Overview in PDF format - Tallinna Tehnikaülikool

Fig. 3.2 Functional dependencies of IMM modules, wherevariables of the model– monitored resettableThe correctness conditions to be checked are constructed from atomic conditionson observable parameters using logical connectives and temporal modalities: A –always; E – sometimes; – globally; ◊ – eventually. The atomic conditions aredivided into two categories: those characterizing the quality of the work pieces (e.g.R z ) and those characterizing the state and working conditions of processing tools (T,h,ω, A). Atomic conditions for a parameter x are defined either in positive form ϕ≡ X - ≤ x ∧ x ≤ X + , where X - and X + are respectively lower and upper bounds of theinterval where x is expected to be, or in negative form ¬ϕ ≡ X - > x ∨ x > X + . Thesimplest composite correctness condition that requires system steadiness for certainperiod of time τ without operator's interference can be expressed as invarianceproperty ϕ ≡ A (clock ≤τ ⇒ (∧ i ϕ i)) where clock models global time of the modeland formulas ϕ i are positive atomic conditions for parameters T, h, ω, A, R z . Here,the verification task M s || M o |=? ϕ is reduced to the task M s |=? ϕ . As an operator'sactivities are involved in the similar task, we run the task M s || M o |=? ϕ. The resultsays whether the chosen operator's activities (encoded in M o ) keep the process safeduring the time intervalτ. Proving invariance properties requires generally traversalof the full search space and it may be too time consuming in the presence ofemergency conditions. Therefore, properties of well defined emergency operationscenarios are more feasible to check by formulating them as bounded reachabilityproblems. It means that when starting the operator's action somewhere out of safetyregion we ask whether it is possible to restore the safe mode during given reactiontime. To check this task, the model M s has to be reset, at first, with emergencyvalues of process parameters, i.e. ¬(∧ i ϕ i) holds and the so-called inevitabilityproperty ϕ ≡ A◊(clock ≤τ ∧ (∧ i ϕ i)) has to be verified for updated modelcomposition M t s || M t o . A simulated MU, Detail and Operator are shown in Fig. 3.3.36