Section: Scientific Foundations
The formal models we use are mainly automata-like structures such as labelled transition systems (LTS) and some of their extensions: an LTS is a tuple where is a non-empty set of states; is the initial state; is the alphabet of actions, is the transition relation. These models are adapted for testing and controller synthesis.
To model reactive systems in the testing context, we use Input/Output labeled transition systems (IOLTS for short). In this setting, the interactions between the system and its environment (where the tester lies) must be partitioned into inputs (controlled by the environment), outputs (observed by the environment), and internal (non observable) events modeling the internal behavior of the system. The alphabet is then partitioned into where is the alphabet of outputs, the alphabet of inputs, and the alphabet of internal actions.
In the controller synthesis theory, we also distinguish between controllable and uncontrollable events (), observable and unobservable events ().
In the context of verification, we also use Timed Automata. A timed automaton is a tuple where is a set of locations, is a set of clocks whose valuations are positive real numbers, 2 is a finite set of edges composed of a source and a target state, a guard given by a finite conjunction of expressions of the form where is a clock, is a natural number and , a set of resetting clocks, and assigns an invariant to each location  . The semantics of a timed automaton is given by a (infinite states) labelled transition system whose states are composed of a location and a valuation of clocks.
Also, for verification purposes, we use graph grammars that are a general tool to define families of graphs. Such grammars are formed by a set of rules whose left-hand sides are hyperedges and right-hand sides are hypergraphs. For graphs with finite degree, these grammars characterise transition graphs of pushdown automata (the correspondence between graphs generated by grammars and transition graphs of pushdown automata is bijective). Graph grammars provide a simple yet powerful setting to define and study infinite state systems.
In order to cope with models closer to practical specification languages, we also need higher level models encompassing both control and data aspects. We defined (input-output) symbolic transition systems ((IO)STS), which are extensions of (IO)LTS that convey or operate on data (i.e., program variables, communication parameters, symbolic constants) through message passing, guards, and assignments. Formally, an IOSTS is a tuple , where is a set of variables (including a counter variable encoding the control structure), is the initial condition defined by a predicate on , is the finite alphabet of actions, where each action has a signature (just like in IOLTS, can be partitioned as e.g. ), is a finite set of symbolic transitions of the form where is an action (possibly with a polarity reflecting its input/output/internal nature), is a tuple of communication parameters, is a guard defined by a predicate on and , and is an assignment of variables. The semantics of IOSTS is defined in terms of (IO)LTS where states are vectors of values of variables, and transitions between them are labelled with instantiated actions (action with valued communication parameter). This (IO)LTS semantics allows us to perform syntactical transformations at the (IO)STS level while ensuring semantical properties at the (IO)LTS level. We also consider extensions of these models with added features such as recursion, fifo channels, etc. An alternative to IOSTS for specifying systems with data variables is the model of synchronous dataflow equations.
Our research is based on well established theories: conformance testing, supervisory control, abstract interpretation, and theorem proving. Most of the algorithms that we employ take their origins in these theories:
BDDs (Binary Decision Diagrams) algorithms, for manipulating Boolean formulae, and their MTBDDs (Multi-Terminal Decision Diagrams) extension for manipulating more general functions. We use these algorithms for verification, test generation and control.
abstract interpretation algorithms, specifically in the abstract domain of convex polyhedra (for example, Chernikova's algorithm for the computation of dual forms). Such algorithms are used in verification and test generation.