Overview in PDF format - Tallinna Tehnikaülikool

Figure 3.1 Model checking in an operator advisory systemTo follow the principle “better no advice than questionable advice” the R/OMShas to verify its emergency action sequences before instructing the operator.Therefore, the R/OMS is extended with a model checking tool Uppaal (Larsen,1997). Before starting the model checker's search engine the following steps have tobe made:• system model M s has to be updated with the parameter values received fromsensors and the measurement system at time instance t, when the potentialhazard was detected (updated model M s t );• the emergency operation strategy inferred by the expert system is encoded inthe operator model M o t ;• safety criteria and other constraints to be met during emergency handling arestated in formula ϕ (here the specification patterns kept in the knowledge baseare exploited).Ideally the verification is completely automatic. However, in practice it involvesexternal assistance that in our case is a part of the expert system responsibility, i.e.,the expert system incorporates also rules for composing verification tasks andselecting verification strategy. In case the MC detects requirements violation, theexpert system is provided with a diagnostic trace. The diagnostic trace is used as acounter example for the checked property and is stored for later improvement of theexpert system's consistency.3.2. An example: CNC latheSystem model M s is defined in terms of parallel composition of timed automata(Fig. 3.2). Here each work unit of the system is modeled as a single automaton. Thebehaviour of automata is synchronized through local clock conditions. Theparameters observable by sensors are defined in the model as global variables thatcan be reinitialized when a new model checking task is started. In our model thoseparameters are R z – surface roughness of the work piece; Tc – cutting temperature;h – tool wear, wear land height; ω – cutter vibration acceleration; A – acousticemission.35