Academia.eduAcademia.edu

Figure 18 – uploaded by Andrzej Kochan

See full PDFdownloadDownload figure
Figure 16. Counter-example for the study of freedom from system deadlock—final fragmen

Figure 16 Counter-example for the study of freedom from system deadlock—final fragmen

Related Figures (17)

Figure 1. Illustrative diagram of the Eap line block and its surroundings.
Figure 1. Illustrative diagram of the Eap line block and its surroundings.
Figure 2. Schematic diagram of a fragment of the line block Eap.
Figure 2. Schematic diagram of a fragment of the line block Eap.
iInis 1s an action 1n server VV, so its name can be omitted in States (VV, statel) and (V\ state2). In the ac tion agent A calls the on service on server W. This action sends the agen message to server S, calling its service ok. The states state1 and state2 refer to the same serve and it is the same server to which the input message is directed, in this case W. We cat therefore replace the states that are pairs, such as (W, state1) with the state values as state! We can also omi the server in the input message (server, agent, service), leaving a pair (agen service), for example (A, on). The output message is of the same agent as the input one, s« we can omit the such as (S, ok). agent in the output message, which shortens it to a pair (server, service However, the server to which the output message is directed cannot bi omitted in the general case. In exceptional cases, when the server in the output message i known, only the “natural” to rou service may be left. However, this only applies to specific cases where it i: te the message to a specific server, for example, to route an ok reply to thi server, which is the only source of the input message. Figure 3. Full description of the action as a transition in the automaton, and its simplifications. W: automaton (server), S: target automaton of a message, A: agent, statei: state values of the server W, on: service of W invoked by the incoming message, ok: service of the server S invoked by the outgoing message.
iInis 1s an action 1n server VV, so its name can be omitted in States (VV, statel) and (V\ state2). In the ac tion agent A calls the on service on server W. This action sends the agen message to server S, calling its service ok. The states state1 and state2 refer to the same serve and it is the same server to which the input message is directed, in this case W. We cat therefore replace the states that are pairs, such as (W, state1) with the state values as state! We can also omi the server in the input message (server, agent, service), leaving a pair (agen service), for example (A, on). The output message is of the same agent as the input one, s« we can omit the such as (S, ok). agent in the output message, which shortens it to a pair (server, service However, the server to which the output message is directed cannot bi omitted in the general case. In exceptional cases, when the server in the output message i known, only the “natural” to rou service may be left. However, this only applies to specific cases where it i: te the message to a specific server, for example, to route an ok reply to thi server, which is the only source of the input message. Figure 3. Full description of the action as a transition in the automaton, and its simplifications. W: automaton (server), S: target automaton of a message, A: agent, statei: state values of the server W, on: service of W invoked by the incoming message, ok: service of the server S invoked by the outgoing message.
Figure 4. Connection diagrams of selected logical elements: (a) coil, (b) contact/switch being the only source of signal, but potentially for many elements at the output (c) contact/switch not being the only source of signal (with number x), for one element at the output (d) galvanic connection. A [1... ]isa vector of all agents (any agent can give a signal). S[1... ] is a vector of elements on output.
Figure 4. Connection diagrams of selected logical elements: (a) coil, (b) contact/switch being the only source of signal, but potentially for many elements at the output (c) contact/switch not being the only source of signal (with number x), for one element at the output (d) galvanic connection. A [1... ]isa vector of all agents (any agent can give a signal). S[1... ] is a vector of elements on output.
Figure 5. Identification of logical elements on the schematic diagram of the line block, and marking their types.
Figure 5. Identification of logical elements on the schematic diagram of the line block, and marking their types.
The system model uses the following types of elements: contacts controlled from the outside Jt1:O1, J#2:O1, Jz1:O1_2 (it is the second source for OR21 on the ground input Z), Jz2:01, Dp:O2 (gives a signal to two elements w2 and K), K:O1_2 (it is the second source for OR22), connections OR21 (used twice) and OR22, and relays: W in NO contacts w1:O1, w2:O1_1 (first source for OR22), w3:O0 _2 (second source for OR21) and Z with NO contact z1:01_1 (first source for OR21 at ground input Z) and NC z2:01_1 (first source for OR21 at ground input W). Additionally, we ad example, OR22B, and the letter C for d the letter B for some elements on the Vcc side, for the ground side.
The system model uses the following types of elements: contacts controlled from the outside Jt1:O1, J#2:O1, Jz1:O1_2 (it is the second source for OR21 on the ground input Z), Jz2:01, Dp:O2 (gives a signal to two elements w2 and K), K:O1_2 (it is the second source for OR22), connections OR21 (used twice) and OR22, and relays: W in NO contacts w1:O1, w2:O1_1 (first source for OR22), w3:O0 _2 (second source for OR21) and Z with NO contact z1:01_1 (first source for OR21 at ground input Z) and NC z2:01_1 (first source for OR21 at ground input W). Additionally, we ad example, OR22B, and the letter C for d the letter B for some elements on the Vcc side, for the ground side.
Figure 9. Observer model. The observer automaton (Figure 9) tracks the correct end of the system operation. Each of the relay coils has an additional agent that starts at the moment of excitation and informs the observer’s automaton about this fact. If such messages are received from both coils, the environment agent that arrives at the observer after all operations in the environment automaton are completed, terminates.
Figure 9. Observer model. The observer automaton (Figure 9) tracks the correct end of the system operation. Each of the relay coils has an additional agent that starts at the moment of excitation and informs the observer’s automaton about this fact. If such messages are received from both coils, the environment agent that arrives at the observer after all operations in the environment automaton are completed, terminates.
Getting rid of the instability errors described in the previous section should result in a good circuit where the circuit inevitably achieves its goal of energizing both relays. This test checks for the inevitable termination of the AEnv agent, which terminates it after receiving a message that both relays have worked. The two observer agents, AobsW and AobsZ, are used to transmit these messages. The result of the test in the Dedan program is shown in Figure 11. Figure 11. Verifier window showing Aenv agent termination.
Getting rid of the instability errors described in the previous section should result in a good circuit where the circuit inevitably achieves its goal of energizing both relays. This test checks for the inevitable termination of the AEnv agent, which terminates it after receiving a message that both relays have worked. The two observer agents, AobsW and AobsZ, are used to transmit these messages. The result of the test in the Dedan program is shown in Figure 11. Figure 11. Verifier window showing Aenv agent termination.
Figure 13. The witness of correct termination—the final fragment.
Figure 13. The witness of correct termination—the final fragment.
Figure 14. Damaged element—a permanent short-circuit between input and contact output.
Figure 14. Damaged element—a permanent short-circuit between input and contact output.
Figure 15. Damaged element—permanent opening of the input with the contact output. A permanent opening of the contact should lead to a safe situation, i.e., none of th coils should be excited. The damage model is quite simple, shown in Figure 15. The mode of the damaged element was used for contact 22.
Figure 15. Damaged element—permanent opening of the input with the contact output. A permanent opening of the contact should lead to a safe situation, i.e., none of th coils should be excited. The damage model is quite simple, shown in Figure 15. The mode of the damaged element was used for contact 22.
Related topics:
EngineeringVerification and Validation
580 California St., Suite 400
San Francisco, CA, 94104
© 2025 Academia. All rights reserved