A Formal Framework for UML Modeling with Timed Constraints: - - PowerPoint PPT Presentation

▶
a formal framework for uml modeling with timed
SMART_READER_LITE
LIVE PREVIEW

A Formal Framework for UML Modeling with Timed Constraints: - - PowerPoint PPT Presentation

Aug 09, 2023 14 likes •254 views

FRENCH NATIONAL INSTITUTE FOR TRANSPORT SAFETY AND RESEARCH A Formal Framework for UML Modeling with Timed Constraints: Application to Railway Control Systems Rafael Marcano Samuel Colin Georges Mariano Specification and Validation of UML

slide-1
SLIDE 1

A Formal Framework for UML Modeling with Timed Constraints: Application to Railway Control Systems

FRENCH NATIONAL INSTITUTE FOR TRANSPORT SAFETY AND RESEARCH Rafael Marcano Samuel Colin Georges Mariano Specification and Validation of UML models for Real Time and Embedded Systems – SVERTS’2004

slide-2
SLIDE 2

2

Context

UML & Railway Applications ...

UML/OCL as formal notation Standard notation for systems modeling But lack of formal semantic Our context : railway control systems

Is actually UML/OCL formal enough to specify reliable software ?

slide-3
SLIDE 3

3

...UML/OCL still informally defined ...insecure basis for software development How to specify precisely ? How to prove rigorously ? ...

Using the B Formal Method Formal methods are used to :

specify precisely the components of a system prove rigorously the desired structural/behavioral properties (analysis and verification)

Context

problem ...

slide-4
SLIDE 4

4

Plan

...

  • 1. Objective
  • 2. The proposed process
  • 3. From requirements to UML
  • 4. From UML models to B specifications

mapping UML diagrams into B formal specifications translating time features into extended B

  • 5. Analysis and verification
  • 6. Conclusion and discussion
slide-5
SLIDE 5

5

  • I. Objective

...

Problem How to enable analysis and verification on UML/OCL models with time properties ? Solution By combining the complementary strengths of UML/OCL and the B formal method By extending B with a real time semantic By providing automated proof tools for the B specification language

slide-6
SLIDE 6

6

UML/OCL + B

why B ? ...

Advantages of the B formal method

precise and rigorous description of a system detection of inconsistencies and mistakes on the UML model proof of structural and behavioral properties ensuring consistency between diagrams using only one formalism supporting refinement

But it does not support timed characteristics

slide-7
SLIDE 7

7

  • II. The Proposed Process

...

  • 1. Requirements elicitation

Create a valid UML description of the required system

  • 3. Analysis and verification

Generate proof obligations and prove them

  • 2. Formal specification

Derive a B formal specification from UML diagrams

slide-8
SLIDE 8

8

  • III. From Requirements to UML

...

A railway level crossing system [JS’00]

slide-9
SLIDE 9

9

Requirements elicitation

sequence diagrams ...

Scenario of an approaching train

aTrain:TrainborneCS aLC:LevelCrossingCS :VehicleSensor :Barrier yellowLight:Light :BarrierSensor redLight:Light

detectTrain(Arriving) [yellowLight.state=Off]switchOn() ackRequest [theBarrier.state=Opened]closeBarrier() [redLight.state=Off]switchOn() receiveAck [yellowLight.state=On]switchOff [bSensor.status<>Closed or t'-t>6sec] setMode(Unsafe) [bSensor.status=Closed and t'-t<=6sec] setMode(Safe) getBarrierStatus {t .. t+3sec} {t=now} {t .. t+12sec} {t'=now}

slide-10
SLIDE 10

10

Requirements elicitation

state diagrams ...

State diagram of the LCC system

Activated Deactivated Failure trainDetectionEntry / yellowLightOn() Closing Barrier Yellow LightOn Closed Opening Barrier timeOut_1 / redLightOn()

[bSensor.status=Closed] / setMode(Safe)

trainDetectionRear / openBarrier() repair deactivate timeOut_3 failure Red LightOn

[bSensor.status=Opened] / setMode(Unsafe)

timeOut_2 / closeBarrier()

slide-11
SLIDE 11

11

Requirements elicitation

main safety properties ...

OCL invariants and pre/post-conditions

context LCC_System inv 1: self.theBarrier.state=Closed implies self.redLight.state=On and self.theBarrier.state=Closing implies self.yellowLight.state=On and self.yellowLight.state=Off and self.redLight.state=Off implies self.theBarrier.state=Open inv 2: self.state=Activated and self.bSensor.state=Open implies self.mode=Unsafe inv 4: self.bSensor.state=Open and self.theBarrier.state=Closed implies self.mode=Unsafe context LCC_System :: openBarrier pre: self.theBarrier.state=Closed and self.mode=Safe post: self.theBarrier.state=Open

slide-12
SLIDE 12

12

  • IV. From UML to B

… mapping UML diagrams into B formal specifications

Formal semantics for UML/OCL Why B ? UML : collections of objects ↔ B : sets How ? Transformation rules of UML/OCL into B

Abstract Machines

  • perations
  • per1( ); … operN( );

a(args) == pre {} then {} ; invariant classi ⊆ CLASSi statei ∈ classi → statei

Translation rules OCL → B Translation rules OCL → B

Diagrams and Constraints context Class i::operation(arg:Type) pre: predicate (class i, arg) post: predicate (class j, arg)

UML/OCL model UML/OCL model B formal specification B formal specification

Classi Assij Classj

slide-13
SLIDE 13

13

UML→B

formalization of class diagrams ...

UML:

LevelCrossingControl Light Barrier BarrierSensor TrainborneControl VehicleSensor OnboardPanel OperationPanel Controller TrainDriver OperationsCenter state : LIGHTstate switchOn() switchOff() getBarrierStatus() status: bSTATE lcc_train train_oc state : bSTATE sendSignal() state : STATE closeBarrier()

  • penBarrier()

yellowLightOnt() mode : {Safe,Unsafe} redLightOn() trainDetectEntry() trainDetectRear() yellowLightOff() redLightOff() rear 1 theBarrier * close()

  • pen()

1 1 sensor redLight 1 bSensor 1 1

  • c

lcc_oc 1 1 yellowLight lc 0..1 lc state : tSTATE getStateLC() * applyBreaks() continueRun()

  • c

* * releaseBreaks() receiveAck() downSpeed() upSpeed() askAck() standStill() train 0..1 train

slide-14
SLIDE 14

14

UML→B

formalization of class diagrams ...

Translation of a class:

MACHINE Barrier USES BarrierSensor SETS BARRIER VARIABLES barrier, bState INVARIANT barrier ⊆ BARRIER ∧ bState ∈ barrier → bSTATE INITIALISATION barrier,bState := ∅,∅ OPERATIONS

  • penBarrier(obj) =

PRE

  • bj∈barrier ∧ bState(obj)=Closed

THEN bState(obj):=Opened END; closeBarrier(obj) = PRE

  • bj∈barrier ∧ bState(obj)=Opened

THEN bState(obj):=Closed END;

slide-15
SLIDE 15

15

UML→B

formalization of class diagrams ...

Part of the B specification – Machine LCC_System:

MACHINE LCC_System SETS LCC; STATE={Deactivated,ShowingYlight,ShowingRlight,ClosingB,OpeningB,ClosedB,Failure}; MODE={Safe,Unsafe} INCLUDES Barrier, BarrierSensor, Red.Light, TrainborneCS, Yellow.Light VARIABLES lcc, lcc_barrier, lcc_sensor, state, redLight, yellowLight, lcc_train, mode INVARIANT lcc ⊆ LCC ∧ lcc_barrier ∈ lcc → barrier ∧ lcc_sensor ∈ lcc → bSensor ∧ state ∈ lcc → STATE ∧ redLight ∈ lcc → Red.light ∧ yellowLight ∈ lcc → Yellow.light ∧ lcc_train ∈ lcc train ∧ mode ∈ lcc → MODE ∧ ...

slide-16
SLIDE 16

16

UML→B

formalization of state diagrams ...

OPERATIONS timeOut_1_showRlight(obj) = PRE

  • bj∈lcc ∧

state(obj)=ShowingYlight ∧ bStatus(lcc_sensor(obj))=Opened ∧ bState(lcc_barrier(obj))=Opened ∧ Red.lState(redLight(obj))=Off ∧ Yellow.lState(yellowLight(obj))=On THEN state(obj):=ShowingRlight || Yellow.switchOff(yellowLight(obj)) || Red.switchOn(redLight(obj)) END; timeOut_2_closeBarrier(obj)= PRE

  • bj∈lcc ∧

state(obj)=ShowingRlight ∧ Red.lState(redLight(obj))=On ∧ Yellow.lState(yellowLight(obj))=Off THEN state(obj):=ClosingB || closeBarrier(lcc_barrier(obj)) END; timeOut_3_setMode(obj) = PRE

  • bj∈lcc ∧

state(obj)=ClosingB ∧ bState(lcc_barrier(obj))=Closed ∧ Red.lState(redLight(obj))=On ∧ Yellow.lState(yellowLight(obj))=Off THEN SELECT bStatus(lcc_sensor(obj))=Closed THEN state(obj):= ClosedB || mode(obj):=Safe WHEN bStatus(lcc_sensor(obj))=Opened THEN state(obj):= Failure ELSE skip END END; …

Machine LCC_System – operations:

slide-17
SLIDE 17

17

UML→B

formalization of OCL constraints ...

Machine LCC_System – invariant:

∀obj.(obj∈lcc ∧ bState(lcc_barrier(obj))=Closed ⇒ Red.lState(redLight(obj))=On) ∧ ∀obj.(obj∈lcc ∧ bState(lcc_barrier(obj))=Closing ⇒ Red.lState(yellowLight(obj))=On) ∧ ∀obj.(obj∈lcc ∧ Yellow.lState(yellowLight(obj))=Off ∧ Red.lState(redLight(obj))=Off ⇒ bState(lcc_barrier(obj))=Opened) ∧ ∀obj.(obj∈lcc ∧ state(obj)∈Activated ∧ bStatus(lcc_sensor(obj))=Opened ⇒ mode(obj)=Unsafe) ∧ ∀obj.(obj∈lcc ∧ bStatus(lcc_sensor(obj))=Opened ∧ bState(lcc_barrier(obj))=Closed ⇒ mode(obj)=Unsafe)

slide-18
SLIDE 18

18

  • IV. From UML to B

translating times features into extended B ...

Classical B Specifying a clock abstract machine Defining abstract variables holding the times Time extended B with timed substitutions Semantic extension of B substitutions : → Derivative of Duration Calculus (WDC*)

slide-19
SLIDE 19

19

Machine LCC_System – classical B with time variables:

Time extended B

  • perations including time constraints ...

closeBarrier(obj) = PRE

  • bj ∈ barrier ∧

bState(obj)=Opened THEN bState(obj):=Closed || ANY newtime WHERE newtime ∈ N ∧ newtime ≥ time ∧ newtime ≤ time+ClosingDelay THEN setTime(newtime) END END; timeOut_2_closeBarrier(obj)= PRE

  • bj∈lcc ∧

state(obj)=ShowingRlight ∧ Red.lState(redLight(obj))=On ∧ Yellow.lState(yellowLight(obj))=Off ∧ time – trainDetectionEntry_Time ≤ 12 THEN state(obj):=ClosingB || closeBarrier(lcc_barrier(obj)) || closeBarrierTime:=time END; timeOut_3_setMode(obj) = PRE

  • bj∈lcc ∧

state(obj)=ClosingB ∧ bState(lcc_barrier(obj))=Closed ∧ Red.lState(redLight(obj))=On ∧ Yellow.lState(yellowLight(obj))=Off THEN SELECT bStatus(lcc_sensor(obj))=Closed ∧ time – closeBarrierTime ≤ 6 THEN state(obj):= ClosedB || mode(obj):=Safe WHEN bStatus(lcc_sensor(obj))=Opened ∧ time – closeBarrierTime > 6 THEN state(obj):= Failure ELSE skip END END;

slide-20
SLIDE 20

20

Time extended B

timed substitutions ...

Classic B substitutions Extended Hoare Triplets

( l = d ) ∧ [| P |] dur( [S]P ) ∧ dur( [T]P ) [| |] [| |] dur([GSL]P) delay d [S]P ∧ [T]P S [] T [S] ([T]P) S ; T g ⇒ [S]P g ⇒ S g ∧ [S]P g | S P [E/x] x := E P skip [GSL]P GSL WHILE C DO S INVARIANT I , dur([S], I)* {[S]I} [S,dur([S], I)] {I} I ∧C⇒[S]I I ∧¬C⇒P {I} {P}

slide-21
SLIDE 21

21

Time extended B

timed machines ...

Timed substitutions

x ← Example1 = TIMING PRE x ≥ 1 THEN delay 1; x:=x-1; END POST x ≥ 0 REQUIRES ( [| x ≥ 0 |] ) END

slide-22
SLIDE 22

22

  • V. Analysis and verification

...

Generating Proof Obligations (POs) The prove process facilitate errors detection

Syntax and type errors Incompleteness of pre-conditions Inconsistent post-conditions

Generation of Proof Obligations (POs) Errors detection Proof Obligations Prove process Unsuccessful proofs Abstract Machines Abstract Machines

MACHINE Systeme INCLUDES Classei, Classej VARIABLES assij INVARIANT assij ∈classei↔classej

OPERATIONS

slide-23
SLIDE 23

23

  • VI. Conclusions and discussion

...

Classical B with time variables

Does not allow complex timed properties

(liveness and fairness)

Enough to railway control systems Easiest implementation

Extended B with duration calculus

Timing diagrams needed Allows to express complex timing properties

Event B ? → CTL semantics

slide-24
SLIDE 24

24

Conclusions and discussion

...

Advantages of using B Analysis, verification and simulation :

coherence/consistency of UML/OCL

Use of existing proof tools Refinement Successfully used in railway applications