IIST and UNU - UNU-IIST - United Nations University

Conclusions 18
There are many possible solutions to the restrictions. We take the following combination:
a = b = 30, B 1 = B 2 = 2, c = 2, d = 30, e = 0, f = 2 . Note that we could let d be 28 and then
e = f = 2 , but that means the control of the ignition must be exactly in 2 seconds — a requirement
difficult to meet in practice. By extending the purging phase, we allow more flexibility for
the ignition. Once an automaton is obtained, the transition restrictions can be strengthened to
reduce nondeterminism. For example, the restriction [d, ∞] can be replaced with [30, 30 + ε]
where ε indicates a tolerantable timing inaccuracy.
In the final step, we split the state of non-leaking into idling and purging and the state of leaking
into two states of ignition, and restrict the timing nondeterminism to obtain a reasonable design.
Again the verification of this step can be conducted in TLA.
Figure 6: Combined design
In the above design, the state of burning must be no less than 30 seconds. This additional
requirement is introduced by Law 11 and can be avoided if we decided to use Law 10 instead,
although this alternative design would generate more complicated restrictions for the parameters.
6 Conclusions
This paper studies a formal framework in which our knowledge about the relationships between
different temporal logics can be formalised in the form of algebraic or refinement laws. In the case
study on DC and TLA, we have identified refinement laws for several design patterns. Some of
the laws are general and cover most types of refinement with a particular target implementation.
More specific laws are introduced for the most common patterns, and their parameters can be
more readily determined. The technique is applied to the design of gas burner problem. It is
not a trivial task to identify general but at the same time practically useful laws. However once
such laws are identified, they genuinely make the design process more systematic, especially on
the determination of parameters.
The formalism of the framework was first presented at IFM’04. The main focus of this paper
is, however, on the relationship between DC and TLA. In particular, the decomposition of
durational specifications (into automata) is the main new contribution.
Report No. 301,
UNU-IIST, P.O. Box 3058, Macau