On the composition of hybrid systems

Bornot, Sébastien; Sifakis, Joseph

doi:10.1007/3-540-64358-3_31

Cited by 27 publications

(4 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Infrastructure "a" Internal dependencies External dependencies Infrastructure "b" #2 #1 #2 Because we represent each CIS component with an open hybrid automaton, it is necessary to be able to connect all these models together properly and create a larger model that we can use to simulate different scenarios. This can be achieved with the composition operation of open hybrid automata [42,43,44]. In general, the composition of two open hybrid automata models consists, roughly, the connection between some of the inputs/outputs (I/O) of one hybrid automaton with some O/I of another, while the remaining I/O become the I/O of the newly composed hybrid automaton [41].…”

Section: Modeling Frameworkmentioning

confidence: 99%

Hybrid systems modeling for critical infrastructures interdependency analysis

Heracleous

Kolios

Panayiotou

et al. 2017

Reliability Engineering & System Safety

View full text Add to dashboard Cite

Critical infrastructure systems (CISs) are large scale and complex systems, across which many interdependencies exist. As a result, several modeling and simulation approaches are being employed to study the concurrent operation of multiple CISs and their interdependencies. Complementary to existing literature, this work develops and implements a modeling and simulation framework based on open hybrid automata to analyze CISs interdependencies. With the proposed approach, it is possible to develop accurate models of infrastructure components, and interlink them together based on their dependencies; in effect creating larger and more complex models that incorporate interdependencies. By implementing specific setups using varying operating conditions, one can study the cascading effects of interdependencies, perform a detailed vulnerability assessment and conduct an extensive planning exercise. To demonstrate the applicability of the proposed framework, a setup with three different types of CISs (i.e., power, telecom and water) components is investigated. Extensive simulation results are used to provide insights on the cascading effects, vulnerabilities and maintenance planning strategies.

show abstract

Section: Modeling Frameworkmentioning

confidence: 99%

Hybrid systems modeling for critical infrastructures interdependency analysis

Heracleous

Kolios

Panayiotou

et al. 2017

Reliability Engineering & System Safety

View full text Add to dashboard Cite

show abstract

“…Because of these particularly counterintuitive aspects, we believe that time-actionlocks should be prevented by construction; i.e., the timed automata model should be reinterpreted in such a way that time-actionlocks just cannot arise. Bowman [Bow01] presents such a method for Timed Automata with Deadlines [BS98] (this is discussed later in Section 4).…”

Section: The Implications Of Different Kinds Of Deadlocksmentioning

confidence: 99%

How to stop time stopping

Bowman

Gómez

2006

Form. Asp. Comput.

View full text Add to dashboard Cite

Zeno-timelocks constitute a challenge for the formal verification of timed automata: they are difficult to detect, and the verification of most properties (e.g., safety) is only correct for timelock-free models. Some time ago, Tripakis proposed a syntactic check on the structure of timed automata: if a certain condition (called strong non-zenoness’ SNZ) is met by all the loops in a given automaton, then zeno-timelocks are guaranteed not to occur. Checking for SNZ is efficient, and compositional (if all components in a network of automata are strongly non-zeno, then the network is free from zeno-timelocks). Strong non-zenoness, however, is sufficient-only: There exist non-zeno specifications which are not strongly non-zeno. A TCTL formula is known that represents a sufficient-and-necessary condition for non-zenoness; unfortunately, this formula requires a demanding model-checking algorithm, and not all model-checkers are able to express it. In addition, this algorithm provides only limited diagnostic information. Here we propose a number of alternative solutions. First, we show that the compositional application of SNZ can be weakened: some networks can be guaranteed to be free from Zeno-timelocks, even if not every component is strongly non-zeno. Secondly, we present new syntactic, sufficient-only conditions that complement SNZ. Finally, we describe a sufficient-and-necessary condition that only requires a simple form of reachability analysis. Furthermore, our conditions identify the cause of zeno-timelocks directly on the model, in the form of unsafe loops. We also comment on a tool that we have developed, which implements the syntactic checks on Uppaal models. The tool is also able to derive, from those unsafe loops in a given automaton (in general, an Uppaal model representing a product automaton of a given network), the reachability formulas that characterise the occurrence of zeno-timelocks. A modified version of the carrier sense multiple access with collision detection protocol is used as a case-study.

show abstract

“…This semantics corresponds to a maximally urgent behavior in the sense that an action may occur when Vigi holds and time progress stops as soon as Vidi holds. In practice, it is often useful to define other choice operators with less prompt semantics ([BS97a]). We define a choice operator taking into account priorities between actions.…”

Section: Choice Operatorsmentioning

confidence: 99%

“…Of course, the most urgent solution is to take dl, 2 = g 1 ,2 A (di V d 2 ) but this often leads to situations where the computed deadline dl, 2 does not correspond to the intuition [BS97a]. For this reason but also to introduce a simple model where deadlines are defined from guards by means of simple assumptions about urgency of the actions, we slightly modify our model.…”

Section: Synchronization Modes Of Hybrid Actionsmentioning

confidence: 99%