PROBABILISTIC HYBRID AUTOMATA WITH VARIABLE STEP WIDTH APPLIED TO THE ANAYLSIS OF NETWORKED AUTOMATION SYSTEMS. Jürgen Greifeneder and Georg Frey

Transcription

1 Copyrght IFAC Dscrete-Event System Desgn Rydzyna, Poland, 26 PROBABILISTIC HYBRID AUTOMATA WITH VARIABLE STEP WIDTH APPLIED TO THE ANAYLSIS OF NETWORKED AUTOMATION SYSTEMS Jürgen Grefeneder and Georg Frey Electrcal and Computer Engneerng Department Unversty of Kaserslautern, Germany Erwn-Schrödnger-Str. 12, Kaserslautern e-mal: Abstract: Probablstc Tmed Automata (PTA) have successfully been appled to dscuss problems specfc to the feld of Networed Automaton Systems (NAS). Ths paper shows the transton from PTA towards Probablstc Hybrd Automata (PHA) by ntroducng an event trggered varable tme verson of PTAs. The man dea s to ncrease accuracy and decrease state space of the underlyng Dscrete Tme Marov Chans (DTMC) whch are nput for those probablstc model checng algorthms for whch these models should be used. For a better llustraton of the advancement, the approach s appled to a typcal example from the feld of NAS. Copyrght 26 IFAC Keywords: Tme varyng systems, Probablstc Models, Qualty, Delay analyss, Dscrete-tme models, Marov models, Networs, Modelng, Automata. 1. INTRODUCTION In the last decade, the feld of automaton has been nterspersed wth apparently smple components borrowed from other techncal felds, partcularly those dealng wth dstrbuted systems. One of the drvng forces thereby can be found n the rapd development of Ethernet or TCP/IP-based technologes resultng n a collapse of prces for the correspondng hard- and software. Apparently to that, the mnaturzaton went on as well as dstrbuton of components and the need to communcate (not at least trggered by a stll growng complexty of automaton control algorthms). The hence composed systems aggregate control (.e. automaton) systems and networ technologes. Ths fuson s called Networed Automaton Systems (NAS) and represents a structure consstng of a number of programmable logc controllers (PLCs), several sensors and actuators, the networ tself, and varous nput-output-networ-devces. The use of open communcaton platforms entals an ncreased and not prevously predctable data flow, whch may nduce delays not present n classcal structures. Furthermore, whle the use of wreless networs (e.g. WLAN, Zgbee) offers a great opportunty n terms of varablty and mnaturzaton, t adds a potental rs of data loss (loss of data n a NAS beng defned as the non-arrval of data wthn a gven tme frame). All n all, ths leads to a system structure whch contans delay tmes, hard tme bounds, stochastc dstrbutons, determnstc choce connectng physcal and computaton processes. There already s some wor done to tacle the challenges yelded by NAS (Dngle et al., 22 ; Marsal et al., 25). However, these approaches are based on smulaton, whch mples that there s no guarantee for a full account of all possble evolutons. Yet, such a guarantee s essental for the analyss of NAS. Addtonally, there are several formal approaches, but those are unfortunately unable to deal wth the system structures descrbed above or are restrcted to producng worst case analyss, whch can only lead to nfeasble demands on the system s hard- and software. Therefore, a new modelng approach s proposed whch can deal wth tme, stochastc dstrbutons and probablstc choce, namely probablstc model 283

2 checng (PMC). When PMC s used for a NAS analyss, several advantages as well as dsadvantages have to be consdered. One of the advantages s that PMC s certan to cover all possble evolutons of a system nstead of only a subset as s the case wth smulaton and testng methods. The dsadvantages are best descrbed by the prce to be pad n terms of modelng abstractons, assumptons, and computatonal lmts. For ths wor, the consdered systems are modeled on a dscrete verson of Probablstc Tmed Automata (PTA) and projected to Dscrete Tme Marov Chans (DTMC) by the use of an event trggered varable tme step (whch wll be ntroduced n the next secton). These DTMCs are ntegrated for the sae of the probablstc model checng algorthms. The results presented wthn ths wor are calculated usng PRISM, a model checer from the Unversty of Brmngham (Kwatowsa et al., 22). For further llustraton of desgn and consequences, a small, but typcal NAS-example s gven n secton 3. Secton 4 furnshes an n-depth explanaton of some detals of the tme concept ntroduced n secton 2; a short dscusson follows n secton 5. Fnally, the concludng secton 6 gves an outloo on further wor. 2. MODELING OF TIME Snce physcal processes are concerned, the correct functonng of the control system depends crucally upon real-tme consderatons. For that reason Alur and Dll developed the theory of tmed automata (Alur and Dll, 1994). Theren, they used a densetme representaton, where tmes are represented by real numbers wth an arbtrary accuracy tolerance up to whch two numbers are consdered as equal. However, usng ths approach t s stll necessary to ntegrate dfferent tmes to result n the same characterstc. Ths s accomplshed through the use of cloc regons or regon graphs (actually the same thng). The method of dgtal clocs suggested by (Henznger et al., 1992) could be used as an alternatve to cloc regons for a successful dscretsaton. Yet, the queston arses why the dscretsaton s not carred out earler n the process. Ths dea leads to a dscrete model, whch has each state attached wth tme nformaton bult of dscrete and monotoncally ncreasng (mostly nteger) numbers. The Analyss of a tmed system wth dscrete tme creates certan phenomena, such as the problem of fndng an approprate tme step and a set of ntal states whch would at least be able to cope wth constant tme drfts among non-synchronzed subsystems (Grefeneder and Frey, 26b). Whle n systems where sgnal changes are consdered to occur synchronously wth a cloc sgnal (e.g. dgtal crcuts) the problem of fndng an approprate tme step s nherent, t stll provdes a potental source for state exploson. When t comes to contnuous tme physcal nterfaces (sensors), there s nether a lower nor an upper lmt to ths decson: f, on the one hand, a tme step whch s shorter than necessary to exactly model the fastest system change s used, the sze of the model has the tendency to ncrease exponentally; f, on the other hand, a tme step whch s longer than necessary s appled, nformaton loss wll occur. One of the most mportant advantages of ths modelng approach s that t can be transformed easly nto an ordnary formal language va the addton of a new event to the set: a synchronze tc. Note: It s not necessary to explctly add the absolute cloc nformaton to each state as ths nformaton can be regenerated through a count of the number of states on a gven path. A dscrete tme model usually requres a strong monotony of the ntegers representng the tme, but n ths case, the use of a fcttous tme whch only needs to be non-decreasng eases ths restrcton. The tme delay between two events s measured as the sum of all tme steps elapsed between the two of them, that s: the pont of tme of each event s the same as ts poston n a seres of states leadng from an ntal to a fnal state (ths s to be called a path). To do the dscretsaton, t s mpossble to state precsely certan about delays. On the other hand, the exact occurrence tme of most of the sgnals s of lower nterest, especally f any dgtal devce forces the ncdence towards a dscrete tme axs. Furthermore, t s rrelevant for most purposes whether an event A (e.g. the change of a sensors value) occurred before or after another ndependent event B (e.g. the arrval of a pacage at a swtch). In these cases, t really s an advantage (n terms of an enormous decrease n state space and calculaton tme) that only the fact that an event occurred wthn the last tme step s recorded nstead of the exact pont of tme wthn ths tme step. The best nterpretaton of ths approach s to say that events occur n the specfed order at real value tmes, but only the (nteger) readngs of the tme value are recorded. Hence, by the way, the system model elmnates the occurrence of non-determnstc choce. All n all, ths leads to the clam that the maxmum length of a tme step must be shorter than the tme passng n between two consecutve sgnfcant events (a sgnfcant event s an event whch has an nfluence on other processes n the system). From thereon, a modelng approach, whch has already been successfully used for several case studes (Grefeneder and Frey, 26a; 26b), was derved. Yet, all of them suffered from the state exploson problem whch rased exponentally to the chosen tme accuracy. Therefore, the orgnally fxed tme steps are ths tme replaced by an event trggered tme step. Ths fuses the advantages of the authors prevous dscrete tme approach and the wor done by (Alur et al., 1991). As n a DTMC the consecutve path only depends on the actual state (that s: the momentary state reles solely on the prevous one), the nformaton about the next tme step s length must be determned before ths state transton s executed. Ths s the real challenge to be taen up and changes the modelng tas n a qute fundamental way (as wll be demonstrated n chapter 4). 284

3 3. INTRODUCTION OF AN EXAMPLE 3.1. System descrpton The system under observaton (cf. Fg. 1) conssts of a transport unt, whch s drven by a speed controlled engne, a drllng unt, and two nductve sensors. Whle the transport unt nows ts speed, but s unable to determne ts own poston, the two nductve sensors ndcated wth s A and s B can only detect when a poston s reached. v s A s B Fg. 1. Schematc representaton of the controlled process used for the case study. The am of the control s to reach a gven drllng poston based on the poston of the sensors s A and s B. The value to be optmzed s the poston where the drll puts the hole. The system s to be understood as NAS as llustrated n Fg. 2 (ths, of course, s a very small example, set up only to demonstrate the capactes). The two sensors are connected to an IO-card, whch tself s connected to the networ. The networ s assumed to be wreless TCP/IP-Ethernet based. Pacage loss s not consdered; for a dscusson on that see e.g. (Grefeneder and Frey, 26a). The IOaccess of the transport unt and the PLC-IO are also connected to the networ. The PLC s connected to ts IO-card va a shared memory (that s, ncomng data wll be avalable for the PLC as soon as t has arrved). The drllng process tself s not ncluded n the model. PLC Inputs Executon Outputs wrte read PLC 1 - IO Cycle tme: 7 ts cyclc requests Cycle tme:1 ts networ v s A s B Fg. 2: Archtecture of the Networed Automaton System used n the case study. When the object passes the sensor at s A, ths pece of nformaton s carred by the networ to the PLC-I/O card. From there, the value s wrtten nto the PLCs nput buffer va a bacplane-bus. Insde the PLC, the nformaton s processed, whch results n a new settng of an output varable used to slow down the motor from normal speed to a slow mode. The new output value s transferred va the PLC I/O-card and the networ to the transport unt. The latter wll execute the command as soon as the sgnal arrves. When the object passes the sensor at s B, the same procedure (as descrbed above for sensor s A ) wll be accomplshed except that ths tme the transport unt wll decelerate from the actual speed (whch mght stll be larger than 285 the slow mode speed, dependng on when the start decelerate for slow mode sgnal arrved) untl t stops. After ths state s reached, a stop sgnal s passed through the networ to the PLC, and after beng processed from there, the drllng command s ssued. Obvously, by movng the postons of the sensors s A and s B, the accuracy of the drllng poston can be optmzed, as well as the tme needed for ths processng tas Abstractons and Assumptons The sensors are assumed to be exact wthn one length unt and the cyclc sensor-readng behavor s neglected. Both would add another delay dstrbuton, whch should be accounted for n a real system. However, those effects wll not add a new phenomenon to ths dscusson (except another ncrease n calculaton tme). The networ tself s assumed to be TCP/IPbased wreless Ethernet contanng an access pont whch acts as a router. Dependng on other traffc condtons (e.g. sgnals from other sensors or to other actuators), the routng tme vares n between one (9%) and two (1%) tme steps. Ths corresponds to measurements at a lab system whch fnds most of the pacages n between one and two mllseconds (.e. one tme step can be assumed to equal one mllsecond). It s assumed that there s no other dsturbance or delay wthn the networ. For a dscusson on consequences of falures n the networ on the delay tme see e.g. (Grefeneder and Frey, 25). The PLC uses a cycle perod of 7 tme steps, whle ts I/O card cycle uses 1 tme steps. The speed s assumed to be 24 length unts per tme step (lu/ts) n the normal mode and 4 lu/ts n the slow mode. The frst deceleraton s assumed to be 2 length unts per tme step square and the second one to be 4 lu/ts². These numbers are of an academc nature and desgned to guarantee that all the state varables wll represent an nteger value after each tme step. The defnton for a length unt to be e.g..1 mm wth the gven tme step of 1ms results n reasonable values for speed and deceleraton. The moment n whch the object enters the system s of stochastc nature. Snce the (mnmum) tme step s fxed, the ntal value of the poston x has to nhert ths stochastc character from the tme: equally dstrbuted over all possble ntal values,.e. wth the ntal (normal) velocty of 24 lu/ts the frst value after enterng the system ranges over 24 neghborng values. Whle ths does not affect the medum end poston, t has an effect on devaton and spread. It s more mportant for the result that PLC, PLC-I/O, engne and sensors are not synchronzed, and therefore all possble permutatons have to be consdered by ntal states (agan, equally dstrbuted). Furthermore, t s assumed that the relatve tme drft n between the modules s less than one tme step over the total tme perod (.e. that t s less than 1%). For the followng dscusson, these dfferent ntal states wll not be consdered, snce they are merely mportant for the correctness of the results, but not for the way n whch the new approach s bult.

4 The nfluence of the NAS on the velocty-trajectory s shown n Fg. 3 for a sngle value-settng: s A =175, s B =5. Whle the lower curve shows a typcal evoluton for the case that the sensors sgnals act drectly on the actuators, the upper curve shows the nfluence of the delay caused by the NAS on the postonng problem. Frst, both curves are dentcal untl the frst sensor s passed. Then, the system wthout NAS starts to decelerate, whle the system wth NAS stll runs on hgh velocty untl the sgnal s passed through the networ (n ths very example ths taes 17 tme steps). Afterwards, the system usng NAS also decelerates down to v slow. Ths paper focuses on the mplementaton of the event based approach and shows the dfferences towards the formerly used fxed step approach. For a more detaled dscusson on the example, ts behavor and the correspondng PMC-modules see (Grefeneder and Frey, 26c). 25 v normal velocty v slow wthout NAS usng NAS tme Fg. 3: Illustraton of the veloctes of a postonng process wth drect sensor-actuator couplng n contrast to a NAS-system. j f thereby ndcates the maxmally possble tme step forecasted by the j th module on the bass of the state at the th tme step. In prncple, ths forecast s produced as the determnaton of the tme necessary to reach a state whch would trgger a transton wthn the j th module. Let us have a closer loo at the prevously ntroduced example. Fve modules are necessary to descrbe t completely: The sensors, the engne, the networ (for reasons of complexty reducton separated n three parts, see below), the PLC, and the assocated PLC- IO. As PRISM maes all (local) varables vsble to all other modules, all modules now about all varables n the system (that s, the exact systems state). In the followng, the dfferent modules wll be ntroduced The sensors module The sensors module determnes the current poston of the object and sends a sgnal each tme that one of the two sensors s passed as shown n Fg. 4. The event assocated wth the dagonal lne on the transton symbolzes the fact that ths transton s fred synchronously wth all the other modules. Note: In each module there s always one and only one actve transton. For a more detaled ntroducton to the automaton representaton see (Grefeneder and Frey, 26a). Dm(x) x<s A x s A R sa =true Dm(x) x<s B x s B R sb =true Dm(x) Fg. 4: Poston determnaton automaton (sensors' module). 4. DETERMINING THE NEXT TIME STEP S LENGTH Some components n NAS exst more than once, and the model of the system has to be scalable n an easy way. Therefore, t maes sense to model the dfferent components separately and connect them afterwards to buld the system. Ths also offers the opportunty (or ntroduces the curse) for each module to determne ts next maxmal tme step s length separately from all the other modules. As the nformaton about the overall length of the next tme step must be avalable to determne the next state, the conjuncton of all the modules maxmal tme steps (each of them determned n the actual tme step) must be done n between the current one and the next step. Obvously, ths could be done by the use of an ntermedate step, but hence the state space would be ncreased by an exponent of two wthout any beneft for the system. Fortunately, PRISM offers a mn-functon whch returns the mnmal value out of a set of values delvered to the functon. Ths functon s used to determne the next step s length () wthn the transton guards tself: = 1 mn ( f j + ) (1) j 286 Dm(x) symbolzes the determnaton of the current x- value (poston). The dotted varables stand for the velocty and acceleraton at the th tme step. 1 2 Dm( x+ 1) = x + x + x (2) 2 If the automaton s n the frst state, the maxmum tme whch may elapse before a state change occurs s the tme whch s necessary to reach the s A -poston gven the current velocty: Sensor sa x f = (3) x The same equaton s used for the state located n the mddle poston of Fg. 4 f the actual acceleraton equals (usng s B nstead of s A ). If the acceleraton does not equal, the correspondng equaton can be deduced from equaton (2): 2 x ± x 2 x ( ) x sb Sensor f = (4) x Sensor If the rght state of the automaton s reached, f wll be set to ts maxmum value (n PRISM all varables must be defned by type and range). As a large range nduces a large state space, t s wse to chose the maxmum value equalng the maxmum result possbly occurrng from equaton (3) respectvely (4).

5 Fnally, there s an excepton to the above equatons: If a sensor s actvated (R sa or R sb set to true), ths nformaton must be handed over to the networ mmedately (.e. maxmum one tme step) PLC and PLC-IO Both the PLC and ts IO module are abstracted from rng-counters. Snce the counter varables (ct) as well as the maxmum counter varables (CtMax) are nown through the system both counters can be mplemented as shown n Fg. 5. ct-= ct:=ctmax-mod(-ct,ctmax) ct-< ct:=ctmax ct-< ct-= ct-> ct:=ct- ct-> Fg. 5: State transton representaton of a rng counter (PLC- and PLC-IO-module) The networs As already mentoned, the networ s splt up nto three modules. The frst one wors n the followng way: t wats untl R sa =true s receved from the poston determnaton module (for reasons of smplfcaton, the tme for sendng a pacage from the IO to the networ s assumed to equal one tme step). As long as ths sgnal s not receved, ths module smply does nothng. In analogy wth the sensors module, Net1 the f varable should be set to ts maxmum value. The maxmum tme delay occurrng n the networ s the sendng tme of two tme steps. Yet, ths s not a sutable value to be used as a maxmum value, for t wll be smaller than all other values n most of the cases. Therefore, the networ modules are provded wth two varables. One, the already nown one ( f Net ) and second a bnary varable (ExNet ) whch ndcates whether or not the frst value has to be consdered by the mnmum functon gven n equaton (1). f Net n equaton (1) therefore s replaced by: Net max( f,5 ExNet) (5) 5 s just an arbtrary number. As soon as the R sa =true sgnal s receved, ExNet 1 s set to and Net f 1 s set to the sendng tme, gven by the queue Net1 length (1 or 2 tme steps). As soon as f mnus equals, ExNet 1 s set bac to 1 and the automaton wats for R sb =true. Then, the same procedure s repeated. Afterwards ths frst of the three networ automaton modules has no specal tas any more. The remanng two modules are used to mplement a sgnal tracng tas; for a more detaled dscusson on ths cf. (Grefeneder and Frey, 26b). To facltate ths concept, the downln from the PLC-IO to the 287 engne s modeled separately for each of the two sgnals. Hence, both of them have the same functonalty although they are actvated by dfferent sensor sgnals (s A versus s B ). The tas to be observed s gven as follows: Wat untl the sgnal got receved from the upln networ. Then wat untl the sgnal got read by the PLC. Wat untl the PLC processed the sgnal and fnally wat untl the PLC-IO has sent the sgnal to the networ. Next, the same functonalty s mplemented as already dscussed for the upln module. The frst watng procedure already got dscussed. The commands to wat for the PLC to read, process and afterwards wrte out the sgnal are mplemented by the assgnment of the actual value (mnus ) of the PLCcounter to f Net plus the PLC s cycle tme mnus Net one (and dscount as long as f ). In the case of watng perod for the PLC-IOs cycle, the assumpton s made that the sgnal wll be send when the counter equals zero. Therefore f Net s smply set to the current value of the correspondng counter The engne The engne-module s probably the most complex one. Therefore, t wll be ntroduced n two steps. Frst, the physcal behavor wll be dscussed as vsualzed n Fg. 6. S1 and S2 represent the events of the recepton of the nformaton from the PLC that the frst (respectvely the second) sensor has been passed. Unless ths s not the case, the automaton remans n the ntal state (bottom left). If S2 s receved, the automaton changes towards the top md state. However, ths should not happen n normal operaton before the two remanng bottom states are passed. From bottom left to bottom md S1 must be receved. From there to bottom rght, the velocty has been decelerated untl the slow mode s reached. If the velocty equals zero, the top rght state wll be entered. S2 x =v x =!S1&!S2 S1&!S2 S2 x =x -x x =B 1 x >v slow &!S2 S2&x > x v slow &!S2 Fg. 6: Automaton of the engne. x =x -x x =B 2 x =v slow x = x v slow &!S2 x x > x x = x = The correspondng maxmum step tme can be determned as follows. In the frst step, t s set to the maxmum of the defned varable s range as t only has to wat. In the two mddle states (bottom and top), t s defned as the actual velocty (old velocty plus old acceleraton tmes ) dvded by the actual acceleraton (whch equals B 1 n the bottom md and B 2 n the top md state): Engne x + x f = (6) x + 1 If one of the two remanng states s entered for the frst tme, the change n the acceleraton wll lead to hgher veloctes n further steps. As ths nformaton true

6 s mportant t should be passed on mmedately or wthn one tme step. If one of theses states s reentered, the maxmum tme step can be set to ts maxmum value. Note: n general, there should be such an nformaton transfer step for each state reentered, but n ths wor, t s only necessary for the deceleraton to be set bac to zero nstead of to a hgher deceleraton, as there s no module n the system whch would suffer from not recevng ths nformaton. 5. DISCUSSION Fg. 7 shows one possble trajectory of the above example. Whle the sold lne wth the lttle rhomb represents the calculaton ponts for a constant tme step of one (summed up, there are 54 of them), the bg crcles represent the calculaton ponts created f a varable step wh s used. In fact, the number of ponts to be determned could thus be reduced from 54 to 16. probablty for values outsde a range of ±1mm (1 length unts) can be determned towards 7%, outsde of ±1.5mm towards.21. Smlar values are found for the standard devaton. The medum poston s -.9mm. The medum tme needed to pass the last centmetre s determned to 49.35ms. 6. CONCLUSION In ths paper a new approach for probablstc model checng of NAS whch uses varable (event trggered) Dscrete Tme Marov Chans was ntroduced. The next step for ths project wll be the transton towards dense tme and a dense representaton of physcal varables. Fnally, t would be nterestng to mplement an estmaton algorthm able to fully use the next state for the estmaton nstead of an extrapolaton from the actual state. 9 poston REFERENCES =1 varable Fg. 7: Poston trajectory of the transport unt over tme for one sngle ntal state. Calculaton s done for a constant step sze of.1ms (sold lne) and for a varable step sze (crcles). tme (ms) The proposed approach not only reduces the state space, but also the tme needed for model checng. Unfortunately, whle the tme needed for model checng can be reduced, the tme needed by PRISM to buld the matrx of reachable states ncreases by a factor of 8 n comparson wth the use of a fxed tme step wh. Therefore, the next am should be to analyze the codng of PRISM and mprove the effectveness of ths operaton. In Fg. 8 the dstrbuton of the drllng poston s gven (s A =699, s B =47). The value of 6 at poston 4 means that the probablty of a stop n between 39 and 4 length unts s determned to be 6. The probablty poston Fg. 8: Dstrbuton of the fnal poston (step wh of 1). Alur R., C. Courcoubets, and D. Dll (1991). Model-checng for probablstc real-tme systems. ICALP 91, LNCS, vol 51, pp. 1 1, Sprnger. Alur R. and D. Dll (1994). A theory of tmed automata. Theoretcal Computer Scence, 126(2), pp Dngle, N.J., P.G. Harrson, and W.J. Knottenbelt (22). Response Tme Denstes n Generalsed Stochastc Petr Net Models Proc. 3rd WOSP, Italy. Grefeneder, J. and G. Frey (25). Probablstc Delay Tme Analyss n Networed Automaton Systems. In: Proc. of the 1 th IEEE ETFA 25, Catana, Italy, Vol. 1, pp Grefeneder J. and G. Frey (26a). Dependablty analyss of networed automaton systems by probablstc delay tme analyss, Proc. of 12 th IFAC ncom, pp Grefeneder J. and G. Frey (26b). Determnaton of Delay Tmes n Falure Afflcted Networed Automaton Systems usng Probablstc Model Checng. Proc. of 6 th IEEE WFCS, Torno, Italy, pp Grefeneder J. and G. Frey (26c) Optmzng Qualty of Control n Networed Automaton Systems usng Probablstc Models. Proc. of 11 th IEEE ETFA, Prague, Czech Republc. Henznger, T., X. Ncolln, J. Sfas, and S. Yovne (1992). What good are dgtal clocs? n Proc. ICALP'92, LNCS, vol. 623, p , Sprnger. Kwatowsa M., G. Norman, D. Parer (22). PRISM: Probablstc symbolc model checer. Proc. TOOLS 2, LNCS, vol. 2324: Sprnger, 22. Marsal, G., D. Wtsch, B. Dens, J.-M. Faure, G. Frey (25): Evaluaton of Real-Tme Capabltes of Ethernet-based Automaton Systems usng Formal Verfcaton and Smulaton. Proc. of 1ère RJCITR'5, Nancy, France, pp