Alvis – Modelling Language for Concurrent Systems

A model checker is an automatic tool that traverses a specific structure (normally a Kripke structure referred as the modelM) to check the satisfaction of some (temporal) logical propertyf. This is formally stated asM⊧f. For some formal notations, the modelMof a specificationS(written in a formal languageL) can be described as a labelled transition system (LTS). Specifically, it is not clear in general how usual tools such as SPIN, FDR, PAT, etc., create the LTS representation from a given process. Although one expects the coherence of the LTS generation with the semantics ofL, it is completely hidden inside the model checker itself. In this paper we show how to create a model checker forL, using a development approach based on its operational semantics. We use a systematic semantics embedding and the formal modeling using logic programming and analysis (FORMULA) framework to this end. We illustrate our strategy considering the formal language COMPASS modelling language (CML)—a new language that was based on CSP, VDM and the refinement calculus proposed for modelling and analysis of systems of systems. As FORMULA is based on satisfiability modulo theories solving, our model checker can handle communications and predicates involving data with infinite domains by building and manipulating a symbolic LTS. This goes beyond the capabilities of traditional CSP model checkers such as FDR and PAT. Moreover, we show how to reduce time and space complexities by simple semantic modifications in the embedding. This allows a more semantics-preserving tuning. Finally, we show a real implementation of our model checker in an integrated development platform for CML and its practical use on an industrial case study.

This paper discusses a Unified Modelling Language (UML) based formal verification methodology for early error detection in the model-based software development cycle. Our approach proposes a UML-based formal verification process utilising functional and behavioural modelling artifacts of UML. It reinforces these artifacts with formal model transition and property verification. The main contribution is a UML to Labelled Transition System (LTS) Translator application that automatically converts UML Statecharts to formal models. Property specifications are derived from system requirements and corresponding Computational Tree Logic (CTL)/Linear Temporal Logic (LTL) model checking procedure verifies property entailment in LTS. With its ability to verify CTL and LTL specifications, the methodology becomes generic for verifying all types of embedded system behaviours. The steep learning curve associated with formal methods is avoided through the automatic formal model generation and thus reduces the reluctance of using formal methods in software development projects. A case study of an embedded controller used in military applications validates the methodology. It establishes how the methodology finds its use in verifying the correctness and consistency of UML models before implementation.

CSP# is a formal modeling language that emphasizes the design of communication in concurrent systems. PAT framework provides a model checking environment for the simulation and verification of CSP# models. Although the desired properties can be formally verified at the design level, it is not always straightforward to ensure the correctness of the system's implementation conforms to the behaviors of the formal design model. To avoid human error and enhance productivity, it would be beneficial to have a tool support to automatically generate the executable programs from their corresponding formal models. In this paper, we propose such a solution for translating verified CSP# models into C# programs in the PAT framework. We encoded the CSP# operators in a C# library-PAT.Runtime, where the event synchronization is based on the Monitor class in C#. The precondition and choice layers are built on top of the CSP event synchronization to support language-specific features. We further developed a code generation tool to automatically transform CSP# models into multi-threaded C# programs. We proved that the generated C# program and original CSP# model are equivalent on the trace semantics. This equivalence guarantees that the verified properties of the CSP# models are preserved in the generated C# programs. Furthermore, based on the existing implementation of choice operator, we improved the synchronization mechanism by pruning the unnecessary communications among the choice operators. The experiment results showed that the improved mechanism notably outperforms the standard JCSP library.

The fulfillment of time requirements is one of the major acceptance criteria of safety-critical and real-time systems. They are dictated by the environment of these systems and are often well known at the early phases of the development process. At the same time, the time behavior is a cross-cutting concern, not bordered by the behavioral design units, e.g. components or classes. This paper argues for consideration of the time behavior as an explicit model-based view on the system under development. It proposes a modeling language and an analysis method. The formal graphical modeling language allows the explicit notation of time requirements and the integration with the architectural and behavioral aspects of the system. The analysis method allows the developer to verify requirements in aspect of their consistency and completeness as well as to validate design concerning the fulfillment of time requirements. It supports modular development, for which results are presented.

Critical systems are present in our daily life and affect many aspects providing essential support to several human activities; they are employed in several application domains, providing support to economic activities, transportation, communication, health-care. Such systems must meet strict non-functional requirements, including dependability requirements, and should be able to cope with competitive market needs. Their criticality implies the necessity to meet several requirements, often dictated by international standards, whose fulfillment must be demonstrated in order to achieve necessary certifications. Quantitative evaluations are hence needed to assess and demonstrate compliance with target requirements, since design phases of the lifecycle. For this purpose modeling approaches have been investigated during the years; their aim is to have a of the overall system which allows to assess and demonstrate these properties. It is commonly known that the adoption of formal models in industry, although if strongly recommended when not mandatory, is slowed down by difficulties dictated both by the complexity of the models (which reflects the complexity of the systems) and by the need to have skilled staff in the usage of formal languages. For this reason, also if the academic research trends have focused on complex modeling approaches and techniques, formal models are not so used in industries: in particular only combinatorial models are widely adopted, thanks to their intuitive representation. The great simplifications introduced by combinatorial models lead to approximated results, hence system designers do not trust in them. In the last years the need of a model engineering is noticed: there is the necessity to define appropriate methodologies and processes to support development activities of complex models, aiming at improving the quality/cost ratio. In this way three main research trends have been introduced: formal models generation, multiformalism, and compositional approaches. This thesis aims at defining a methodology for quantitative analysis of critical system that can integrate Model-Based evaluations, conducted by using formal models, with Model-Driven Engineering (MDE) paradigms, taking advantage of the actual research trends. More in detail, according to such approach, critical systems properties can be assessed starting from high level models expressed in proper languages (usually called Domain Specific Modeling Languages - DSMLs), and defining automatic transformation chains, able to generate formal models. The methodology is implementable into cost-effective processes in order to reduce time-to-market specifically during verification stages of critical system development lifecycles. Such objective will be achieved by both improving usability and re-usability of typical Model-Driven artifacts. The adoption of this methodology for railway system dependability analysis may lead to an estimated costs reduction of approximately 30%. The usage of a high-level central language significantly decreases also the training time of new analysts, as they only need to learn the DSML usage (properly developed for the application domain). This thesis defines also two high-level modeling languages: the first, CIP_VAM, has been defined to vulnerability aspects of physical infrastructures, while the second, DAM-Rail, allows the dependability modeling in railway domain. Another important contribution of this thesis is given in the definition of new methods and formal operators: in detail a reference architecture for performability and Quality of Service evaluation is defined, as well as the formal concept of Model Template is introduced (to enable reuse). At last two techniques which deals with scalability are addressed: stub and reduced models. Even if the focus is on quantitative evaluation, the proposed methodology is useful also for the complete design (based on centralized informations), hence it is possible to extend it for automatic generation of documents and, more generally, of all those artifacts which support system development. The proposed approach has been applied with different goals to case studies coming from three different domains: railway systems, conferencing systems, and sensor network. These systems have different and complementary properties in terms of number of involved components, scalability, etc. Produced models are described, and obtained results are shown and commented.

Checking of models built using a graphically based formal modelling language

Business process management encompasses a variety of tasks that can be solved system-aided but usually require formal process representations, i.e. process models. However, it requires a significant effort to learn a formal process modeling language like, for instance, BPMN. Among others, this is one reason why companies often still stick to informal textual process descriptions. However, in contrast to formal models, information from natural language text usually cannot be automatically processed by algorithms. Hence, recent research also focuses on annotated textual process descriptions to make text machine processable. While still human-readable, they additionally contain annotations following a formal scheme. Thus, they also enable automated processing by, for instance, formal reasoning and simulation. State-of-the-art techniques for automatically annotating textual process descriptions are either based on hand-crafted rule sets or artificial neural networks. Maintaining complex rule sets requires a significant manual effort and the approaches using neural networks suffer from rather low result quality. In this paper we present an approach based on Semantic Parsing and Graph Convolutional Networks that avoids manually defined rules and provides significantly better results than existing techniques based on neural networks. A comprehensive evaluation using multiple data sets from both academia and industry shows encouraging results and differentiates between several applied text features.

Multi-touch gestures like swipe and pinch have introduced a new interaction paradigm that is currently used in developing mobile applications. Such applications can include different user gestures that cause different results for different interactions with the same user interface element. Testing such user interaction is complex. We present a formal task-based approach to automate testing of user gestures in mobile applications. In previous work, we used TaMoGolog, a formal task modelling language built on the top of the Golog family of high-level programming languages, for evaluating user interfaces along the development process. In this work, we present MobiGolog that extends TaMoGolog to support the testing of users' multi-touch gestures in the developing and developed mobile applications.

The Unified Modeling Language UML is well-suited for the design of real-time systems. In particular the design of dynamic system behaviors is supported by interaction diagrams and statecharts. Real-time aspects of behaviors can be described by time constraints. The semantics of the UML, however, is non-formal. In order to enable formal design verification, we therefore propose to complement the UML based design by additional formal models which refine UML diagrams to precise formal models. We apply the formal specification technique cTLA which is based on L. Lamport's Temporal Logic of Actions, TLA. In particular cTLA supports modular definitions of process types and the composition of systems from coupled process instances. Since process composition has superposition character each process system has all of the relevant properties of its constituting processes. Therefore mostly small subsystems are sufficient for the verification of system properties and it is not necessary to use complete and complex formal system models. We present this approach by means of an example and also exemplify the formal verification of its hard real-time properties.

The situation of telecommunications systems is rapidly evolving towards a state characterized by the presence of a multitude of services integrated in a single network structure. In order to ease their integration, it is important to provide an unambiguous description of the organization, of the functionality, and of the relationships existing among services. Since it is not possible to completely foresee the situation of services in the future, the description should be modular, so that the task of adding new services to an existing environment is simplified. Formal description techniques are languages designed to handle such descriptions. Their goal is to produce correct and unambiguous specifications, understanding and modeling the system and the domain within which it operates. Their input is a set of required statements and a conceptual overview of the system. Their output is a formal representation that captures the functional behavior. On the other hand, the throughput of physical networks is constantly growing, reaching the order of Gbit/s. In the meantime, services needing high throughput, like multimedia conferencing systems are being designed, creating a need for flexible, high performance communication systems. An important feature of new high speed services is their increased need for guarantees. Therefore, the use of powerful performance modeling techniques becomes of prime importance. Their goal is to obtain some notion of how the system will perform under a given set of conditions. Performance evaluation theorists have long been using system specifications to make a heuristic model of the system and then an analysis of the model. When system specifications exist, the question arises whether a more direct path to performance analysis can be found. Our scope is to provide a methodology that fully and consistently integrates formal specification and performance evaluation. A problem is that many of the bottlenecks and impediments to smooth data flow have to do with implementation issues not directly dealt within the system specification itself. Therefore, prior to generating a performance model, the formal specification should be enhanced with the relevant non-functional information. It is essential to assure a smooth specification of the non-functional information. Thus, it is necessary to consistently add this information to the formal specification. Besides, the extended formal method should focus on conserving the semantics of the original one, and on providing a coherent extension of the semantics and syntax for the new concepts. Since all relevant required information is integrated within the formal extended representation, we provide a mapping technique that translates the extended formal representation into a performance modeling conserving the properties of the formal model. In parallel to the development of a performance model, the formal model can be validated and verified, and their implementation can be tested for conformance towards the original formal model. Finally, the performance modelling is implemented in a programming language, and then simulated. The results from simulation can be reused as inputs for the optimization of the formal specification (functional optimization) or the extended formal model (design optimization). To sum up, the goal of this work is to: Define extensions to current formal methods that allow to enhance the formal specification with performance modeling related information. Develop a method to translate the extended formal specification into a performance modeling. Develop rules and guidelines to automatically implement the performance modeling for the purpose of a performance evaluation (we use the commercial tool Opnet). Develop a consistent and coherent methodology for the integration of performance modeling and formal specification.

Often the most effective diagrams are those which are very simple. However there is a strong tendency, particularly prevalent in visual formal modelling and specification languages, to take a diagrammatic language which at core is very simple, and then add many extensions and features to make it more expressive - often making it so expressive that the diagrams produced in the language are no longer readable; or at least, the diagrams are no longer obviously a more effective form of representation than a text-based one. Both the design of effective visual formal modelling and specification languages, and the effective formalisation of (the semantics of) such visual languages requires the unification of results from visual language theory, cognitive science, empirical psychology and graphic design. Integrating results from such diverse fields is a non-trivial task, which may be approached through a decomposition of the study of issues of effectiveness in diagrammatic languages according to analogous understandings of (written and spoken) natural languages.

The next few years will see distributed real-time computer systems playing an important role in control systems of high-dependability applications, such as rail transportation. In these applications a failure in the temporal domain can be as critical as a failure in the value domain. In rail transportation, train control system has become more complex and the methods to ensure its correctness of have been considered outmoded. The safety of train control system is becoming increasingly important as computers pervade them on which human life depends and the failure to meet time deadline can have serious or even fatal consequences. This paper proposes a formal modeling and verification approach for real-time system. In the proposed method the real-time system is modeled by timed automata network (TAN) and verified by model checking which explores the state space to determine whether the system satisfies a given specification. The case study of ATP (automatic train protection) shows how the method can assist in designing more efficient and reliable real-time systems. Firstly, automatic train protection (ATP) system and timed automata network (TAN) model is proposed; secondly, the state transitions and multi-tasks ATP onboard model was modeled with TAN model, and then the time sequences of each task are expressed in UML sequence diagrams. Finally, the timing characteristics was verified to meet the requirement by UPPAAL model checker. A major conclusion of the survey is that formal methods, while still immature in some respects, can be used successfully to model and verify real-time systems.

In information systems engineering, conceptual models are constructed to assess existing information systems and work out requirements for new ones. As these models serve as a means for communication between customers and developers, it is paramount that both parties understand the models, as well as that the models form a proper basis for the subsequent design and implementation of the systems. New CASE environments are now experimenting with formal modeling languages and various techniques for validating conceptual models, though it seems difficult to come up with a technique that handles the linguistic barriers between the parties involved in a satisfactory manner. In this article, we discuss the theoretical basis of an explanation component implemented for the PPP CASE environment. This component integrates other validation techniques and provides a very flexible natural-language interface to complex model information. It describes properties of the modeling language and the conceptual models in terms familiar to users, and the explanations can be combined with graphical model views. When models are executed, it can justify requested inputs and explain computed outputs by relating trace information to properties of the models.

PROMELA is a high level modeling language for model checking purpose. PROMELA model can be checked using SPIN (Simple PROMELA Interpreter) model checker to ensure formally some specifications hold in the model. However, PROMELA does not have formal and clear semantics. It is interpreted under SPIN implementation only and thus is bounded into SPIN. With high-level language it has, PROMELA has gain fame in model checker world due to its easiness to capture process model using high level language. Describing PROMELA formal semantic is a good way to broaden PROMELA usage. One of PROMELA feature is the ability to model concurrent processes, in which the concurrent process may not start from the same time point. This feature, called dynamic process creation, is essential to be noticed, to ensure that state-transition of PROMELA model is correct. Dynamic process creation in PROMELA should be defined formally, we use Labeled Transition Systems (LTSs) to describe formal semantic of PROMELA dynamic process creation.

Multidatabase interoperability in the Jupiter system