Trying to understand clocks and timeouts in UPPAAL - model-checking

Question

I need to model a system as a timed automaton with UPPAAL and I'm really puzzled with the way UPPAAL manages clocks and guards according to elapsed time: it looks like UPPAAL just ignores clock guards!
I suppose my problem is that I'm approaching modelling from a very "physical" approach, and so I'm facing this kind of problems.
So here comes a trivial automaton. When run on UPPAAL simulation, I would expect that it loops forever between initial and A locations, never going to B. But this is not the case: it alternates randomly between A and B (at least using the latest UPPAAL snapshot; I cannot try the release, as there's no Linux 64 version).
So what I'm missing? How really UPPAAL treats clock guards?
What I was trying to do when I first encountered this issue is to model a timeout, so the automaton takes a different edge if the guard of the nominal behavior is not meet before 30 seconds.
Thank you a lot
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE nta PUBLIC '-//Uppaal Team//DTD Flat System 1.1//EN' 'http://www.it.uu.se/research/group/darts/uppaal/flat-1_2.dtd'>
<nta>
<declaration>// Place global declarations here.
clock t;</declaration>
<template>
<name x="5" y="5">Template</name>
<declaration>// Place local declarations here.
</declaration>
<location id="id0" x="153" y="8">
<name x="170" y="0">B</name>
</location>
<location id="id1" x="0" y="119">
<name x="-8" y="136">A</name>
</location>
<location id="id2" x="0" y="0">
</location>
<init ref="id2"/>
<transition>
<source ref="id0"/>
<target ref="id2"/>
<label kind="assignment" x="60" y="-55">t:=0</label>
<nail x="153" y="-8"/>
<nail x="42" y="-102"/>
</transition>
<transition>
<source ref="id1"/>
<target ref="id2"/>
<label kind="assignment" x="-135" y="55">t:=0</label>
<nail x="-153" y="-8"/>
</transition>
<transition>
<source ref="id2"/>
<target ref="id0"/>
<label kind="guard" x="93" y="-17">t > 30</label>
</transition>
<transition>
<source ref="id2"/>
<target ref="id1"/>
<label kind="guard" x="0" y="25">t<30</label>
</transition>
</template>
<system>// Place template instantiations here.
// List one or more processes to be composed into a system.
system Template;
</system>
<queries>
<query>
<formula>sup: t
</formula>
<comment>
</comment>
</query>
</queries>
</nta>

Answer 1

Sorry, I got a solution for this long time ago on uppaal Yahoo group. I paste the answer here, so it can be useful for others:
There is nothing special in your model.
You are probably expecting "as soon as possible" semantics where the
automaton would take the transition as soon as it becomes enabled. Timed
automaton is not like that: if there is no invariant (as in your example),
then the timed automaton is allowed to delay as much as possible.
Consequently, the behavior of your automaton includes non-deterministic
choices: either to delay (let time pass) or take the transition. Then the
whole point of model-checker like Uppaal is to explore all possibilities
and that's why you see both edges (with t<30 and t>30) being exercised.
Please note that the clock values (constraints) are different when either
transition is taken, which means that they are executed at different
(mutually exclusive) times.
If you want something definitely to happen within 30 time units, i.e. do
not allow time to pass beyond this point without anything happening and
you have some transition enabled, then you need to add an invariant t<30
(double-click the location and enter this expression into Invariant text
field).
Hope this helps to someone!