Electronic Notes in Theoretical Computer Science, 2005
We present a tool-supported framework for proving that the composition of the behaviors of the se... more We present a tool-supported framework for proving that the composition of the behaviors of the separate parts of a complex system ensures a desired global property of the overall system. A compositional inference rule is formally introduced and encoded in the logic of the PVS theorem prover. Methodological considerations on the usage of the inference rule are presented, and the framework is then used to prove a meaningful property of a simple, but significant, control system.
This paper presents a verification technique for dense-time MTL based on discretization. The tech... more This paper presents a verification technique for dense-time MTL based on discretization. The technique reduces the validity problem of MTL formulas from dense to discrete time, through the notion of sampling invariance, introduced in previous work . Since the reduction is from an undecidable problem to a decidable one, the technique is necessarily incomplete, so it fails to provide conclusive answers for some formulas. The paper discusses this shortcoming and hints at how it can be mitigated in practice. The verification technique has been implemented on top of the ot tool [19] for discrete-time bounded validity checking; the paper also reports on in-the-small experiments with the tool, which show some results that are promising in terms of performance.
ArchiTRIO [14] is a formal language, which complements UML 2.0 concepts with a formal, logic-base... more ArchiTRIO [14] is a formal language, which complements UML 2.0 concepts with a formal, logic-based notation that allows users to state system-wide properties, both static and dynamic, including real-time constraints. In this paper we present the semantics of the core concepts of the ArchiTRIO language. As the core elements of ArchiTRIO coincide with those of UML 2.0 (operation, interface, port, class), the semantics of ArchiTRIO provides also a formal definition for the basic concepts on which UML 2.0 is built.
The increasing relevance of areas such as real-time and embedded systems, pervasive computing, hy... more The increasing relevance of areas such as real-time and embedded systems, pervasive computing, hybrid systems control, and biological and social systems modeling is bringing a growing attention to the temporal aspects of computing, not only in the computer science domain, but also in more traditional fields of engineering.
This paper investigates the use of object-oriented techniques for the specification and design of... more This paper investigates the use of object-oriented techniques for the specification and design of distributed multimedia applications (DMAs). DMAs are a class of software applications with a range of strong-often conflicting-requirements of dynamicity, interactivity, real-time synchronized processing of several media types, network distribution, high-performance, fault-tolerance, load balancing and security. The development of complex DMAs can benefit from the adoption of object design methods and distributed object implementation technologies. The paper describes the use of two modeling approaches, based on the standard UML modeling language, and on the TRIO formal specification language, respectively. The problem of defining steps to move from the UML or TRIO specification to a CORBA IDL implementation is addressed. An experimental distributed video-on-demand system is used throughout the paper as a case study
This article introduces a fully automated verification technique that permits to analyze real-tim... more This article introduces a fully automated verification technique that permits to analyze real-time systems described using a continuous notion of time and a mixture of operational (i.e., automata-based) and descriptive (i.e., logic-based) formalisms. The technique relies on the reduction, under reasonable assumptions, of the continuous-time verification problem to its discrete-time counterpart. This reconciles in a viable and effective way the dense/discrete and operational/descriptive dichotomies that are often encountered in practice when it comes to specifying and analyzing complex critical systems. The article investigates the applicability of the technique through a significant example centered on a communication protocol. Concurrent runs of the protocol are formalized by parallel instances of a Timed Automaton, while the synchronization rules between these instances are specified through Metric Temporal Logic formulas, thus creating a multi-paradigm model. Verification tests run on this model using a bounded satisfiability checker implementing the technique show consistent results and interesting performances.
This paper presents ArchiTRIO (Architectural TRIO), a new temporal logic language which combines ... more This paper presents ArchiTRIO (Architectural TRIO), a new temporal logic language which combines a subset of the UML notation with a precise formal semantics inspired from the authors’ experiences. ArchiTRIO allows developers to use standard UML 2.0 notation to describe non-critical aspects of systems, but it also offers a complementary formal notation, fully integrated with the UML one, to represent those system aspects that require precise modeling.
ACM Transactions on Software Engineering and Methodology, 2003
The design of distributed applications in a CORBA based environment can be carried out by means o... more The design of distributed applications in a CORBA based environment can be carried out by means of an incremental approach, which starts from the specification and leads to the high level architectural design. This paper discusses a methodology to transform a formal specification written in TRIO into a high level design document written in an extension of TRIO, named TRIO/CORBA (TC). The TC language is suited to formally describe the high level architecture of a CORBA based application. As a result, designers are offered with highlevel concepts that precisely define the architectural elements of an application. Furthermore, TC offers mechanisms to extend its base semantics, and can be adapted to future developments and enhancements in the CORBA standard. The methodology and the associated language are presented by means of a case study derived from a real Supervision and Control System.
The article "Temporal Logics for Real-Time System Specification" surveys some of the relevant lit... more The article "Temporal Logics for Real-Time System Specification" surveys some of the relevant literature dealing with the use of temporal logics for the specification of real-time systems. Unfortunately, [3] introduces some imprecisions that might create some confusion in the reader. While a certain degree of informality is certainly useful when addressing a broad audience, imprecisions can negatively impact the legibility of the exposition. We clarify some of the remarks of [3] on a few topics, in an effort to contribute to the usefulness of the survey for the reader.
The basic modal operator bounded until of Metric Temporal Logic (MTL) comes in several variants. ... more The basic modal operator bounded until of Metric Temporal Logic (MTL) comes in several variants. In particular it can be strict (when it does not constrain the current instant) or not, and matching (when it requires its two arguments to eventually hold together) or not. This paper compares the relative expressiveness of the resulting MTL variants over dense time. We prove that the expressiveness is not affected by the variations when considering non-Zeno interpretations and arbitrary nesting of temporal operators. On the contrary, the expressiveness changes for flat (i.e., without nesting) formulas, or when Zeno interpretations are allowed.
Real-time systems usually encompass parts that are best described by a continuous-time model, suc... more Real-time systems usually encompass parts that are best described by a continuous-time model, such as physical processes under control, together with other components that are more naturally formalized by a discrete-time model, such as digital computing modules. Describing such systems in a unified framework based on metric temporal logic requires to integrate formulas which are interpreted over discrete and continuous time. In this paper, we tackle this problem with reference to the metric temporal logic TRIO, that admits both a discrete-time and a continuous-time semantics. We identify sufficient conditions under which TRIO formulas have a consistent truth value when moving from continuous-time to discrete-time interpretations, or vice versa. These conditions basically involve the restriction to a proper subset of the TRIO language and a requirement on the finite variability over time of the basic items in the specification formulas. We demonstrate the approach with an example of specification and verification.
Complex systems typically have many different parts and facets, with different characteristics. I... more Complex systems typically have many different parts and facets, with different characteristics. In a multi-paradigm approach to modeling, formalisms with different natures are used in combination to describe complementary parts and aspects of the system. This can have a beneficial impact on the modeling activity, as different paradigms can be better suited to describe different aspects of the system. While each paradigm provides a different view on the many facets of the system, it is of paramount importance that a coherent comprehensive model emerges from the combination of the various partial descriptions. In this paper we present a technique to model different aspects of the same system with different formalisms, while keeping the various models tightly integrated with one another. In addition, our approach leverages the flexibility provided by a bounded satisfiability checker to encode the verification problem of the integrated model in the propositional satisfiability (SAT) problem; this allows users to carry out formal verification activities both on the whole model and on parts thereof. The effectiveness of the approach is illustrated through the example of a monitoring system.
This paper presents a verification technique for dense-time MTL based on discretization. The tech... more This paper presents a verification technique for dense-time MTL based on discretization. The technique reduces the validity problem of MTL formulas from dense to discrete time, through the notion of sampling invariance, introduced in previous work . Since the reduction is from an undecidable problem to a decidable one, the technique is necessarily incomplete, so it fails to provide conclusive answers on some problem instances. The paper discusses this shortcoming and hints at how it can be mitigated in practice. The verification technique has been implemented on top of a tool for discrete-time bounded validity checking; the paper also reports on in-the-small experiments with the tool, which show some promising results.
We present a framework for formally proving that the composition of the behaviors of the differen... more We present a framework for formally proving that the composition of the behaviors of the different parts of a complex, real-time system ensures a desired global specification of the overall system. The framework is based on a simple compositional rely/guarantee circular inference rule, plus a small set of conditions concerning the integration of the different parts into a whole system. The reference specification language is the TRIO metric linear temporal logic. The novelty of our approach with respect to existing compositional frameworks -most of which do not deal explicitly with real-time requirements -consists mainly in its generality and abstraction from any assumptions about the underlying computational model and from any semantic characterizations of the temporal logic language used in the specification. Moreover, the framework deals equally well with continuous and discrete time. It is supported by a tool, implemented on top of the proof-checker PVS, to perform deduction-based verification through theorem-proving of modular real-time axiom systems. As an example of application, we show the verification of a real-time version of the old-fashioned but still relevant "benchmark" of the dining philosophers problem.
The design of distributed applications in a CORBA based environment can be carried out by means o... more The design of distributed applications in a CORBA based environment can be carried out by means of an incremental approach, which starts from the specification and leads to the high level architectural design. This is done by introducing in the specification all typical elements of CORBA and by providing a methodological support to the designers. The paper discusses a methodology to transform a formal specification written in TRIO into a high level design document written using an extension of TRIO named TC. The TC language is suited to formally describe the high level architecture of a CORBA based application. The methodology and the associated language are presented by means of an example involving a real Supervision and Control System.
We present a framework for formally proving that the composition of the behaviors of the differen... more We present a framework for formally proving that the composition of the behaviors of the different parts of a complex, real-time system ensures a desired global specification of the overall system. The framework is based on a simple compositional rely/guarantee circular inference rule, plus a small set of conditions concerning the integration of the different parts into a whole system. The reference specification language is the TRIO metric linear temporal logic. The novelty of our approach with respect to existing compositional frameworks -most of which do not deal explicitly with real-time requirements -consists mainly in its generality and abstraction from any assumptions about the underlying computational model and from any semantic characterizations of the temporal logic language used in the specification. Moreover, the framework deals equally well with continuous and discrete time. It is supported by a tool, implemented on top of the proof-checker PVS, to perform deduction-based verification through theorem-proving of modular real-time axiom systems. As an example of application, we show the verification of a real-time version of the old-fashioned but still relevant "benchmark" of the dining philosophers problem.
In contrast with a formal notion of specification, requirements are often considered an informal ... more In contrast with a formal notion of specification, requirements are often considered an informal entity. In a companion paper [SFRKM06], we have proposed a reference model that provides a clear distinction between requirements and specification, a distinction not based on the degree of formality. Using that notion of requirements, this paper shows how requirements as well as specifications can be formalized.
The distinction between requirements and specification is often confused in practice. This obstru... more The distinction between requirements and specification is often confused in practice. This obstructs the system validation process, because it is unclear what exactly should be validated, and against what it should be validated. The reference model of Gunter et al. addresses this difficulty by providing a framework within which requirements can be distinguished from specification. It separates world phenomena from machine phenomena. However, it does not explain how the characterization can be used to help assure system validity.
Electronic Notes in Theoretical Computer Science, 2005
We present a tool-supported framework for proving that the composition of the behaviors of the se... more We present a tool-supported framework for proving that the composition of the behaviors of the separate parts of a complex system ensures a desired global property of the overall system. A compositional inference rule is formally introduced and encoded in the logic of the PVS theorem prover. Methodological considerations on the usage of the inference rule are presented, and the framework is then used to prove a meaningful property of a simple, but significant, control system.
This paper presents a verification technique for dense-time MTL based on discretization. The tech... more This paper presents a verification technique for dense-time MTL based on discretization. The technique reduces the validity problem of MTL formulas from dense to discrete time, through the notion of sampling invariance, introduced in previous work . Since the reduction is from an undecidable problem to a decidable one, the technique is necessarily incomplete, so it fails to provide conclusive answers for some formulas. The paper discusses this shortcoming and hints at how it can be mitigated in practice. The verification technique has been implemented on top of the ot tool [19] for discrete-time bounded validity checking; the paper also reports on in-the-small experiments with the tool, which show some results that are promising in terms of performance.
ArchiTRIO [14] is a formal language, which complements UML 2.0 concepts with a formal, logic-base... more ArchiTRIO [14] is a formal language, which complements UML 2.0 concepts with a formal, logic-based notation that allows users to state system-wide properties, both static and dynamic, including real-time constraints. In this paper we present the semantics of the core concepts of the ArchiTRIO language. As the core elements of ArchiTRIO coincide with those of UML 2.0 (operation, interface, port, class), the semantics of ArchiTRIO provides also a formal definition for the basic concepts on which UML 2.0 is built.
The increasing relevance of areas such as real-time and embedded systems, pervasive computing, hy... more The increasing relevance of areas such as real-time and embedded systems, pervasive computing, hybrid systems control, and biological and social systems modeling is bringing a growing attention to the temporal aspects of computing, not only in the computer science domain, but also in more traditional fields of engineering.
This paper investigates the use of object-oriented techniques for the specification and design of... more This paper investigates the use of object-oriented techniques for the specification and design of distributed multimedia applications (DMAs). DMAs are a class of software applications with a range of strong-often conflicting-requirements of dynamicity, interactivity, real-time synchronized processing of several media types, network distribution, high-performance, fault-tolerance, load balancing and security. The development of complex DMAs can benefit from the adoption of object design methods and distributed object implementation technologies. The paper describes the use of two modeling approaches, based on the standard UML modeling language, and on the TRIO formal specification language, respectively. The problem of defining steps to move from the UML or TRIO specification to a CORBA IDL implementation is addressed. An experimental distributed video-on-demand system is used throughout the paper as a case study
This article introduces a fully automated verification technique that permits to analyze real-tim... more This article introduces a fully automated verification technique that permits to analyze real-time systems described using a continuous notion of time and a mixture of operational (i.e., automata-based) and descriptive (i.e., logic-based) formalisms. The technique relies on the reduction, under reasonable assumptions, of the continuous-time verification problem to its discrete-time counterpart. This reconciles in a viable and effective way the dense/discrete and operational/descriptive dichotomies that are often encountered in practice when it comes to specifying and analyzing complex critical systems. The article investigates the applicability of the technique through a significant example centered on a communication protocol. Concurrent runs of the protocol are formalized by parallel instances of a Timed Automaton, while the synchronization rules between these instances are specified through Metric Temporal Logic formulas, thus creating a multi-paradigm model. Verification tests run on this model using a bounded satisfiability checker implementing the technique show consistent results and interesting performances.
This paper presents ArchiTRIO (Architectural TRIO), a new temporal logic language which combines ... more This paper presents ArchiTRIO (Architectural TRIO), a new temporal logic language which combines a subset of the UML notation with a precise formal semantics inspired from the authors’ experiences. ArchiTRIO allows developers to use standard UML 2.0 notation to describe non-critical aspects of systems, but it also offers a complementary formal notation, fully integrated with the UML one, to represent those system aspects that require precise modeling.
ACM Transactions on Software Engineering and Methodology, 2003
The design of distributed applications in a CORBA based environment can be carried out by means o... more The design of distributed applications in a CORBA based environment can be carried out by means of an incremental approach, which starts from the specification and leads to the high level architectural design. This paper discusses a methodology to transform a formal specification written in TRIO into a high level design document written in an extension of TRIO, named TRIO/CORBA (TC). The TC language is suited to formally describe the high level architecture of a CORBA based application. As a result, designers are offered with highlevel concepts that precisely define the architectural elements of an application. Furthermore, TC offers mechanisms to extend its base semantics, and can be adapted to future developments and enhancements in the CORBA standard. The methodology and the associated language are presented by means of a case study derived from a real Supervision and Control System.
The article "Temporal Logics for Real-Time System Specification" surveys some of the relevant lit... more The article "Temporal Logics for Real-Time System Specification" surveys some of the relevant literature dealing with the use of temporal logics for the specification of real-time systems. Unfortunately, [3] introduces some imprecisions that might create some confusion in the reader. While a certain degree of informality is certainly useful when addressing a broad audience, imprecisions can negatively impact the legibility of the exposition. We clarify some of the remarks of [3] on a few topics, in an effort to contribute to the usefulness of the survey for the reader.
The basic modal operator bounded until of Metric Temporal Logic (MTL) comes in several variants. ... more The basic modal operator bounded until of Metric Temporal Logic (MTL) comes in several variants. In particular it can be strict (when it does not constrain the current instant) or not, and matching (when it requires its two arguments to eventually hold together) or not. This paper compares the relative expressiveness of the resulting MTL variants over dense time. We prove that the expressiveness is not affected by the variations when considering non-Zeno interpretations and arbitrary nesting of temporal operators. On the contrary, the expressiveness changes for flat (i.e., without nesting) formulas, or when Zeno interpretations are allowed.
Real-time systems usually encompass parts that are best described by a continuous-time model, suc... more Real-time systems usually encompass parts that are best described by a continuous-time model, such as physical processes under control, together with other components that are more naturally formalized by a discrete-time model, such as digital computing modules. Describing such systems in a unified framework based on metric temporal logic requires to integrate formulas which are interpreted over discrete and continuous time. In this paper, we tackle this problem with reference to the metric temporal logic TRIO, that admits both a discrete-time and a continuous-time semantics. We identify sufficient conditions under which TRIO formulas have a consistent truth value when moving from continuous-time to discrete-time interpretations, or vice versa. These conditions basically involve the restriction to a proper subset of the TRIO language and a requirement on the finite variability over time of the basic items in the specification formulas. We demonstrate the approach with an example of specification and verification.
Complex systems typically have many different parts and facets, with different characteristics. I... more Complex systems typically have many different parts and facets, with different characteristics. In a multi-paradigm approach to modeling, formalisms with different natures are used in combination to describe complementary parts and aspects of the system. This can have a beneficial impact on the modeling activity, as different paradigms can be better suited to describe different aspects of the system. While each paradigm provides a different view on the many facets of the system, it is of paramount importance that a coherent comprehensive model emerges from the combination of the various partial descriptions. In this paper we present a technique to model different aspects of the same system with different formalisms, while keeping the various models tightly integrated with one another. In addition, our approach leverages the flexibility provided by a bounded satisfiability checker to encode the verification problem of the integrated model in the propositional satisfiability (SAT) problem; this allows users to carry out formal verification activities both on the whole model and on parts thereof. The effectiveness of the approach is illustrated through the example of a monitoring system.
This paper presents a verification technique for dense-time MTL based on discretization. The tech... more This paper presents a verification technique for dense-time MTL based on discretization. The technique reduces the validity problem of MTL formulas from dense to discrete time, through the notion of sampling invariance, introduced in previous work . Since the reduction is from an undecidable problem to a decidable one, the technique is necessarily incomplete, so it fails to provide conclusive answers on some problem instances. The paper discusses this shortcoming and hints at how it can be mitigated in practice. The verification technique has been implemented on top of a tool for discrete-time bounded validity checking; the paper also reports on in-the-small experiments with the tool, which show some promising results.
We present a framework for formally proving that the composition of the behaviors of the differen... more We present a framework for formally proving that the composition of the behaviors of the different parts of a complex, real-time system ensures a desired global specification of the overall system. The framework is based on a simple compositional rely/guarantee circular inference rule, plus a small set of conditions concerning the integration of the different parts into a whole system. The reference specification language is the TRIO metric linear temporal logic. The novelty of our approach with respect to existing compositional frameworks -most of which do not deal explicitly with real-time requirements -consists mainly in its generality and abstraction from any assumptions about the underlying computational model and from any semantic characterizations of the temporal logic language used in the specification. Moreover, the framework deals equally well with continuous and discrete time. It is supported by a tool, implemented on top of the proof-checker PVS, to perform deduction-based verification through theorem-proving of modular real-time axiom systems. As an example of application, we show the verification of a real-time version of the old-fashioned but still relevant "benchmark" of the dining philosophers problem.
The design of distributed applications in a CORBA based environment can be carried out by means o... more The design of distributed applications in a CORBA based environment can be carried out by means of an incremental approach, which starts from the specification and leads to the high level architectural design. This is done by introducing in the specification all typical elements of CORBA and by providing a methodological support to the designers. The paper discusses a methodology to transform a formal specification written in TRIO into a high level design document written using an extension of TRIO named TC. The TC language is suited to formally describe the high level architecture of a CORBA based application. The methodology and the associated language are presented by means of an example involving a real Supervision and Control System.
We present a framework for formally proving that the composition of the behaviors of the differen... more We present a framework for formally proving that the composition of the behaviors of the different parts of a complex, real-time system ensures a desired global specification of the overall system. The framework is based on a simple compositional rely/guarantee circular inference rule, plus a small set of conditions concerning the integration of the different parts into a whole system. The reference specification language is the TRIO metric linear temporal logic. The novelty of our approach with respect to existing compositional frameworks -most of which do not deal explicitly with real-time requirements -consists mainly in its generality and abstraction from any assumptions about the underlying computational model and from any semantic characterizations of the temporal logic language used in the specification. Moreover, the framework deals equally well with continuous and discrete time. It is supported by a tool, implemented on top of the proof-checker PVS, to perform deduction-based verification through theorem-proving of modular real-time axiom systems. As an example of application, we show the verification of a real-time version of the old-fashioned but still relevant "benchmark" of the dining philosophers problem.
In contrast with a formal notion of specification, requirements are often considered an informal ... more In contrast with a formal notion of specification, requirements are often considered an informal entity. In a companion paper [SFRKM06], we have proposed a reference model that provides a clear distinction between requirements and specification, a distinction not based on the degree of formality. Using that notion of requirements, this paper shows how requirements as well as specifications can be formalized.
The distinction between requirements and specification is often confused in practice. This obstru... more The distinction between requirements and specification is often confused in practice. This obstructs the system validation process, because it is unclear what exactly should be validated, and against what it should be validated. The reference model of Gunter et al. addresses this difficulty by providing a framework within which requirements can be distinguished from specification. It separates world phenomena from machine phenomena. However, it does not explain how the characterization can be used to help assure system validity.
Uploads
Papers by matteo rossi