Testing real-time systems using TINA

The paper presents a technique for model-based black-box conformance testing of real-time systems using the Time Petri Net Analyzer TINA. Such test suites are derived from a prioritized time Petri net composed of two concurrent sub-nets specifying respectively the expected behaviour of the system under test and its environment.We describe how the toolbox TINA has been extended to support automatic generation of time-optimal test suites. The result is optimal in the sense that the set of test cases in the test suite have the shortest possible accumulated time to be executed. Input/output conformance serves as the notion of implementation correctness, essentially timed trace inclusion taking environment assumptions into account. Test cases selection is based either on using manually formulated test purposes or automatically from various coverage criteria specifying structural criteria of the model to be fulfilled by the test suite. We discuss how test purposes and coverage criterion are specified in the linear temporal logic SE-LTL, derive test sequences, and assign verdicts

Formal modelling and analysis of broadcasting embedded control systems

PhD ThesisEmbedded systems are real-time, communicating systems, and the effective modelling and analysis of these aspects of their behaviour is regarded as essential for acquiring confidence in their correct operation. In practice, it is important to minimise the burden of model construction and to automate the analysis, if possible. Among the most promising techniques for real-time systems are reachability analysis and model-checking of networks of timed automata. We identify two obstacles to the application of these techniques to a large class of distributed embedded systems: firstly, the language of timed automata is too low-level for straightforward model construction, and secondly, the synchronous, handshake communication mechanism of the timed automata model does not fit well with the asynchronous, broadcast mechanism employed in many distributed embedded systems. As a result, the task of model construction can be unduly onerous. This dissertation proposes an expressive language for the construction of models of real-time, broadcasting control systems, and demonstrates how effi- cient analysis techniques can be applied to them. The dissertation is concerned in particular with the Controller Area Network (CAN) protocol which is emerging as a de facto standard in the automotive industry. An abstract formal model of CAN is developed. This model is adopted as the communication primitive in a new language, bCANDLE, which includes value passing, broadcast communication, message priorities and explicit time. A high-level language, CANDLE, is introduced and its semantics defined by translation to bCANDLE. We show how realistic CAN systems can be described in CANDLE and how a timed transition model of a system can be extracted for analysis. Finally, it is shown how efficient methods of analysis, such as 'on-the- fly' and symbolic techniques, can be applied to these models. The dissertation contributes to the practical application of formal methods within the domain of broadcasting, embedded control systemsSchool of Computing and Mathematics at the University of Northumbri

Sémantique compositionnelle et raffinement de systèmes temporisés : application aux automates temporisés d'UPPAAL et au langage FIACRE

Les systèmes temps-réel sont massivement impliqués dans de nombreuses applications, dont notre vie dépend comme les logiciels embarqués dans les voitures et les avions. Pour ces systèmes des erreurs inattendues ne sont pas acceptables. De ce fait, assurer la correction de ces systèmes est une tâche primordiale. Les systèmes temps-réel représentent un large spectre de systèmes automatisés dont la correction dépend de la ponctualité des événements (timeliness) et pas seulement de leurs propriétés fonctionnelles. Chaque événement doit être produit selon la date indiquée par la spécification du système. Les systèmes temps-réel sont concurrents et embarqués, et conçus comme un assemblage de composants en interaction. Malgré les progrès réalisés dans les techniques de model checking, la vérification et l'analyse des systèmes temps-réel représentent toujours un défi autant pour les chercheurs que les praticiens. Pour étudier le comportement des systèmes temps-réel, différents formalismes ont été considérés comme les automates temporisés, les réseaux de Petri temporisés et les algèbres de processus. Cela donne lieu à plusieurs points délicats concernant le raffinement, la composition et la vérification. Ces points représentent un champ de recherche intensif. Ma thèse présente une étude des systèmes temps-réel focalisée sur les notions de sémantique, de composition et de raffinement. Elle décrit nos efforts pour explorer et étendre les formalismes temps-réel. Nous avons abordé les concepts de base de la modélisation des systèmes temps réel tels que les variables partagées, la communication, les priorités, la dynamicité, etc. La contribution de cette thèse porte sur la définition d’un cadre formel pour raisonner sur la sémantique, la composition et le raffinement des systèmes temporisés. Nous avons instancié ce cadre pour le formalisme des automates temporisés et le langage Fiacre.Nowadays, real-time systems are intensively involved in many applications on which our life is dependent, like embedded software in cars and planes. For these systems unexpected errors are not acceptable. Real-time systems represent a large spectrum of automated systems of which correctness depends on the timing of events (timeliness) and not only on their functional properties. Each event must be produced on time. Realtime systems can be concurrent and embedded where different interactive modules and components are assembled together. Despite advances in model checking techniques, the verification and analysis of real-time systems still represent a strong challenge for researchers and practitioners. To study the behavior of real-time systems, different formalisms have been considered like timed automata, time Petri nets and timed algebra, and several challenges concerning refinement, composition and verification have emerged. These points represent an intensive field of research. This thesis describes our effort to explore and extend real-time formalisms. We have revisited real-time language semantics, focusing on composition and refinement. We have addressed high level concepts like shared variables, communication, priorities, dynamicity, etc. The main contribution consists of a theoretical study of timed systems where we establish a framework for reasoning on composition, refinement and semantics. We instantiate this framework for timed automata and the Fiacre language

Automatic techniques for detecting and exploiting symmetry in model checking

The application of model checking is limited due to the state-space explosion problem – as the number of components represented by a model increase, the worst case size of the associated state-space grows exponentially. Current techniques can handle limited kinds of symmetry, e.g. full symmetry between identical components in a concurrent system. They avoid the problem of automatic symmetry detection by requiring the user to specify the presence of symmetry in a model (explicitly, or by annotating the associated specification using additional language keywords), or by restricting the input language of a model checker so that only symmetric systems can be specified. Additionally, computing unique representatives for each symmetric equivalence class is easy for these limited kinds of symmetry. We present a theoretical framework for symmetry reduction which can be applied to explicit state model checking. The framework includes techniques for automatic symmetry detection using computational group theory, which can be applied with no additional user input. These techniques detect structural symmetries induced by the topology of a concurrent system, so our framework includes exact and approximate techniques to efficiently exploit arbitrary symmetry groups which may arise in this way. These techniques are also based on computational group theoretic methods. We prove that our framework is logically sound, and demonstrate its general applicability to explicit state model checking. By providing a new symmetry reduction package for the SPIN model checker, we show that our framework can be feasibly implemented as part of a system which is widely used in both industry and academia. Through a study of SPIN users, we assess the usability of our automatic symmetry detection techniques in practice

Distributed Real-time Systems - Deterministic Protocols for Wireless Networks and Model-Driven Development with SDL

In a networked system, the communication system is indispensable but often the weakest link w.r.t. performance and reliability. This, particularly, holds for wireless communication systems, where the error- and interference-prone medium and the character of network topologies implicate special challenges. However, there are many scenarios of wireless networks, in which a certain quality-of-service has to be provided despite these conditions. In this regard, distributed real-time systems, whose realization by wireless multi-hop networks becomes increasingly popular, are a particular challenge. For such systems, it is of crucial importance that communication protocols are deterministic and come with the required amount of efficiency and predictability, while additionally considering scarce hardware resources that are a major limiting factor of wireless sensor nodes. This, in turn, does not only place demands on the behavior of a protocol but also on its implementation, which has to comply with timing and resource constraints. The first part of this thesis presents a deterministic protocol for wireless multi-hop networks with time-critical behavior. The protocol is referred to as Arbitrating and Cooperative Transfer Protocol (ACTP), and is an instance of a binary countdown protocol. It enables the reliable transfer of bit sequences of adjustable length and deterministically resolves contest among nodes based on a flexible priority assignment, with constant delays, and within configurable arbitration radii. The protocol's key requirement is the collision-resistant encoding of bits, which is achieved by the incorporation of black bursts. Besides revisiting black bursts and proposing measures to optimize their detection, robustness, and implementation on wireless sensor nodes, the first part of this thesis presents the mode of operation and time behavior of ACTP. In addition, possible applications of ACTP are illustrated, presenting solutions to well-known problems of distributed systems like leader election and data dissemination. Furthermore, results of experimental evaluations with customary wireless transceivers are outlined to provide evidence of the protocol's implementability and benefits. In the second part of this thesis, the focus is shifted from concrete deterministic protocols to their model-driven development with the Specification and Description Language (SDL). Though SDL is well-established in the domain of telecommunication and distributed systems, the predictability of its implementations is often insufficient as previous projects have shown. To increase this predictability and to improve SDL's applicability to time-critical systems, real-time tasks, an approved concept in the design of real-time systems, are transferred to SDL and extended to cover node-spanning system tasks. In this regard, a priority-based execution and suspension model is introduced in SDL, which enables task-specific priority assignments in the SDL specification that are orthogonal to the static structure of SDL systems and control transition execution orders on design as well as on implementation level. Both the formal incorporation of real-time tasks into SDL and their implementation in a novel scheduling strategy are discussed in this context. By means of evaluations on wireless sensor nodes, evidence is provided that these extensions reduce worst-case execution times substantially, and improve the predictability of SDL implementations and the language's applicability to real-time systems

The Past, Present, and Future(s): Verifying Temporal Software Properties

Software systems are increasingly present in every aspect of our society, as their deployment can be witnessed from seemingly trivial applications of light switches, to critical control systems of nuclear facilities. In the context of critical systems, software faults and errors could potentially lead to detrimental consequences, thus more rigorous methodologies beyond the scope of testing need be applied to software systems. Formal verification, the concept of being able to mathematically prove the correctness of an algorithm with respect to a mathematical formal specification, can indeed help us prevent these failures. A popular specification language for these formal specifications is temporal logic, due to its intuitive, yet precise expressions that can be utilized to both specify and verify fundamental properties pertaining to software systems. Temporal logic can express properties pertaining to safety, liveness, termination, non-termination, and more with regards to various systems such as Windows device drivers, kernel APIs, database servers, etc. This dissertation thus presents automated scalable techniques for verifying expressive temporal logic properties of software systems, specifically those beyond the scope of existing techniques. Furthermore, this work considers the temporal sub-logics fair-CTL, CTL*, and CTL*lp, as verifying these more expressive sub-logics has been an outstanding research problem. We begin building our framework by introducing a novel scalable and high-performance CTL verification technique. Our CTL methodology is unique relative to existing techniques in that it facilitates reasoning about more expressive temporal logics. In particular, it allows us to further introduce various methodologies that allow us to verify fair-CTL, CTL*, and CTL*lp. We support the verification of fair-CTL through a reduction to our CTL model checking technique via the use of infinite non-deterministic branching to symbolically partition fair from unfair executions. For CTL∗, we propose a method that uses an internal encoding which facilitates reasoning about the subtle interplay between the nesting of path and state temporal operators that occurs within CTL∗ proofs. A precondition synthesis strategy is then used over a program transformation which trades nondeterminism in the transition relation for nondeterminism explicit in variables predicting future outcomes when necessary. Finally, we propose a linear-past extension to CTL*, that being CTL*lp, in which the past is linear and each moment in time has a unique past. We support this extension through the use of history variables over our CTL∗ technique. We demonstrate the fully automated implementation of our techniques, and report our bench- marks carried out on code fragments from the PostgreSQL database server, Apache web server, Windows OS kernel, as well as smaller programs demonstrating the expressiveness of fair-CTL, CTL*, and CTL*lp specifications. Together, these novel methodologies lead to a new class of fully automated tools capable of proving crucial properties that no tool could previously prove in the infinite-state setting