Verification Of Real-time Systems Research Articles

A property specification pattern catalog for real-time system verification with UPPAAL

Context: The goal of specification pattern catalogs for real-time requirements is to mask the complexity of specifying such requirements in a timed temporal logic for verification. For this purpose, they provide frontends to express and translate pattern-based natural language requirements to formulae in a suitable logic. However, the widely used real-time model checking tool UPPAAL only supports a restricted subset of those formulae that focus only on basic and non-nested reachability, safety, and liveness properties. This restriction renders many specification patterns inapplicable. As a workaround, timed observer automata need to be constructed manually to express sophisticated requirements envisioned by these patterns. Objective: In this work, we fill these gaps by providing a comprehensive specification pattern catalog for UPPAAL. The catalog supports qualitative and real-time requirements and covers all corresponding patterns of existing catalogs. Method: The catalog we propose is integrated with UPPAAL. It supports the specification of qualitative and real-time requirements using patterns and provides an automated generator that translates these requirements to observer automata and TCTL formulae. The resulting artifacts are used for verifying systems in UPPAAL. Thus, our catalog enables an automated end-to-end verification process for UPPAAL based on property specification patterns and observer automata. Results: We evaluate our catalog on three UPPAAL system models reported in the literature and mostly applied in an industrial setting. As a result, not only the reproducibility of the related UPPAAL models was possible, but also the validation of an automated, seamless, and accurate pattern- and observer-based verification process. Conclusion: The proposed property specification pattern catalog for UPPAAL enables practitioners to specify qualitative and real-time requirements...

Automata column

For the Automata Theory Column, we have an article by B. Srivathsan on the reachability problem in timed automata. Ever since timed automata were introduced by Alur and Dill, they have been widely used in the verification of real-time systems. Their appeal comes from a simple definition that couples expressiveness with computational tractability. The control state reachability problem, which asks if there is a computation of a given timed automaton that reaches a given control state, is an important problem in this context and was shown to be decidable in PSPACE by Alur and Dill in their seminal paper. However, because of the central role this problem plays in verification, it has been extensively studied in the past 30 years. In this issue, Srivathsan lucidly articulates the main principles underlying modern approaches to solving this problem.

Exploring the ERTMS/ETCS full moving block specification: an experience with formal methods

Shift2Rail is a joint undertaking funded by the EU via its Horizon 2020 program and by main railway stakeholders. Several Shift2Rail projects aim to investigate the application of formal methods to new ERTMS/ETCS railway signalling systems that promise to move European railway forward by guaranteeing high capacity, low cost and improved reliability. We explore the ERTMS/ETCS level 3 full moving block specifications stemming from different Shift2Rail projects using Uppaal and statistical model checking. The results range from novel rigorously formalised requirements to an operational model formally verified against scenarios with multiple trains on a single railway line. From the gained experience, we have distilled future research goals to improve the formal specification and verification of real-time systems, and we discuss some barriers concerning a possible uptake of formal methods and tools in the railway industry.

A Property Specification Pattern Catalog for Real-Time System Verification with UPPAAL

A Property Specification Pattern Catalog for Real-Time System Verification with UPPAAL

Towards a formal specification for an AADL behavioural subset using the LNT language

The analysis of real-time systems designed by architectural languages such as architecture analysis and design language (AADL) is a challenging research topic. In such a context, formal methods become an advocated practice in software engineering for rigorous analysis. Yet, they are applied on specific formalisms to be analysed on dedicated tools. This paper studies the formal verification of real-time systems modelled with the AADL language and its behaviour annex. We define a formal semantics of an AADL behavioural subset using the LNT language. This work is illustrated with a robot case study.

Schedulability analysis of real-time multiframe cosimulations on multicore platforms

For real-time simulations, the fidelity of simulation depends not only on the functional accuracy of simulation but also on its timeliness. It is helpful for simulation designers if they can analyze and verify that a simulation will always meet its timing requirements without unnecessarily sacrificing functional accuracy. Abstracting the simulated processes simply as software tasks allows us to transform the problem of verifying timeliness into a schedulability analysis problem where tasks are checked as to whether they are schedulable under the timing constraints or not. In this paper we extend a timed automaton-based framework due to Fersman and Yi for schedulability analysis of real-time systems, for the special case of real-time multiframe cosimulations. To the best of our knowledge, this work is the first to analyze the schedulability of single- or multiframe real-time simulations. We found that there are some special requirements posed by multiframe simulations, which necessitate changes and improvements in the existing framework designed for actual real-time systems. We made the required theoretical extensions to the framework and implemented our extended framework in UPPAAL, a tool for modeling, simulation, and verification of real-time systems modeled as timed automata. The functional correctness and resource requirements of the implemented framework are then demonstrated using simple examples.

A Flattening Algorithm for Hierarchical Timed Automata

We propose a coherent algorithm for the translation of hierarchical timed automata into networks of (planar) timed automata. This kind of translation is called flattening. The two types of timed automata are used in formal verification of real-time systems: systems of parallel interacting components whose execution essentially depends not only on the order of the events in the system, but also on the real time of these events. The concept of hierarchical timed automaton covers the syntactic variations that are used in existing studies and are non-comparable by their expressive power. The number of states in a flattened network of time automata is of the least order among the flattening results of existing studies.

One-Pass and Tree-Shaped Tableau Systems for TPTL and TPTLb+Past

In this paper, we propose a novel one-pass and tree-shaped tableau method for Timed Propositional Temporal Logic and for a bounded variant of its extension with past operators. Timed Propositional Temporal Logic (TPTL) is a real-time temporal logic, with an EXPSPACE-complete satisfiability problem, which has been successfully applied to the verification of real-time systems. In contrast to LTL, adding past operators to TPTL makes the satisfiability problem for the resulting logic (TPTL+P) non-elementary. In this paper, we devise a one-pass and tree-shaped tableau for both TPTL and bounded TPTL+P (TPTLb+P), a syntactic restriction introduced to encode timeline-based planning problems, which recovers the EXPSPACE-complete complexity. The tableau systems for TPTL and TPTLb+P are presented in a unified way, being very similar to each other, providing a common skeleton that is then specialised to each logic. In doing that, we characterise the semantics of TPTLb+P in terms of a purely syntactic fragment of TPTL+P, giving a translation that embeds the former into the latter. Soundness and completeness of the system are proved fully. In particular, we give a greatly simplified model-theoretic completeness proof, which sidesteps the complex combinatorial argument used by known proofs for the one-pass and tree-shaped tableau systems for LTL and LTL+P.

A multi-mode real-time system verification model using efficient event-driven dataset

Real-time systems experience many safety and performance issues at run time due to different uncertainties in the environment. Systems are now becoming highly interactive and must be able to execute in a changing environment without experiencing any failure. A real-time system can have multiple modes of operation such as safety and performance. The system can satisfy its safety and performance requirements by switching between the modes at run time. It is essential for the designers to ensure that a multi-mode real-time system operates in the expected mode at run time. In this paper, we present a verification model that identifies the expected mode at run time and checks whether the multi-mode real-time system is operating in the correct mode or not. To determine the expected mode, we present a monitoring module that checks the environment of the system, identifies different real-world occurrences as events, determines their properties and creates an event-driven dataset for failure analysis. The dataset consumes less memory in comparison to the raw input data obtained from the monitored environment. The event-driven dataset also facilitates onboard decision-making because the dataset allows the system to perform a safety analysis by determining the probability of failure in each environmental situations. We use the probability of failure of the system to determine the safety mode in different environmental situations. To demonstrate the applicability of our proposed scheme, we design and implement a real-time traffic monitoring system that has two modes: safety, and performance. The experimental analysis of our work shows that the verification model can identify the expected operating mode at run time based on the safety (probability of failure) and performance (usage) requirements of the system as well as allows the system to operate in performance mode (in 3295 out of 3421 time intervals) and safety mode (in 126 out of 3421 time intervals). The experimental result demonstrates that the volume of the dataset generated using our approach is significantly less in comparison to existing data compression techniques.

Exploiting Execution Dynamics in Timing Analysis Using Job Sequences

Editor’s note: Performance verification for real-time systems is based on system models for which it is possible to formally derive safe timing parameters such as worst case response times. In order to make such a verification manageable, the models are often oversimplified compared to the real loads and, thus, the results, even if safe, are overly pessimistic. This article presents modeling and analysis techniques based on richer models that allow for a more accurate representation of real workloads and produce less pessimistic results. In particular, the authors argue for sequence-based approaches in both modeling the workload and specifying the imposed constraints. They also show how such approaches can be applied in industrial practice. — Petru Eles, Linkoping University

Formal Specification of Memory Coherence Protocol

Memory coherence is the most fundamental re-quirement in a shared virtual memory system where there are concurrent as well as loosely coupled processes. These processes can demand a page for reading or writing. The memory is called coherent if the last update in a page remains constant for each process until the owner of that page does not change it. The ownership is transferred to a process interested to update that page. In [Kai LI, and Paul Hudak. Memory Coherence in Shared Virtual Memory Systems, 1986. Proc. of Fifth Annual ACM Symposium on Principles of Distributed Computing.], algorithms ensuring memory coherence are given. We formally specify these protocols and report the improvements through formal analysis. The protocols are specified in UPPAAL, i.e., a tool for modeling, validation and verification of real-time systems.

Formal Verification of Real-Time Systems with Data Processing

The behavior of practical safety critical systems often combines real-time behavior with structured data flow. To ensure correctness of such systems, both aspects have to be modeled and formally verified. Time related behavior can be efficiently modeled and analyzed in terms of timed automata. At the same time, program verification techniques like abstract interpretation and software model checking can efficiently handle data flow. In this paper, we describe a simple formalism that represents both aspects of such systems in a uniform and explicit way, thus enables the combination of formal analysis methods for real-time systems and software using standard techniques.

Tools and Methods for RTCP-Nets Modeling and Verification

Abstract RTCP-nets are high level Petri nets similar to timed colored Petri nets, but with different time model and some structural restrictions. The paper deals with practical aspects of using RTCP-nets for modeling and verification of real-time systems. It contains a survey of software tools developed to support RTCP-nets. Verification of RTCP-nets is based on coverability graphs which represent the set of reachable states in the form of directed graph. Two approaches to verification of RTCP-nets are considered in the paper. The former one is oriented towards states and is based on translation of a coverability graph into nuXmv (NuSMV) finite state model. The later approach is oriented towards transitions and uses the CADP toolkit to check whether requirements given as μ-calculus formulae hold for a given coverability graph. All presented concepts are discussed using illustrative examples

On the real time modeling of interlocking system of passenger lines of Rawalpindi Cantt train station

Abstract Purpose Recent advancements in technology have enabled railway organizations to shift from manual to computer based automated interlocking systems for increasing their efficiency and profits. Since automated systems are complex and interlocking systems are safety critical systems, these systems should be modeled and verified against safety requirements to weed out any design bugs which might lead to catastrophes during their system life cycles. In this study, we model software based automated interlocking control system of a train station, located at Rawalpindi Cantt (Pakistan). Methods We have modeled software based automated interlocking control system using timed automata and verified its correctness using UPPAAL model checking software. Timed automata have successfully been used for the modeling and verification of real-time systems. Results We constructed a real-time model of railyard interlocking system by employing a model-checking approach to determine behavior of the model under various conditions. The model checker ascertains the absence of errors in a system by inspecting all the possible states or scenarios of the modeled system. The results show that important properties related to the safety of the designed interlocking system of the railyard management system can be verified using our presented approach. These properties ranged from collision and de-railment avoidance to checking the correct error handling functionality of the timed automata models. Conclusions The final modular design can easily adapt to the route upgrades and changes within the station by simple variable adjustments. Based on the laid down methodology and verification techniques, this study can be further built upon, extended and linked to cover the shunting aspect of the train station operations, run through operations, introducing automatic train stop (ATS) functionality and recommend three to four aspect traffic signaling for the train station. This study takes a first step in providing an indigenous solution to an indigenous problem of designing an upgraded and verified signaling infrastructure for Pakistan Railway’s Rawalpindi Cantt train station.

Formal Verification of UML2 Timing Diagrams based on Time Petri Nets

Unified Modeling Language (UML) is using in the design notation in industry and academia projects. Interesting by the critical Real-Time System verification, it is important to ensure its dependability in order to avoid eventual errors. In this paper, the authors aim to extend the UML diagrams by adding a formal verification stage. They tackle with the UML2 timing diagram (TD), as interaction diagram in order to describe the system's behavior in temporal way. For that, the authors give a formal description for TD using Time Petri Nets (TPN). Then, they propose a formal verification by means of Romeo Model Checker. In particular, they show how to formulate quantitative properties using TCTL (timed computation tree logic). In addition, the authors show how they can derive the TCTL formulae from Object Constraint Language-Real Time (OCLRT) constraints. Finally, they illustrate the proposed approach through a real case study.

Verification Method of Real-time System Based on Refinement Relation

With the continuous increase in the size and complexity of a real-time computer system, the use of formal verification methods in software development is also on the rise. The traditional formal verification method is not fully applicable to the development of actual system life cycle. Therefore, this paper presents a new real-time system verification method, It takes the deadlock timed Buchi automata as the medium, and translates the timed temporal logic into timed communicating sequential process language. The tock event is also joined, which can be directly used for the detection of refinement tool FDR. The method verifies the situation of deadlock. To establish the link between the conventional model checking and refinement model checking can well combine the advantages of both and improves system security and reliability.

How to make a simple tool for verification of real-time systems

To verify real-time properties of UML statecharts one may apply a UPPAAL, toolbox for model checking of real-time systems. One of the most suitable ways to specify an operational semantics of UML statecharts is to invoke the formal model of Hierarchical Timed Automata. Since the model language of UPPAAL is based on Networks of Timed Automata one has to provide a conversion of Hierarchical Timed Automata to Networks of Timed Automata. In this paper we describe this conversion algorithm and prove that it is correct w.r.t. UPPAAL query language which is based on the subset of Timed CTL.

Structural transformations for data-enriched real-time systems

Abstract We investigate design-level structural transformations that aim at easier subsequent verification of real-time systems with shared data variables, modelled as networks of extended timed automata (ETA). Our contributions to this end are the following: (1) we first equip ETA with an operator for layered composition , intermediate between parallel and sequential composition. Under certain non-interference and/or precedence conditions imposed on the structure of the ETA networks, the communication closed layer (CCL) laws and associated partial-order (po-) and (layered) reachability equivalences are shown to hold. (2) Next, we investigate (under certain cycle conditions on the ETA) the (reachability preserving) transformations of separation and flattening aimed at reducing the number of cycles of the ETA. (3) We then show that our separation and flattening in (2) may be applied together with the CCL laws in (1), in order to restructure ETA networks such that the verification of layered reachability properties is rendered easier. This interplay of the three structural transformations (separation, flattening, and layering) is demonstrated on an enhanced version of Fischer’s real-time mutual exclusion protocol for access to multiple critical sections.

From Timed Reo Networks to Networks of Timed Automata

The Reo coordination language is an extensible graphical notation for component or service coordination wherein independent autonomous software entities exchange data through a connector or a network imposing synchronization and data constraints on those entities. Each connector is formed from a set of binary connectors, called channels, with precise semantics and, thus, amenable to formal verification. However, the development of verification tools for Reo-specific semantic models, namely, constraint automata with its multiple extensions to represent quality of service, time constraints, context-dependent or probabilistic behavior would require years of research and development. A much more promising approach is to exploit already existing verification tools. In this paper, we present a mapping of timed Reo networks to networks of timed automata used for system specification in Uppaal. Uppaal is a state-of-the-art toolset for modeling, validation and verification of real-time systems used in many large-scale industrial projects. Our work enables its application to the compositional analysis of timed service-based workflow models specified with Reo.

Design, Analysis and Verification of Real-Time Systems Based on Time Petri Net Refinement

A type of refinement operations of time Petri nets is presented for design, analysis and verification of complex real-time systems. First, the behavior preservation is studied under time constraints in a refinement operation, and a sufficient condition for behavior preservation is obtained. Then, the property preservation is considered, and the results indicate that if the refinement operation of time Petri nets satisfies behavior preservation, it can also preserve properties such as boundedness and liveness. Finally, based on the behavior preservation, a reachability decidability algorithm of a refined time Petri net is designed using the reachability trees of its original net and subnet. The research results are illustrated by an example of designing, analyzing and verifying a real-time manufacturing system.