Well-formedness Properties Research Articles

Burst Automaton: Framework for Speed-Independent Synthesis Using Burst-Mode Specifications

Burst-Mode (BM) formalism is a variant of an asynchronous Finite State Machine (FSM) that operates in ‘burst-mode’ timing assumption and offers simple entry into asynchronous circuit design. However, some of BM’s well-formedness properties, while useful for implementing BM specifications as circuits, are rather restrictive in some important contexts e.g. BM’s maximal set property (or its analog, Extended Burst-Mode (XBM) formalism’s distinguishability constraint) forbids non-deterministic specifications that are inherent in some design approaches, input and output bursts must alternate meaning BMs are not a proper extension of FSMs with arcs labelled by single events, and BMs cannot express input-output concurrency whereas FSMs can with interleaving. The latter limitation is particularly problematic when interoperability between several formalisms is desirable. In this paper, we propose the Burst Automation (BA) model that is more powerful and yet simpler than BM, by relaxing BM’s well-formedness properties. BA is a proper extension of FSMs, and can express input-output concurrency and non-determinism. We define BA’s interleaving semantics via its asynchronous reachability graph that is an FSM, and develop three translations from BAs to Signal Transition Graphs (STGs) that preserve strong bisimulation, weak bisimulation, or the language. Former two translations may be exponential, whereas latter translation is linear. The resulting STG can then be used for verification and synthesis into Speed-Independent (SI) or Quasi-Delay-Insensitive (QDI) circuits, or for composition with other STGs. The proposed workflow was implemented in Workcraft, and experimental results show an improved synthesis rate and a significant reduction in the literal count.

Validating, verifying and testing timed data-flow reactive systems in Coq from controlled natural-language requirements

• Coq framework for validating, verifying and testing timed data-flow reactive systems. • Formal specification derived from controlled natural-language requirements. • System validation (verification) supported by bounded exploration (proof scripts). • Test generation supported by random sampling and user-defined test purposes. • Empirical analyses considering examples from the literature and industry. Data-flow reactive systems (DFRSs) form a class of embedded systems whose inputs and outputs are always available as signals. Input signals can be seen as data provided by sensors, whereas the output data are provided to system actuators. In previous works, verifying well-formedness properties of DFRS models was accomplished in a programmatic way, with no formal guarantees, and test cases were generated by translating these models into other notations. Here, we use Coq as a single framework to specify, validate and verify DFRS models. Moreover, the specification of DFRSs in Coq is automatically derived from controlled natural-language requirements, and well-formedness properties are formally verified with no user intervention. System validation is supported by bounded exploration of models; general and domain-specific system property verification is supported by the development of proof scripts, and test generation is achieved with the aid of the QuickChick tool. Considering examples from the literature, but also from the aerospace (Embraer) and the automotive (Mercedes) industries, our automatic testing strategy was evaluated in terms of performance and the ability to detect defects generated by mutation. Within seconds, test cases were generated automatically from the requirements, achieving an average mutation score of about 75%.

The role of safety architectures in aviation safety cases

We develop a notion of safety architecture (SA), based on an extension to Bow Tie Diagrams (BTDs), to characterize the overall scope of the mitigation measures undertaken to provide safety assurance at both design time and during operations. We motivate the need for SAs, whilst also illustrating their application and utility in the context of aviation systems, through an example based upon a safety case for an unmanned aircraft system mission that successfully underwent regulatory scrutiny. We elaborate how SAs fit into our overall safety assurance methodology, also discussing the key role they play in conjunction with structured assurance arguments to provide a more comprehensive basis for the associated safety case. We give a formal semantics as a basis for implementing both BTDs and SAs in our assurance case tool, AdvoCATE, describing the functionality afforded to support both the related safety analysis and subsequent development activities, e.g., enforcement of well-formedness properties, computation of residual risk, and model-based views and transformations.

Logics for unordered trees with data constraints

We study monadic second-order logics with counting constraints (CMso) for unordered data trees. Our objective is to enhance this logic with data constraints for comparing string data values. Comparisons between data values at arbitrary positions of a data tree quickly lead to undecidability. Therefore, we restrict ourselves to comparing sibling data values of unordered trees. But even in this case CMso remains undecidable when allowing for data comparisons that can check the equality of string factors. However, for more restricted data constraints that can only check the equality of string prefixes, it becomes decidable. This decidability result is obtained by reduction to WSkS. Furthermore, we exhibit a restricted class of constraints which can be used in transitions of tree automata, resulting in a model with tractable complexity, which can be extended with structural equality tests between siblings. This efficient restriction is relevant to applications such as checking well-formedness properties of file system trees.

A survey of Euler diagrams

Euler diagrams visually represent containment, intersection and exclusion using closed curves. They first appeared several hundred years ago, however, there has been a resurgence in Euler diagram research in the twenty-first century. This was initially driven by their use in visual languages, where they can be used to represent logical expressions diagrammatically. This work lead to the requirement to automatically generate Euler diagrams from an abstract description. The ability to generate diagrams has accelerated their use in information visualization, both in the standard case where multiple grouping of data items inside curves is required and in the area-proportional case where the area of curve intersections is important. As a result, examining the usability of Euler diagrams has become an important aspect of this research. Usability has been investigated by empirical studies, but much research has concentrated on wellformedness, which concerns how curves and other features of the diagram interrelate. This work has revealed the drawability of Euler diagrams under various wellformedness properties and has developed embedding methods that meet these properties.Euler diagram research surveyed in this paper includes theoretical results, generation techniques, transformation methods and the development of automated reasoning systems for Euler diagrams. It also overviews application areas and the ways in which Euler diagrams have been extended.

Wellformedness Properties in Euler Diagrams: Which Should Be Used?

Euler diagrams are often used to visualize intersecting data sets in applications such as criminology; genetics, medicine, and computer file systems. One interesting aspect of these diagrams is that some data sets cannot be drawn without breaking one or more "wellformedness properties," which are considered to reduce the user comprehension of the diagrams. However, it is possible to draw the same data with different diagrams, each of which breaks different wellformedness properties. Hence, some properties are "swappable," so motivating the study of which of the alternatives would be best to use. This paper reports on the two empirical studies to determine how wellformedness properties affect comprehension. One study was with abstract data, the other was with concrete data that visualized students' enrollment on university modules. We have results from both studies that imply that diagrams with concurrency or disconnected zones perform less well than other some other properties. Further, we have no results that imply that diagrams with brushing points adversely affect performance. Our data also indicate that nonsimple curves are preferred less than diagrams with other properties. These results will inform both human diagram designers and the developers of automated drawing systems on the best way to visualize data using Euler diagrams.

Genesys: service-oriented construction of property conform code generators

This paper presents Genesys, a framework for the high-level construction of property conform code generators. Genesys is an integral part of jABC, a flexible framework designed to enable a systematic model-driven development of systems and applications on the basis of an (extensible) library of well-defined, reusable building blocks. Within jABC, Genesys manages the construction of code generators for jABC’s models. So far, Genesys has been used to develop code generators for a variety of different target platforms, like a number of Java-based platforms, mobile devices, BPEL engines, etc. Since the code generators are themselves built within the jABC in a model-driven way, concepts like bootstrapping and reuse of existing components enable a fast evolution of Genesys’ code generation library, and a high degree of self-application. Due to its increasing complexity and its high degree of reuse, Genesys profits from model checking-based verification. This way, jABC’s models of code generators can be automatically checked wrt. well-formedness properties, to ensure that the models do indeed only consist of building blocks which are suitable for the considered target platforms, and whose versions are mutually compatible. It can be also be verified that the code generation process only starts after a successful initialization phase, and that the generated code is always packaged with all the required libraries. We will illustrate the ease of extension and flexibility of the Genesys framework by describing the intended coverage of diversity while highlighting the high potential of reuse.

Statically safe program generation with SafeGen

SafeGen is a meta-programming language for writing statically safe generators of Java programs. If a program generator written in SafeGen passes the checks of the SafeGen compiler, then the generator will only generate well-formed Java programs, for any generator input. In other words, statically checking the generator guarantees the correctness of any generated program, with respect to static checks commonly performed by a conventional compiler (including type safety, existence of a superclass, etc.). To achieve this guarantee, SafeGen supports only language primitives for reflection over an existing well-formed Java program, primitives for creating program fragments, and a restricted set of constructs for iteration, conditional actions, and name generation. SafeGen’s static checking algorithm is a combination of traditional type checking for Java, and a series of calls to a theorem prover to check the validity of first-order logical sentences, constructed to represent well-formedness properties of the generated program under all inputs. The approach has worked quite well in our tests, providing proofs for correct generators or pointing out interesting bugs.

Goal-directed requirements acquisition

Requirements analysis includes a preliminary acquisition step where a global model for the specification of the system and its environment is elaborated. This model, called requirements model, involves concepts that are currently not supported by existing formal specification languages, such as goals to be achieved, agents to be assigned, alternatives to be negotiated, etc. The paper presents an approach to requirements acquisition which is driven by such higher-level concepts. Requirements models are acquired as instances of a conceptual meta-model. The latter can be represented as a graph where each node captures an abstraction such as, e.g., goal, action, agent, entity, or event, and where the edges capture semantic links between such abstractions. Well-formedness properties on nodes and links constrain their instances—that is, elements of requirements models. Requirements acquisition processes then correspond to particular ways of traversing the meta-model graph to acquire appropriate instances of the various nodes and links according to such constraints. Acquisition processes are governed by strategies telling which way to follow systematically in that graph; at each node specific tactics can be used to acquire the corresponding instances. The paper describes a significant portion of the meta-model related to system goals, and one particular acquisition strategy where the meta-model is traversed backwards from such goals. The meta-model and the strategy are illustrated by excerpts of a university library system.