Utilisation de SMV pour la vérification de propriétés d'IHM multimodales

Mobile and general-purpose robots increasingly support everyday life, requiring dependable robotics control software. Creating such software mainly amounts to implementing complex behaviors known as missions. Recognizing this need, a large number of domain-specific specification languages has been proposed. These, in addition to traditional logical languages, allow the use of formally specified missions for synthesis, verification, simulation or guiding implementation. For instance, the logical language LTL is commonly used by experts to specify missions as an input for planners, which synthesize a robot's required behavior. Unfortunately, domain-specific languages are usually tied to specific robot models, while logical languages such as LTL are difficult to use by non-experts. We present a catalog of 22 mission specification patterns for mobile robots, together with tooling for instantiating, composing, and compiling the patterns to create mission specifications. The patterns provide solutions for recurrent specification problems; each pattern details the usage intent, known uses, relationships to other patterns, and—most importantly—a template mission specification in temporal logic. Our tooling produces specifications expressed in the temporal logics LTL and CTL to be used by planners, simulators or model checkers. The patterns originate from 245 mission requirements extracted from the robotics literature, and they are evaluated upon a total of 441 real-world mission requirements and 1251 mission specifications. Five of these reflect scenarios defined with two well-known industrial partners developing human-size robots. We further validate our patterns’ correctness with simulators and two different types of real robots.

Business processes usually have to consider certain constraints like domain specific and quality requirements. The automated formal verification of these constraints is desirable, but requires the user to provide an unambiguous formal specification. In particular since the notations for business process modeling are usually visual flow-oriented languages, the notational gap to the languages usually employed for the formal specification of constraints, e.g., temporal logic, is significant and hard to bridge. Thus, our approach relies on UML Activities as a single language for the specification of both business processes and the corresponding constraints. For the expression of such constraints, we have provided a process pattern definition language based on specialized Activities. In this paper, we describe how model checking can be employed for formal verification of business processes against such patterns. For this, we present an automated transformation of the business process and the corresponding patterns into a transition system and temporal logic, respectively.

Bisimilar linear systems

Detection of Dataflow Modeling Anomalies in Workflow Systems: Toward an Active Help Verification Using Model Checking

A case study in model checking software systems

Spatial aspects of computation are increasingly relevant in Computer Science, especially in the field of collective adaptive systems and when dealing with systems distributed in physical space. Traditional formal verification techniques are well suited to analyse the temporal evolution of concurrent systems; however, properties of space are typically not explicitly taken into account. This tutorial provides an introduction to recent work on a topology-inspired approach to formal verification of spatial properties depending upon (physical) space. A logic is presented, stemming from the tradition of topological interpretations of modal logics, dating back to earlier logicians such as Tarski, where modalities describe neighbourhood. These topological definitions are lifted to the more general setting of closure spaces, also encompassing discrete, graph-based structures. The present tutorial illustrates the extension of the framework with a spatial surrounded operator, leading to the spatial logic for closure spaces SLCS, and its combination with the temporal logic CTL, leading to STLCS. The interplay of space and time permits one to define complex spatio-temporal properties. Both for the spatial and the spatio-temporal fragment efficient model-checking algorithms have been developed and their use on a number of case studies and examples is illustrated.

To verify hardware designs by model checking, circuit specifications are commonly expressed in the temporal logic CTL. Automatic conversion of English to CTL requires the definition of an appropriately restricted subset of English. We show how the limited semantic expressibility of CTL can be exploited to derive a hierarchy of subsets. Our strategy avoids potential difficulties with approaches that take existing computational semantic analyses of English as their starting point---such as the need to ensure that all sentences in the subset possess a CTL translation.

Formal methods are crucial in program specification and verification. Instead of building cases to test functionalities, formal methods specify functionalities as properties and mathematically prove them. Nevertheless, the applicability of formal methods is limited in most development processes due to the requirement of mathematical knowledge for developers. To promote the application of formal methods, we formulate formalism-driven development (FDD), which is an iterative and incremental development process that guides developers to adopt proper formal methods throughout the whole development lifespan. In FDD, system graphs, a variant of transition systems optimized for usability, are designed to model system structures and behaviors with representative properties. System graphs are built iteratively and incrementally via refinement. Properties of system graphs are specified in propositional and temporal logics and verified by model-checking techniques with interpretation over transition system. In addition, skeleton programs are generated based on system graphs and expose implementable interfaces for executing external algorithms and emitting observable effects. Furthermore, we present Seniz, a framework that practicalizes and automates FDD. In this paper, we explicate the concepts and taxonomy of FDD and discuss its practice.

Model checking has been used to verify the correctness of digital circuits, security protocols, communication protocols, as they can be modelled by means of finite state transition model. However, modelling the behaviour of hybrid systems like UAVs in a Kripke model is challenging. This work is aimed at capturing the behaviour of an UAV performing cooperative search mission into a Kripke model, so as to verify it against the temporal properties expressed in Computation Tree Logic (CTL). SMV model checker is used for the purpose of model checking.

In this paper, we address the problem of temporal logic planning given both hard specifications of the robot's mission and soft preferences on the plans that achieve the mission. In particular, we consider a problem whose inputs are a transition system, a linear temporal logic (LTL) formula specifying the robot's mission, and an ordered sequence of formulas expressed in linear dynamic logic over finite traces (LDL <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">f</sub> ) specifying the user's preferences for how the mission should be completed. The planner's objective is to synthesize, on this transition system, an infinite trajectory that best fits the user's preferences over finite prefixes of that trajectory while nonetheless satisfying the overall objective. We describe an algorithm for this problem that constructs, from the inputs, a product automaton -which is, in fact, a special kind of state-weighted Büchi automaton- over which an optimal trajectory is synthesized. This synthesis problem is solved via reduction to the minimax path problem in vertex weighted graphs, which can be solved by variants of the standard algorithms for computing shortest paths in a graph or by algorithms for the all-pairs bottleneck paths problem on vertex-weighted graphs. We show the applicability of the approach via some case studies, for which we present results computed by an implementation.

In temporal-logic model checking, we verify the correctness of a program with respect to a desired behavior by checking whether a structure that models the program satisfies a temporal-logic formula that specifies the behavior. The model-checking problem for the branching-time temporal logic CTL can be solved in linear running time, and model-checking tools for CTL are used successfully in industrial applications. The development of programs that must meet rigid real-time constraints has brought with it a need for real-time temporal logics that enable quantitative reference to time. Early research on real-time temporal logics uses the discrete domain of the integers to model time. Present research on real-time temporal logics focuses on continuous time and uses the dense domain of the reals to model time. There, model checking becomes significantly more complicated. For example, the model-checking problem for TCTL, a continuous-time extension of the logic CTL, is PSPACE-complete.In this paper we suggest a reduction from TCTL model checking to CTL model checking. The contribution of such a reduction is twofold. Theoretically, while it has long been known that model-checking methods for untimed temporal logics can be extended quite easily to handle discrete time, it was not clear whether and how untimed methods can handle the reset quantifier of TCTL, which resets a realvalued clock. Practically, our reduction enables anyone who has a tool for CTL model checking to use it for TCTL model checking. The TCTL model-checking algorithm that follows from our reduction is in PSPACE, matching the known bound for this problem. In addition, it enjoys the wide distribution of CTL model-checking tools and the extensive and fruitful research efforts and heuristics that have been put into these tools.KeywordsModel CheckTemporal LogicAtomic PropositionKripke StructureTemporal ReasoningThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Specifying and verifying interaction protocols in a temporal action logic

In this thesis, we introduce and examine four new temporal logic formalisms that can be used as specification languages for the automated verification of the reliability of hardware and software designs with respect to a desired behavior. The work is organized in two parts. In the first one, we reason about two logics for computations, GCTL* and MCTL*, which are useful to describe a correct execution of monolithic closed systems. In the second one, instead, we focus on two logics for strategies, SL and mATL*, which are useful to formalize several interesting properties about interactive plays in multi-entities systems modeled as multi-agent games. In the “Logics for Computations” part, we first study the immersion of the idea of graded quantifications into the temporal-logic framework. In first order logic, existential and universal quantifiers express the concepts of the existence of at least one individual object satisfying a formula, or that all individual objects satisfy a formula. In other logics, these quantifiers have been generalized to express that, for a given non-negative integer n, at least n or all but n individuals satisfy a particular formula. Here, we consider GCTL, a temporal logic with graded path quantifiers, which allows to describe properties like “there exist at least n different classes of computational fluxes in which a system reaches a predetermined state”, where the classes over paths are computed by means of a predetermined equivalence relation. More precisely, we uniformly extend the classic concept of graded quantifiers from states to paths, through the use of a concept of path equivalence with respect to a given path formula. About this logic, in particular, we study the expressiveness and succinctness relationships with respect to GµCalculus and the complexity of the satisfiability problem, which results to be ExpTime-Complete. This research is partially based on the works [BMM09] “Graded Computation Tree Logic” and [BMM10] “Graded Computation Tree Logic with Binary Coding” published, respectively, in the proceedings of the “IEEE Symposium on Logic in Computer Science, 2009” and “EACSL Annual Conference on Computer Science Logic, 2010”. Preliminary results can be also found in [Mog07]. Furthermore, we consider special quantifiers over substructures, which allow to select, using parametric criteria, small critical parts of a system to be successively verified. In literature, there are some attempts to define a logic that allows to modify the underlying structure under exam and then to verify on it some assigned property. However, as far as we know, none of them is able to select minimal submodels of a given property describing the criteria on which then execute the verification process. Here, we base our work on the search of a new operator that merges the concept of quantifiers on structures with that one derived by a generalization of the concept of pruning. The results of this work, is a class of three different extensions of CTL* with minimal model quantifiers, which we name MCTL*. Regarding these logics, we study several reductions among them, as well as the satisfiability problem that we prove to be highly undecidability, i.e., Σ_1^1-Hard, for two out of the three cases. This research is partially based on the work [MM09] “Branching-Time Temporal Logics with Minimal Model Quantifiers” published in the proceedings of the “International Conference on Developments in Language Theory, 2009”. In the “Logics for Strategies” part, we first study the problem of defining a new specification language through which it is possible to express several important properties of multi-entities systems that are neither expressible using classical monolithic temporal logics, such as CTL*, nor using two-agent-teams temporal logics, such as ATL*. In literature, we can found some proposal of logics that try to achieve this goal, but unfortunately, none of them succeeds completely on all the aspects. Among them, one of the most important attempts is CHP-SL, a logics in which one can use variables over strategies. However, this logic has a deep weakness, since it does not allow to describe games with more than two players and even two-players concurrent games. Here, we introduce SL, a logic with a syntax similar in some aspects to the first order logic, in which the strategies of the agent building the game are treated as first order objects on which we can quantify. This logic generalizes CHP-SL, by allowing the specification of the correct behavior of multi-agent concurrent games. In SL, for example, we are able to express very complex but useful Nash equilibria that are not expressible with CHP-SL. We enlighten that Nash equilibrium is one of the most important concepts in game theory. For the introduced logic, we solve two problems left open in the work on CHP-SL. Precisely, we show that the related model-checking problem is 2ExpTime-Complete, thus not harder of the same problem for several subsumed logics, while we prove that its satisfiability problem is highly undecidable, i.e., Σ_1^1-Hard. This research is partially based on the work [MMV10a] “Reasoning About Strategies” published in the proceedings of the “IARCS Annual Conference on Foundations of Software Technology and Theoretical Computer Science, 2010”. Finally, we consider the concept of relentful strategic reasoning, i.e., a formalism that expresses the ability of a strategy to be used not only to achieve a first given goal, but also to change its final goal in dependence of the history of the play. In the context of planning, memoryful quantification, i.e., quantification over computations that does not lose information about the past along the time, is one of the principal way to express the fact that a system is able to achieve a desired result, and shift to a different goal if some event happens. However, this kind of quantification was not considered before in the context of multi-agent planning. Here, we introduce mATL*, a fusion of the classic alternating temporal logic ATL* with memoryful quantification, with the aim of covering the previous idea. About this logics, we prove that, although it is equivalent to ATL*, it is exponentially more succinct. Nevertheless, we prove that both the model-checking and the satisfiability problems remain 2ExpTime-Complete, as for ATL*. This research is partially based on the work [MMV10b] “Relentful Strategic Reasoning in Alternating-Time Temporal Logic” published in the proceedings of the “International Conference on Logic for Programming Artificial Intelligence and Reasoning, 2010”.

: The question of whether branching-time temporal logic or linear-time temporal logic is best for reasoning about concurrent programs is one of the most controversial issues in logics of programs. Concurrent programs are usually modelled by labelled state-transition graphs in which some state is designated as the initial state. For historical reasons such graphs are called Kripke structures. In linear temporal logic operators are provided for describing events along a single time path (i.e., along a single path in a Kripke structure). In a branching-time logic the temporal operators quantify over the futures that are possible from a given state (i.e., over the possible paths that lead from a state). It is well known that the two types of temporal logic have different expressive powers. Linear temporal logic, for example, can express certain fairness properties that cannot be expressed in branching-time temporal logic. On the other hand, certain practical decision problems like model checking are easier for branching-time temporal logic than for linear temporal logic. This paper provides further insight on which type of logic is best. It is shown that if two finite Kripke structures can be distinguished by some formula that contains both branching-time and linear-time operators, then the structures can be distinguished by a formula that contains only branching time operators. Specifically, we show that if two finite Kripke structures can be distinguished by some formula of the logic CTL (i.e., if there is some CTL formula that is true in one but not in the other), then they can be distinguished by some formula of the logic CTL.

The dynamic description logic DDL provides formalism for describing dynamic system in the semantic Web environment Model checking is a formal verification method based on state transition system. In this paper, we bring dynamic description logic into model checking. Firstly, state transition systems considered in model checking are modeled as complex actions in dynamic description logic. Secondly, a kind of temporal description logic DL-CTL is introduced to specify temporal properties on state transition systems, where DL-CTL is a DL-based extension of propositional branch-time temporal logic CTL. Finally, verification algorithm is presented with the help of reasoning mechanisms provided by description logic.