Verification of scope-dependent hierarchical state machines

In temporal-logic model checking, we verify the correctness of a program with respect to a desired behaviour by checking whether a structure that models the program satisfies a temporal logic formula that specifies this s behaviour. One of the ways to overcome the expressiveness limitation of temporal logics is to augment them with quantification over atomic propositions. In this paper we consider the extension of branching temporal logics with existential quantification over atomic propositions. Once we add existential quantification to a branching temporal logic, it becomes sensitive to unwinding. That is, unwinding a structure into an infinite tree does not preserve the set of formulas it satisfies. Accordingly, we distinguish between two semantics, two practices as specification languages, and two versions of the model-checking problem for such a logic. One semantics refers to the structure that models the program, and the second semantics refers to the infinite computation tree that the program induces. We examine the complexity of the model-checking problem in the two semantics for the logics CTL and CTL* augmented with existential quantification over atomic propositions. Following the cheerless results that we get, we examine also the program complexity of model checking; i.e. the complexity of this problem in terms of the program, assuming the formula is fixed. We show that while fixing the formula dramatically reduces model-checking complexity in the tree semantics its influence on the structure semantics is poor.

In this work, novel symbolic step encodings of the transition relation for object based communicating state machines are presented. This class of systems is tailored to capture the essential data manipulation features of UML state machines when enriched with a Java-like object oriented action language. The main contribution of the work is the generalization of the \(\exists\)-step semantics approach, which Rintanen has used for improving the efficiency of SAT based AI planning, to a much more complex class of systems. Furthermore, the approach is extended to employ a dynamic notion of independence. To evaluate the encodings, UML state machine models are automatically translated into NuSMV models and then symbolically model checked with NuSMV. Especially in bounded model checking (BMC), the \(\exists\)-step semantics often significantly outperforms the traditional interleaving semantics without any substantial blowup in the BMC encoding as a SAT formula.KeywordsState MachineModel CheckTransition RelationSymbolic Model CheckBound Model CheckThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

A binary-tree-based finite state machine (BT-FSM) is a state machine with a 1-bit input signal whose state transition graph is a binary tree. BT-FSMs are useful in those application areas where searching in a binary tree is required, such as computer networks, compression, automatic control, or cryptography. This paper presents a new architecture for implementing BT-FSMs which is based on the model finite virtual state machine (FVSM). The proposed architecture has been compared with the general FVSM and conventional approaches by using both synthetic test benches and very large BT-FSMs obtained from a real application. In synthetic test benches, the average speed improvement of the proposed architecture respect to the best results of the other approaches achieves 41% (there are some cases in which the speed is more than double). In the case of the real application, the average speed improvement achieves 155%.

Separation of Concerns (SoC) is an important issue to reduce the complexity of software. Recent advances in programming language research show that Aspect-Oriented Programming (AOP) may be helpful for enhancing the SoC in software systems: AOP provides a means for describing concerns which are normally spread throughout the whole program at one location. The arguments for introducing aspects into programming languages also hold for modeling languages. In particular, modeling state-crosscutting behavior is insufficiently supported by UML state machines. This often leads to model elements addressing the same concern scattered all over the state machine. We present an approach to aspect-oriented state machines, which show considerably better modularity in modeling state-crosscutting behavior than standard UML state machines.

In model based development, embedded systems are modeled using a mix of dataflow formalism, that capture the flow of computation, and hierarchical state machines, that capture the modal behavior of the system. For safety analysis, existing approaches rely on a compilation scheme that transform the original model (dataflow and state machines) into a pure dataflow formalism. Such compilation often result in loss of important structural information that capture the modal behaviour of the system. In previous work we have developed a compilation technique from a dataflow formalism into modular Horn clauses. In this paper, we present a novel technique that faithfully compile hierarchical state machines into modular Horn clauses. Our compilation technique preserves the structural and modal behavior of the system, making the safety analysis of such models more tractable.

The finite state machine (FSM) needed for the low power system pulse frequency modulated (PFM) mode in a buck converter is usually asynchronous because the fast clock needed for a synchronous FSM consumes too much power, or is maybe even not available. However, the implementation, verification and testing of a asynchronous FSM is complicated compared to an synchronous one. This paper presents a concept of a semi-synchronous FSM that combines the benefits of both synchronous and asynchronous state machines. The result is a FSM which runs at high clock frequency, consumes very little power and can be implemented, verified and tested as a synchronous FSM. This concept has been used to design a PFM FSM in a field programmable gate array (FPGA) and in a 65 nm CMOS technology.

Mutual exclusion is a very common requirement in parallel systems. Yet its modeling is a tedious task in UML state machines, one of the most popular languages for behavior modeling. We present HiLA, an aspect-oriented extension of UML state machines, to address this problem. In HiLA, mutual exclusion can be modeled in a highly modular and declarative way. That is, the logic of mutual exclusion is modeled at a dedicated place rather than by model elements scattered all over the state machine, and the modeler only needs to specify which states to mutually exclude rather than how to exclude them.KeywordsState MachineGraph TransformationMutual ExclusionComposite StateConcrete SyntaxThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

A new fast PWM modulation strategy for power electric converter based on finite set state machine theory

In this paper, we adapt the abstraction refinement techniques of Clarke et al. [7] and Gulavani et al. [15] for systematic generation of model based test cases. Formal models are in general infinite state machines. We approximate such a formal model by a more abstract finite state machine. From the finite model, we obtain probable test cases through model checking, and then a guided symbolic execution is performed over the given formal model to check if this is a real test case. In case of failure, the finite abstract model is refined and the cycle is repeated. The two main results of this paper are: (a) better specification coverage is achieved, and (b) we obtain a more accurate coverage estimate. We explain our method by considering models in the specification language B.

Use cases are commonly used to structure and document requirements while UML state machine diagrams often describe the behavior of a system and serve as a basis to automate test case generation in many model-based testing (MBT) tools. Therefore, automated support for the transition from use cases to state machines would provide significant, practical help for testing system requirements. Additionally, traceability could be established through automated transformations, which could then be used for instance to link requirements to design decisions and test cases, and assess the impact of requirements changes. In this paper, we propose an approach to automatically generate state machine diagrams from use cases while establishing traceability links. Our approach is implemented in a tool, which we used to perform three case studies, including an industrial case study. The results show that high quality state machine diagrams can be generated, which can be manually refined at reasonable cost to support MBT. Automatically generated state machines showed to largely conform to the actual system behavior as evaluated by a domain expert.

RINGA: Design and verification of finite state machine for self-adaptive software at runtime

Surveying the current state of practice of spacecraft autonomy, one can detect many different attributes of the various autonomy systems currently employed to maintain the safety of the spacecraft. In an effort to move beyond the state of practice, Johns Hopkins University Applied Physics Lab has focused on three of these attributes not found together in current systems: Understandability, Flexibility and Verifiability. Understandability defines the ability to specify and review the autonomy system in such a way that any nonsoftware domain expert or system engineer can understand the design. Flexibility defines the ability to modify the design preand post-launch in parts without patching or without complete code uploads. Verifiability defines the ability to exhaustively and rapidly verify correct autonomy system behavior before it is uploaded to the spacecraft. With the goal of attaining all three of these attributes, JHU/APL has designed and developed a new autonomy system called ExecSpec (short for Executable Specification). The system has been progressed to TRL 5 and is now poised for infusion into future spacecraft programs. ExecSpec is a new visual programming approach to autonomy system development that enables any system designer or domain expert to visually create spacecraft functionality and autonomous behavior in the form of up-loadable specification diagrams. ExecSpec allows developers to interactively construct autonomy systems by drawing diagrams of individual Finite State Machines (FSM) and linking them together to form autonomy components and subsystems. The diagram components are easily understandable by non-software domain experts and system engineers, allowing for system-level review of the autonomy system design. The diagram components can either be built from scratch, or instantiated from libraries of reusable FSM components. In contrast to current software capabilities, ExecSpec is not a code generator but rather an interpreter-based system which enables the uploading diagrams directly to an on-board FSM execution engine, allowing the autonomy system to be rapidly and safely modified at any time in a project's lifecycle and thus reducing overall lifecycle and maintenance costs. This makes the system inherently flexible to post launch modifications and enables changes on the individual FSM level such that new FSM diagrams can be added or interchanged. The resulting diagram behavior produced by ExecSpec can be tested directly through interactive stimulation of system inputs or by playing back scripted input scenarios. Model checking tools can also be used to rapidly verify that the diagrams obey specified constraints and requirements, and the uploaded system behavior can be visually monitored during flight. This combination of interactive testing, model checking and in-flight monitoring ensures autonomy systems built within ExecSpec can be exhaustively verified in a rapid manner. This paper will describe in detail the three attributes chosen by JHU/APL, including the driving need for each, then go on to describe how the new ExecSpec system meets these attributes. Finally, the paper will describe the current state of the ExecSpec development and plans for infusion into future spacecraft systems.

The authors present a hierarchical analysis of interconnected finite state machines helpful for testability evaluation. Formal operators determine the controllable and observable functional parts of the modules of the hierarchy; several kinds of functional redundancies are deduced and their causes are diagnosed. A prototype written in PROLOG validates these concepts. >

Sharing intellectual property (IP) blocks in today's competitive market poses significant high security risks. In this paper, we present a tutorial for a watermarking approach based on the embedding of the ownership proof as part of the IP design's finite state machine (FSM). It utilizes coinciding as well as unused transitions in the state transition graph of the design. Based on this approach, we have developed a robust watermarking framework, used for copyright protection. The developed technique increases the robustness of the watermark and allows a secure implementation, hence enabling the development of the first public-key IP watermarking scheme at the FSM level. In order to integrate these algorithms in the design cycle of industrial projects, we extend the above techniques to enable the watermarking of hierarchical finite state machines (HFSMs)

Verification and test are critical phases in the development of any hardware or software system. This article focuses on black box testing of the control part of hardware and software systems. Black box testing involves specification, test generation, and fault coverage. Finite state machines (FSMs) are commonly used for specifying controllers. FSMs may have shortcomings in modeling complex systems. With the introduction of X-machines, complex systems can be modeled at higher levels of abstraction. An X-machine can be converted into an FSM while preserving the level of abstraction. The fault coverage of a test sequence for an FSM specification provides a confidence level. We propose a fault coverage metric for an FSM specification based on the transition fault model, and using this metric, we derive the coverage of a test sequence. The article also presents a method which generates short test sequences that meet a specific coverage level and then extends this metric to determine the coverage of a test sequence for an FSM driven by an FSM network. We applied our FSM verification technique to a real-life FSM, namely, the fibre channel arbitrated loop port state machine, used in the field of storage area networks.