IIST and UNU - UNU-IIST - United Nations University

Linking Duration Calculus and TLA 10
where Leak is a predicate denoting whether there is leaking in a state. For simplicity, we rewrite
the specification using standard abbreviations:
D (l 30 ⇒ ∫ Leak 4)
where l ̂= |i| and ∫ Leak ̂= ∫ i
Leak(x(t)) dt .
The following two concrete DC specifications form a common design implementing the above
abstract specification:
(4)
D (⌈Leak⌉⇒ |i| 4) and D (⌈Leak⌉ ⌈¬Leak⌉ ⌈Leak⌉ ⇒ |i| 26)
where the real-time function x(t) records the state at the time point t , the specification
⌈Leak⌉ ̂= ( ∫ Leak = l) describes a period with gas leak (at “most” time points of in the period
[17]), and ⌈¬Leak⌉ ̂= ( ∫ Leak = l) describes a period almost without leak. The first
specification requires any leaking period to be bounded by 4 seconds; the second specification
states that, during any interval, the period of non-leak between two periods of leak should be
no less than 26 seconds. The sequential composition (also known as the chop operation) is
the pointwise concatenation of the intervals of specifications:
P Q ̂= ∃i 1 i 2 · (P [i 1 /i] ∧ Q[i 2 /i] ∧ i = i ⌢ 1 i 2) .
The similarity between the TLA specification (1) and the DC design (4) is obvious. They
essentially describe the same controlling strategy. Their link will be captured by a transformer
between the two logics.
4 Linking Duration Calculus and TLA
The transformer from TLA to DC
We now study a technique to link DC specifications with TLA designs. Indeed each timed trace
of 0s and 1s determines some real-time Boolean function in [0, ∞] → {0, 1} . For example, the
timed trace 〈(1.0, 0), (2.0, 1), (4.0, 0)〉 corresponds to a Boolean real-time function whose value
is 0 from time 1.0 to time 2.0 when the value becomes 1 until time 4.0 . The state between
any two consecutive time points is constant. For example, the DC abstract specification (3) can
be implemented with a TLA specification of timed traces (1). The TLA design is arguably more
intuitive than (3) in DC alone. Such interpretation of a timed trace also directly corresponds to
a timed automaton.
Report No. 301,
UNU-IIST, P.O. Box 3058, Macau