the .t - (F [a , b ] ⁇ ) .rel_cert].
• the first dates on the value of ⁇ which influence the continuation window of F [aib ] ⁇ are the dates superior to lt - (F [a! B] ⁇ ) .rel_cert + a while the last one which influences this window of continuation is the .t - (F [a ib ] ⁇ ) .rel_cert + b. In other words, it is the interval F [aib ] .w ⁇ [a, b].
• This can be expressed and generalized as a function that accepts two formulas as arguments and returns an interval. If ⁇ is a direct subformula formula of ⁇ , ZI ( ⁇ , ⁇ ) is the time range of the validity list of ⁇ to consider in calculating the continuation of ⁇ .
• the process will take into account the constraints that a function, which we will call Dl, must satisfy to be a function of uselessness with the idea that a function of uselessness takes as argument a formula ⁇ n supposed to be a sub-formula of a main formula ⁇ , and returns a real number DI ( ⁇ n ), so that the absolute useless date ⁇ n .abs_di of ⁇ n is: ⁇ .abs_di + DI ( ⁇ n ) .
• DI ( ⁇ n ) is therefore a useless date relative to the date of absolute uselessness ⁇ .abs_di of the main formula.
• DI ( ⁇ n ) is therefore a useless date relative to the date of absolute uselessness ⁇ .abs_di of the main formula.
• FIG. 9 illustrates an example of practical application to control the behavior of a mass-spring system.
• a mass M moving without friction on a horizontal plane is connected to a vertical support S by a spring R and a damping system A.
• Several properties can be analyzed by the method according to the invention, during a simulation of this model.
• an expected property could be that the force f and the displacement x always vary in the same direction. In other words, what is feared is the proposition (df.dx ⁇ 0). It is possible to release this property by asking that if it happens that (df.dx ⁇ 0) then (df.dx> 0) is restored between 0.2 and 0.5 seconds later. In other words, the expected property is (df.dx ⁇ 0) ⁇ F [0 2, 05] (df.dx> 0).
• the formula expressing the dreaded behavior is therefore -1 (-1 ((df.dx ⁇ 0) ⁇ -1 Fp 2, 05] (df.dx> 0))) that is to say simply: (df .dx ⁇ 0) ⁇ -1 F [0 2 , 05] (-> (df.dx ⁇ O)).
• Another expected property could be: we must have (df.dx> 0) globally but we tolerate that (df.dx ⁇ 0) when df is close to zero (at plus or minus 0.5 newtons).
• the expected property is (df.dx> 0) v (- 0.5 ⁇ df ⁇ 0.5).
• the dreaded property is its negation -1 ((df.dx> 0) v (-0.5 ⁇ df ⁇ 0.5)) or simply ((df.dx ⁇ 0) ⁇ (-0.5 ⁇ f v f> 0.5)).
• X (i) means that the value X has been calculated because the formula considered is a sub-formula of the formula of the line i.
• the notation 0.2 (3) in line 2 means that 0.2 has been calculated for -i (df.dx ⁇ 0) because this formula is a sub-formula of that found in line 3. It can be seen that (df.dx ⁇ 0) is a sub-formula of two formulas (those in line 2 and 5, which is why there are two values for this formula).
• intervals of their respective validity lists predate strictly their respective absolute useless dates. These are [0.0.3 [for ⁇ i and [0.3.0.7 [for ⁇ 2 . These intervals can be deleted from the respective validity lists (they no longer play any role in the detection of ⁇ 5 which is the main one). As it was explained, it is this mode of suppression which makes it possible to ensure that the monitor requires a bounded memory resource.
• the method and the system according to the invention have the following advantages in particular:
• An automatic method the monitor is automatically calculated from the expression of the dreaded behavior and the operation of the monitor is automatic in normal operation. It is fast and inexpensive in memory.
• the method can be applied to any model, unlike the proof or model-checking model approaches that analyze the model as defined in its internal structure.
• the monitor is only interested in executions of a system, to its observable productions. Whether the model is, in its internal structure, very simple or very complex, small or large, this has no impact on the generated monitor, since it does not depend on the structure of the model but only on the formula given in Entrance.
• the analysis is done online, which means that:
• the method according to the invention does not suppose a particular regularity on the execution, the delay between two observations being any.
• Buffer is a variable of validity list type, initialized empty from each algorithm. "Nil” does not have a specific meaning. It intervenes to denote empty or undefined objects (lists, intervals %)
• ⁇ .LV for list of validity of ⁇ (lists of disjoint intervals steadily increased)
• ⁇ .LV.first and ⁇ .LV.Iast denote respectively the first and the last element of ⁇ .LV (are both Nil to denote that ⁇ .LV is empty)
• I and u are elements of ⁇ 0,1 ⁇ which denote the opening or closing of the interval on terminals Ib and ub
• Ib lower bound
• ub upper bound example: (0, 4.32, 6.21, 1) represents] 4.32, 6.21] if i is an interval then i.l, i.lb, i.ub and i.u denote the parameters mentioned above
• i be an interval of a validity list LV: i.pred denotes its predecessor in LV (Nil if i is the first element) i.next denotes the following interval in LV (Nil if i is last element)
• ⁇ .LV is not empty, then be i its unique interval. This interval is modified so that it becomes (i.l, i.lb, w.ub, w.u) and FIN.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Software Systems (AREA)
• Computer Hardware Design (AREA)
• Quality & Reliability (AREA)
• Physics & Mathematics (AREA)
• General Engineering & Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
• Debugging And Monitoring (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=40351954

Family Applications (1)

Country Status (3)

Cited By (1)

Families Citing this family (1)

• 2008
  • 2008-09-02 FR FR0804812A patent/FR2935500B1/fr not_active Expired - Fee Related
• 2009
  • 2009-09-02 EP EP09782492A patent/EP2321728A2/de not_active Ceased
  • 2009-09-02 WO PCT/EP2009/061318 patent/WO2010026150A2/fr not_active Ceased

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events