UPPAAL Model Research Articles

Automatic test case generation for structural testing of function block diagrams

ContextFunction Block Diagram (FBD) is increasingly used in safety-critical applications. Test coverage issues for FBDs are frequently raised by regulators and users. However, there is little work at this aspect on testing FBD at model level. Our previous study has designed a new data-flow test coverage criterion, FB-Path Complete Condition Test Coverage (FPCC), that can directly test FBD structures and effectively detect function mutation errors. Nevertheless, because FPCC scheme involves several data-flow concepts and thus it is somewhat complicated to comprehend and to generate FPCC-complied test cases. An automatic test suite generator for FPCC is highly desirable. ObjectiveThis study designs an automatic test case generator, FPCCTestGen, for FPCC so as to enhance the practicability and acceptance of the FPCC approach. MethodFirst, a supporting infrastructure for performing automatic FBD-to-UPPAAL-for-FPCC transformation is designed. The supporting infrastructure includes templates, declarations, and functions as building blocks for transformation. Then, for each input FBD, represented in PLCopen XML format, FPCCTestGen performs parsing and converts FBD components into corresponding UPPAAL model components using aforementioned building blocks. After that, queries related to FPCC characteristics are submitted to UPPAAL model checker for verification. Finally, the verification traces are analyzed to obtain a FPCC-complied test suite. ResultsA safety injection system is used as a case study. Preliminary results show that the generated test suite achieves the highest FPCC percentage with a near optimal number of test cases. ConclusionThis automatic test case generation tool is effective and thus, can promote the use of the new test coverage criterion. Methodology used in FPCCTestGen is generic and can be applied to test suite generation for other test criteria on data-flow programs.

Modeling biological pathway dynamics with timed automata.

Living cells are constantly subjected to a plethora of environmental stimuli that require integration into an appropriate cellular response. This integration takes place through signal transduction events that form tightly interconnected networks. The understanding of these networks requires capturing their dynamics through computational support and models. ANIMO (analysis of Networks with Interactive Modeling) is a tool that enables the construction and exploration of executable models of biological networks, helping to derive hypotheses and to plan wet-lab experiments. The tool is based on the formalism of Timed Automata, which can be analyzed via the UPPAAL model checker. Thanks to Timed Automata, we can provide a formal semantics for the domain-specific language used to represent signaling networks. This enforces precision and uniformity in the definition of signaling pathways, contributing to the integration of isolated signaling events into complex network models. We propose an approach to discretization of reaction kinetics that allows us to efficiently use UPPAAL as the computational engine to explore the dynamic behavior of the network of interest. A user-friendly interface hides the use of Timed Automata from the user, while keeping the expressive power intact. Abstraction to single-parameter kinetics speeds up construction of models that remain faithful enough to provide meaningful insight. The resulting dynamic behavior of the network components is displayed graphically, allowing for an intuitive and interactive modeling experience.

Model Checking Applied to Embedded Software of University Satellite

This work proposes the use of model checking for verifying the specification of critical embedded software of university satellites. The motivation for this work comes from two features commonly found in university satellite projects. The first one is the limited budget of the project. It usually results in a design of the on-board computer that relies on the software for detecting and treating hardware faults, instead of using radiation hard components. The second one is the lack of experience of the development team, which may compromise the quality of specification documents, jeopardizing the mission. In order to identify the advantages and limitations of model checking for university satellites, we used the software of the communication module of ITASAT satellite as a case study. The verification is performed with UPPAAL model checker. In order to avoid the state space explosion problem, similar non-deterministic events are simplified. The results show that the model checking process significantly contributed to identify and remove completeness problems in the software requirement specification documents.

Closed-loop verification of medical devices with model abstraction and refinement

The design and implementation of software for medical devices is challenging due to the closed-loop interaction with the patient, which is a stochastic physical environment. The safety-critical nature and the lack of existing industry standards for verification make this an ideal domain for exploring applications of formal modeling and closed-loop analysis. The biggest challenge is that the environment model(s) have to be both complex enough to express the physiological requirements and general enough to cover all possible inputs to the device. In this effort, we use a dual chamber implantable pacemaker as a case study to demonstrate verification of software specifications of medical devices as timed-automata models in UPPAAL. The pacemaker model is based on the specifications and algorithm descriptions from Boston Scientific. The heart is modeled using timed automata based on the physiology of heart. The model is gradually abstracted with timed simulation to preserve properties. A manual Counter-Example-Guided Abstraction and Refinement (CEGAR) framework has been adapted to refine the heart model when spurious counter-examples are found. To demonstrate the closed-loop nature of the problem and heart model refinement, we investigated two clinical cases of Pacemaker Mediated Tachycardia and verified their corresponding correction algorithms in the pacemaker. Along with our tools for code generation from UPPAAL models, this effort enables model-driven design and certification of software for medical devices.

Towards a Formal Semantics for UML/MARTE State Machines Based on Hierarchical Timed Automata

UML is a widely-used, general purpose modeling language. But its lack of a rigorous semantics forbids the thorough analysis of designed solution, and thus precludes the discovery of significant problems at design time. To bridge the gap, the paper investigates the underlying semantics of UML state machine diagrams, along with the time-related modeling elements of MARTE, the profile for modeling and analysis of real-time embedded systems, and proposes a formal operational semantics based on extended hierarchical timed automata. The approach is exemplified on a simple example taken from the automotive domain. Verification is accomplished by translating designed models into the input language of the UPPAAL model checker.

Artificial Pancreas Coupled Vital Signs Monitoring for Improved Patient Safety

This paper describes an improved design of artificial pancreas, which takes into account the physical parameters of human body for detecting hypoglycemic state of diabetic patients. In diabetes mellitus, failure in endogenous insulin production requires exogenous infusion of required drug amount. Traditionally, a closed-loop blood glucose level (BGL) control system includes a patient, continuous glucose monitor, controller and an insulin pump as the actuating device. Such systems are not perfectly safe to use as an overdose due to late action of insulin and/or delay in reading sensor data may lead to dangerously low blood sugar levels (hypoglycemia). Our design incorporates vital signs such as electrocardiogram, heart beat rate, electroencephalography and skin resistance for early detection and avoidance of hypoglycemia state. The objective is to securely control BGL of a patient suffering from diabetes and to prevent the harmful state of hypoglycemia. A typical proportional integrate derivative controller is designed for keeping glucose level inside the desired ‘safe’ range under normal conditions. Once hypoglycemia is detected, a specified amount of glucagon is infused into the patient’s body. The simulations have shown that patient safety can be improved through this strategy. In addition, the model-based design of the purposed system is validated by the UPPAAL model checker tool.

Modeling task systems using parameterized partial orders

Inspired by work on model-based design of printers, the notion of a parametrized partial order (PPO) has recently been introduced. PPOs are a simple extension of partial orders, expressive enough to compactly represent large task graphs with finite repetitive behavior. We present a translation of a subclass of PPOs to timed automata and prove that the transition system induced by the Uppaal models is isomorphic to the configuration structure of the original PPO. Moreover, we introduce real-time task systems (RTTSs), a general model for real-time embedded systems that we have used to describe the data paths of realistic printer designs. In an RTTS, tasks are represented as PPOs and the pace of a task instance may vary, depending on the resources that are allocated to it. We describe a translation of a subclass of RTTSs to Uppaal, and establish, for an even smaller subclass, bisimulation equivalence between the timed configuration semantics of an RTTS and the transition system induced by the corresponding Uppaal translation. Lastly, we report on a series of experiments which demonstrates that the resulting Uppaal models are more tractable than handcrafted models of the same systems used in earlier case studies.

A proposal and verification of a software architecture based on LabVIEW for a multifunctional robotic end-effector

This paper proposes a software architecture based on LabVIEW for controlling discrete event systems. The proposed architecture is an adaptation of the producer-consumer design pattern. This work uses the control software of a multifunctional robotic end-effector as a test-bed for analyzing the applicability of the software architecture and its limitations and advantages. This case study demonstrates the effectiveness of the architecture for dealing with the integration of multiple functionalities in the control system. For this case study, the validation of the architecture is performed using two verification techniques: (1) a formal verification using timed automata and the UPPAAL model checker and (2) the CoFI (Conformance and Fault Injection) method for defining the set of test cases to check the software product. Both verification techniques identified errors that were introduced into the control system during the programming phase.

Special Section on Intelligent Unmanned Systems

There has been increased worldwide interest in the research on intelligent unmanned systems in recent decades. The unmannedsystem technologies have been implemented in the underwater, ground, aerial, and space domains within an ever-extending operational envelope. The miniaturization of the hardware footprint coupled with exponentially increased computing power has enabled more efficient application of a wide range of unmanned vehicles. The papers in this special section represent recent contributions to several aspects of intelligent unmanned systems. The papers were largely an extension of select papers presented at the ICIUS2010 held in Bali, Indonesia, in October 2010. Three papers deal with the development of intelligent algorithms for unmanned aerial vehicles, while two papers focus on the software and hardware integration. The rest of the papers cover the application of aerospace technology for unmanned-vehicle design. The paper by Manathara and Ghose addresses the problem of multiple unmanned aerial vehicle (UAV) rendezvous when the UAVs have to perform maneuvers to avoid collisions with other UAVs. The authors proposed a solution that consists of velocity control and a wandering maneuver of the UAVs based on a consensus among them on the estimated time of arrival at the point of rendezvous. This simple algorithm was shown to be useful in tracking stationary or slowly moving targets with a standoff distance. Kim et al. paper present an automatic landing control design using adaptive, integrated guidance and control (IGC) logic. The proposed IGC design uses a combination of an adaptive output feedback inversion and backstepping techniques. The authors formulated the problem as an adaptive output feedback control problem for a line-of-sight–based chasing-flight configuration. The automatic landing system using IGC logic was evaluated using a sophisticated six-degrees-of-freedom nonlinear simulation program with the approach and landing scenario. Jeong et al. focused on the design of a robust H-infinity attitude controller for an unmanned small-scale helicopter. It was demonstrated that the H-infinity controller works amiably when applied to the nonlinear model, even though it is designed using a linear model approximation. The time-domain simulation with the nonlinear model demonstrated that the proposed controller was very robust to the uncertainties as expected, overcoming large gain uncertainties and time delay in each input channel. Formal verification currently plays an important role in guaranteeing the correctness of the operation of safety-critical systems, for example, in UAVs. Lee et al. discuss formal modeling and verification of operational flight programs (OFPs) in a small-scale unmanned helicopter. Two different formal models for the OFP were developed and verified using SPIN and UPPAAL model checkers. Real-time behavior of theOFPwas specified using a timed-automata model. Their verification of the OFP found several safety-critical faults to be reported to and fixed by the development team. One of the key features of autonomous flight of UAVs is the ability to perform localization and map building of flight environments simultaneously. Park et al. present vision-based simultaneous localization and mapping (SLAM) for small UAVs in global-positioningsystem–denied environments. A method that combines onboard and on-ground localization and mapping was proposed. The paper by Thu et al. investigates the nature of vortex structure developed by a double-delta wing. Dye-flow visualization in a small-scale water tunnel was used for the study. The authors identified two types of flow interaction, which are enveloping and coiling-up modes. Characteristics of the two modes were examined for various angles of attack (AOAs) at relatively low Reynolds numbers of 10,000 and 15,000. The authors found that the wing vortex became stronger and the enveloping mode was dominant for a low AOA, while the coiling-up mode was dominant at a high AOA. They also reported that the transition of these two modes occurred at around an AOA of 20 . Another paper in the special section studied the unsteady flow field of a flapping model butterfly under the zero-advance ratio (J 5 0) condition using timeresolved stereoscopic particle image velocimetry. The effect of feathering on thrust generation because of chordwise wing flexibility was identified by focusing on the ejection of airflow from the gap between two wings. Ghosh et al. found that the wing flexibility adds a feathering effect and enhances net lift and thrust generation through ejection of vortex pairs during the downstroke-to-upstroke–motion reversal. They also reported that the thrust produced was positive all over the cycle, even at J 5 0, because of the feathering motion. The special section editors would like to express their sincerest gratitude to all the contributing authors. We hope that the readers will find the content of this section not only relevant but also stimulating and beneficial for their ongoing research endeavors.

Contributions of model checking and CoFI methodology to the development of space embedded software

The role of embedded software in the last space accidents highlights the importance of verification and validation techniques for the development of space embedded software. In this context, this work analyses the contribution of two verification techniques applied to the onboard data handling software of space products. The first technique is model checking. The system is modeled by a set of timed automata and the verification of safety and liveness properties is performed using UPPAAL model checker. The verified model is then used to generate the embedded software. The second technique analyzed in this work is model based approach for the generation of test cases. The Conformance and Fault Injection (CoFI) testing methodology is used to guide the development of a set of Finite State Machine (FSM) models from the software specification. The test suite is automatically generated from the FSM models. The contributions of the two methodologies are analyzed based on the results provided by an experiment. Two software products are used as case study, each one implementing two services of the Packet Utilization Standard (PUS). These services represent the functionalities offered by a satellite onboard data handling computer. One of the products is developed with the aid of model checking, while the other is developed according to the practices currently used at the Instituto Nacional de Pesquisas Espaciais (INPE). Both software products are tested by the CoFI methodology. The experiment highlights the advantages and vulnerable points of model checking. It also demonstrates that the main contribution of CoFI testing methodology is to highlight problems related to situations that have not been considered in the software specification, such as the occurrence of inopportune events. This analysis helps to understand how different techniques can be integrated in the design of critical embedded software.

Computing Nash Equilibrium in Wireless Ad Hoc Networks: A Simulation-Based Approach

This paper studies the problem of computing Nash equilibrium in wireless networks modeled by Weighted Timed Automata. Such formalism comes together with a logic that can be used to describe complex features such as timed energy constraints. Our contribution is a method for solving this problem using Statistical Model Checking. The method has been implemented in UPPAAL model checker and has been applied to the analysis of Aloha CSMA/CD and IEEE 802.15.4 CSMA/CA protocols.

Static analysis of aspect interaction and composition in component models

Component based software engineering and aspect orientation are claimed to be two complementary approaches. While the former ensures the modularity and the reusability of software entities, the latter enables the modularity of crosscutting concerns that cannot be modularized as regular components. Nowadays, several approaches and frameworks are dedicated to integrate aspects into component models. However, when several aspects are woven, aspects may interact with each other which often results in undesirable behavior. The contribution of this paper is twofold. First, we show how aspectized component models can be formally modeled in UPPAAL model checker in order to detect negative interactions (a.k.a., interferences) among aspects. Second, we provide an extendible catalog of composition operators used for aspect composition. We illustrate our general approach with an airport Internet service example.

Analysis of a clock synchronization protocol for wireless sensor networks

The Dutch company Chess develops a wireless sensor network (WSN) platform using an epidemic communication model. One of the greatest challenges in the design is to find suitable mechanisms for clock synchronization. In this paper, we study a proposed clock synchronization protocol for the Chess platform. First, we model the protocol as a network of timed automata and verify various instances using the Uppaal model checker. Next, we present a full parametric analysis of the protocol for the special case of cliques (networks with full connectivity), that is, we give constraints on the parameters that are both necessary and sufficient for correctness. These results have been checked using the proof assistant Isabelle. We report on the exhaustive analysis of the protocol for networks with four nodes, and we present a negative result for the special case of line topologies: for any instantiation of the parameters, the protocol will eventually fail if the network grows.

Using integer clocks to verify clock-synchronization protocols

We use the Uppaal model checker for timed automata to verify the Timing-Sync time-synchronization protocol for sensor networks (TPSN), the clock-synchronization algorithm of Lenzen, Locher and Wattenhofer (LLW) for general distributed systems, and the clock-thread technique of the software monitoring with controllable overhead algorithm (SMCO). Clock-synchronization algorithms such as TPSN, LLW, and SMCO must be able to perform arithmetic on clock values to calculate clock drift and network propagation delays. They must also be able to read the value of a local clock and assign it to another local clock. Such operations are not directly supported by the theory of timed automata. To overcome this formal-modeling obstacle, we augment the Uppaal specification language with the integer clock-derived type. Integer clocks, which are essentially integer variables that are periodically incremented by a global pulse generator, greatly facilitate the encoding of the operations required to synchronize clocks as in the TPSN, LLW, and SMCO protocols. With these integer-clock-based models in hand, we use Uppaal to verify a number of key correctness properties, including network-wide time synchronization, bounded clock skew, bounded overhead skew, and absence of deadlock. We also use the Uppaal Tracer tool to illustrate how integer clocks can be used to capture clock drift and resynchronization during protocol execution.

Tool building in formal methods

Tool building in formal methods

A Semantic-Preserving Transformation from the Compositional Interchange Format to UPPAAL

AbstractThe Compositional Interchange Format (CIF), is a modeling formalism for hybrid systems, that aims to establishing interoperability of a wide range of tools by means of model transformations to and from CIF. UPPAAL is a very successful tool for the specification and analysis of timed systems.It is interesting, both from a theoretical and a practical perspective, to be able to translate CIF models to UPPAAL models, since this makes it possible to model check properties of timed CIF models. This requires a semantic preserving transformation, which ensures that properties validated in UPPAAL models also hold for their CIF counterparts. In addition, by providing such a translation we are, at the same time, providing translations for a wider set of languages that can be transformed to CIF.This paper presents a semantic-preserving transformation from a subset of CIF models to UPPAAL. The transformation described in this work constitutes the cornerstone for transformations of a broader subset of CIF.

Efficient asynchronous event handling in the real-time specification for Java

The Real-Time Specification for Java (RTSJ) is becoming mature. It has been implemented, formed the basis for research and used in serious applications. Some strengths and weaknesses are emerging. One of the areas that requires further elaboration is asynchronous event handling (AEH). The primary goal for handlers in the RTSJ is to have a lightweight concurrency mechanism. Some implementation will, however, simply map a handler to a real-time thread and this results in undermining the original motivations and introduces performance penalties. However it is generally unclear how to map handlers to real-time threads effectively. Also the support for nonblocking handlers in the RTSJ is criticized as lacking in configurability as implementations are unable to take advantage of them. This article, therefore, examines the AEH techniques used in some popular RTSJ implementations and proposes two efficient AEH models for the RTSJ. We then define formal models of the RTSJ AEH implementations using the automata formalism provided by the UPPAAL model checking tool. Using the automata models, their properties are explored and verified. In the proposed models, blocking and nonblocking handlers are serviced by different algorithms. In this way, it is possible to assign a real-time thread to a handler at the right time in the right place while maintaining the fewest possible threads overall and to give a certain level of configurability to AEH. We also have implemented the proposed models on an existing RTSJ implementation, jRate and executed a set of performance tests that measure their respective dispatch and multiple-handler completion latencies. The results from the tests and the verifications indicate that the proposed models require fewer threads on average with better performance than other approaches.

Integrating UML and UPPAAL for designing, specifying and verifying component-based real-time systems

A new tool for integrating formal methods, particularly model checking, in the development process of component-based real-time systems specified in UML is proposed. The described tool, TANGRAM (Tool for Analysis of Diagrams), performs automatic translation from UML diagrams into timed automata, which can be verified by the UPPAAL model checker. We focus on the CORBA Component Model. We demonstrate the overall process of our approach, from system design to verification, using a simple but real application, used in train control systems. Also, a more complex case study regarding train control systems is described.

Modelling Clock Synchronization in the Chess gMAC WSN Protocol

We present a detailled timed automata model of the clock synchronization algorithm that is currently being used in a wireless sensor network (WSN) that has been developed by the Dutch company Chess. Using the Uppaal model checker, we establish that in certain cases a static, fully synchronized network may eventually become unsynchronized if the current algorithm is used, even in a setting with infinitesimal clock drifts.

Schedulability of asynchronous real-time concurrent objects

We present a modular method for schedulability analysis of real time distributed systems. We extend the actor model, as the asynchronous model for concurrent objects, with real time using timed automata, and show how actors can be analyzed individually to make sure that no task misses its deadline. We introduce drivers to specify how an actor can be safely used. Using these drivers we can verify schedulability, for a given scheduler, by doing a reachability check with the Uppaal model checker. Our method makes it possible to put a finite bound on the process queue and still obtain schedulability results that hold for any queue length.