[PPT] - Formal and Incremental Verification of SysML Specifications for the PowerPoint Presentation

SLIDE 1

Formal and Incremental Verification of SysML Specifications for the Design of Component-Based Systems

Oscar Carrillo

Département d’Informatique des Systèmes Complexes (DISC), Femto-ST UMR 6174 CNRS

Encadrement : Hassan Mountassir et Samir Chouali Soutenue le 17 decembre 2015 à Besançon

Oscar Carrillo Formal and Incremental Verification... 1 / 54

SLIDE 2

Outline

1

Introduction

2

Scientific Context

3

Contributions

4

Conclusion and Perspectives

Oscar Carrillo Formal and Incremental Verification... 1 / 54

SLIDE 3

Introduction Scientific Context Contributions Conclusion and Perspectives

Outline

1

Introduction

2

Scientific Context

3

Contributions

4

Conclusion and Perspectives

Oscar Carrillo Formal and Incremental Verification... 1 / 54

SLIDE 4

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Context

Context

Development of Systems by Component Assembly

◮ Reduce complexity ◮ Reduce development costs ◮ Improve reliability

Functional Requirements Functional properties that the system must satisfy to fulfill user needs SysML Complex systems, communicate, popular

Oscar Carrillo Formal and Incremental Verification... 2 / 54

SLIDE 5

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Context

Context

Component-Based Systems (CBS)

◮ Components described by their interfaces ◮ Simple and composite components ◮ Built by assembling the components ◮ Architecture described by the connections between the

components

◮ Leads to big systems (complex) A B AB

Oscar Carrillo Formal and Incremental Verification... 3 / 54

SLIDE 6

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Challenge

Challenge

In SysML a component is defined by a block How to formally ensure reliability of CBS described by SysML ?

Oscar Carrillo Formal and Incremental Verification... 4 / 54

SLIDE 7

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Contributions

Contributions

Oscar Carrillo Formal and Incremental Verification... 5 / 54

SLIDE 8

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Case Study

A Car Safety System

Airbag and seat-belts protecting passenger lives

Oscar Carrillo Formal and Incremental Verification... 6 / 54

SLIDE 9

Introduction Scientific Context Contributions Conclusion and Perspectives

Outline

1

Introduction

2

Scientific Context The SysML Language Interface automata

3

Contributions

4

Conclusion and Perspectives

Oscar Carrillo Formal and Incremental Verification... 6 / 54

SLIDE 10

Introduction Scientific Context Contributions Conclusion and Perspectives . . . SysML

The SysML Language

Systems Modeling Language

◮ Model hardware and software systems ◮ Functional and non-functional requirements ◮ Interdisciplinary ◮ SysML is a communication method, not a methodology

SysML Behavioral Diagrams Structural Diagrams Cross-Cutting Diagrams Block Definition Diagram Internal Block Diagram Parametric Diagram Package Diagram Use Case Diagram Sequence Diagram Activity Diagram State Machine Diagram Requirement Diagram UML 2.0 SysML 1.3

Oscar Carrillo Formal and Incremental Verification... 7 / 54

SLIDE 11

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Interface automata

Interface Automata [Alfaro, Henzinger 2001]

Definition An interface automaton A is represented by the tuple S, I, ΣI, ΣO, ΣH, δ such as :

◮ S is a finite set of states, ◮ I ⊆ S is a finite set of initial states, ◮ ΣI, ΣO and ΣH, respectively denote the sets of input, output

and internal actions. ΣA = ΣI ∪ ΣO ∪ ΣH,

◮ δ ⊆ S × Σ × S is the set of transitions between two states.

Oscar Carrillo Formal and Incremental Verification... 8 / 54

SLIDE 12

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Interface automata

Interface automata synchronized product

Definition Let A1 and A2 two composable interface automata. The synchro- nized product A1 ⊗ A2 of A1 and A2 is defined by :

◮ SA1⊗A2 = SA1 × SA2 and IA1⊗A2 = IA1 × IA2; ◮ ΣI A1⊗A2 = (ΣI A1 ∪ ΣI A2) \ Shared(A1, A2); ◮ ΣO A1⊗A2 = (ΣO A1 ∪ ΣO A2) \ Shared(A1, A2); ◮ ΣH A1⊗A2 = ΣH A1 ∪ ΣH A2 ∪ Shared(A1, A2); ◮ ((s1, s2), a, (s′ 1, s′ 2)) ∈ δA1⊗A2 if

◮ a ∈ Shared(A1, A2) ∧ (s1, a, s′

1) ∈ δA1 ∧ s2 = s′ 2

◮ a ∈ Shared(A1, A2) ∧ (s2, a, s′

2) ∈ δA2 ∧ s1 = s′ 1

◮ a ∈ Shared(A1, A2) ∧ (s1, a, s′

1) ∈ δA1 ∧ (s2, a, s′ 2) ∈ δA2.

Oscar Carrillo Formal and Incremental Verification... 9 / 54

SLIDE 13

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Interface automata

Interface automata synchronized product

Oscar Carrillo Formal and Incremental Verification... 10 / 54

SLIDE 14

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Interface automata

Illegal states

Definition Let two composable interface automata A1 and A2, the set of illegal states Illegal(A1, A2) ⊆ SA1 × SA2 is defined by {(s1, s2) ∈ SA1 × SA2 | ∃a ∈ Shared(A1, A2) . C} where C is : C = (a ∈ ΣO

A1(s1) ∧ a ∈ ΣI A2(s2)) ∨ (a ∈ ΣO A2(s2) ∧ a ∈ ΣI A1(s1))

Oscar Carrillo Formal and Incremental Verification... 11 / 54

SLIDE 15

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Interface automata

Composition

Definition The composition A1 A2 of two IA A1 and A2 is defined by : (i) SA1A2 = Comp(A1,A2), (ii) IA1A2 = IA1⊗A2 ∩ Comp(A1,A2) (iii) δA1A2 = δA1⊗A2 ∩ Comp(A1, A2) × ΣA1A2 × Comp(A1, A2) Where Comp(A1, A2) = A1 ⊗ A2 − Illegal(A1, A2) Compatibility Two interface automata A1 and A2 are compatibles if and only if their composition A1 A2 has at least one reachable state.

Oscar Carrillo Formal and Incremental Verification... 12 / 54

SLIDE 16

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Outline

1

Introduction

2

Scientific Context

3

Contributions Incremental Refinement of a CBS Architecture Formal Verification of SysML Requirements Incremental Specification of CBS Architecture

4

Conclusion and Perspectives

Oscar Carrillo Formal and Incremental Verification... 12 / 54

SLIDE 17

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Incremental Refinement of a CBS Architecture

Oscar Carrillo Formal and Incremental Verification... 13 / 54

SLIDE 18

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Overview

Refinement by decomposition Structural and behavioral refinement relation.

Oscar Carrillo Formal and Incremental Verification... 14 / 54

SLIDE 19

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Refinement Process

Oscar Carrillo Formal and Incremental Verification... 15 / 54

SLIDE 20

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

CBS Specification with SysML 1.3

Block Definition Diagram (BDD) Structure of abstract system

Oscar Carrillo Formal and Incremental Verification... 16 / 54

SLIDE 21

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

CBS Specification with SysML 1.3

Block Definition Diagram (BDD) Description of SensorsControl block

Oscar Carrillo Formal and Incremental Verification... 17 / 54

SLIDE 22

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

CBS Specification with SysML 1.3

Block Definition Diagram (BDD) Proposed decomposition for abstract block.

Oscar Carrillo Formal and Incremental Verification... 18 / 54

SLIDE 23

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

CBS Specification with SysML 1.3

Internal Block Diagram (IBD) Proposed internal structure for abstract block

Oscar Carrillo Formal and Incremental Verification... 19 / 54

SLIDE 24

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Formal SysML Specification

Definition : SysML Block Let SB a set of blocks modeled with a BDD, a SysML block B in SB is a tuple ΦB, Pin, Pout, TypePort, where :

◮ ΦB is the set of the private

perations in B,

◮ Pin the unique input port of B, ◮ Pout the unique output port of

B.

◮ TypePort : Pin ∪ Pout → SB

determines the interface that types each port.

Oscar Carrillo Formal and Incremental Verification... 20 / 54

SLIDE 25

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Formal SysML Specification

Definition : SysML IBD A SysML IBD, of a composite block, is a tuple ΦParts, iPin, iPout, ePin, ePout, Connector, where :

◮ ΦParts is the set of parts, ◮ iPin and iPout are the sets of internal input and output ports, ◮ ePin and ePout are the external input and output ports, ◮ Connector : Pin ∪ Pout → Pin ∪ Pout associates input and

utput ports to other input and output ports.

Oscar Carrillo Formal and Incremental Verification... 21 / 54

SLIDE 26

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Structural Refinement

Definition : Structural refinement of SysML blocks Let B be an abstract block described with the BDD, and IBDB the internal block diagram of B. Let B1, ..., Bn be the set of blocks composing B according to the BDD, so B1, ..., Bn refine structurally B iff :

◮ B1, ..., Bn are consistent with B, ◮ the interacting blocks B1, ..., Bn according to IBDB are

compatible.

Oscar Carrillo Formal and Incremental Verification... 22 / 54

SLIDE 27

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Consistency Verification

Condition 1 (Composability) For every pair of connected sub-blocks {Bi, Bj}, it holds that : ΦinBi∩ΦinBj = ΦoutBi∩ΦoutBj = ΦBi∩(ΦBj ∪ΦinBj ∪ΦoutBj) = ΦBj ∩ (ΦBi ∪ ΦinBi ∪ ΦoutBi) = ∅

Oscar Carrillo Formal and Incremental Verification... 23 / 54

SLIDE 28

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Consistency Verification

Condition 2 (At least same inputs) For a sub-block Bi connected to the external input port ePin it holds that : ΦinB ⊆ ΦinBi

Oscar Carrillo Formal and Incremental Verification... 24 / 54

SLIDE 29

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Consistency Verification

Condition 3 (At most same outputs) For a sub-block Bi connected to the external port ePout it holds that : ΦoutBi ⊆ ΦoutB.

Oscar Carrillo Formal and Incremental Verification... 25 / 54

SLIDE 30

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Compatibility Verification

Interface Automata Generation Obtained by applying [Chouali et al. 2011] approach, from sequence diagrams. Condition 4 (Compatibility) Two connected sub-blocks B1 and B2 are compatible if their interface automata A1 and A2 are compatible. Ptolemy II [Barais et al. 2005] Verification module for interface automata composition

Oscar Carrillo Formal and Incremental Verification... 26 / 54

SLIDE 31

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Behavioral Refinement

◮ Let P = A1 ... An, be the composite automaton of the

composition of a set of blocks B1, ..., Bn

◮ Let Q be the interface automaton for an abstract block B

Definition : Interface Automata Refinement [Alfaro et al. 2005] An interface automaton P refines an interface automaton Q, written P ≤a Q, if

1. ΣI

Q ⊆ ΣI P and ΣO Q ⊇ ΣO P

2. there is an alternating simulation ≤a by Q of P such that

IP ≤a IQ

Oscar Carrillo Formal and Incremental Verification... 27 / 54

SLIDE 32

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Behavioral Refinement

Definition : Alternating Simulation [Alfaro et al. 2005] For a pair of interface automata P = SP , IP , ΣI

P , ΣO P , ΣH P , δP and Q = SQ, IQ, ΣI Q, ΣO Q, ΣH Q, δQ

with the same signature, a binary relation ≤a⊆ SP × SQ is an alternating simulation if whenever p ≤a q and a ∈ ΣP it holds that : if q

a?

− → q′ and a ∈ ΣI

Q then ∃p′.p a?

− → p′ and (p′, q′) ∈≤a if p

a!

− → p′ and a ∈ ΣO

P then ∃q′.q τ

− →∗ q′.∃q′′.q′

a!

− →∗ q′′ and (p′, q′′) ∈≤a if p

a;

− → p′ and a ∈ ΣH

P then ∃q′.q τ

− →∗ q′ and (p′, q′) ∈≤a

Oscar Carrillo Formal and Incremental Verification... 28 / 54

SLIDE 33

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Behavioral Refinement

Definition : Alternating Simulation [Alfaro et al. 2005] For a pair of interface automata P = SP , IP , ΣI

P , ΣO P , ΣH P , δP and Q = SQ, IQ, ΣI Q, ΣO Q, ΣH Q, δQ

with the same signature, a binary relation ≤a⊆ SP × SQ is an alternating simulation if whenever p ≤a q and a ∈ ΣP it holds that : if q

a?

− → q′ and a ∈ ΣI

Q then ∃p′.p a?

− → p′ and (p′, q′) ∈≤a if p

a!

− → p′ and a ∈ ΣO

P then ∃q′.q τ

− →∗ q′.∃q′′.q′

a!

− →∗ q′′ and (p′, q′′) ∈≤a if p

a;

− → p′ and a ∈ ΣH

P then ∃q′.q τ

− →∗ q′ and (p′, q′) ∈≤a

Oscar Carrillo Formal and Incremental Verification... 28 / 54

SLIDE 34

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

Behavioral Refinement

Definition : Alternating Simulation [Alfaro et al. 2005] For a pair of interface automata P = SP , IP , ΣI

P , ΣO P , ΣH P , δP and Q = SQ, IQ, ΣI Q, ΣO Q, ΣH Q, δQ

with the same signature, a binary relation ≤a⊆ SP × SQ is an alternating simulation if whenever p ≤a q and a ∈ ΣP it holds that : if q

a?

− → q′ and a ∈ ΣI

Q then ∃p′.p a?

− → p′ and (p′, q′) ∈≤a if p

a!

− → p′ and a ∈ ΣO

P then ∃q′.q τ

− →∗ q′.∃q′′.q′

a!

− →∗ q′′ and (p′, q′′) ∈≤a if p

a;

− → p′ and a ∈ ΣH

P then ∃q′.q τ

− →∗ q′ and (p′, q′) ∈≤a

Oscar Carrillo Formal and Incremental Verification... 28 / 54

SLIDE 35

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

MIO Workbench [Bauer et al. 2010]

Modal automaton

◮ Larsen et al. 2007 ◮ A modal automaton S is a six tuple :

S = (SS, IS, Σext

S , ΣH S , −

→S

♦, −

→S

) ◮ T (SP , IP , ΣI P , ΣO P , ΣH P , δP ) = (SS, IS, Σext S , ΣH S , −

→♦, − →) Alternating simulation and observational modal refinement Alternating simulation and observational modal refinement coincide for interface automata in the following sense : For any two interface automata P, Q : P ≤a Q iff T (P) ≤∗

m T (Q)

Oscar Carrillo Formal and Incremental Verification... 29 / 54

SLIDE 36

Introduction Scientific Context Contributions Conclusion and Perspectives . . . CBS Architecture Refinement

MIO Workbench

Oscar Carrillo Formal and Incremental Verification... 30 / 54

SLIDE 37

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Formal Verification of SysML Requirements

Outline

1

Introduction

2

Scientific Context

3

Contributions Incremental Refinement of a CBS Architecture Formal Verification of SysML Requirements Incremental Specification of CBS Architecture

4

Conclusion and Perspectives

Oscar Carrillo Formal and Incremental Verification... 30 / 54

SLIDE 38

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Formal Verification of SysML Requirements

Formal Verification of SysML Requirements

Oscar Carrillo Formal and Incremental Verification... 31 / 54

SLIDE 39

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Formal Verification of SysML Requirements

Requirements for a Car Safety System

Requirements Refinement for a Safety System

Oscar Carrillo Formal and Incremental Verification... 32 / 54

SLIDE 40

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Formal Verification of SysML Requirements

Case Study

Sensors Requirements Always get the sensor values and send them to the ACU.

Oscar Carrillo Formal and Incremental Verification... 33 / 54

SLIDE 41

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Formal Verification of SysML Requirements

From SD to Promela

SD element Promela Element Promela Statement Lifeline Process proctype{...} Message Message mtype{m1,...,mn} Connector Communication channel for each message arrow chan chanName = [1] of {mtype} Send and receive events Send and receive operations Send ⇒ ab!m, Receive ⇒ ab?m Alt combined fragment if condition if ::(guard)->ab_p?p; :: else -> ab_q?q; fi; Loop combined fragment do operator do ::ab_p?p;

d

Mapping of basic concepts from Sequence Diagrams to Promela Lima et al. 2009

Oscar Carrillo Formal and Incremental Verification... 34 / 54

SLIDE 42

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Formal Verification of SysML Requirements

Sensors block Promela description

SD for sensors block

... proctype proc_sensors(){ do sensors_environment_get_sensor_values?get_sensor_values; sensors_environment_sensor_values!sensor_values;

d

} proctype proc_environment(){ do sensors_environment_get_sensor_values!get_sensor_values; sensors_environment_sensor_values?sensor_values;

d

} init{ atomic{run proc_sensors(); run proc_environment();} }

Promela code for sensors block

Oscar Carrillo Formal and Incremental Verification... 35 / 54

SLIDE 43

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Formal Verification of SysML Requirements

Verification with SPIN

◮ Promela description must keep track of who is

sending/receiving what message at any time of the execution. Flags for sensor component

◮ send, receive ◮ msg_get_sensor_values, msg_send_sensor_values ◮ sensors, environment ◮ All flags updated by d_step

LTL Property with flags ((sensors && receive && msg_get_sensor_values) → ♦ (sensors && send && msg_sensor_values))

Oscar Carrillo Formal and Incremental Verification... 36 / 54

SLIDE 44

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Incremental Specification of CBS Architecture

Outline

1

Introduction

2

Scientific Context

3

Contributions Incremental Refinement of a CBS Architecture Formal Verification of SysML Requirements Incremental Specification of CBS Architecture

4

Conclusion and Perspectives

Oscar Carrillo Formal and Incremental Verification... 36 / 54

SLIDE 45

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Incremental Specification of CBS Architecture

Incremental Specification of CBS Architecture

Oscar Carrillo Formal and Incremental Verification... 37 / 54

SLIDE 46

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Incremental Specification of CBS Architecture

Approach Steps

select atomic requirements requirement diagram S = ∅ for each atomic

req. R

link R to a block B such that B R (Use SD, Pro- mela, SPIN) block library Verify that S B = ∅ (use IA and preservation of actions) let S = S B and generate par- tial BDD and IBD Generate system architecture next yes no end

Oscar Carrillo Formal and Incremental Verification... 38 / 54

SLIDE 47

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Incremental Specification of CBS Architecture

Requirements for a Car Safety System

Requirements Refinement for a Safety System

Oscar Carrillo Formal and Incremental Verification... 39 / 54

SLIDE 48

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Incremental Specification of CBS Architecture

Requirement Diagram Analysis

Definition : Requirement diagram specification We specify a SysML requirement diagram by RD = IR, SR, RelC, RelD such that :

◮ IR : define the set of initial requirements, ◮ SR : the set of all requirements. ◮ RelC ⊆ SR × P(SR) the relation of containment, where

P(SR) is the set of the subsets of SR.

◮ RelD ⊆ SR × P(SR) the relation of derivation. R0 R01 R02 R011 R012 R1 R2 ⊕ ⊕

<<derive>> <<derive>> Oscar Carrillo Formal and Incremental Verification... 40 / 54

SLIDE 49

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Incremental Specification of CBS Architecture

Atomic Requirements

Definition : Atomic requirements The set of atomic requirements in the requirement diagram speci- fied by RD = IR, SR, RelC, RelD is the set AR = {R|R ∈ SR, ∄(R, {Ri, ...Rn}) ∈ RelC} Theorem : System satisfying all atomic requirements Let S be a CBS, let RD = IR, SR, RelC, RelD be the specifi- cation of a requirement diagram, and let AR be the set of atomic requirements of RD. S satisfies all the requirements in SR iff it satisfies the atomic requirements AR.

Oscar Carrillo Formal and Incremental Verification... 41 / 54

SLIDE 50

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Incremental Specification of CBS Architecture

Atomic Requirements in Case Study

R1.1.1 : Sensors Always get the sensor values and send them to the ACU. ((sensors && receive && msg_get_sensor_values) → ♦ (sensors && send && msg_sensor_values)) R1.1.2 : Airbag Control Unit Decide whether or not to deploy the airbag and/or lock the seat-belts

nce the sensors report new values.

((acu && receive && msg_sensor_values) → ♦ (acu && send && (msg_act_sb || msg_act_ab))) Connected Requirements R1.1.1 and R1.1.2 share input and output actions.

Oscar Carrillo Formal and Incremental Verification... 42 / 54

SLIDE 51

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Incremental Specification of CBS Architecture

Block Library

Component interfaces are described by SysML Sequence Diagrams

SD for sensors block SD for the ACU block

Oscar Carrillo Formal and Incremental Verification... 43 / 54

SLIDE 52

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Incremental Specification of CBS Architecture

Block Sensors

SD for sensors block

... proctype proc_sensors(){ do sensors_environment_get_sensor_values?get_sensor_values; sensors_environment_sensor_values!sensor_values;

d

} proctype proc_environment(){ do sensors_environment_get_sensor_values!get_sensor_values; sensors_environment_sensor_values?sensor_values;

d

} init{ atomic{run proc_sensors(); run proc_environment();} }

Promela code for sensors block

Oscar Carrillo Formal and Incremental Verification... 44 / 54

SLIDE 53

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Incremental Specification of CBS Architecture

Block ACU

SD for the ACU block

... proctype proc_acu(){ do ::acu_environment_sensor_values? sensor_values; if ::(val_acc>=60)−> {acu_environment_act_sb!act_sb; acu_environment_act_ab!act_ab;} ::((val_acc<60) && (val_acc>=3))−> acu_environment_act_sb!act_sb; ::else{acu_reset!reset; acu_reset?reset;} fi;

d}

Promela code for ACU block

Oscar Carrillo Formal and Incremental Verification... 45 / 54

SLIDE 54

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Incremental Specification of CBS Architecture

Compatibility Verification

1

get_sensor_values? sensor_values! get_sensor _values sensor _values

IA for the Sensors block

1 2

sensor_values? act_sb! reset; act_sb! act_ab! sensor _values act_sb act_ab

IA for the ACU

1 2 3

get_sensor_values? sensor_values; reset; act_sb! act_sb! act_ab! get_sensor _values act_sb act_ab

IA composition generated by Ptolemy (Lee et al. 2004)

Oscar Carrillo Formal and Incremental Verification... 46 / 54

SLIDE 55

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Incremental Specification of CBS Architecture

Requirement Preservation over Composition

Theorem : Preservation of requirements The composite block S = Bi Bi+1 preserves the requirements {Ri, Ri+1} iff the interface automata Ai, and Ai+1, are compatible, and the input and output actions, Ii, Ii+1, Oi, and Oi+1 are preserved in S.

1 2 3

get_sensor_values? sensor_values; reset; act_sb! act_sb! act_ab! get_sensor _values act_sb act_ab

Oscar Carrillo Formal and Incremental Verification... 47 / 54

SLIDE 56

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Incremental Specification of CBS Architecture

Architecture Specification

BDD for the second iteration

Oscar Carrillo Formal and Incremental Verification... 48 / 54

SLIDE 57

Introduction Scientific Context Contributions Conclusion and Perspectives . . . Incremental Specification of CBS Architecture

Architecture Specification

IBD for the second iteration

Oscar Carrillo Formal and Incremental Verification... 49 / 54

SLIDE 58

Introduction Scientific Context Contributions Conclusion and Perspectives

Outline

1

Introduction

2

Scientific Context

3

Contributions

4

Conclusion and Perspectives

Oscar Carrillo Formal and Incremental Verification... 49 / 54

SLIDE 59

Introduction Scientific Context Contributions Conclusion and Perspectives

Contributions

Oscar Carrillo Formal and Incremental Verification... 50 / 54

SLIDE 60

Introduction Scientific Context Contributions Conclusion and Perspectives

Contributions

Formalize SysML

◮ Compatibility of SysML blocks ◮ Refinement of abstract SysML blocks

Verification of SysML Requirements

◮ SysML Requirements as LTL properties ◮ Promela description from SysML Sequence Diagrams ◮ Verification with SPIN model-checker

Incremental CBS Architecture Specification

◮ Guided by requirements ◮ Reuse of SysML blocks

Oscar Carrillo Formal and Incremental Verification... 51 / 54

SLIDE 61

Introduction Scientific Context Contributions Conclusion and Perspectives

Future Work

Oscar Carrillo Formal and Incremental Verification... 52 / 54

SLIDE 62

Introduction Scientific Context Contributions Conclusion and Perspectives

Future Work

Block adapters Automatic generation of a block adapter when assembled blocks are incompatible Non-functional requirements Validation by simulation Requirements when refining Preservation over a decomposition Toolchain for verification SysML, SD to IA, SD to Promela, Ptolemy, MIO Workbench, SPIN, SysML Model

Oscar Carrillo Formal and Incremental Verification... 53 / 54

SLIDE 63

Introduction Scientific Context Contributions Conclusion and Perspectives . . . The End

Any questions ?

Thank you for your attention

Oscar Carrillo Formal and Incremental Verification... 54 / 54

SLIDE 64

Introduction Scientific Context Contributions Conclusion and Perspectives . . . The End

Final Architecture for the Vehicle Safety System

1 2 3 5 7 4 6

get_sensor_values? sensor_values; reset; act_sb; act_sb; act_ab; lock_sb; lock_sb; inflate_ab; inflate_ab; lock_sb; act_ab; get_sensor_values act_sb act_ab

IA for the fourth iteration

Oscar Carrillo Formal and Incremental Verification... 54 / 54

SLIDE 65

Introduction Scientific Context Contributions Conclusion and Perspectives . . . The End

Final Architecture for the Vehicle Safety System

Oscar Carrillo Formal and Incremental Verification... 54 / 54