PLTL Partitioned Model Checking for Reactive Systems under Fairness Assumptions

We are interested in verifying dynamic properties of finite state reactive systems under fairness assumptions by model checking. The systems we want to verify are specified through a top-down refinement process. In order to deal with the state explosion problem, we have proposed in previous works to partition the reachability graph, and to perform the verification on each part separately. Moreover, we have defined a class, called Bmod, of dynamic properties that are verifiable by parts, whatever the partition. We decide if a property P belongs to Bmod by looking at the form of the Buchi automaton that accepts the negation of P. However, when a property P belongs to Bmod, the property f => P, where f is a fairness assumption, does not necessarily belong to Bmod. In this paper, we propose to use the refinement process in order to build the parts on which the verification has to be performed. We then show that with such a partition, if a property P is verifiable by parts and if f is the expression of the fairness assumptions on a system, then the property f => P is still verifiable by parts. This approach is illustrated by its application to the chip card protocol T=1 using the B engineering design language

Syntactic Abstraction of B Models to Generate Tests

In a model-based testing approach as well as for the verification of properties, B models provide an interesting solution. However, for industrial applications, the size of their state space often makes them hard to handle. To reduce the amount of states, an abstraction function can be used, often combining state variable elimination and domain abstractions of the remaining variables. This paper complements previous results, based on domain abstraction for test generation, by adding a preliminary syntactic abstraction phase, based on variable elimination. We define a syntactic transformation that suppresses some variables from a B event model, in addition to a method that chooses relevant variables according to a test purpose. We propose two methods to compute an abstraction A of an initial model M. The first one computes A as a simulation of M, and the second one computes A as a bisimulation of M. The abstraction process produces a finite state system. We apply this abstraction computation to a Model Based Testing process.Comment: Tests and Proofs 2010, Malaga : Spain (2010

Preservation of timed properties during an incremental development by components

International audienceWe are interested in the preservation of local properties of timed components during their integration in a timed system. Timed components are modeled as timed automata or timed automata with deadlines. Properties considered are all safety and liveness properties which can be expressed with the timed linear logic Mitl (Metric Interval Linear Logic), as well as non-zenoness and deadlock-freedom. Integration of components is a kind of incremental development which consists in checking locally the properties of the components, before integrating them in the complete system, using some composition operator. Of course, established properties have to be preserved by this integration. Checking preservation can be achieved by means of the verification of timed tau-simulation relations. Composability, compatibility and compositionality of these relations w.r.t. composition operators are properties which allow to reduce the cost of this verification. We examine these properties when integration is achieved with two different timed composition operators: the classic operator usually taken for timed systems and which uses a CSP-like composition paradigm, and a non-blocking operator closer to the CCS paradigm

Incremental Verification of Component-Based Timed Systems

International audienceWe are interested in the incremental development, by integration of components, of component-based timed systems, and in particular, in the preservation of their properties during such a development process. We model timed components with timed automata. Their composition is achieved with the classic parallel composition operator for timed automata. The specifications of these timed systems are expressed with the timed linear logic Mitl (Metric Interval Temporal Logic). To guarantee the preservation of properties during an incremental development process, we propose to use ? -simulation relations, adapted for timed systems. First, we extend the classic notion of ? -simulation with timed aspects. As in the untimed case, this relation, called timed ? -simulation, preserves safety properties. To preserve more properties, in particular liveness ones, we present another relation, called divergencesensitive and stability-respecting (DS) timed ? -simulation. This last relation preserves all Mitl properties (and thus liveness ones), but also strong non-zenoness and deadlockfreedom. Moreover, as we put ourselves in a component-based framework, we study if the relations are appropriate to the use of the composition operator that we consider. For this purpose, we study if the relations are compatible with this operator, and if composability and compositionality hold. These three properties are a way to reduce the cost of the verification of the preservation, or even to get it for free. It results that the timed ? -simulation is appropriate with the classic operator since the properties hold without any assumption. However, this is not the case for the DS timed ? - simulation. We implemented the algorithmic verification of the simulations in a tool called Vesta (Verification of Simulation for Timed Automata). The structure of the tool was inspired from the one of the Open-Kronos tool. This allows, as additionnal feature, to connect the models considered in Vesta to the modules of the verification platform Open-Caesar. We show the interest of our method by applying it on a case study, concerning a production cell example

{JML}-based Verification of Liveness Properties on a Class in isolation

International audienceThis paper proposes a way to verify temporal properties of a Java class in an extension of JML (Java Modeling Language) called JTPL (Java Temporal Pattern Language). We particularly address the verification of liveness properties by automatically translating the temporal properties into JML annotations for this class. This automatic translation is implemented in a tool called JAG (JML Annotation Generator). Correctness of the generated annotations ensures that the temporal property is established for the executions of the class in isolation

Generating Tests from {B} Specifications and Test Purposes

International audienceThis paper is about generating tests from test purposes, in addition to structural tests. We present a method that re-uses a behavioural model and an abstract test concretization layer developed for structural testing, and relies on additional test purposes. We propose, in the B framework, a process of test generation that uses the symbolic animation mechanisms of LTG (Leirios Test Generator) based on constraint solving, and guided by the test purposes. We build for that a B animable model that is the synchronized product of a behavioural B abstract model and a test purpose described as a labelled transition system. We prove the correctness of this method, and illustrate it by means of the IAS case study. IAS is a smart-card application dedicated to the operations of Identification, Authentication and electronic Signature

Partitioned {PLTL} Model-Checking for Refined Transition Systems

International audienceThis paper is about the verification of dynamic properties by model-checking for finite state reactive systems. Properties are expressed as PLTL formulae. Systems are specified through a top-down refinement process. In order to cope with the state explosion problem, we propose partitioning the state space to be verified and to verify the properties independently on each part. Properties that are such that if they hold on every part then they hold for the whole system are called verifiable by parts. In a previous paper, we presented a class of interesting PLTL properties that are always verifiable by parts. That is, they are verifiable by parts with any partitioning of the state space. In addition to these properties, some properties are verifiable by parts on a system provided with a particular partitioning. In this paper, we propose a partitioning of the state space of a system that is guided by the refinement process. We introduce an extended class of PLTL properties that are verifiable by parts with regard to this partitioning. This class includes the first one. In particular, the new class includes liveness properties under fairness assumptions. This class is defined from Buchi automata that accept the language of the negations of the properties. Our work is illustrated by its application to a chip card protocol called T=1. This protocol is specified through successive refinements

StaDy: Deep Integration of Static and Dynamic Analysis in Frama-C

We present StaDy, a new integration of the concolic test generator PathCrawler within the software analysis platform Frama- C. When executing a dynamic analysis of a C code, the integrated test generator also exploits its formal specification, written in an executable fragment of the acsl specification language shared with other analyzers of Frama-C. The test generator provides the user with accurate verdicts, that other Frama-C plugins can reuse to improve their own analyses. This tool is designed to be the foundation stone of static and dynamic analysis combinations in the Frama-C platform. Our first experiments confirm the benefits of such a deep integration of static and dynamic analysis within the same platform

Safety Property Driven Test Generation from {JML} Specifications

International audienceThis paper describes the automated generation of test sequences derived from a JML specification and a safety property written in an ad hoc language, named JTPL. The functional JML model is animated to build the test sequences w.r.t. the safety properties, which represent the test targets. From these properties, we derive strategies that are used to guide the symbolic animation. Moreover, additional JML annotations reinforce the oracle in order to guarantee that the safety properties are not violated during the execution of the test suite. Finally, we illustrate this approach on an industrial JavaCard case study

Verification of class liveness properties with Java modeling language

International audienceStatic checking is key for the security of software components. As a component model, this paper considers a Java class enriched with annotations from the Java Modeling Language (JML). It defines a formal execution semantics for repetitive method invocations from this annotated class, called the class in isolation semantics. Afterwards, a pattern of liveness properties is defined, together with its formal semantics, providing a foundation for both static and runtime checking. This pattern is then inscribed in a complete language of temporal properties, called JTPL (Java Temporal Pattern Language), extending JML. We particularly address the verification of liveness properties by auto- matically translating the temporal properties into JML annotations for this class. This automatic translation is implemented in a tool called JAG (JML Annotation Generator). Correctness of the generated annotations ensures that the temporal property is established for the executions of the class in isolation