Improving Testing Coverage for Safety-Critical System by Mutated Specification

An Input Output Symbolic Transition System (IOSTS) specifies all expected sequences of input and output messages of a reactive system. Symbolic execution over this IOSTS then allows to generate a set of test cases that can exercise the various possible behaviors of the system it represents. In this paper, we extend the IOSTS framework with explicit program calls, possibly equipped with contracts specifying what the program is supposed to do. This approach bridges the gap between a model-based approach in which user-defined programs are abstracted away and a code-based approach in which small pieces of code are separately considered regardless of the way they are combined. First, we extend symbolic execution techniques for IOSTS with programs, in order to re-use classical test case generation algorithms. Second, we explore how constraints coming from IOSTS symbolic execution can be used to infer contracts for programs used in the IOSTS.KeywordsInput output symbolic transition systemsProgram contractsModel-based testingSymbolic executionFeasibility

In our previous paper [1], a new model of a Labeled Transition System (LTS)-type implementation was proposed. In ordinary LTSs, transitions are labeled by actions; therefore, they can be called LTSs of actions. The new model is an LTS of observations; in this model, observations and test actions (buttons) are used instead of actions. This model generalizes many testing semantics that are based on the LTS of actions but use additional observations (refusals, ready sets, etc.). Moreover, systems with priority, which are not described by the LTS of actions, are simulated uniformly. In the present paper, we develop this approach by focusing on the composition of systems. The point is that, on observation traces, one cannot define a composition with respect to which a composition of LTSs would possess the property of additivity: the set of traces of a composition of LTSs coincides with the set of all pairwise compositions of traces of LTS operands. This is explained by the fact that an observation in a composition state is not calculated based on observations in states-operands. In this paper, we propose an approach that eliminates this drawback. To this end, we label the transitions of LTSs by symbols (events) that, on the one hand, can be composed to guarantee the property of additivity, and, on the other hand, can be used to generate observations under testing: a transition by an event gives rise to an observation related to this event. This model is called an LTS of events. In this paper, we define (1) a transformation of an LTS of events into an LTS of observations to conform with the principles of our previous paper [1]; (2) a composition of LTSs of events; (3) a composition of specifications that preserves conformance: a composition of conformal implementations is conformal to a composition of specifications; and (4) a uniform simulation of LTSs of actions in terms of the LTSs of events, which allows one to consider an implementation in any interaction semantics admissible for LTSs of actions. In this case, a composition of LTSs of events obtained as a result of simulation of the original LTSs of actions is equivalent to the LTS of events obtained as a result of simulation of the composition of these LTSs of actions.

Linear Hybrid Automata (LHA) is a natural modeling language for real-time embedded systems. However, due to the existences of both discrete and continuous behaviors, formal analysis of LHA is recognized as a very challenging task. Despite decades of active research, the kinds of LHA problems that can be efficiently analyzed is rather limited. On the other hand, Labelled Linear Transition System (LTS) is a widely used modeling language to describe the state changes of the system before and after certain transitions. Lots of research efforts have been devoted into the verification of LTS models. Many off-the-shelf formal techniques and tools are available for analyzing different kinds of problems for LTS systems. In this paper, we propose to express an LHA as an equivalent LTS model explicitly. Then, we can take advantage of all the off-the-shelf formal checkers of LTS to answer different problems of the LHA model. A prototype tool HAT is implemented under this idea. By integrating typical LTS checkers like ARMC and Interproc, we conduct considerably difficult checking problems like reachability verification, termination analysis, and invariant generation of LHA successfully and efficiently. It shows the open possibility of analyzing more kinds of difficult problems of LHA by LTS checkers easily in the future.

Under the complex operational environment of the antimissile operation, the application of Systems Modeling Language (SysML) parametric model in weapon system effectiveness evaluation is explored. The function of parametric graph model, the construction process of the model and the optimization method of the model are researched. Using feedback mechanism to collect, collate and calculate the parameters of the model, and realize the leap from the index relationship description to the calculation of the index. Finally, the feasibility and effectiveness of the proposed method is verified by using the system of antimissile weapon system as an example.

When a Petri net is synthesised from a labelled transition system, it is frequently desirable that certain additional constraints are fulfilled. For example, in circuit design, one is often interested in constructing safe Petri nets. Targeting such subclasses of Petri nets is not necessarily computationally more efficient than targeting the whole class. For example, targeting safe nets is known to be NP-complete while targeting the full class of place/transition nets is polynomial, in the size of the transition system. In this paper, several classes of Petri nets are examined, and their suitability for being targeted through efficient synthesis from labelled transition systems is studied and assessed. The focus is on choice-free Petri nets and some of their subclasses. It is described how they can be synthesised efficiently from persistent transition systems, summarising and streamlining in tutorial style some of the authors’ and their groups’ work over the past few years.

In this chapter, we provide the essential theory and practical details of employing the principles of Object Orientation (OO) in system architecture modeling. We do not attempt to provide an exhaustive OO tutorial, since there exists a very large literature on this subject (see the references to this chapter). Our goal, instead, is to give the reader the level of understanding needed to master the MBSAP methodology and apply it to practical system architecting challenges. First, we present the rationale for OO and define the essential concepts and terminology, stressing the benefits it delivers in dealing with complex entities. Although we use the Systems Modeling Language (SysML) as the basis for this book, we begin by discussing and illustrating the primary diagrams of the Unified Modeling Language (UML), which is the root language standard for OO. This is then followed by a description of the changes to UML introduced by the SysML, which is defined as a Profile of UML. The reality is that a large part of the SysML is taken directly from the UML language specification. We believe understanding of this material is enhanced by first considering the parent UML and then explicitly showing how UML modifies and extends the language. We include generic UML and SysML diagrams that illustrate important principles and syntax and that can serve as format samples in developing real architecture models. Appendices A and B are concise references to UML and SysML, respectively, intended to give readers a quick and easy way to look up the details. Chapter objective: the reader will be able to create and read UML and SysML diagrams and to describe the role of each.

This paper proposes a test generation algorithm combining genetic algorithm for fault diagnosis on linear systems. Most test generation algorithms just used a single value fault model. This test generation algorithm is based on a continuous fault model. This algorithm can improve the treatment of the tolerance problem, including the tolerances of both normal and fault parameters, and enhance the fault coverage rate. The genetic algorithm can be used to choose the characteristic values. The genetic algorithm can enhance precision of test generation algorithm especially for complex fitness functions derived from complex systems under test. The genetic algorithm can also further improve the fault coverage rate by reducing the loop number of divisions of the initial fault range. The experiments are carried out to show this test generation algorithm with a linear system and an integrated circuit.

Model checking is a technique for finding bugs in systems by systematically exploring their state spaces. We wish to extract sound models from concurrent programs automatically and check the behaviors of these models systematically. The zing project is an effort to build a flexible infrastructure to represent and model check abstractions of large concurrent software.To support automatic extraction of models from programs written in common programming languages, zing’s modeling language supports three facilities present in modern programming languages: (1) procedure calls with a call-stack, (2) objects with dynamic allocation, and (3) processes with dynamic creation, using both shared memory and message passing for communication. We believe that these three facilities capture the essence of model checking modern concurrent software.Building a scalable model-checker for such an expressive modeling language is a huge challenge. zing’s modular architecture provides a clear separation between the expressive semantics of the modeling language, and a simple view of zing programs as labeled transition systems. This separation has allowed us to decouple the design of efficient model checking algorithms from the complexity of supporting rich constructs in the modeling language. zing’s model checking algorithms have been designed to exploit existing structural abstractions in concurrent programs such as processes and procedure calls. We present two such novel techniques in the paper: (1) compositional checking of zing models for message-passing programs using a conformance theory inspired by work in the process algebra community, and (2) a new summarization algorithm, which enables zing to reuse work at procedure boundaries by extending interprocedural data-flow analysis algorithms from the compiler community to analyze concurrent programs.KeywordsModel CheckModeling LanguageProcedure CallLabel Transition SystemConcurrent ProgramThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

An Integrated Intelligent Modeling and Simulation Language for Model-based Systems Engineering

Wireless sensor networks (WSNs) are expected to run unattendedly for critical tasks. To guarantee the correctness of WSNs is important, but highly nontrivial due to the distributed nature. In this work, we present an automatic approach to directly verify WSNs built with TinyOS applications implemented in the NesC language. To achieve this target, we firstly define a set of formal operational semantics for most of the NesC language structures for the first time. This allows us to capture the behaviors of sensors by labelled transition systems (LTSs), which are the underlying semantic models of NesC programs. Secondly, WSNs are modeled as the composition of sensors with a network topology. Verifications of individual sensors and the whole WSN become possible by exploring the corresponding LTSs using model checking. With substantial engineering efforts, we implemented this approach in the tool NesC@PAT to support verifications of deadlock-freeness, state reachability and temporal properties for WSNs. NesC@PAT has been applied to analyze and verify WSNs, with unknown bugs being detected. To the best of our knowledge, NesC@PAT is the first model checker which takes NesC language as the modeling language and completely preserves the interrupt-driven feature of the TinyOS execution model.KeywordsWireless Sensor NetworkModel CheckerOperational SemanticLinear Temporal LogicState ReachabilityThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

In this chapter, I try to formulate swarms as labelled transition systems with the same set of labels (events or actions): direction, splitting, fusion, repelling. Then I show that these labelled transition systems can implement Kolmogorov-Uspensky machines, but with a low accuracy because of emergent patterns which occur if we have many states of appropriate transition system. Then I propose a p-adic arithmetic and logic to formalize emergent patterns of swarms. To sum up, I offer a general logical approach to swarm intelligence.

Comparing operational models of name-passing process calculi

The development process of complex systems needs to take in account differents domains and aspects. SysML (Systems Modeling Language) is a new modeling language that allows a system description with various integrated diagrams (as structure, behavior and requirements diagrams), but SysML lacks formality for the requirement verification. The aim of this paper is to propose an approach to verify complex systems using SysML as a language which describes the system structure and requirements. Petri nets and temporal logic LTL are used respectively to formalize the system behavior and requirements. The benefit of such formalization is to allow an automatic formal verification. In order to demonstrate this methodology, it will be used a factory automation system, modeled by SysML and Petri nets, and verified by the TINA toolbox.

Energetic gas-phase particles that collide with adsorbed species on solid surfaces induce a variety of processes. Collision induced processes (CIP) are important and may play a central role in the mechanism governing heterogeneous catalytic reactions at high pressures and elevated temperatures. A number of different CIPs are discussed in this article with a strong emphasis on the utilization of molecular dynamics (MD) simulations as a tool for gaining molecular level mechanistic and dynamic insight into chemical events under investigation. Collision induced desorption (CID) is the simplest CIP to be discussed. The CID of N2 from Ru(001) is described as a test case for the effect of collisions on a polarized adsorbate and has been studied at both low and high coverages. The interpretation of the experimental data at low coverage using MD simulations has led to the introduction of a new desorption mechanism. It involves strong coupling of surface corrugation and adsorbate frustrated rotation that lead to a normal motion away from the surface. Another system for which CID was shown to provide unique information is that of water on Ru(001). Here, the enhanced CID rate was demonstrated to be selective for a specific adsorption site/structure on the surface (the A2 site), providing a new insight into the structure of water on this surface, recently recalculated by employing ab initio methods. At the multilayer coverage range, a remarkable stability was found of the ice layer against CID, suggesting particularly efficient dissipation of the collider energy within the hydrogen bonded network at an ice thickness of 3 bilayers and above. A unique CIP to be discussed is collision induced migration (CIM), a new phenomenon that has never been considered before. Based on MD simulations, it is shown that CIM may result in migration distances of more than 150 Å at very low coverage, whereas at high coverage, these displacements are shortened significantly. The potential importance of this process for inducing novel catalytic routes on surfaces is discussed. A related example involves MD simulations that address the relation between tracer surface diffusion and the pressure of collider from the gas phase. It is predicted that by increasing the pressure in the range 0−500 atm significant changes in adsorbates surface diffusivity should take place as a result of collision induced migration. Finally, CID within the O2/Ag(110) system arising from photodissociation of adsorbed molecular oxygen is described. MD simulations were used to explain the experimentally determined coverage dependent phenomena such as desorption yield and angular distribution of desorbates.

The chapter presents a description of a novel modelling language called Alvis defined for the design of concurrent especially real-time systems. Alvis combines the advantages of formal methods and practical modelling languages. Based on CCS and XCCS process algebras, Alvis utilizes flexible graphical modelling of interconnections among agents and a high level programming language used for the description of agents behaviour. Each agent in a model can use rule-based systems to support its decisions. A small set of language statements and graphical concepts make Alvis easy to learn and use. The possibility of a formal model verification, makes Alvis a formal modelling language. Alvis modelling environment creates in parallel a model of the considered system and a labelled transition system (LTS graph) that is its formal representation. The LTS graph can be formally verified with the CADP toolbox. A survey of main Alvis features from practical point of view, is given in the chapter.