Timed Automata Model Research Articles

A Timed Automaton Model with Timing Intervals and Outputs for Fault Diagnosis of the Drilling Process on a CNC Machine

A Timed Automaton Model with Timing Intervals and Outputs for Fault Diagnosis of the Drilling Process on a CNC Machine

Model Based Verification of Spiking Neural Networks in Cyber Physical Systems

Spiking Neural Networks (SNNs) have found increasing utility in designing safety-critical Cyber-Physical Systems (CPSs) such as implantable medical devices, autonomous vehicles, and space robotics due to their capability to operate on information represented in temporal coding and exhibit various behavioural modalities. Thus, there has been recent interest in formally verifying their timing behaviours and providing soundness guarantees of their diverse characteristics. However, beyond the simplistic Leaky Integrate and Fire (LIF) model, which only mimics 3 spiking behaviours, there is a lack of unifying methodology in literature to verify complex dynamics of biological neurons exhibiting 20 spiking behaviours as demonstrated by the pioneering work of Izhikevich. There is also a complete lack of formulation for the verification of SNN-based systems. This paper bridges these gaps by proposing a model-based approach for designing SNN-based controllers in CPS. We propose sound structural transformations translating any spiking neuron into networks of Timed Automata (TA), model the complex Izhikevich neural model and formally verify all 20 timing behaviours it exhibits for the first time. We then present two case studies that were modelled as SNNs using our approach: the PID controller, and the Car-Following controller, and subsequently attempt static model checking and statistical verification of their generated TA models for safety guarantees.

Timed protocol analysis of interconnected mobile IoT devices

With the emergence of the Internet of Things (IoT), application developers can rely on a variety of protocols and Application Programming Interfaces (APIs) to support data exchange between IoT devices. However, this may result in highly heterogeneous IoT interactions in terms of both functional and non-functional semantics. To map between heterogeneous functional semantics, middleware connectors can be utilized to interconnect IoT devices via bridging mechanisms. In this paper, we make use of the Data eXchange (DeX) connector model that enables interoperability among heterogeneous IoT devices. DeX interactions, including synchronous, asynchronous and streaming, rely on generic post and get primitives to represent IoT device behaviors with varying space/time coupling. Nevertheless, non-functional time semantics of IoT interactions such as data availability/validity, intermittent connectivity and application processing time, can severely affect response times and success rates of DeX interactions. We introduce timing parameters for time semantics to enhance the DeX API. The new DeX API enables the mapping of both functional and time semantics of DeX interactions. By precisely studying these timing parameters using timed automata models, we verify conditions for successful interactions with DeX connectors. Furthermore, we statistically analyze through simulations the effect of varying timing parameters to ensure higher probabilities of successful interactions. Simulation experiments are compared with experiments run on the DeX Mediators (DeXM) framework to evaluate the accuracy of the results. This work can provide application developers with precise design time information when setting these timing parameters in order to ensure accurate runtime behavior.

Abstraction models for verifying resource adequacy of IMA systems at concept level

Complex cyber-physical systems can be difficult to analyze for resource adequacy (e.g., bandwidth and buffer size) at the concept development stage since relevant models are hard to create. During this period, details about the functions to be executed or the platforms in the architecture are partially unknown. This is especially true for Integrated Modular Avionics (IMA) systems, for which life-cycles span over several decades, with potential changes to functionality in the future. This work aims to identify abstractions for representing data exchanges among functions realized in networked IMA systems and investigates how these can be represented in formal models and analyzed with exact guarantees. Timed automata (TA) are a relevant choice for modeling since communication resource adequacy is directly related to potential network delays. We explore two alternatives in modeling with TA, a direct one representing every process using a TA template, and a more abstract one representing every computation device with a TA template. While the first approach represents process-to-process data exchanges, the modified approach reduces the state space by representing all processes currently allocated to a single computing element to obtain scalability gains. Both approaches are flexible since the templates presented can be instantiated to represent different types of network topologies and communication patterns. The instantiated TA models are used to illustrate an use case and analyzed with the UPPAAL model checker to verify that a given platform instance supports the desired system functions in terms of network bandwidth and buffer size adequacy, thereby messages reaching their final destination with freshness guarantees. Both abstraction levels are shown to be suitable for verifying the intended properties, but the more abstract one demonstrates a 67% improvement in verification time and a 66% reduction in state space during verification. The more abstract approach is also applied to a real-world example from an earlier publication, with a much larger state space and a more complex structure, to illustrate the ability to reuse the approach in multiple use cases. • A modular UPPAAL-based framework to model avionic application and platform elements. • A framework to analyze IMA systems timeliness and resource adequacy at an early stage. • Alternative abstractions for data exchanges among functions in IMA-based systems.

A Time Refinement Framework Based on iUML-B State Machine

Event-B is a formal modeling language that is very suitable for software engineering, but it lacks the ability of modeling time. Researchers have proposed some methods for modeling time constraints in Event-B. The limitations with existing methods are that, first of all, the existing research work lacks a systematic time refinement framework based on Event-B; secondly, the existing methods only model time in the Event-B framework and cannot be smoothly converted to automata-based models such as timed automata that facilitate the verification of time properties. These limitations make it more difficult to model and verify real-time systems with Event-B because it is very time-consuming to prove time properties in the Event-B framework. In this paper, we firstly proposed a systematic time refinement framework to express and refine time constraints in Event-B. Secondly, we also proposed various vertical refinement patterns and horizontal extension patterns to guide modelers to refine the Event-B real-time model step by step. Finally, we use a real-time system case to demonstrate the practicality of our method. The experimental results show that the proposed method can make the real-time system modeling in Event-B more convenient and the models are easier to convert to the timed automata model, thereby facilitating the verification of various time properties.

Modelling and Verification of Cash Withdrawal Transaction in Automated Teller Machine Using Timed Automata

This study was conducted to verify a system of Automated Teller Machine (ATM) which is a facility provided by a bank. Various transactions can be done by using ATM, including cash withdrawal, payment, and transfer. However, in spite of its function, ATM can also be a target of crime such as cash robbery and frauds. Therefore, the correctness of ATM and its security is essential and for that reason, formal verification is needed. Formal verification is a technique to ensure the model of a system to satisfy a certain specification. ATM has a time variable on its system. Therefore, timed automata can be used as a model of ATM. In this paper, an algorithm is constructed based on the ATM cash withdrawal steps. Next, we construct a timed automaton model and design nine specifications. Then, timed automaton were verified against these nine specifications using UPPAAL. From the verification results, it can be concluded that the security of the ATM system is guaranteed.

Exact acceleration of complex real-time model checking based on overlapping cycle.

When real-time systems are modeled as timed automata, different time scales may lead to substantial fragmentation of the symbolic state space. Exact acceleration solves the fragmentation problem without changing system reachability. The relatively mature technology of exact acceleration has been used with an appended cycle or a parking cycle, which can be applied to the calculation of a single acceleratable cycle model. Using these two technologies to develop a complex real-time model requires additional states and consumes a large amount of time cost, thereby influencing acceleration efficiency. In this paper, a complex real-time exact acceleration method based on an overlapping cycle is proposed, which is an application scenario extension of the parking-cycle technique. By comprehensively analyzing the accelerating impacts of multiple acceleratable cycles, it is only necessary to add a single overlapping period with a fixed length without relying on the windows of acceleratable cycles. Experimental results show that the proposed timed automaton model is simple and effectively decreases the time costs of exact acceleration. For the complex real-time system model, the method based on an overlapping cycle can accelerate the large scale and concurrent states which cannot be solved by the original exact acceleration theory.

A Unified Model-Based Framework for the Simplified Execution of Static and Dynamic Assertion-Based Verification

The improved productivity and reduced time-to-market are essential requirements for the development of modern embedded systems and, therefore, the comprehensive as well as timely design verification is critical. Assertion Based Verification (ABV) is a renowned paradigm to timely achieve an optimum test coverage, either through static or dynamic techniques. However, the major limitation with ABV is its inherited low-level implementation complexity. In order to simplify its execution, various Model Based System Engineering approaches provide a higher abstraction layer. Nevertheless, the complete verification requirements, targeting the static as well as dynamic ABV at the same time in a unified framework, are not being addressed. Furthermore, the dynamic verification support is provided through some traditional languages (like C, Verilog) where the advanced ABV features cannot be exploited. Consequently, this article introduces the MODEVES (MOdel-based DEsign Verification for Embedded Systems) framework to simultaneously support the static and dynamic ABV. Particularly, the UML (Unified Modeling Language) and SysML (Systems Modeling Language) diagrams are used to model the structural and behavioral requirements. Moreover, the NLCTL (Natural Language for Computation Tree Logic) is proposed to include the verification requirements for static ABV while the SVOCL (SystemVerilog in Object Constraint Language) is used to represent the dynamic verification constraints. An open source transformation engine is developed to automatically generate the SystemVerilog Register Transfer Level (RTL) code, Timed Automata model, SystemVerilog assertions and Computation Tree Logic (CTL) assertions with minimum transformation losses. The significance of the MODEVES framework is established through several case studies and the quantitative analysis shows an improvement of almost 100% in design productivity, as compared to the conventional low-level implementations.

A method for testing distributed anomaly detectors

Distributed anomaly detectors are deployed in critical infrastructure to raise alerts when the underlying plant deviates from its expected behaviour. A novel method, referred to as SCM, that uses well defined state and command mutation operators, is proposed to test such detectors prior to their deployment. Cyber-attacks, each modelled as a timed-automaton, serve as reference attacks. A potentially large set of attacks is then created by systematically applying the mutation operators to each reference attack. In a case study, SCM was applied to a timed-automata model of a water treatment plant to assess its effectiveness in testing a distributed anomaly detector. Results attest to the value of SCM in identifying weaknesses in an anomaly detector, prior to its deployment, and improving its effectiveness in detecting process anomalies.

Efficient Tracing Methodology Using Automata Processor

Tracing or trace interface has been used in various ways to find system defects or bugs. As embedded systems are increasingly used in safety-critical applications, tracing can provide useful information during system execution at runtime. Non-intrusive tracing that does not affect system performance has become especially important, but unfortunately, the biggest obstacle to this approach was the vast amount of real-time trace data, making it challenging to address complex requirements with relatively limited hardware implementations. Automata processors can be programmed with a memory-like structure of automata and have a structure specific to streaming data, large capacity, and parallel processing functions. This paper promotes the idea of high-level system-on-chip monitoring using automata processors. We used a safety-critical pacemaker application in the experiments, described timed automata (TA)-based requirements, and tested intentionally injected 4,000 random failures. The TA model converted for Automata Processor to monitor system, correctness, and safety properties achieved 100% failure detection rate in the experiment, and the detected failure is reported as fast enough to allow enough extent for failure recovery.

Correct-by-construction model-based design of reactive streaming software for multi-core embedded systems

We present a model-based design approach toward correct-by-construction implementations of reactive streaming software for multi-core systems. A system’s implementation is derived from a high-level process network model by applying semantics-preserving model transformations. The so-called fixed priority process networks (FPPNs) are programmed independently from the execution platform and combine streaming and reactive control behavior with task parallelism for utilizing multi-core processing. We first define the FPPN sequential execution semantics that specifies precedence constraints between job executions of different tasks. Applications are thus rendered such that for any given test stimuli, a deterministic output response is expected. Furthermore, we define the FPPN real-time semantics based on a timed-automata modeling framework. This is provably a functionally equivalent semantics specifying the real-time execution of FPPNs and enabling runtime managers for scheduling jobs on multi-cores. A model transformation framework has been developed for deriving executable implementations of FPPNs on the BIP (Behavior–Interaction–Priority) runtime environment, ported on multi-core platforms. Schedulability is established by static analysis of the FPPN, and it is guaranteed by construction. Thus, the developers do not need to program low-level real-time OS services (e.g., for task management) and applications are amenable to testing, as opposed to if their outputs would depend on timing behavior. We have successfully ported a guidance-navigation and control application of a satellite system, onto a radiation hardened multi-core platform. Various implementation scenarios for efficiently utilizing HW resources are illustrated, and the test results are discussed.

Safety Verification of a Train Interlocking Timed Automaton Model

This paper presents an application of formal methods based on model checking techniques for safety verification of a railway interlocking system. The proposed model checking techniques are implemented on a timed automaton model of the considered interlocking systems and with respect to safety operational specification that are expressed as computation tree logic formulas. The freely available UPPAAL model checker is used to perform the model checking task and simulation results of the performed verification are presented.

Model-based testing of software for automation systems using heuristics and coverage criterion

The aim of this work is to increase the confidence on software for automation systems defining a coverage criterion to measure the quality level of generated tests and the time interval needed to execute them. This coverage criterion called At Least N (ALN) is based on the Effect Predicate Heuristic (EPH) that provides all effect predicate for ISA 5.2 diagrams. The ALN and EPH have been incorporated into the Gungnir tool that was built using model-based testing concepts. The Gungnir uses timed automata to model the specification, in the ISA 5.2 diagrams, and the implementation, in the Ladder language. The timed automata models are automatically extracted, data tests are generated and the tool automatically verifies if the implementation is in conformance with the specification, given a quality level defined by the user.

타임드 오토마타 모델 기반 산업 자동화 응용 자동생성 프레임워크

ICT 기술과의 융합으로 인해 산업 자동화 시스템은 복잡도와 신뢰성 요구 수준이 급격히 증가하고 있다. 최근에는 이러한 요구에 대응하기 위해 응용 개발 초기 과정에서부터 정형 기법을 활용하는 연구들이 주목받고 있다. 본 논문에서는 산업 자동화 응용을 위한 타임드 오토마타 모델 기반 네이티브코드 자동 생성 프레임워크를 제안한다. 사례 연구로 산업용 네트워크를 사용하는 신호등 제어 시스템을 모델링하고, 탑재되는 응용의 타이밍 속성을 검증하였다. 제안하는 프레임워크의 유효성을 검증하기 위해 자동 변환된 네이티브 코드를 사용하여 EtherCAT 네트워크 기반 테스트베드의 동작을 확인한 결과, 모델 명세와 동일하게 동작하는 것을 확인하였다.

Formal verification considering a systematic modeling approach for function blocks

Formal verification of automation systems controller software is a complex task. This happens mainly because this kind of systems need to be programmed by highly skilled designers as results obtained from formal verification are highly dependent of the “quality” of the developed models. In this paper, is explained and presented an approach for modeling a series of function blocks from IEC 61 131-3 standard and, in the same context, is proposed an approach for developing the respective Timed Automata model for formal verification purposes, by model-checking, using UPPAAL model-checker. Some interesting results are achieved and the proposed approach is user friendly.

Comparison of Timed Automata with Discrete Event Simulation for Modeling of Biomarker-Based Treatment Decisions: An Illustration for Metastatic Castration-Resistant Prostate Cancer

BackgroundWith the advent of personalized medicine, the field of health economic modeling is being challenged and the use of patient-level dynamic modeling techniques might be required. ObjectivesTo illustrate the usability of two such techniques, timed automata (TA) and discrete event simulation (DES), for modeling personalized treatment decisions. MethodsAn early health technology assessment on the use of circulating tumor cells, compared with prostate-specific antigen and bone scintigraphy, to inform treatment decisions in metastatic castration-resistant prostate cancer was performed. Both modeling techniques were assessed quantitatively, in terms of intermediate outcomes (e.g., overtreatment) and health economic outcomes (e.g., net monetary benefit). Qualitatively, among others, model structure, agent interactions, data management (i.e., importing and exporting data), and model transparency were assessed. ResultsBoth models yielded realistic and similar intermediate and health economic outcomes. Overtreatment was reduced by 6.99 and 7.02 weeks by applying circulating tumor cell as a response marker at a net monetary benefit of −€1033 and −€1104 for the TA model and the DES model, respectively. Software-specific differences were observed regarding data management features and the support for statistical distributions, which were considered better for the DES software. Regarding method-specific differences, interactions were modeled more straightforward using TA, benefiting from its compositional model structure. ConclusionsBoth techniques prove suitable for modeling personalized treatment decisions, although DES would be preferred given the current software-specific limitations of TA. When these limitations are resolved, TA would be an interesting modeling alternative if interactions are key or its compositional structure is useful to manage multi-agent complex problems.

A Model-Derivation Framework for Software Analysis

Model-based verification allows to express behavioral correctness conditions like the validity of execution states, boundaries of variables or timing at a high level of abstraction and affirm that they are satisfied by a software system. However, this requires expressive models which are difficult and cumbersome to create and maintain by hand. This paper presents a framework that automatically derives behavioral models from real-sized Java programs. Our framework builds on the EMF/ECore technology and provides a tool that creates an initial model from Java bytecode, as well as a series of transformations that simplify the model and eventually output a timed-automata model that can be processed by a model checker such as UPPAAL. The framework has the following properties: (1) consistency of models with software, (2) extensibility of the model derivation process, (3) scalability and (4) expressiveness of models. We report several case studies to validate how our framework satisfies these properties.

Formal modelling and analysis of Bitflips in ARM assembly code

Bitflips, or single-event upsets (SEUs) as they are more formally known, may occur for instance when a high-energy particle such as a proton strikes a CPU and thereby corrupting the contents of an on-chip register, e.g., by randomly flipping one or more bits in that register. Such random changes in central registers may lead to critical failure in the execution of a program, which is especially problematic for safety- or security-critical applications. Even though SEUs are well studied in the literature, relatively little attention have been given to the formal modelling of SEUs and the application of formal methods to mitigate the consequences of SEUs. In this paper we develop a formal semantic framework for easy formal modelling of a large variety of SEUs in a core assembly language capturing the essential features of the ARM assembly language. Based on the semantic framework, we derive and formally prove correct a static analysis that enforces so-called blue/green separation in a given program. Static blue/green separation is a language-based fault detection technique relying on inlined replication of critical code. A program that has proper blue/green separation is shown to be fault-tolerant with respect SEUs in data registers. However, this technique requires specialised hardware support in order to achieve full coverage. We therefore use our semantic framework to further develop so-called gadgets, essentially small code fragments that emulate the behaviour of blue/green instructions in a safe manner. The gadgets allow us to achieve partial blue/green separation without specialised hardware support. Finally, we show how our semantic framework can be used to extract timed-automata models of ARM assembler code programs. We then apply statistical model checking to these timed-automata models enabling us to model, analyse, and quantify program behaviour in the presence of fault models that go well beyond data-flow SEUs, e.g., bitflips in program counters or in the code itself. We use this approach to provide evidence that our suggested program modifications, i.e., the use of gadgets, significantly decrease the probability of such faults going undetected.

Design and verification of Cyber-Physical Systems using TrueTime, evolutionary optimization and UPPAAL

Timing imperfections in Cyber-Physical Systems (CPS) components affect their performance and reliability. This investigation presents a methodology to design and verify CPS using multi-objective evolutionary optimization, model checking and supporting software tools. The time-varying delays in CPS are modeled as constant delays plus jitter. It is shown that the CPS design problem is a trade-off between performance and jitter margin. To make good trade-offs, this investigation models the design problem as a constrained multi-objective optimization problem. The design algorithm results in a non-linear and multi-objective optimization problem that is generally difficult to solve. To overcome this computation barrier, this investigation uses the evolutionary algorithm Non-dominated Sorting Genetic Algorithm II (NSGA II). Solution of the optimization problem computes the proportional integral and derivative controller gains that simultaneously maximize the jitter margin while improving the system performance. Implementing the CPS controller in embedded platform requires the selection and validation of the process schedules as well as network protocols. To validate the CPS design, the computed controller gains are simulated in TrueTime to verify the performance for a given network protocol and processor scheduling policy. Three scheduling policies are considered due to their appropriateness for use with temporal imperfections: fixed priority, earliest deadline first and deadline monotonic. Finally, to verify the CPS for timing guarantees, a timed-automata model is used that defines the timing interfaces among the components. The formal model is then used to verify CPS response time and properties such as safety using computation tree logic in UPPAAL model checker. The proposed CPS design and verification approach is illustrated on an industrial mine pump example. Our results demonstrate that the proposed approach can be used to design and validate CPS for performance and verify timing guarantees. The proposed method provides a systematic design and verification approach that can be used for deployments of CPS in industries.

Timed Automata for Modelling Caches and Pipelines

In this paper, we focus on modelling the timing aspects of binary programs running on architectures featuring caches and pipelines. The objective is to obtain a timed automaton model to compute tight bounds for the worst-case execution time (WCET) of the programs using model-checking techniques.