Tasks Design And Formal Verification
-
Rating
-
Date
November 2018 -
Size
430.7KB -
Views
3,581 -
Categories
Transcript
INSTITUT NATIONAL DE RECHERCHE EN INFORMATIQUE ET EN AUTOMATIQUE On the Validation of Robotics Control Systems Part I: High Level Specification and Formal Verification Bernard Espiau, Konstantin Kapellos, Muriel Jourdan, Daniel Simon N˚ 2719 Novembre 1995 PROGRAMME 4 ISSN 0249-6399 apport de recherche "!#$%& ('$)*+-,. / 0%132&456798:<;< ='$>?-@BA@0CDE%F,G0 H <%&BA@ IJLKM&NOKPRQTSVUWXNOY[Z1\C]^M_S`aNbMc`WdM\eNOUfJhgigd]^SjVZfklYKWdJhg-mO]cYKP&NOM[ZfnCNbMoWpJqg-rcWdst]cMjj ufvxwqyhv{zh|$|~}@02@?7EH&2@0n DJ@0H&2@03?. ?21og03.1032@DiG2IH&2@D u?.h>J@J@D.2 G 8:2@D7E8>p8:03.1fBdD7 h?JIH&?f0n GpDL0H&2@03?.h8 H 1JIH2@0nH&H&1J@?H F1; UQ)'cX:d/ R~s=r m EWic 4 5 &9 - US*{-P'[* WFT"J|H6} UQ 9UQ~*{- V- 9 ("J|;-190)5%&}& 1;F)8945 4 524&9 w hCD G037 ?.D; .< DJ@fH&7 03.0/? )UQ$ m*;-, ,:= dDL 1.0nH&* Dh?J@2 .1?99;P82498 4 528&9~ Le gD[email protected]&.pC-D[- ;B T$ UQ-(\#[TP})U2"SUS* )'J+*,-_6} 'J~- *,'J/,*{- tWFUQ)'J"`|%|"J|;dD$ = Dh?J@2 GpDL2@J@D![p 3 ; a+; ,F5 ,:Ai= ; ;V+; J@D.? "13D;V89494( 4 3-6&9 dH ( > D. 03.fDJ; <% 0n?3303.Z; h G0<1 H&*-0n8H$.pCwG *?- 03.D;i G 7 "h?30nAB?1CD 5 DLI*-03.fL1 ?JDLH& /5 d037MD G 8:2@D7E8Q ; iG9sa0 m ;h,$ u?7M1>2@DJoG?03D2 J@D$8@8;F& >1.D7)898 } 4 3 9 A & ?>1JICH$.;gBu AiH$JIH&.03.h 10 H&.hC =w )+30 DJ@? DJ@01 -03.fyC >hH&.2@032IH$2@0 D J@DLH& F5 2@037 D J@?hDJ@2@03D$8 ?21 8$.h 1J@?.1?>h8 1J@?fJIH&78Q ; R GS- 6"SUS-P+*,-PTs /-)})"[U%"S-P'`"H-^s LWF#"[U`j /*,$:"%$ k "SUS* )'J+*,h- ;1' G 980 ;hG1J@03.fDJ DJ@nH&fp;($ >.1D7898 5 41 3 }L9 A & ?>1JICH&.Z; GS- 6" :UQ+*{ - })U`!T2"SUS* )'J/,*,- !"[ R[$|<6 } )(- ,*{, * 9"LU%"%/T j,*{!"WFUQ`W("SUS,*,"`| *{- # $:" 2"ST`W "S- B"S - *{UQ- "S- })/UwU% ,*+'<'J- ,UQT T "SUJ| ;-,/.1J@0nH DL8:D$H&JI Dh?J@2 .VZ }K-3 6 ;P898 K 43 5&9 H&hD33?8 l - *{UQ- -i"[!"S-F $:"~W U% 9UQ~t,*,/- $:"J|`W9W T *,'%,*,/-| UQ /,* [ "J| U %9'[, * 9"J| ; F. C-0n8@8:DJ@2IH&2@03?.;%u?3DmCDL8 A~03.DL8 C-D H&J@0n8;hG?10nHM=.2@03h?30n8;1g1JIH&.hD-;? D7 "hDJL8983F 4 32 3 9~.< G037 ?.; g1J@DDLC7H&.XH&.pC e H8:2@0333?p; B =.hH& 03.f 2 1DdD7 h?JIH& tD hH 03?J ?21 DLH& 5 2@037MD u3?-8:D$C:F5 3?-? ? "h?2@0nmd H8:*8Q ;G lBlBl GS- #cMs -[})c?-Kb ,*+'S|~/-i$ #/!+*,h- ;G-H&.+ . 03Df?h;P8983F 41 3 KL9~.; e H8:2@0333?p;~ H$pD33?8 u?7 >12@DJQ/5 H&0nC-D$C+. DL8:03f. ?2+1 H+; D.1DJ@0n ?95 "h?2 ?.2@J@?33DJE> H&.hC-303.f D$H2@0 - 032BH$.pC D$H& 5 2@037MD ?.2@J@?,:8@8:>1D$8Q ;aG lBlBl NUQ-(|)cb- s - +U%/T m |S6"S|7NF"%'`R-PT ;: ? ;1.1?!p3 ;(+. DLD7 "hDJ828 5 43 &9 Lh G-H&78:?.Z;A1 ZDmtu?J@f.1D;1tL% u8:0nH$>BK s - ,UQ,T b{R "7N |+'j+qP-P'[,*,- MW9WFUQ[9'`R ;unH$J@D.hC?. J@DL8@8;) :1 ?JICBG03D.hD >%"130nH&2@03?.p8;w ~ ;=8989 4 3(L0 9 H$7EHC-fD;@x A @ ?.%hH&7 ; u d1D ?.2@J@??21i+. 0n8@J@D2@D D.-2I8G 8:2@D7E8Q1 ;#UQ['cV6}e R "BG lBlBl ; 090 \Q$ bI;P89498 4 3:&4 9 +H&7EHCfD;/@ - A 2@ ?.%pH$7 ; G>hDJQ 0n8:?J u?.-2@J@?1?21 H unH8@8e?1=. 0n8@J@D2@D D.2 J@?DL8@8:D$8Q ; m:GJL r cbs- ,U)cMo=WF,* ~* )/,*,h- ;}K\Q& bI; }&6 :5 }&56; 894:0 4 3:&8 9~.< G037M?.Z;~ H$pD33?8;1tL u8:0nH&>Z;hA P& ?>1JIC1H&.Lo g1?J@7H& DJ@0 H&2@03?. ?2e1 AB0n8@8:03?.h8 H&.hCBd H8:*8Q 9-P$ l UQ`W("%- & +U '|JR(`Wy/-Kb"%T j)N=*{ "w-P$~u US*,$m |S6"S<| ; + ; J@D.1? "13D-;1g1JIH&.hD;15[:5 K}<5 ~898 K: 4jK$6&9 e >2@2@D.Z; ZD+ ; >D[email protected];F GD/C >D.h03.1fHm. H&2IH+g3? d H8:*8p03. G,Q; =+v & +U '|JRJW /- V- 9 ("J|J\ s /EWF*{T"SUJ|w-P$yNF[Tvm )W9W(/US })UEKb"%/T j[Nv*{!"m |S#"[| ;hb1.D!)8983F 4jK: 9 w tuJ@?-?*8m = J@? "1>p8:2+nH DJ@D$C?.2@J@?8$8:2@D7 1 ?J+H 7M? "1033DmJ@? "h?2J ;FG lBlBl :U`-i/Ta6}wK /,*,'`| -P$L:#t,*,/p- ; ?#% =b5 }; ?F = ;hA H&JI ]894 ;-pH$fD$8 [395 }$5 ë cëÂö £ t H #@8$;`. 0n8@J@D2@D D.2AB?1CD3303.f ?21 0n8:>pH$3 ];+>0nC-D$C tuD hH5 k * |`*,-h;P[3p;-108/5%8;F)898K 4jK$5&9 tL =w tJIH&.pC-03.Z;=@ A F@ ?.%pH&7B;?mF)W"SU /*|)U s- ,UQT6}]Nv* "%$ & * |[')U%"S6" l 2"[- m |S#"S<|;dDL (5 .10nH&Dp?J@2L8}6;hG 18:2@D78?.2@J@?v+ ; J@?>Z;*.10 DJI8:032$ ?21 d?J@?.-2@?p; H$.pHC1H;V)898} 4jK)39<@x *m? 1.;= i H&7 DL8;=w DJ@?1CD; ;P+ > H&J "10n8:?.;=wZ =fJIH H&nH1;? =x1> "1J@0nCG 8:2@D7E8m=1J@?H B2@? u?7M1>2@DJQ5/=0nC-D$C u?.-2@J@?.f03.1DD[email protected]EG lBlBl s - +U%/TFm |S#"S<|rz ( S*{-i" ;&1][395 }K;H$J@03V898 K: 4jKKL9 ~ dH GD?; F+ . D.hH& H&2 pH$.; = dD7 h?JIH& Z?f0n=1J@?H i2@? +. 0n8@J@D2@D D.2 u?.-2@J@?{ ; G lBlBl GS- #cMs -[})c?- K +*,'`|/-i$ #/!+*,h- ;+H&f? H;: H$pH&.Z;h7H 898 K 4jK$ &9 w m>17EH$J; ~ vm; H$J@fp;G ,` A H&JI>p8;M J@DLC0nH&2@D H&.hC J@D$C-0nH$2@D dJIH$.p8#1 ?J@7MDJI8bn1 ?JG>1pDJQ 0n8:?J u?.2@J@??21L. 0n8@J@D2@D D.2~ . -.pH&7 0nH&G 8:2@D78Q]G lBlBl N(UQ-(|)ce-L!/,*,'ys- ,UQT ;? ? 5914 ; .1? 4 ;11& }S395%& }}90 ;H&>f>p8:2w898 5 4jK2L0 9 A =.2@?.103?2@2@0/;tL1 AB0n8$1JIH;iS+. 0n8@J@D2@D D.-2A~?C-Dn8dD7Mh?JIH&hZ?f0n8 G>hDJQ 0n8:?J u?.2@J@? 5 3DJu=>2@?7H&2@0nG .2 1DL8:0n8 ?2e 1 Z?1?7 ?2@03?. ?.2@J@?33DJI8Q ;:G lBlBl GS- #"[U`-P,*,/-i/Ts -[}"SU%"S-i'J"H-]Kj +*,'`|/-i$t !+*,h- ;+H&f? H1; H&pH$.;hA H ]898 K 4jK/&4 9 A = .-2@?.03?2@2@0/;A H/F1 H&J@0/;1tLh A~0n8$JIH;v = 11 03.1fMdD7 h?JIH&?f0n DJ@0p H&2@03?.EH&.hCBG .2 1DL8:0n8 2@? AiH$.><1 H2@>[email protected]~G 8:2@D78Q ;=G lBlBl GS- 6"SU`-i/,*,-PT s -[}"SU%"S-i'J"-m |S6"S|J\rz-_-P$s "[U`-i"[+*,'`| ; H&.h?>( DJ;* H$.pHC1H;h)m2) V89-8 K 4jK/&8 9~.< A ?.h8; = J@?D$8@86<5 t H8:DLCB=1J@?H i2@?deH8:*:5 nH&. DJ@DL8:D.-2IH&2@03?. ; G lBlBl GS- #cbs -[})cK +*,'`|<-P$~ !+*,- 03.p03.hH&2@2@0/;oG-=;p7H 828 6 4 6&9 dH ; 1J@-;i.< A ?.h8;=w ( V> D.hC-J@03*8; 0n8:>hH&3 +; >0nC-DLCBAB>132@0 /5 g03.fDJ@DLC +; JIH8:03.1fH8L+. D[5 .DLC " wG D7H8 H&.hCH D$H2@0 DmG 18:2@D7 ; & (U '|JR`W]- I"SUQTP U%'`R* 6"%'[,:U%"`| -P$ & * |`,US* :6"%$ bG ;oG% ;pZ?8= .1fD3D$8;%mG-=; 4 ( 9~.< A ?.p8;=w ( v> D.pC-J@03*8;b G-H/1 D w= C1H&12@03.f H7> 03DJIH&JI 10nH$' DLH2@0 D G 8:2@D77 ;m G l m EWic -7GS-F#"ST{T * "S- =Kb {|~/-i$ sEWF:6"SU k *|S*,-(\ LGQG ;ht?8:2@?.Z;oG-=;a828 5 4 -}L9~.< AB>h8:303.DJ;1e >w b+. >J 1 DD;~ ;< G 03.Z;t D$H8:?.03.1f H "h?>2Bt?>.hC-D$C DLH2@0 032$ 2@? =+ 103D[ D D$H& <5 d 037 D+ ; >hH&JIH&.-2@DDL8Q ; *{- UQ['ce eGm2WFUS* - ym LW()|S*{ -hmi"ST "Q')+* 2" "SUQ'`"6WF,*,/p- ;AiH&JI 89-8 } 4 5&9M)< H&>h8@8:D-;=>w ,` J@0n8:2@D.p8:D.Z;`> 03DJIH&JI 10nH& u?.2@J@??. DL8:03f. t H8:DLCB?. D2@J@0 D2 AB?1CD3303.f~1 ?J H&. =>2@?.?7 ?>h8MA~? "1033D ? "h?2J ; GS- 6"ST{T ,* ("[- ML-P!/9|m |S6"S|zs-[ } ,GJEm_Z $;H$J@n8:J@>1D-; ; DJ@7EH&.-;-7H&JI y)898 K + 4 / 3 9 +H 037 0/; 0nH;= =Qg1JIH&7 D[ ?J@*n1 ?J G?1 26 H&J@DoG-H/1 D2$ DJ@0 H&2@03?. ?2 1 ,<.pC->h8:2@J@0nH&'? "h?2 )+hDJIH$2@03?.p8Q1 ; s /EWF:6"SUw-P$GS-i$/9|S+US*,T l - 9*{-i"J"SUS* - ;/ ?}&6 .1?~} ;h1}908:5 }40 ;(898(9 4 -KL9 v * 03.1fp;p= ~ AiH * ?J@2 Z;? GhD$0p H&2@03?.BH&.pC DJ@0p H$2@03?.?211 u?.h8:2@JIH&03.2+t H8:DLC. .hH&7 0n G 1865 2@D7E8Q ;03.09-P$HGS-Fc & /+U '|JR`W]- U`*{-P'[* WFT"`| -P $ UQ9'[,*+'`"L6}!s-(|S,UQ* -F UQ 9UQ~*{ - ;1G1J@03.fDJ DJ@nH$fp;P8983 4 &9 w -.p ;M> tL a@ D03."pDJ@fp; J@? 03.1f3u?J@J@DL2@.DL8@8?21 H D 0n3DEA H&.1D>( DJ +. D$D3DJIH&2@03?. 0 9-P$ l UQ`W("%- & (U '|JR`Wz-Ke"QT j[Nv* "/-i$u US*,$m |S6"S<|%\V+; J@D.1? "13D-;gJIH$.pD-;5[5 K }/5 t898 K 4jK}L9~ m?8:DLI*&H;i> J@0n8:2@D.h8:D.Z; 03?JIQ8 (; GS- #c c6} s LWF#"SU Áï NM&O3P&Q'R £L K @ * 7I 4 :0L9 e u ?8:2@D[5/A H&.10 J@D;A DJ@J@03DJ;=w D>p hA~0n8@8:03?. J@?fJIH&7 7M03.1fp= 1130nH&2@03?.B2@? .hC-DJQ H$2@DJ ? h" ?2I8Q~Z R GS- #c=m LWic- l -`W("SUS*{!"[- T(Kb ,*+'S|;G2IH$.(1 ?JIC;oG-=;F &>1.D 565 $> B};V)898K 4 24&9 =w v.+DL8$ hH&.hCD; H&JIH&0 -H;S.+DL8:03f.H$.pC &H&3>pH$2@03?.id??n8e1 ?J=>2@?7EH&2@DLC]>03f : H iG 18:2@D78Q 9-P$ l UQ`W("%- & U+'|JR(`Wy/- Kb"%T j)N=*{ "/-i$u US*,$m |`6"S<|J\i;+J@D.1? 1" 3D-;1g1JIH&.hD;15[5:K}5< ~898K: 4 28&9MG v;mH&>%h " DJ@2;Md037MDLCw=>2@?7H&2IHH&.hC].+0n8@J@D2@D D.-2oG 8:2@D7E8Q; UQ)'c l :U%JW"%/- s - ,UQTMs -[})c ; ;+J@?.103.fD.Z; :# >1 )8985 4 0$6&9!;< u ? D.; -AB?33DJ;9 ( + >pHC-JIH&2;1A 03?2;== 3fD 1" JIH&0n d??n8a1 ?Ju2 D DJ 1 ?J@7EH&.hD &H&3>hH&2@03?. ?21F.+0n8@J@D2@D D.-2G 8:2@D7E8Q1;G lBlBl U%['`"J"Q$*{- |Bm2W"Q')*+TGJ|J|` "e- & * |[')U%"S6" l 9"S- Pm |S6"S|;090\Q$bI; @# H&.->pH$J 82498 4 0:9 w 0n8@8@H&JIC:5 ;+0 h" ?33D2;%~ * H&hD33?8; 0 DL8; t?J@J@D3 ;= D$H$ 5/d 037 D J@?fJIH&7 7M03.1f ?21AB? 1" 033D ? h" ?2u= 2@03?.h8 + 8:03.f =+C:H$.pD$C u ?.2@J@?1dDL 1 .0{C>DL8QEZ{RGS- #c m EWici- l -SW("SUS*{!"S-FT9K ,*,'`|; G2IH&.(1n?JIC;o G-=;i &>1.D 565 &> B };i898K 4 0}L9 % 0 DL8; w 0n8@8@H&JIC:5 ;+0 h" ?33D2; ~ % H$pD33?8 . D[D3?17MD.2?21 H DLH2@0 D A~? " 033D ? p" ?2 8:03.1f D$H&d 037 D 0n8:03?. ;BNVR:*{UQ$
g1?J@7H& DJ@0pH$2@03?.?1+AB0n8@8:03?.h8 H&.hC deH8:*8=130nH&2@03?. 2@? .hC-DQJ $H 2@DJ ? "p?2@0n8QGS-Fc s -[})c- e$ -P'`"%$tK ,*,'`|J\G9s=LK!" &;pt H&JID3?.p8;GhH&03.Z;8:D2) 898-K 4 0)39 4 0KL9 ~ H&hD33?8;1GF = "C-?>;A &?>1JICH&.Z;htL u8:0nH$>GhDL0pH$2@03?.;1g1?J@7H& DJ@0pH&2@03?.H&.pC,<7 3D[5 7 D.-2IH&2@03?. ?1d H8:*8uH&.h8 A~0n8@8:03?.h8a1 ?J H&.w=>2@?.1?7 ?>h8 D 10n3D/wZ RtGS-FcVm EWPca- l -SW("SUS*{!"S-FT K +*,'`|;G2IH&.1 ?JIC;oG-=;V &>1.1D 565 &>1 }-;V898K: ~ H&nH&H&.10n8 H$.pCH&# ; DLC-032@?JI8;bI,<.2@D[email protected]&2@03?.pH& J@?fJIH&7 + . D[D3?7 D.2m03. .hCDJI8:D$H ? "h?2@0n8 H&.hCB,<.2@D3303fD.2?.2@J@?{1; UQ)'cB6}{R " /*{- ~gvmeU`, (/T & U('|JR`Wp;Z0n8$"h?H1; ?J@2@>1fH&/;7EH&JI 898-K 4 0$ &9 *< hZ>Z; ptu>0n8@8:?.;?= .hH& 8:0n8uH$.pC D1J@DL8:D.-2IH&2@03?.h8?21>1 "1J@0nCBG 18:2@D78032 BG03.1f>1nH&J G 8:2@D7E8Q; q*{UJ|S |S*,/-]'J- ,UQTMs -[}"SU%"S-P'`";d?* ?p;( H&hH&.Z;P &>1 ]8983F 4 02L0 9~ % m?8:DLI*&H;2>w 1J@0n8:2@D.h8:D.Z; - pDJ@037 D.-2I803.EtuD hH 03?Ju?7Mh?8:032@03?. ; YUQ$wGS- cVm EWic=- GS- 6"ST j T ,* ("[- ?K +*,' 1 y)898 K ë cëÂö Unite´ de recherche INRIA Lorraine, Technopoˆle de Nancy-Brabois, Campus scientifique, 615 rue du Jardin Botanique, BP 101, 54600 VILLERS LE` S NANCY Unite´ de recherche INRIA Rennes, Irisa, Campus universitaire de Beaulieu, 35042 RENNES Cedex Unite´ de recherche INRIA Rhoˆne-Alpes, 46 avenue Fe´lix Viallet, 38031 GRENOBLE Cedex 1 Unite´ de recherche INRIA Rocquencourt, Domaine de Voluceau, Rocquencourt, BP 105, 78153 LE CHESNAY Cedex Unite´ de recherche INRIA Sophia-Antipolis, 2004 route des Lucioles, BP 93, 06902 SOPHIA-ANTIPOLIS Cedex E´diteur INRIA, Domaine de Voluceau, Rocquencourt, BP 105, 78153 LE CHESNAY Cedex (France) ISSN 0249-6399