IIST and UNU - UNU-IIST - United Nations University

Case study: the Gas Burner 16
Figure 3(b) illustrates the refinement of the basic patterns. The grey area indicates the requirements,
while the dark area (contained in the grey area) illustrates the TLA design.
The following law is a generalisation of Law 12 for general functional restrictions.
Law 13 If l f(l) for any l b , f(l) > b for any l > b , and c sup l>b
l−f(l)
⌊f(l)/b⌋ , then
D
∫
p f(l) ⊇ 〈 [0, b] ↑ p ↓ [c, ∞] 〉 .
5 Case study: the Gas Burner
The Gas Burner problem was first stated in [13] and has been a standard example of hybrid
system design. A gas burner can be in any state of being idle, purging (waiting the leaked gas
to disperse), attempting to ignite, monitoring flame when igniting, or burning after successful
ignition. There is no leak in idling or purging, but there is always leak in any attempt of ignition
before burning. In this paper, we consider a challenging version of the example in which the
burning phase may have some leak due to the possibility of disturbance from the environment
(see [10]).
The main requirement is to ensure that the total gas leak in every 30 seconds does not exceed
4 seconds. This can be neatly specified in Duration Calculus as follows:
D (l 30 ⇒ ∫ Leak 4) .
Our treatment of this problem consists of several steps of automata decomposition hierarchically.
This process may be viewed as “refinement”, as each step corresponds to a reduction of
nondeterminism. On the other hand, if the target automaton is constructed and model-checked
first, the reversed process can be used to establish the link between the checked model and the
original specification for verification purposes.
We first decompose the original requirement into burning and non-burning phases generated
by a cyclic automaton. For simplicity, we intend to use the 2-segment refinement Law 11 and
thus need to construct a slow automaton that takes at least 30 seconds to change state. Since
the original specification is in a special form, we need to consider only intervals of length 30
and choose g(·) and h(·) (to characterise the amount of leak) such that for any t 0 and t 1 ,
if t 0 + t 1 = 30 g(t 0 ) + h(t 1 ) 4 . For convenience, we choose g(t) ̂= B 1 ⊳ t ∈ [B 1 , 30] ⊲ l and
h(t) ̂= B 2 ⊳ t ∈ [B 2 , 30] ⊲ l . We now obtain our first refinement (illustrated in Figure 5).
D (l 30 ⇒ ∫ Leak 4)
⊇
D (l 30 ⇒ ∫ Leak B 1 ) ⊳ Burn ⊲ D (l 30 ⇒ ∫ Leak B 2 )
∧ 〈 [a, ∞] ↑ Burn ↓ [b, ∞] 〉
Report No. 301,
UNU-IIST, P.O. Box 3058, Macau