Formal Description Techniques Research Articles

Formal relational database design: an exercise in extending the formal template language

Abstract The use of formal description techniques aims to prevent the defects found in software that arise due to poor planning at the design stage. However, the ensuing specifications are often designed with only a single application in mind and are not easily generalised. One area in which these deficiencies arise is that of the formal modelling of relational databases: many authors have drawn parallels between the formal description language, Z, and the relational model of data, but none of these contributions have managed to be both close to the relational model in terms of providing a practical means of database design and fully formal in terms of providing an appropriate metamodel. In this paper, we describe a generative template language, based on the formal template language (FTL). In particular, we extend the FTL, which was developed originally as means of expressing templates, to underpin an approach that facilitates the reuse of specifications in Z, paying particular attention to the formal design of relational databases. These templates encapsulate the common structure found in specifications and can be instantiated to produce specifications tailored to suit particular needs. To achieve this, we extend the FTL and present a mechanism for naming and referencing templates. We also introduce the semantics of template annotations to enforce the syntactic correctness of instantiations.

Towards Standardized Conformance Test Suite for ISO Transport Layer Protocol

In this paper, we develop a sound Conformance Test Suite for the Transport Layer Protocol Internationally standardized by both ISO and IEC. This is to test the implementations of the protocol, promote and facilitate standardized test suites, and promote the use of formal methods. We use formal methods for the generation of testing sequences to make the results sound. The protocol is formally specified in Lotos; the ISO/IEC Formal Description Technique for computer/communications protocols and distributed systems.

A Formal Data-Centric Approach for Passive Testing of Communication Protocols

There is currently a high level of consciousness of the importance and impact of formally testing communicating networks. By applying formal description techniques and formal testing approaches, we are able to validate the conformance of implementations to the requirements of communication protocols. In this context, passive testing techniques are used whenever the system under test cannot be interrupted or access to its interfaces is unavailable. Under such conditions, communication traces are extracted from points of observation and compared to the expected behavior formally specified as properties. Since most works on the subject come from a formal model context, they are optimized for testing the control part of the communication with a secondary focus on the data parts. In the current work, we provide a data-centric approach for black-box testing of network protocols. A formalism is provided to express complex properties in a bottom-up fashion starting from expected data relations in messages. A novel algorithm is provided for evaluation of properties in protocol traces. Experimental results on Session Initiation Protocol (SIP) traces for IP Multimedia Subsystem (IMS) services are provided.

Bridging the gap between a behavioural formal description technique and a user interface description language: Enhancing ICO with a graphical user interface markup language

In the last years, User Interface Description Languages (UIDLs) appeared as a suitable solution for developing interactive systems. In order to implement reliable and efficient applications, we propose to employ a formal description technique called ICO (Interactive Cooperative Object) that has been developed to cope with complex behaviours of interactive systems including event-based and multimodal interactions. So far, ICO is able to describe most of the parts of an interactive system, from functional core concerns to fine grain interaction techniques, but, even if it addresses parts of the rendering, it still not has means to describe the effective rendering of such interactive system. This paper presents a solution to overcome this gap using markup languages. A first technique is based on the Java technology called JavaFX and a second technique is based on the emergent UsiXML language for describing user interface components for multi-target platforms. The proposed approach offers a bridge between markup language based descriptions of the user interface components and a robust technique for describing behaviour using ICO modelling. Furthermore, this paper highlights how it is possible to take advantage from both behavioural and markup language description techniques to propose a new model-based approach for prototyping interactive systems. The proposed approach is fully illustrated by a case study using an interactive application embedded into interactive aircraft cockpits.

The handbook of human-machine interaction: a human-centered design approach

Contents: Introduction: a human-centered design approach, Guy A. Boy Part I Analysis: Analysis, modeling and simulation of human operator's mental activities, Thierry Bellet Psychophysiology and performance: considerations for human-centered design, Anil K. Raj, Margery J. Doyle and Joshua D. Cameron Automation and situation awareness, Anke Popken and Josef F. Krems Human error, interaction and the development of safety-critical systems, Christopher Johnson Operating documents that change in real-time: dynamic documents and user performance support, Barbara K. Burian and Lynne Martin The authority issue in organizational automation, Guy A. Boy and Gudela Grote. Part II Design: Scenario-based design, John M. Carroll and Stephen R. Haynes Socio-cognitive issues in human-centred design for the real world, Saadi Lahlou Cognitive function analysis in the design of human and machine multi-agent systems, Guy A. Boy Authority and cooperation between humans and machines, Patrick Millot, Serge Debernard and FrA(c)dA(c)ric Vanderhaegen Formal description techniques for human-machine interfaces: model-based approaches for the design and evaluation of dependable usable interactive systems, David Navarre, Philippe Palanque, CA(c)lia Martinie, Marco A.A. Winkler and Sandra Steere Designing human-automation interaction, Amy Pritchett and Michael Feary Human-agent interaction, Jeffrey M. Bradshaw, Paul J. Feltovich and Matthew Johnson. Part III Evaluation: From usability to user experience with interactive systems, Jean-Marc Robert and Annemarie Lesage Designing and evaluating user experience, Jean-Marc Robert and Annmarie Lesage Eye tracking from a human factors perspective, Alexandre Lucas Stephane Operator fatigue: implications for human-machine interaction, Philippa Gander, Curt Graeber and Gregory Belenky Transversal perspectives on human-machine interaction: the effect of age in human-machine systems, Anabela dos Santos SimA es, Marta Pereira and Maria Panou Error on the flight deck: interfaces, organizations and culture, Don Harris and Wen-Chin Li The diminishing relevance of human-machine interaction, Erik Hollnagel Conclusion and perspectives: from automation to interaction design, Guy A. Boy Index.

Modelling the protocol stack in NCS with deterministic and stochastic petri net

Protocol stack is the basis of the networked control systems (NCS). Full or partial reconfiguration of protocol stack offers both optimised communication service and system performance. Nowadays, field testing is unrealistic to determine the performance of reconfigurable protocol stack; and the Petri net formal description technique offers the best combination of intuitive representation, tool support and analytical capabilities. Traditionally, separation between the different layers of the OSI model has been a common practice. Nevertheless, such a layered modelling analysis framework of protocol stack leads to the lack of global optimisation for protocol reconfiguration. In this article, we proposed a general modelling analysis framework for NCS based on the cross-layer concept, which is to establish an efficiency system scheduling model through abstracting the time constraint, the task interrelation, the processor and the bus sub-models from upper and lower layers (application, data link and physical layer). Cross-layer design can help to overcome the inadequacy of global optimisation based on information sharing between protocol layers. To illustrate the framework, we take controller area network (CAN) as a case study. The simulation results of deterministic and stochastic Petri-net (DSPN) model can help us adjust the message scheduling scheme and obtain better system performance.

The Design and Implementation of a Editor that Supports Syntax Highlighting of E-Lotos

Formal methods (FM) are mathematically based techniques that provide a rigorous basis for software development: the application of FMs makes it possible to achieve provable correctness and reliability in the various steps of system design and implementation. Generally, Formal methods need the support of formal description technique (FDT). Because the FDL has strict syntax and semantics. It is the realization of the abstract to the concrete, strictly, can be symbolic execution, unambiguous. E-LOTOS formal description is an important technology. This paper describes the design and the implement of the editor that support syntax highlighting of E-LOTOS. The editor is implemented using java Swing and JFlex.

Designing for resilience to hardware failures in interactive systems: A model and simulation-based approach

The paper proposes a formal description technique and a supporting tool that provide a means to handle both static and dynamic aspects of input and output device configurations and reconfigurations. More precisely, in addition to the notation, the paper proposes an architecture for the management of failure on input and output devices by means of reconfiguration of in/output device configuration and interaction techniques. Such reconfiguration aims at allowing operators to continue interacting with the interactive system even though part of the hardware side of the user interface is failing. These types of problems arise in domains such as command and control systems where the operator is confronted with several display units. The contribution presented in the paper thus addresses usability issues (improving the ways in which operators can reach their goals while interacting with the system) by increasing the reliability of the system using diverse configuration both for input and output devices.

Some notes on the history of protocol engineering

During the 1970s and 1980s, the first computer communication networks were designed and implemented in the research and commercial sectors. Many of the protocols developed during that time are still in use today. This paper starts by giving an overview of these developments. Then it concentrates on the development of protocol engineering, that is, the methods for the specification of communication protocols and services, the verification of protocols and their implementation and testing. After personal views of the developments in the 1970s, the basic concepts developed at that time are explained. The standardization of Formal Description Techniques in the 1980s is discussed in the following section, as well as the standardization of conformance testing. The purpose of the paper is to show the long way we have come and to suggest that many of the basic concepts have not changed too much during these years, although more detailed aspects have evolved and given rise to new technological developments.

Precise Descriptions of VLC Synchronization with CSP Semantic Models

Variable length codes (VLC) have found widespread applications due to their inherent coding efficiency. However, encoder-decoder synchronization becomes critically important for VLC to operate properly. Traditional treebased techniques lack the scalability to analyse the synchronization behaviours of VLC, and simulation techniques are typically used instead for large code sets. Building on an initial paper in which we first described an application of CSP to this domain, we present further advances in this paper. The contributions of this paper are twofold. First, we describe a novel application of the CSP stable failure model to completely describe the VLC synchronization mechanisms. Consequently, we concisely characterize bit patterns that can bring about rapid synchronization. The overall goal is to advance our understanding in this important area of research through an established formal description technique originally developed and used within the computing research community.

ICOs

The design of real-life complex systems calls for advanced software engineering models, methods, and tools in order to meet critical requirements such as reliability, dependability, safety, or resilience that will avoid putting the company, the mission, or even human life at stake. When such systems encompass a substantial interactive component, the same level of confidence is required towards the human-computer interface. Conventional empirical or semiformal techniques, although very fruitful, do not provide sufficient insight on the reliability of the human-system cooperation, and offer no easy way to, for example, quantitatively and qualitatively compare two design options with respect to that reliability. The aim of this article is to present a user interface description language (called ICOs) for the engineering and development of usable and reliable user interfaces. The CASE tool supporting the ICOs notation (called Petshop) is a Petri nets-based-tool for the design, specification, prototyping, and validation of interactive software. In that environment models (built with the formal description technique ICOs) of the interactive application can be interactively modified and executed. This is used to support prototyping phases (when the models and the interactive application evolve significantly to meet late user requirements, for instance) as well as the operation phase (after the system is deployed). The use of ICOs and PetShop is presented on several large-scale systems such as a multimodal ground segment application for satellite control, an air traffic control interactive application, and an application for new generation of interactive cockpits in large civil aircraft such as Airbus A380 or Boeing 787. The article emphasizes the demonstration of the expressive power of the notation and how it can support the description of various aspects of user interfaces, namely interaction techniques (both WIMP and post-WIMP), interactive components (such as widgets), and the behavioral part of interactive applications such as the dialog and the functional core. It also demonstrates that PetShop provides dedicated support for prototyping activities of behavioral aspects at the various levels of the architecture of interactive systems. While the focus is on past work done on various large-scale applications, the article also highlights why and how ICOs and Petshop are able to address challenges raised by next-generation user interfaces.

Formal Verification of Graph Grammars using Mathematical Induction

Graph grammars are a formal description technique suitable for the specification of distributed and reactive systems. Model-checking of graph grammars is currently supported by various approaches. However, in many situations the use of this technique can be very time and space consuming, hindering the verification of properties of many systems. This work proposes a relational and logical approach to graph grammars that allows formal verification of systems using mathematical induction. We use relational structures to define graph grammars and first-order logic to model graph transformations. This approach allows proving properties of systems with infinite state-spaces.

Designing distributed software with RT-CORBA and SDL

The use of formal description techniques (FDTs), and specifically SDL, has emerged as an interesting way of designing embedded real time distributed systems (ERTDSs) taking into account the increasing complexity of this kind of system. The communication platform for these ERTDSs should be included at the design stage in order to consider the behaviour of the communications. RT-CORBA is an interesting alternative as a middleware for real-time distributed applications because, unlike standard CORBA, it guarantees predictable temporal response to invocations to remote objects. We propose a set of design patterns in SDL for the RT-CORBA middleware so that users can integrate the communication behavior into their designs. This approach provides three important results: firstly, it is possible to carry out the simulation and validation of the whole system including communications; secondly, the implementation stage is simplified because the integration of RT-CORBA allows code to be generated from the design. Finally, different analysis techniques at design level for ERTDS including the temporal behavior of RT-CORBA middleware can be carried out. To apply our proposals we have integrated the design of RT-CORBA with the SDL specification of a distributed control application called Siroco.

On Formalizing and Normalizing Role-Based Access Control Systems

Role-based access control (RBAC) has emerged as the dominant access control paradigm for service-oriented systems, with this dominance being reflected by the popularity of RBAC both with the research community and with information technology vendors. RBAC's dominance was solidified in 2004 when an American National Standards Institute standard for RBAC was approved. In this paper, we consider some of the drawbacks of this standard and show how the formal description technique, Z, has been used to underpin a model of RBAC. The model builds on the work of Li et al. and adopts a modular approach. In particular, we consider the relationships between different types of inheritance within our model. We show our model can be used to define a notion of equivalence between different RBAC systems. Finally, we show how—via our model—a particular RBAC system can be normalized to produce a simpler—but semantically equivalent—representation. We illustrate this process via two examples.

Stochastic models for the in silico simulation of synaptic processes

BackgroundResearch in life sciences is benefiting from a large availability of formal description techniques and analysis methodologies. These allow both the phenomena investigated to be precisely modeled and virtual experiments to be performed in silico. Such experiments may result in easier, faster, and satisfying approximations of their in vitro/vivo counterparts. A promising approach is represented by the study of biological phenomena as a collection of interactive entities through process calculi equipped with stochastic semantics. These exploit formal grounds developed in the theory of concurrency in computer science, account for the not continuous, nor discrete, nature of many phenomena, enjoy nice compositional properties and allow for simulations that have been demonstrated to be coherent with data in literature.ResultsMotivated by the need to address some aspects of the functioning of neural synapses, we have developed one such model for synaptic processes in the calyx of Held, which is a glutamatergic synapse in the auditory pathway of the mammalia. We have developed such a stochastic model starting from existing kinetic models based on ODEs of some sub-components of the synapse, integrating other data from literature and making some assumptions about non-fully understood processes. Experiments have confirmed the coherence of our model with known biological data, also validating the assumptions made. Our model overcomes some limitations of the kinetic ones and, to our knowledge, represents the first model of synaptic processes based on process calculi. The compositionality of the approach has permitted us to independently focus on tuning the models of the pre- and post- synaptic traits, and then to naturally connect them, by dealing with “interface” issues. Furthermore, we have improved the expressiveness of the model, e.g. by embedding easy control of element concentration time courses. Sensitivity analysis over several parameters of the model has provided results that may help clarify the dynamics of synaptic transmission, while experiments with the model of the complete synapse seem worth explaining short-term plasticity mechanisms.ConclusionsSpecific presynaptic and postsynaptic mechanisms can be further analysed under various conditions, for instance by studying the presynaptic behaviour under repeated activations. The level of details of the description can be refined, for instance by further specifying the neurotransmitter generation and release steps. Taking advantage of the compositionality of the approach, an enhanced model could then be composed with other neural models, designed within the same framework, in order to obtain a more detailed and comprehensive model. In the long term, we are interested, in particular, in addressing models of synaptic plasticity, i.e. activity dependent mechanisms, which are the bases of memory and learning processes.More on the computer science side, we plan to follow some directions to improve the underlying computational model and the linguistic primitives it provides as suggested by the experiments carried out, e.g. by introducing a suitable notion of (spatial) locality.

Formal Specification and Verification of Real-Time Systems using Graph Grammars

Abstract The importance of real-time systems has enormously increased in the last decade. Application areas that typically need real-time models include railroad systems, intelligent vehicle highway systems, avionics, multimedia and telephony. To assure that such systems are correct, additionally to prove that they provide the required functionality, time constraints must be satisfied. There are already formal specification methods for real-time systems, but most of them are difficult to use by software developers, that are usually not very familiar with mathematical notation but rather specify systems using the objectoriented paradigm. In this paper we propose a formal approach to specify and analyze real-time systems that has an object-oriented flavor. This approach is based on Object-Based Graph Grammars (OBGGs), a formal description technique suitable for the specification of asynchronous distributed systems, and intuitive even for nontheoreticians. We extend OBGGs to enable explicit modeling of time constraints, and define the semantics of the specifications via transition systems. Finally, we translate timed OBGGs to Timed Automata, a formal notation that is wide spread in the area of real-time systems modeling and allows the automatic verification of properties.

Using LOTOS for FormalisingWireless Sensor Network Applications

The number of wireless sensor network (WSN) applications is rapidly increasingand becoming an integral part of sensor nodes. These applications have been widely devel-oped on TinyOS operating system using the nesC programming language. However, due tothe tight integration to physical world, limited node power and resources (CPU and memory)and complexity of combining components into an application, to build such applications isnot a trivial task. In this context, we present an approach for treating with this complexityadopting a formal description technique, namely LOTOS, for formalising the WSN applica-tions‘ behaviour. The formalisation has three main benefits: better understanding on how theapplication actually works, checking of desired properties of the application‘s behaviour, andsimulation facilities. In order to illustrate the proposed approach, we apply it to two nesCtraditional applications, namely BLink and Sense.

Study of the characteristics of CT-Equivalence with proves

Semantic between process specifications is essential for various phases of the development of computer/telecommunications protocols as well as other systems. This includes the verifications of the refined communicating entities and their underlying service provider against their service specifications. It includes also checking the of competing designs while developing the National or International Standards. Also, it is needed in transforming a specification given in the algebraic International Standardization Organization (ISO) Formal Description Technique (FDT) Lotos into an equivalent version given in the ISO FDT Estelle or the FDT SDL (Specification and Description Language) developed by the Telecommunications Standardization Section of the International Telecommunications Union (TSS/ITU). Nevertheless, often in conformance testing/certification testing of the final products this is needed to facilitate the derivation of testing sequences. In the literature, there are many notions for that aim at ratifying the problem of equivalence. In this paper, we study the characteristics of Conformance Testing (CT) Equivalence. We prove that CT Equivalence ratifies significant problems with the other notions of semantic equivalence in the literature. We prove that CT Equivalence is a congruent and develop an application of it in verification.

Petri-nets for formal verification of MAC protocols

Full or partial reconfiguration of communications devices offers both optimised performance for niche scenario-specific deployments and support for de-regulated radio spectrum management. The correctness of the protocols or protocol-enhancements being deployed in such a dynamic and autonomous manner cannot easily be determined through traditional testing techniques. Formal description techniques are a key verification technique for protocols. The Petri-net formal description technique offers the best combination of intuitive representation, tool-support and analytical capabilities. Having described key features and analytical approaches of Reference-nets (an extended Petri-net formalism), a case study is presented applying this approach to a contemporary research area: IEEE 802.11 centralised control mechanisms to support delay-sensitive streams and bursty data traffic. This case study showcases the ability both to generate performance-oriented simulation results and to determine more formal correctness properties. The simulation results allow comparison with published results and show that a packet-expiration mechanism places greater demands on the contention-free resource allocation, while the mathematical analysis of the model reveals it to be free of deadlock and k-bounded with respect to resources. The work demonstrates the potential that the Petri-net formal method has for analysing process and protocol models to support reconfigurable devices.

Formal socio-technical barrier modelling for safety-critical interactive systems design

This paper presents a three step approach to improve safety in the field of interactive systems. The approach combines, within a single framework, previous work in the field of barrier analysis and modelling, with model based design of interactive systems. The approach first uses the Safety Modelling Language to specify safety barriers which could achieve risk reduction if implemented. The detailed mechanism by which these barriers behave is designed in the subsequent stage, using a Petri nets-based formal description technique called Interactive Cooperative Objects. One of the main characteristics of interactive systems is the fact that the user is deeply involved in the operation of such systems. This paper addresses this issue of user behaviour by modelling tasks and activities using the same notation as for the system side (both barriers and interactive system). The use of a formal modelling technique for the description of these three components makes it possible to compare, analyse and integrate them. The approach and the integration are presented on a mining case study. Two safety barriers are modelled as well as the relevant parts of the interactive system behaviour. Operators’ tasks are also modelled. The paper then shows how the integration of barriers within the system model can prevent previously identified hazardous sequences of events from occurring, thus increasing the entire system safety.