Specification Of Reactive Systems Research Articles

Automata-based Software Engineering for Control System Design and Verification

The automata composition is defined as the basic language construct of automata programming. Incorporating automata composition into an arbitrary programming language allows the development of automata programs in that language. Methods for specification and verification of reactive systems are defined in detail. All kinds of correctness formulas for a reactive system with respect to its specification are defined. In addition, correctness formulas for verification using the full invariant of the reactive system are developed. The Event-B manual begins with a brilliant illustration of the basic Event-B methods using the example of a car traffic control problem on a narrow bridge. However, the latter refinement in this illustration generates a complex cumbersome program. A simpler and shorter solution to this problem was presented in our work [7] using automata programming approach. Our solution was not easy because 4 non-trivial bugs were found by verification in Event-B. This paper describes our third attempt to construct a short simple automata program to solve this problem. Verification of the automata program in Event-B and Why3 systems was carried out. No errors were found. For verification, a reactive system model is built on Why3, which is simpler and more universal than the why3-do model.

A Characterization on Necessary Conditions of Realizability for Reactive System Specifications

A Characterization on Necessary Conditions of Realizability for Reactive System Specifications

Verified Lustre Normalization with Node Subsampling

Dataflow languages allow the specification of reactive systems by mutually recursive stream equations, functions, and boolean activation conditions called clocks. Lustre and Scade are dataflow languages for programming embedded systems. Dataflow programs are compiled by a succession of passes. This article focuses on the normalization pass which rewrites programs into the simpler form required for code generation. Vélus is a compiler from a normalized form of Lustre to CompCert’s Clight language. Its specification in the Coq interactive theorem prover includes an end-to-end correctness proof that the values prescribed by the dataflow semantics of source programs are produced by executions of generated assembly code. We describe how to extend Vélus with a normalization pass and to allow subsampled node inputs and outputs. We propose semantic definitions for the unrestricted language, divide normalization into three steps to facilitate proofs, adapt the clock type system to handle richer node definitions, and extend the end-to-end correctness theorem to incorporate the new features. The proofs require reasoning about the relation between static clock annotations and the presence and absence of values in the dynamic semantics. The generalization of node inputs requires adding a compiler pass to ensure the initialization of variables passed in function calls.

Efficient Realizability Checking by Modularization of LTL Specifications

AbstractRealizability is an important requirement for reactive system specifications. A reactive system interacts with an environment and responds to input events. Realizability ensures the reactive system behaves as specified, no matter how its environment provides input. Typically, reactive system specifications are given using linear temporal logic (LTL), and they can be tested to ascertain whether the specification is realizable. However, the LTL specification realizability problem is 2EXPTIME-complete, which hinders its application to large-scale systems. In this article, we present a modularization method to mitigate this computational challenge.

On the Model Checking Problem for Some Extension of CTL*

Sequential reactive systems include programs and devices that work with two streams of data and convert input streams of data into output streams. Such information processing systems include controllers, device drivers, computer interpreters. The result of the operation of such computing systems are infinite sequences of pairs of events of the request-response type, and, therefore, finite transducers are most often used as formal models for them. The behavior of transducers is represented by binary relations on infinite sequences, and so, traditional applied temporal logics (like HML, LTL, CTL, mu-calculus) are poorly suited as specification languages, since omega-languages, not binary relations on omega-words are used for interpretation of their formulae. To provide temporal logics with the ability to define properties of transformations that characterize the behavior ofreactive systems, we introduced new extensions ofthese logics, which have two distinctive features: 1) temporal operators are parameterized, and languages in the input alphabet oftransducers are used as parameters; 2) languages in the output alphabet oftransducers are used as basic predicates. Previously, we studied the expressive power ofnew extensions Reg-LTL and Reg-CTL ofthe well-known temporal logics oflinear and branching time LTL and CTL, in which it was allowed to use only regular languages for parameterization of temporal operators and basic predicates. We discovered that such a parameterization increases the expressive capabilities oftemporal logic, but preserves the decidability of the model checking problem. For the logics mentioned above, we have developed algorithms for the verification of finite transducers. At the next stage of our research on the new extensions of temporal logic designed for the specification and verification of sequential reactive systems, we studied the verification problem for these systems using the temporal logic Reg-CTL*, which is an extension ofthe Generalized Computational Tree Logics CTL*. In this paper we present an algorithm for checking the satisfiability of Reg-CTL* formulae on models of finite state transducers and show that this problem belongs to the complexity class ExpSpace.

The Challenges in Specifying and Explaining Synthesized Implementations of Reactive Systems

In formal synthesis of reactive systems an implementation of a system is automatically constructed from its formal specification. The great advantage of synthesis is that the resulting implementation is correct by construction; therefore there is no need for manual programming and tedious debugging tasks. Developers remain, nevertheless, hesitant to using automatic synthesis tools and still favor manually writing code. A common argument against synthesis is that the resulting implementation does not always give a clear picture on what decisions were made during the synthesis process. The outcome of synthesis tools is mostly unreadable and hinders the developer from understanding the functionality of the resulting implementation. Many attempts have been made in the last years to make the synthesis process more transparent to users. Either by structuring the outcome of synthesis tools or by providing additional automated support to help users with the specification process. In this paper we discuss the challenges in writing specifications for reactive systems and give a survey on what tools have been developed to guide users in specifying reactive systems and understanding the outcome of synthesis tools.

Behavioural and abstractor specifications revisited

In the area of algebraic specification there are two main approaches for defining observational abstraction: behavioural specifications use a notion of observational satisfaction for the axioms of a specification, whereas abstractor specifications define an abstraction from the standard semantics of a specification w.r.t. an observational equivalence relation between algebras. Earlier work by Bidoit, Hennicker, Wirsing has shown that in the case of first-order logic specifications both concepts coincide semantically under mild assumptions. Analogous results have been shown by Sannella and Hofmann for higher-order logic specifications and recently, by Hennicker and Madeira, for specifications of reactive systems using a dynamic logic with binders. In this paper, we bring these results into a common setting: we isolate a small set of characteristic principles to express the behaviour/abstractor equivalence and show that all three mentioned specification frameworks satisfy these principles and therefore their behaviour and abstractor specifications coincide semantically (under mild assumptions). As a new case we consider observational modal logic where observational satisfaction of Hennessy–Milner logic formulae is defined “up to” silent transitions and observational abstraction is defined by weak bisimulation. We show that in this case the behaviour/abstractor equivalence can only be obtained, if we restrict models to weakly deterministic labelled transition systems.

Efficient CTL Verification via Horn Constraints Solving

The use of temporal logics has long been recognised as a fundamental approach to the formal specification and verification of reactive systems. In this paper, we take on the problem of automatically verifying a temporal property, given by a CTL formula, for a given (possibly infinite-state) program. We propose a method based on encoding the problem as a set of Horn constraints. The method takes a program, modeled as a transition system, and a property given by a CTL formula as input. It first generates a set of forall-exists quantified Horn constraints and well-foundedness constraints by exploiting the syntactic structure of the CTL formula. Then, the generated set of constraints are solved by applying an off-the-shelf Horn constraints solving engine. The program is said to satisfy the property if and only if the generated set of constraints has a solution. We demonstrate the practical promises of the method by applying it on a set of challenging examples. Although our method is based on a generic Horn constraint solving engine, it is able to outperform state-of-art methods specialised for CTL verification.

An approach to modeling and developing teleo-reactive systems considering timing constraints

ContextTeleoR is an extension and implementation of teleo-reactive (TR) language for defining the behavior of reactive systems when the consideration of timing constraints is a matter of interest. ObjectiveThis paper analyzes how to consider real-time constraints when a TR approach is followed from modeling to implementation. MethodAfter carrying out a study of the type of timing constraints from the TR perspective, the possibility of using TeleoR for incorporating such constraints was considered. Some extensions on TRiStar notation were then made to represent temporal requirements. A drone-based case study was carried out to demonstrate the usefulness of this approach. Finally, a survey was conducted to validate the approach. ResultsTeleoR can, to a great extent, support the kind of real-time constraints required for developing real-time systems, offering a direct solution to five of the eight temporal requirements identified, which can be implemented using the basic features of the language. ConclusionsConsidering real-time requirements should be part of the specification of reactive systems implemented when using the TR approach and should be supported by the implementation platform. In this regard, TeleoR offers reasonable possibilities that should be extended by taking into account the limitations identified here.

IDF: A framework for the incremental development and conformance verification of UML active primitive components

Modelling component behaviour is widely recognised as a complex task during the specification and design phases of reactive systems. Our proposal for treating this problem involves an incremental approach that allows UML state machines to be built using a composition of two types of development: model extension for adding services or behaviours, and refinement for adding details or eliminating non-determinism. At each step of the development process, the current model is verified for compliance with the model obtained during the previous step, in such a way that initial liveness properties are preserved. The novelty of this work lies in the possibility to combine and sequence both refinement and extension developments. This iterative process is usually not taken into account in conventional refinement relations. This set of development techniques and verification means are assembled into a framework called IDF (Incremental Development Framework), which is supported by a tool, under the acronym IDCM (Incremental Development of Compliant Models), developed herein in addition to the Topcased UML tool.

A Symbolic Model for Timed Concurrent Constraint Programming

Concurrent Constraint Programming (ccp) is a model for concurrency where agents interact with each other by telling and asking constraints (i.e., formulas in logic) into a shared store of partial information. The ntcc calculus extends ccp with the notion of discrete time-units for the specification of reactive systems. Moreover, ntcc features constructors for non-deterministic choices and asynchronous behavior, thus allowing for (1) synchronization of processes via constraint entailment during a time-unit and (2) synchronization of processes along time-intervals. In this paper we develop the techniques needed for the automatic verification of ntcc programs based on symbolic model checking. We show that the internal transition relation, modeling the behavior of processes during a time-unit (1 above), can be symbolically represented by formulas in a suitable fragment of linear time temporal logic. Moreover, by using standard techniques as difference decision diagrams, we provide a compact representation of these constraints. Then, relying on a fixpoint characterization of the timed constructs, we obtain a symbolic model of the observable transition (2 above). We prove that our construction is correct with respect to the operational semantics. Finally, we introduce a prototypical tool implementing our method.

Relentful strategic reasoning in alternating-time temporal logic

Temporal logics are a well investigated formalism for the specification, verification, and synthesis of reactive systems. Within this family, alternating temporal logic, ATL*, has been introduced as a useful generalization of classical linear- and branching-time temporal logics by allowing temporal operators to be indexed by coalitions of agents. Classically, temporal logics are memoryless: once a path in the computation tree is quantified at a given node, the computation that has led to that node is forgotten. Recently, mCTL* has been defined as a memoryful variant of CTL*, where path quantification is memoryful. In the context of multi-agent planning, memoryful quantification enables agents to relent and change their goals and strategies depending on their past history. In this paper, we define mATL*, a memoryful extension of ATL*, in which a formula is satisfied at a certain node of a path by taking into account both the future and the past. We study the expressive power of mATL*, its succinctness, as well as related decision problems. We also investigate the relationship between memoryful quantification and past modalities and show their equivalence. We show that both the memoryful and the past extensions come without any computational price; indeed, we prove that both the satisfiability and the model-checking problems are 2EXPTIME-COMPLETE, as they are for ATL*.

Bounded Strong Satisfiability Checking of Reactive System Specifications

Bounded Strong Satisfiability Checking of Reactive System Specifications

Formal Verification Strategy for Statechart based Design of Reconfigurable Control of High Integrity Reactive Systems

Automated high integrity reactive systems required in the control of defence, automotive, rapid mass transport, manufacturing and healthcare systems, among many others, accentuate the need for formal specification and design tools. Reconfigurability by design is an added requirement given the costly development processes. Many of these systems are hybrids of discrete event and continuous-time subsystems. Statecharts (implemented as stateflow in Matlab) are increasingly being proposed as the language of choice for the discrete-event part. However, the complex semantics of statecharts make automated formal verification difficult and hence largely an unresolved problem. Formal verification, in preference to simulation/testing, is necessary to specify these systems at the required level of integrity and to maintain traceability along the different phases of design and operation. Drawing from a number of different approaches by others to develop formal semantics at requirement and implementation levels, a first attempt was made by the author to develop a modular formal verification strategy applicable to statechart based controller specifications for complex reactive systems and an early version of the original approach, which was completely based on regular languages (hence, finite state automata) and different compositions thereof, was published in 2005.The key idea was the implementation of these composition operations through suitably interpreted port structures between pairs of automata resulting from a decomposition of the statechart. Application development based on this model has been done with collaborators on an elevator test rig built for the purpose and still continuing. While many of the under lying concepts are still valid and there is much to be learnt from their practical implementation and extension, there are fundamental limitations in this model stemming from the rather basic computational and expressive power of regular languages. In the current paper the author attempts to extend the method to context­ free language based models (hence, pushdown automata, PDA) to include real-time semantics for internal (fast) events and general correctness properties expressed in temporal logic, posed as supervisory specifications of Ramage-Wonham type interpreted on the port structures between pairs of PDA whenever possible. It is shown that decidability problems limit this choice to restricted forms of context-free languages, and the development is done with Event-dock Visibly Pushdown Automata (ECVPA), which are dosed under Boolean operations and determinisable. The ECVPA based verification model is presented with high-speed railway signalling as a target environment.

Complexity of Strong Satisfiability Problems for Reactive System Specifications

Complexity of Strong Satisfiability Problems for Reactive System Specifications

Synthesizing Robust Systems with RATSY

Specifications for reactive systems often consist of environment assumptions and system guarantees. An implementation should not only be correct, but also robust in the sense that it behaves reasonably even when the assumptions are (temporarily) violated. We present an extension of the requirements analysis and synthesis tool RATSY that is able to synthesize robust systems from GR(1) specifications, i.e., system in which a finite number of safety assumption violations is guaranteed to induce only a finite number of safety guarantee violations. We show how the specification can be turned into a two-pair Streett game, and how a winning strategy corresponding to a correct and robust implementation can be computed. Finally, we provide some experimental results.

Defining Fairness in Reactive and Concurrent Systems

We define when a linear-time temporal property is a fairness property with respect to a given system. This captures the essence shared by most fairness assumptions that are used in the specification and verification of reactive and concurrent systems, such as weak fairness, strong fairness, k -fairness, and many others. We provide three characterizations of fairness: a language-theoretic, a game-theoretic, and a topological characterization. It turns out that the fairness properties are the sets that are “large” from a topological point of view, that is, they are the co-meager sets in the natural topology of runs of a given system. This insight provides a link to probability theory where a set is “large” when it has measure 1. While these two notions of largeness are similar, they do not coincide in general. However, we show that they coincide for ω -regular properties and bounded Borel measures. That is, an ω -regular temporal property of a finite-state system has measure 1 under a bounded Borel measure if and only if it is a fairness property with respect to that system. The definition of fairness leads to a generic relaxation of correctness of a system in linear-time semantics. We define a system to be fairly correct if there exists a fairness assumption under which it satisfies its specification. Equivalently, a system is fairly correct if the set of runs satisfying the specification is topologically large. We motivate this notion of correctness and show how it can be verified in a system.

Value-passing CCS with noisy channels

Value-passing CCS, a full version of Milner’s CCS, is a process algebra in which actions consist of sending and receiving values through noiseless communication channels. The full calculus is a succinct yet expressive language for the specification and verification of reactive systems. Taking into account the reality of channel noise in reactive systems, in this paper we introduce an extension of value-passing CCS, called value-passing CCS with noisy channels (VCCSN), in which noise is described by a probability distribution over the values. After presenting the reduction operational semantics and labelled operational semantics of VCCSN, we develop the theory of behavioural equivalence by introducing barbed equivalence, barbed congruence, bisimilarity, and full bisimilarity. In particular, we show that barbed equivalence and barbed congruence coincide with bisimilarity and full bisimilarity, respectively. Based upon the labelled operational semantics of VCCSN, we establish a probabilistic modal logic for expressing system properties and show its connection with the notion of bisimilarity. Finally, we use VCCSN to model a communication protocol for ensuring the reliable transmission of data across an error-prone channel.

Behavioral specification of reactive systems using stream-based I/O tables

A core problem in formal methods is the transition from informal requirements to formal specifications. Especially when specifying the behavior of reactive systems, many formalisms require the user to either understand a complex mathematical theory and notation or to derive details not given in the requirements, such as the state space of the problem. For many approaches also a consistent set of requirements is needed, which enforces to resolve requirements conflicts prior to formalization. This paper describes a specification technique, where not states but signal patterns are the main elements. The notation is based on tables of regular expressions and supports a piece-wise formalization of potentially inconsistent requirements. Many properties, such as input completeness and consistency, can be checked automatically for these specifications. The detection and resolution of conflicts can be performed within our framework after formalization. Besides the formal foundation of our approach, this paper presents prototypical tool support and results from an industrial case study.

Dynamic Slicing Research of UML Statechart Specifications

This paper extends the well-known technique of dynamic slicing to Statechart specifications of reactive systems. Statechart language extends state machines along hierarchy, concurrency and communication – resulting in a compact visual notation that allows engineers to structure and modularize system descriptions. Dynamic slicing is well known in the domain of sequential transformational programs and has been found to be useful in understanding, analysis and verification. The classical definition of dynamic slicing is unsuitable for Statechart specifications. In this paper, we firstly formally define a formal semantics model -- observable semantics, which is very suitable for dynamic slicing, because that it only describes outside observable behavior and conceals unobservable behavior of Statechart specifications, and it fully captures the run-time dependence relation among the state transitions in the Statechart specification. Then we propose a new notion of dynamic slicing that, in our opinion, is more natural for Statechart specifications. We formally define notions of dynamic slicing criterion, dynamic slice and minimal dynamic slice, and we also explain how to produce valid dynamic slicing criterion and propose a simple and practical approximation algorithm for minimal dynamic slice generation using observable semantics as an intermediate representation.