Overview in PDF format - Tallinna Tehnikaülikool

3. MODELS OF RELIABILITY AND OPERATIONS MONITORINGSYSTEM3.1. Use of pre-emptive model checkingModel checking (MC) is an algorithmic technique for verifying that a model of thesystem satisfies a given specification. The procedure normally uses an exhaustivesearch of the state space of the system to determine if some property of the systemis true or not. Although restricted with finite state systems, MC can be combinedwith various abstraction, compositionality and induction principles to handle certainclasses of infinite state systems (Clarke, 1999).Model checking has several advantages over other system validation methodsmaking it suitable for analyses: it conducts an exhaustive exploration of all possiblebehaviors and can even be used by investigation of certain infinite systems. MC isfully automatic and allows counter example (diagnostic trace) generation. In thecurrent case MC can be used to evaluate all database units listed to determine if thedefined requirements of production speed, cost and confidence level (previousexperiences) of a product can be met. Using timed computational tree logic TCTLthe conditional existence properties can be specified by formula templates (seePaper V). As a result, a solution for production chain will be provided by the modelchecker in the form of diagnostic trace.In general, the properties expressible in temporal logics are combinations ofsafety and liveness properties. Safety properties express the fact that "something baddoes not happen", i.e., if the property is falsified by an infinite execution of themodel, then this is already observable on a finite prefix of that execution. Livenesscan be paraphrased "something good will happen". Liveness cannot be falsified by afinite prefix. The bounded liveness properties can be expressed as safety propertiesand checked efficiently using the technique of test automata.The proposed role of MC in Reliabiality and Operations Monitoring System(R/OMS) is to prove that the emergency behaviour suggested by an expert systemsatisfies all necessary safety and (bounded) liveness requirements before presentedto an operator. Formally, given a system model M s , the planned behaviour modelM o and a correctness requirement ϕ , we prove that the parallel composition M s || M osatisfies ϕ, denoted M s || M o |= ϕ .The loop of R/OMS that is extended with MC is depicted in Fig. 3.1. The expertsystem receives sensor data from the measurement system. When the potentialemergency is detected, the expert system starts inference process using itsaccumulated hazard avoidance and handling rules.The result of the inference is an action sequence or control strategy that has beensuccessful in similar emergency situations and has been stored in the knowledgebase. Since the rules of the expert system are heuristic in their nature, theirapplicability always includes some uncertainty.34