Steam Boiler Control An Example in Z Formalisation

Formal Specification of Software

Steam Boiler ControlAn Example in Z Formalisation

Bernhard Beckert

UNIVERSITÄT KOBLENZ-LANDAU

B. Beckert: Formal Specification of Software – p.1

Steam Boiler Control: Scenario

4

w

w

d

w

/ k

/ k

k k

l/ δ

δ

p1 / . . . / p4v

a

z

p1 p4/ ... /

d

w

min

max

p

d System Components

steam boiler

water level measuring device

four pumps

four pump controlers

steam quantity measuring device

valve for emptying the boiler



4

w

w

d

w

/ k

/ k

k k

l/ δ

δ

p1 / . . . / p4v

a

z

p1 p4/ ... /

d

w

min

max

p

d

Physical constants

wmin minimal water level

wmax maximal water level

l water amount per pump

dmax maximal quantity of steam

exiting the boiler

δp error in the value of l

δd error in steam

measurement



4

w

w

d

w

/ k

/ k

k k

l/ δ

δ

p1 / . . . / p4v

a

z

p1 p4/ ... /

d

w

min

max

p

d

Measured values

w water level

d amount of steam exiting

the boiler

kp,i pump i works/broken

kw water level measuring device

works/broken

kd steam amount measuring

device works/broken



4

w

w

d

w

/ k

/ k

k k

l/ δ

δ

p1 / . . . / p4v

a

z

p1 p4/ ... /

d

w

min

max

p

d

Control values

pi pump i on/off

v valve open/closed

a boiler on/off

z state init/norm/broken/stop


Steam Boiler Control

Types

State ::= init | norm | broken | stop

OnOff ::= on | off

OpenClosed ::= open | closed



Physical constants

wmin : N

wmax : N

l : N

dmax : N

δp : N

δd : N

wmin < wmax

Measured values

Inputw? : N

d? : N



Physical constants

wmin : N

wmax : N

l : N

dmax : N

δp : N

δd : N

wmin < wmax

Measured values

Inputw? : N

d? : N



Control values

Pumpsp1, p2, p3, p4 : OnOff

SteamBoiler0Pumpsv : OpenCloseda : OnOffz : State


Auxiliary Schemata

Auxiliary Schemata

PumpsOffPumps′

p′1 = off ∧ p′2 = off ∧ p′3 = off ∧ p′4 = off

PumpsOnPumps′

p′1 = on ∧ p′2 = on ∧ p′3 = on ∧ p′4 = on


Steam Boiler Initial State

SteamBoilerInit0SteamBoiler0′

a′ = offz′ = init


Operations for Initialisation

SInitNormal0∆SteamBoiler0Input

z = initd? = 0w? ≥ wmin + dmaxw? ≤ wmax

PumpsOffz′ = normv′ = closeda′ = on



SInitStop0∆SteamBoiler0Input

z = initd? > 0z′ = stop



SInitFill0∆SteamBoiler0Input

z = initd? = 0w? < wmin + dmax

PumpsOnz′ = zv′ = closeda′ = off



SInitEmpty0∆SteamBoiler0Input

z = initd? = 0w? > wmax

PumpsOffz′ = zv′ = opena′ = off



ControlInit0 =̂ SInitNormal0∨ SInitStop0∨ SInitFill0∨ SInitEmpty0


Operations for Normal State

SNormalFill0∆SteamBoiler0Input

z = normw? ≥ wminw? ≤ wopt − 3lPumpsOnv′ = closed ∧ a′ = on ∧ z′ = z

Note:Simplified version where all four pumps are switched simultaneously



SNormalContinue0ΞSteamBoiler0Input

z = normw? > wopt − 3lw? ≤ wopt



SNormalNotFill0∆SteamBoiler0Input

z = normw? > woptw? ≤ wmax

PumpsOffv′ = closed ∧ a′ = on ∧ z′ = z



SNormalStop0∆SteamBoiler0Input

z = normw? < wmin ∨ w? > wmax

a′ = off ∧ z′ = stop


Complete Operation

ControlNormal0 =̂ SNormalFill0∨ SNormalContinue0

∨ SNormalNotFill0∨ SNormalStop0

Control0 =̂ ControlInit0∨ ControlNormal0


Extended Solution

Additional Type

WorksBroken ::= works | broken

Additional measured values

ControlInputkw? : WorksBrokenkd? : WorksBrokenkp1? : WorksBrokenkp2? : WorksBrokenkp3? : WorksBrokenkp4? : WorksBroken


Extended Solution

Additional Type

WorksBroken ::= works | broken

Additional measured values

ControlInputkw? : WorksBrokenkd? : WorksBrokenkp1? : WorksBrokenkp2? : WorksBrokenkp3? : WorksBrokenkp4? : WorksBroken


Extended Solution

Control values

SteamBoiler1SteamBoiler0s : N

δ : N

Initial State




Extended Solution

Control values

SteamBoiler1SteamBoiler0s : N

δ : N

Initial State




Extended Auxiliary Schemata

Auxiliary Functions

pswitch : (OnOff × WorksBroken) → OnOff

pswitch(on, works) = onpswitch(on, broken) = offpswitch(off , works) = offpswitch(off , broken) = off

pamount : (OnOff ×WorksBroken) → N

∀x : OnOff , y : WorksBroken| x = off ∨ y = broken • pamount(x, y) = 0

pamount(on, works) = 1


Extended Auxiliary Schemata

Auxiliary Schemata

PumpsControlledOnPumps′ControlInput

p′1 = pswitch(on, kp1?) ∧ p′2 = pswitch(on, kp2?)p′3 = pswitch(on, kp3?) ∧ p′4 = pswitch(on, kp4?)

PumpsControlledOffPumps′ControlInput

p′1 = pswitch(off , kp1?) ∧ p′2 = pswitch(off , kp2?)p′3 = pswitch(off , kp3?) ∧ p′4 = pswitch(off , kp4?)



SInitNormal1∆SteamBoiler1InputControlInput

z = initd? = 0kw = works ∧ kd = worksw? ≥ wmin + dmaxw? ≤ wmax

z′ = normv′ = closeda′ = ons′ = w?PumpsOff



SInitFill1∆SteamBoiler1InputControlInput

z = initd? = 0kw = works ∧ kd = worksw? < wmin + dmax

z′ = zv′ = closeda′ = offPumpsOn



SInitEmpty1∆SteamBoiler1InputControlInput

z = initd? = 0w? > wmax

z′ = zv′ = opena′ = offPumpsOff



SInitStop1∆SteamBoiler1InputControlInput

z = initd? > 0 ∨ kw = broken ∨ kd = brokenz′ = stop



ControlInit1 =̂ SInitNormal1∨ SInitFill1∨ SInitEmpty1

∨ SInitStop1



SNormalFill1∆SteamBoiler1InputControlInput

z = normkw = worksw? ≥ wminw? ≤ wopt − 3ls′ = w?PumpsControlledOnv′ = closed ∧ a′ = on ∧ z′ = z



SNormalContinue1∆SteamBoiler1InputControlInput

z = normkw = worksw? > wopt − 3lw? ≤ wopt

p′1 = pswitch(p1, kp1) ∧ p′2 = pswitch(p2, kp2)p′3 = pswitch(p3, kp3) ∧ p′4 = pswitch(p4, kp4)s′ = w?v′ = v ∧ a′ = a ∧ z′ = z



SNormalNotFill1∆SteamBoiler1InputControlInput

z = normkw = worksw? > woptw? ≤ wmax

s′ = w?PumpsControlledOffv′ = closed ∧ a′ = on ∧ z′ = z



SNormalWaterStop1∆SteamBoiler1InputControlInput

z = norm ∨ z = brokenkw = worksw? < wmin ∨ w? > wmaxa′ = off ∧ z′ = stop



SNormalControlStop1∆SteamBoiler1InputControlInput

z = normkw = broken ∧ kd = brokena′ = off ∧ z′ = stop


Schema AmountComputation

AmountComputationSteamBoiler1ControlInputamount : N

δpumps : N

amount = l ∗ (pamount(p1, kp1?) + pamount(p2, kp2?) +

pamount(p3, kp3?) + pamount(p4, kp4?))δpumps = δp ∗ (pamount(p1, works) + pamount(p2, works) +

pamount(p3, works) + pamount(p4, works))



SNormalBroken1∆SteamBoiler1InputControlInputAmountComputation

z = normkw = brokenkd = workss′ = s + amount − d?δ ′ = δpumps + δds′ ≥ wmin + δ ′

s′ ≤ wmax − δ ′

s′ < (wmin + wmax)/2 → PumpsControlledOns′ ≥ (wmin + wmax)/2 → PumpsControlledOffv′ = closed ∧ a′ = onz′ = broken

Note:Simple strategy because number of workin pumps is unknown


Complete Operation

ControlNormal1 =̂ SNormalFill1∨ SNormalContinue1

∨ SNormalNotFill1∨ SNormalWaterStop1

∨ SNormalControlStop1

∨ SNormalBroken1


Operations for Broken State

SBrokenContinue1∆SteamBoiler1InputControlInputAmountComputation

z = brokenkw = brokenkd = workss′ = s + amount − d?δ ′ = δ + δpumps + δds′ ≥ wmin + δ ′

s′ ≤ wmax − δ ′

s′ < (wmin + wmax)/2 → PumpsControlledOns′ ≥ (wmin + wmax)/2 → PumpsControlledOffv′ = closed ∧ a′ = onz′ = broken



SBrokenNormal1∆SteamBoiler1InputControlInputAmountComputation

z = brokenkw = worksw? ≥ wminw? ≤ wmaxw? < (wmin + wmax)/2 → PumpsControlledOnw? ≥ (wmin + wmax)/2 → PumpsControlledOffs′ = w?v′ = closed ∧ a′ = onz′ = norm



SBrokenControlStop1∆SteamBoiler1InputControlInput

z = brokenkw = brokenkd = brokena′ = off ∧ z′ = stop



SBrokenWaterStop1∆SteamBoiler1InputControlInputAmountComputation

z = broken ∨ z = normkw = brokenkd = workss′ = s + amount − d?z = broken → δ ′ = δ + δpumps + δdz = norm → δ ′ = δpumps + δds′ < wmin + δ ′ ∨ s′ > wmax − δ ′

a′ = off ∧ z′ = stop



ControlBroken1 =̂ SBrokenContinue1

∨ SBrokenNormal1∨ SBrokenControlStop1

∨ SBrokenWaterStop1


Complete Operation

Control1 =̂ ControlInit1∨ ControlNormal1∨ ControlBroken1


Date post:	02-Feb-2022
Category:	Documents
Upload:	others
View:	2 times
Download:	0 times

Steam Boiler Control An Example in Z Formalisation

Documents