Failure Semantics for Modal Transition Systems

Modal transition systems (MTS) is a well-studied specification formalism of reactive systems supporting a step-wise refinement methodology. Despite its many advantages, the formalism as well as its currently known extensions are incapable of expressing some practically needed aspects in the refinement process like exclusive, conditional and persistent choices. We introduce a new model called parametric modal transition systems (PMTS) together with a general modal refinement notion that overcomes many of the limitations. We investigate the computational complexity of modal and thorough refinement checking on PMTS and its subclasses and provide a direct encoding of the modal refinement problem into quantified Boolean formulae, allowing us to employ state-of-the-art QBF solvers for modal refinement checking. The experiments we report on show that the feasibility of refinement checking is more influenced by the degree of nondeterminism rather than by the syntactic restrictions on the types of formulae allowed in the description of the PMTS.

Modal Transition System (MTS) is a well studied formalism for partial model specification. It allows a modeller to distinguish between required, prohibited and possible transitions. Disjunctive MTS (DMTS) is an extension of MTS that has been getting attention in recent years. A key concept for (D)MTS is refinement, supporting a development process where abstract specifications are gradually refined into more concrete ones. Refinement comes in different flavours: strong, observational (where \(\tau \)-labelled transitions are taken into account), and alphabet (allowing the comparison of models defined on different alphabets). Another important operation on (D)MTS is that of merge: given two models M and N, their merge is a model P which refines both M and N, and which is the least refined one.

Modal transition systems are an elegant way to formalise the design process of a system through refinement and composition. Here we propose to adapt this methodology to asynchronous composition via Petri nets. The Petri nets that we consider have distinguished labels for inputs, outputs, internal communications and silent actions and “must” and “may” modalities for transitions. The input/output labels show the interaction capabilities of a net to the outside used to build larger nets by asynchronous composition via communication channels. The modalities express constraints for Petri net refinement taking into account observational abstraction from silent transitions. Modal I/O-Petri nets are equipped with a modal transition system semantics. We show that refinement is preserved by asynchronous composition and by hiding of communication channels. We study compatibility properties which express communication requirements for composed systems and we show that these properties are decidable, they are preserved in larger contexts and also by modal refinement. On this basis we propose a methodology for the specification of distributed systems in terms of modal I/O-Petri nets which supports incremental design, encapsulation of components, stepwise refinement and independent implementability.KeywordsCommunication PropertySilent TransitionConsuming PropertyModal RefinementInput LabelThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Modal transition systems provide a behavioral and compositional specification formalism for reactive systems. We survey two extensions of modal transition systems: parametric modal transition systems for specifications with parameters, and weighted modal transition systems for quantitative specifications.

Modal Transition Systems (MTSs) provide an appropriate framework for modelling software behaviour when only a partial specification is available. A key characteristic of an MTS is that it explicitly models events that a system is required to provide and is proscribed from exhibiting, and those for which no specification is available, called maybe events. Incremental elaboration of maybe events into either required or proscribed events can be seen as a process of MTS refinement, resulting from extending a given partial specification with more information about the system behaviour. This paper focuses on providing automated support for computing strong refinements of an MTS with respect to event traces that describe required and proscribed behaviours using a non-monotonic inductive logic programming technique. A real case study is used to illustrate the practical application of the approach.

In the setting of the modal logic that characterizes modal refinement over modal transition systems, Boudol and Larsen showed that the formulae for which model checking can be reduced to preorder checking, that is, the characteristic formulae, are exactly the consistent and prime ones. This paper presents general, sufficient conditions guaranteeing that characteristic formulae are exactly the consistent and prime ones. It is shown that the given conditions apply to various behavioural relations in the literature. In particular, characteristic formulae are exactly the prime and consistent ones for all the semantics in van Glabbeek's linear time-branching time spectrum.

In this paper, we present a constraint-oriented state-based proof methodology for concurrent software systems which exploits compositionality and abstraction for the reduction of the verification problem under investigation. Formal basis for this methodology are Modal Transition Systems allowing loose state-based specifications, which can be refined by successively adding constraints. Key concepts of our method are <em>projective views</em>, <em>separation of proof obligations</em>, <em> Skolemization</em> and <em>abstraction</em>. The method is even applicable to real time systems

In this paper, the synthesis of bounded Petri nets from deterministic modal transition systems is shown to be undecidable. The proof is built from three components. First, it is shown that the problem of synthesising bounded Petri nets satisfying a given formula of the conjunctive nu-calculus (a suitable fragment of the mu-calculus) is undecidable. Then, an equivalence between deterministic modal transition systems and a language-based formalism called modal specifications is developed. Finally, the claim follows from a known equivalence between the conjunctive nu-calculus and modal specifications.

Modern software systems are typically built of components that communicate through their external interfaces. A component's behavior can be effectively described using finite state automata-based formalisms (e.g., statecharts [5]). The basic formalism, labelled transition systems, describes the behavior of a component in terms of states and labeled transitions. The more advanced formalisms, such as modal transition systems and interface automata, extend LTS to incorporate additional information related to interface operation controllability — distinguishing between input, output, and internal actions — and the possible partiality of a component's specification — distinguishing between required and unknown (maybe) behaviors. Capturing the controllability and partiality aspects of a component's specification facilitates (1) checking interface compatibility, (2) checking whether one component can safely replace another component, and (3) checking whether one specification is a proper refinement of another specification. In this paper, we study the existing definitions of these three types of checks, and then exemplify their limitations in the context of modal interface automata (MIA); MIA is a class of component behavior specifications that incorporates both controllability and partiality information. We outline a set of enhancements to MIA as possible solutions to the identified limitations.

We propose a platform for the specification and analysis of systems. This platform contain models, their refinement and abstraction, and a temporal logic semantics; rendering a sound framework for property validation and refutation. The platform is parametric in a domain of view, an abstraction of a construction based on the Plotkin power domain. For each domain of view E, the resulting platform P [E]1 contains partial,incomplete systems and complete systems — the actual implementations. Complete systems correspond to the platform that has as parameter a domain D that is, as a set, isomorphic to the maximal elements of E. If one restricts P [E] to implementations, but retains the temporal logic semantics, refinement, and abstraction relations, one recovers the platform P [D]. This foundation recasts existing work on modal transition systems, presents fuzzy systems, and ponders on the nature of probabilistic platforms. For domains of view E that are determined by a linearly ordered, complete lattice, we present a category of “relations” as a step toward a view-based semantics of predicate logic.

We survey the specification formalism of modal transition systems (MTS). We discuss various extensions of MTS, their relationships and modelling capabilities. The extensions include more involved modalities, quantitative aspects, or infinite state spaces. Further, we discuss problems arising in verification and analysis of these systems. We cover refinement checking, model checking and synthesis, standard logical and structural operations as used in specification theories as well as the respective tool support.

FTS4VMC: A front-end tool for static analysis and family-based model checking of FTSs with VMC

De Alfaro and Henzinger's Interface Automata (IA) and Nyman et al.'s recent combination IOMTS of IA and Larsen's Modal Transition Systems (MTS) are established frameworks for specifying interfaces of system components. However, neither IA nor IOMTS consider conjunction that is needed in practice when a component shall satisfy multiple interfaces, while Larsen's MTS-conjunction is not closed and Bene\v{s} et al.'s conjunction on disjunctive MTS does not treat internal transitions. In addition, IOMTS-parallel composition exhibits a compositionality defect. This article defines conjunction (and also disjunction) on IA and disjunctive MTS and proves the operators to be 'correct', i.e., the greatest lower bounds (least upper bounds) wrt. IA- and resp. MTS-refinement. As its main contribution, a novel interface theory called Modal Interface Automata (MIA) is introduced: MIA is a rich subset of IOMTS featuring explicit output-must-transitions while input-transitions are always allowed implicitly, is equipped with compositional parallel, conjunction and disjunction operators, and allows a simpler embedding of IA than Nyman's. Thus, it fixes the shortcomings of related work, without restricting designers to deterministic interfaces as Raclet et al.'s modal interface theory does.

We propose an input/output conformance testing theory utilizing Modal Interface Automata with Input Refusals (IR-MIA) as novel behavioral formalism for both the specification and the implementation under test. A modal refinement relation on IR-MIA allows distinguishing between obligatory and allowed output behaviors, as well as between implicitly underspecified and explicitly forbidden input behaviors. The theory therefore supports positive and negative conformance testing with optimistic and pessimistic environmental assumptions. We further show that the resulting conformance relation on IR-MIA, called modal-irioco, enjoys many desirable properties concerning component-based behaviors. First, modal-irioco is preserved under modal refinement and constitutes a preorder under certain restrictions which can be ensured by a canonical input completion for IR-MIA. Second, under the same restrictions, modal-irioco is compositional with respect to parallel composition of IR-MIA with multi-cast and hiding. Finally, the quotient operator on IR-MIA, as the inverse to parallel composition, facilitates decompositionality in conformance testing to solve the unknown-component problem.

Logical vs. behavioural specifications