State-based Specifications Research Articles

A formal specification framework for smart grid components

PurposeSmart grid can be considered as the next step in the evolution of power systems. It comprises of different entities and objects ranging from smart appliances, smart meters, generators, smart storages, and more. One key problem in modeling smart grid is that while currently there has previously been a considerable focus on the proof of concept aspect of smart grid, there have been very few modeling attempts and even lesser attempts at formalization. To the best of our knowledge, formal specification has not been applied previously in the domain of smart grid.MethodsUsing a state-based formal specification language namely Z (pronounced as ‘Zed’), we present a novel approach to formally modeling and specify smart grid components.ResultsThe modeling exercise clearly demonstrates that Z is particularly suited for modeling various smart grid components.ConclusionsThe presented formal specification can be considered as a first step towards the modeling of smart grid using a Software Engineering formalism. It also demonstrates how formal specification can be used to model complex systems in general, and the smart grid, in particular.

Developing a Hybrid Intrusion Detection System Using Data Mining for Power Systems

Synchrophasor systems provide an immense volume of data for wide area monitoring and control of power systems to meet the increasing demand of reliable energy. The construction of traditional intrusion detection systems (IDSs) that use manually created rules based upon expert knowledge is knowledge-intensive and is not suitable in the context of this big data problem. This paper presents a systematic and automated approach to build a hybrid IDS that learns temporal state-based specifications for power system scenarios including disturbances, normal control operations, and cyber-attacks. A data mining technique called common path mining is used to automatically and accurately learn patterns for scenarios from a fusion of synchrophasor measurement data, and power system audit logs. As a proof of concept, an IDS prototype was implemented and validated. The IDS prototype accurately classifies disturbances, normal control operations, and cyber-attacks for the distance protection scheme for a two-line three-bus power transmission system.

Designing of Testing Framework through Finite State Automata for Object-Oriented Systems using UML

Many researches to testing object-oriented systems (OOSs) have been proposed for the past decade. After all, almost all large OO software specifications still contain incompleteness, inconsistency, and ambiguity. The framework can be defined using any state-based specification notation and used to derive test cases from state-based specifications in this paper, it is demonstrated using the RSML notation. A state transition diagram (STD) derived from RSML specification provides a complete behavior of a given OOS. System testing is concerned with testing an entire system based on its specifications. In the context of object-oriented, UML development, this means that system test requirements are derived from UML analysis artifacts such as use cases, their corresponding sequence and collaboration diagrams, class diagrams. The goal is here to support the derivation of functional system test requirements, which will be transformed into test cases once we have detailed design information. In this paper, we describe a methodology in a practical way and illustrate it with an example. In this paper a framework that formally defines test data sets and their relation to the operations in a specification and to other test data sets, providing structure to the testing process.

Analyzing Critical Decision-Based Processes

Decision-based processes are composed of tasks whose application may depend on explicit decisions relying on the state of the process environment. In specific domains such as healthcare, decision-based processes are often complex and critical in terms of timing and resources. The paper presents a variety of tool-supported techniques for analyzing models of such processes. The analyses allow a variety of errors to be detected early and incrementally on partial models, notably: inadequate decisions resulting from inaccurate or outdated information about the environment state; incomplete decisions; non-deterministic task selections; unreachable tasks along process paths; and violations of non-functional process requirements involving time, resources or costs. The proposed techniques are based on different instantiations of the same generic algorithm that propagates decorations iteratively through the process model. This algorithm in particular allows event-based models to be automatically decorated with state-based invariants. A formal language supporting both event-based and state-based specifications is introduced as a process modeling language to enable such analyses. This language mimics the informal flowcharts commonly used by process stakeholders. It extends High-Level Message Sequence Charts with guards on task-related and environment-related variables. The language provides constructs for specifying task compositions, task refinements, decision trees, multi-agent communication scenarios, and time and resource constraints. The proposed techniques are demonstrated on the incremental building and analysis of a complex model of a real protocol for cancer therapy.

COMPARING AND IMPROVING THE SYNTHESIS OF STATE-BASED SPECIFICATIONS FROM SCENARIO-BASED SPECIFICATIONS

The scenario-based specifications are popularly used to capture user requirements. The state-based specifications are very appropriate to capture system design. Recently, there has been increased research interest in connecting these two kinds of specifications, called synthesis. Synthesis is a way to automatically construct the state-based specifications from the scenario-based specifications. There are two kinds of synthesis methods: global synthesis and local synthesis. Global synthesis means constructing a state-based specification for the whole system from the scenario-based specifications, while local synthesis means constructing a state-based specification for each object in the system. The two different synthesis methods have different uses and need to be systematically compared. The contributions of this paper are twofold. Firstly, we propose an improved method supporting the global and the local synthesis of state machines (a kind of state-based specifications) by using a novel algorithm for state machine execution and an algorithm similar to operator priority analysis method, which can fully automate the process of synthesis. Our synthesis method also satisfies two important properties: completeness and soundness. Secondly, to the best of our knowledge, our work does the first attempt to systematically compare global synthesis with local synthesis, and shows some insightful results of the experimental comparison between the two kinds of synthesis methods, which are valuable for the practitioners to choose an appropriate synthesis method for the analysis and verification of the system.

Using genetic algorithms to generate test sequences for complex timed systems

The generation of test data for state-based specifications is a computationally expensive process. This problem is magnified if we consider that time constraints have to be taken into account to govern the transitions of the studied system. The main goal of this paper is to introduce a complete methodology, supported by tools, that addresses this issue by representing the test data generation problem as an optimization problem. We use heuristics to generate test cases. In order to assess the suitability of our approach we consider two different case studies: a communication protocol and the scientific application BIPS3D. We give details concerning how the test case generation problem can be presented as a search problem and automated. Genetic algorithms (GAs) and random search are used to generate test data and evaluate the approach. GAs outperform random search and seem to scale well as the problem size increases. It is worth to mention that we use a very simple fitness function that can be easily adapted to be used with other evolutionary search techniques.

Aspect-Oriented Modeling and Verification with Finite State Machines

Aspect-oriented programming modularizes crosscutting concerns into aspects with the advice invoked at the specified points of program execution. Aspects can be used in a harmful way that invalidates desired properties and even destroys the conceptual integrity of programs. To assure the quality of an aspect-oriented system, rigorous analysis and design of aspects are highly desirable. In this paper, we present an approach to aspect-oriented modeling and verification with finite state machines. Our approach provides explicit notations (e.g., pointcut, advice and aspect) for capturing crosscutting concerns and incremental modification requirements with respect to class state models. For verification purposes, we compose the aspect models and class models in an aspect-oriented model through a weaving mechanism. Then we transform the woven models and the class models not affected by the aspects into FSP (Finite State Processes), which are to be checked by the LTSA (Labeled Transition System Analyzer) model checker against the desired system properties. We have applied our approach to the modeling and verification of three aspect-oriented systems. To further evaluate the effectiveness of verification, we created a large number of flawed aspect models and verified them against the system requirements. The results how that the verification has revealed all flawed models. This indicates that our approach is effective in quality assurance of aspect-oriented state models. As such, our approach can be used for model-checking state-based specification of aspect-oriented design and can uncover some system design problems before the system is implemented.

Using communication coverage criteria and partial model generation to assist software integration testing

This paper considers the problem of integration testing the components of a timed distributed software system. We assume that communication between the components is specified using timed interface automata and use computational tree logic (CTL) to define communication-based coverage criteria that refer to send- and receive-statements and communication paths. The proposed method enables testers to focus during component integration on such parts of the specification, e.g. behaviour specifications or Markovian usage models, that are involved in the communication between components to be integrated. A more specific application area of this approach is the integration of test-models, e.g. a transmission gear can be tested based on separated models for the driver behaviour, the engine condition, and the mechanical and hydraulical transmission states. Given such a state-based specification of a distributed system and a concrete coverage goal, a model checker is used in order to determine the coverage or generate test sequences that achieve the goal. Given the generated test sequences we derive a partial test-model of the components from which the test sequences were derived. The partial model can be used to drive further testing and can also be used as the basis for producing additional partial models in incremental integration testing. While the process of deriving the test sequences could suffer from a combinatorial explosion, the effort required to generate the partial model is polynomial in the number of test sequences and their length. Thus, where it is not feasible to produce test sequences that achieve a given type of coverage it is still possible to produce a partial model on the basis of test sequences generated to achieve some other criterion. As a result, the process of generating a partial model has the potential to scale to large industrial software systems. While a particular model checker, UPPAAL, was used, it should be relatively straightforward to adapt the approach for use with other CTL based model checkers. A potential additional benefit of the approach is that it provides a visual description of the state-based testing of distributed systems, which may be beneficial in other contexts such as education and comprehension.

Using Model Checking to Automatically Find Retrieve Relations

Downward and upward simulations form a sound and jointly complete methodology for verifying relational data refinement in state-based specification languages such as Z and B. In previous work, we showed how both downward and upward simulation conditions can be discharged using a CTL model checker. The approach was implemented in the SAL tool suite. Given the retrieve relation, each of the simulation conditions can be proven fully automatically. It has been recognised, however, that finding retrieve relations is often very hard. In this paper, we show how it is feasible to use the SAL model checkers to also generate retrieve relations.

Integrating Temporal Logic as a State-Based Specification Language for Discrete-Event Control Design in Finite Automata

This paper presents and analyzes a correct and complete translation algorithm that converts a class of propositional linear-time temporal-logic (PTL) formulae to deterministic finite (-trace) automata. The translation algorithm is proposed as a specification interface for finitary control design of discrete-event systems (DESs). While there has been a lot of computer science research that connects PTL formulae to omega-automata, there is relatively little prior work that translates state-based PTL formulae in the context of a finite-state DES model, to event-based finite automata-the formalism on which well-established control synthesis methods exist. The proposed translation allows control requirements to be more easily described and understood in temporal logic, widely recognized as a useful specification language for its intuitively appealing operators that provide the natural-language expressiveness and readability needed to express and explain these requirements. Adding such a translation interface could therefore effectively combine specifiability and readability in temporal logic with prescriptiveness and computability in finite automata. The former temporal-logic features support specification while the latter automata features support the prescription of DES dynamics and algorithmic computations. A practical implementation of the interface has been developed, providing an enabling technology for writing readable control specifications in PTL that it translates for discrete-event control synthesis in deterministic finite automata. Two application examples illustrate the use of the proposed temporal-logic interface. Practical implications of the complexity of the translation algorithm are discussed.

Achieving communication coverage in testing

This paper considers the problem of testing the communication between components of a timed distributed software system. We assume that communication is specified using timed interface automata and use computational tree logic (CTL) to define coverage criteria that refer to send- and receive-statements and communication paths. Given such a state-based specification of a distributed system and a concrete coverage goal, a model checker is used in order to determine the coverage provided by a finite set of test-cases, expressed using sequence diagrams. If parts of the specification remain uncovered then a goal is derived so that the model checker can be used to generate test cases that increase the coverage provided by the test suite. A major benefit of the presented approach is the generation of a potentially minimal set of test cases with the confidence that every interaction between components is executed during testing. A potential additional benefit of this approach is that it provides a visual description of the state based testing of distributed systems, which may be beneficial in other contexts such as education and program comprehension. The complexity of our approach strongly depends on the input model, the testing goal, and the model checking algorithm, which is implemented in the used tool. While a particular model checker, UPPAAL, was used, it should be relatively straightforward to adapt the approach for use with other CTL based model checkers.

L. M. G. FEIJS AND H. B. M. JONKERS Formal Specification and Design. Cambridge University Press (2005). ISBN-13: 9780521435925 ISBN-10: 0521435927. 29.00/$50.00351. Softbound.

The necessity of enhancing software quality by means of formal approaches to software development is being increasingly widely recognized. Both traditionally and in current research, algebraic specification plays an important role in this context. Formal Specification and Design, originally published in 1992 and recently re-issued as paperback, gives a textbook level introduction to algebraic and state-based formal software development, using the wide-spectrum language COLD-K (common object-oriented language for design). At the same time, the book serves as a COLD-K user manual that complements more formal language descriptions. The book is divided into three parts, concerned with algebraic specification, state-based specification, and selected advanced topics, respectively. The algebraic part of COLD-K is based essentially on a partial first-order logic, extended with mechanisms for inductive definitions and notably with non-deterministic operators. The state-based aspects of COLD-K follow the states-as-algebras paradigm, which is combined with a version of dynamic logic featuring a...

Verifying data refinements using a model checker

Abstract In this paper, we consider how refinements between state-based specifications (e.g., written in Z) can be checked by use of a model checker. Specifically, we are interested in the verification of downward and upward simulations which are the standard approach to verifying refinements in state-based notations. We show how downward and upward simulations can be checked using existing temporal logic model checkers. In particular, we show how the branching time temporal logic CTL can be used to encode the standard simulation conditions. We do this for both a blocking, or guarded, interpretation of operations (often used when specifying reactive systems) as well as the more common non-blocking interpretation of operations used in many state-based specification languages (for modelling sequential systems). The approach is general enough to use with any state-based specification language, and we illustrate how refinements between Z specifications can be checked using the SAL CTL model checker using a small example.

Design synthesis from interaction and state-based specifications

Interaction-based and state-based modeling are two complementary approaches of behavior modeling. The former focuses on global interactions between system components. The latter concentrates on the internal states of individual components. Both approaches have been proven useful in practice. One challenging and important research objective is to combine the modeling power of both effectively and then use the combination as the basis for automatic design synthesis. We present a combination of interaction-based and state-based modeling, namely, live sequence charts and Z, for system specification. We then propose a way of generating distributed design from the combinations. Our approach handles systems with intensive interactive behaviors as well as complex state structures

Extended state identification and verification using a model checker

This article presents a method for the application of model checking, i.e., verifying a finite state system against a given temporal specification, on the problem of generating test inputs. The generated test inputs allow state characterization, i.e., the identification of internal states of the software under test by observation of the input/output behavior only. A test model is derived semi-automatically from a given state-based specification and the testing goal is specified in terms of temporal logic. On the basis of these inputs, a model checking tool performs the testing input generation automatically. In consequence, the complexity of our approach is strongly depending on the input model, the testing goal, and the model checking algorithm, which is implemented in the used tool. The presented approach can be adapted with small changes to other model checking tools. It is a capable test generation method, whenever a finite state model of the software under test exists. Furthermore, it provides a descriptive view on state-based testing, which may be beneficial in other contexts, e.g., education and program comprehension.

Model Checking Downward Simulations

This paper shows how downward simulation can be checked using existing temporal logic model checkers. In particular, we show how the branching time temporal logic CTL can be used to encode the standard downward simulation conditions. We do this for both a blocking, or guarded, interpretation of operations (often used when specifying reactive systems) as well as the more common non-blocking interpretation of operations used in many state-based specification languages (for modelling sequential systems). The approach is general enough to use with any state-based specification language, and any CTL model checker in which the language can be encoded.

Using the Alloy Analyzer to Verify Data Refinement in Z

In the development of critical systems, standards dictate that it is necessary to first design, construct and formally analyse abstract models of the system. Developers must then verify that the final implementation is consistent with these more abstract specifications.Z is an example of a state-based specification language. It has been shown to be effective in a variety of cases—indeed it was developed as part of a joint collaboration between Oxford University's PRG and IBM Hursley for the specification of the CICS system. However, Z's main weakness is that it does not have the necessary tool support: whilst there are associated type checkers, there is no tool for automatically verifying refinement in Z.The contribution of this paper is to show how data refinement in Z can be automatically verified using the Alloy Analyzer. The soundness and joint completeness of the simulation rules for Z have already been established: here we translate them to Alloy. We then show how data types expressed in Z can also be translated to Alloy, before presenting the assertions necessary for the Alloy Analyzer to identify the retrieve relation and hence verify refinement. We present a simple example in which the Alloy Analyzer successfully identifies the retrieve relation between two data types thereby verifying simulation and hence refinement. We conclude the paper with a discussion of the suitability of the Alloy Analyzer for such a task.

A strategy for efficiently verifying requirements

This paper describes a compositional proof strategy for verifying properties of requirements specifications. The proof strategy, which may be applied using either a model checker or a theorem prover, uses known state invariants to prove state and transition invariants. Two proof rules are presented: a standard incremental proof rule analogous to Manna and Pnueli's incremental proof rule and a compositional proof rule. The advantage of applying the compositional rule is that it decomposes a large verification problem into smaller problems which often can be solved more efficiently than the larger problem. The steps needed to implement the compositional rule are described, and the results of applying the proof strategy to two examples, a simple cruise control system and a real-world Navy system, are presented. In the Navy example, compositional verification %based on the compositional proof using either theorem proving or model checking was three times faster than verification %model checking using based on the standard incremental (noncompositional) rule. In addition to the two above rules for proving invariants, a new compositional proof rule is presented for circular assume-guarantee proofs of invariants. While in principle the strategy and %the rules described for proving invariants may be applied to any state-based specification with parallel composition of components, the specifications in the paper are expressed in the SCR (Software Cost Reduction) tabular notation, the auxiliary invariants used in the proofs are automatically generated invariants, and the verification is supported by the SCR tools.

Generating test data from state‐based specifications

AbstractAlthough the majority of software testing in industry is conducted at the system level, most formal research has focused on the unit level. As a result, most system‐level testing techniques are only described informally. This paper presents formal testing criteria for system level testing that are based on formal specifications of the software. Software testing can only be formalized and quantified when a solid basis for test generation can be defined. Formal specifications represent a significant opportunity for testing because they precisely describe what functions the software is supposed to provide in a form that can be automatically manipulated.This paper presents general criteria for generating test inputs from state‐based specifications. The criteria include techniques for generating tests at several levels of abstraction for specifications (transition predicates, transitions, pairs of transitions and sequences of transitions). These techniques provide coverage criteria that are based on the specifications and are made up of several parts, including test prefixes that contain inputs necessary to put the software into the appropriate state for the test values. The test generation process includes several steps for transforming specifications to tests. These criteria have been applied to a case study to compare their ability to detect seeded faults. Copyright © 2003 John Wiley & Sons, Ltd.

A comparison of refinement orderings and their associated simulation rules

In this paper we compare the refinement orderings, and their associated simulation rules, of state-based specification languages such as Z and Object-Z with the refinement orderings of event-based specification languages such as CSP. We prove with a simple counter-example that data refinement, established using the standard simulation rules for Z, does not imply failures refinement in CSP. This contradicts accepted results.Having explored the differences between the simulation rules for establishing data refinement and those for establishing the refinement of action systems and state-transition systems—models in which refinement is equivalent to failures refinement within CSP—we present a new set of simulation rules for data types. These alternative rules are both sound and jointly complete with respect to the stable failures refinement ordering. Furthermore we present an alternative refinement ordering for CSP, one in which refinement is equivalent to data refinement in Z.