Real-time system analysis based on state-space exploration

Abstract

The traditional approach for analyzing correctness of systems is to identify a set of reachable states and then to analyze this set for verification. This approach is called state-space exploration. State-space exploration is widely used because it can be easily automated. However, verification methods based on state-space exploration suffer from state explosion, so they are impractical for verifying systems with large state spaces. We propose a method for state-space reduction to cope with the state explosion, especially that caused by large time space. The state-space reduction is crucial because in general, the complexities of existing algorithms for automatic analysis, e.g. model-checking, depend on the size of the state space. Our state reduction approach uses Communicating Timed State Machine (CTSM), a state machine-based formal model, to describe real-time systems. In CTSM, a system consists of concurrent processes communicating with each other through channels. Each process has special variables called clocks to express various timing constraints such as delays and deadlines. For a CTSM process, there can be an infinite number of states due to time and data values. Our goal is to generate the smallest representation of the reachable states of a CTSM process. For timed-state space reduction, we first collapse states into an equivalence class using the notions of history equivalence and transition bisimulation. In this approach, equivalent states have identical observable events although transitions into the states may happen at different times. The algorithm then augments the resultant state space with timing relations that describe time distances between transition executions. Using this reduced state space, we analyze properties such as reachability, and other properties described in linear-time temporal logic. We have developed an automatic analysis tool based on approaches we have presented in this thesis, called Timed Reachability Analysis Tool (TREAT). It accepts input in CTSM and produces a timed reachability graph, from which users analyze the correctness of the given system. Using TREAT, we show the efficiency of our algorithm and make a comparison with other existing tools by case studies of well-known real-time system examples: the railroad crossing control system, the Fischer\u27s mutual exclusion protocol, the active structure control system, and the Philips audio control protocol