Section: Scientific Foundations

Underlying models

The formal models we use are mainly automata-like structures such as labelled transition systems (LTS) and some of their extensions: an LTS is a tuple $M=(Q,\Lambda ,\to ,q_o)$ where $Q$ is a non-empty set of states; $q_o\in Q$ is the initial state; $A$ is the alphabet of actions, $\to \subseteq Q\times \Lambda \times Q$ is the transition relation. These models are adapted for testing and controller synthesis.

To model reactive systems in the testing context, we use Input/Output labeled transition systems (IOLTS for short). In this setting, the interactions between the system and its environment (where the tester lies) must be partitioned into inputs (controlled by the environment), outputs (observed by the environment), and internal (non observable) events modeling the internal behavior of the system. The alphabet $\Lambda$ is then partitioned into ${\Lambda }_{!}\cup {\Lambda }_{?}\cup 𝒯$ where ${\Lambda }_{!}$ is the alphabet of outputs, ${\Lambda }_{?}$ the alphabet of inputs, and $𝒯$ the alphabet of internal actions.

In the controller synthesis theory, we also distinguish between controllable and uncontrollable events ($\Lambda ={\Lambda }_c\cup {\Lambda }_{uc}$), observable and unobservable events ($\Lambda ={\Lambda }_O\cup 𝒯$).

In the context of verification, we also use Timed Automata. A timed automaton is a tuple $A=(L,X,E,ℐ)$ where $L$ is a set of locations, $X$ is a set of clocks whose valuations are positive real numbers, $E\subseteq L\times 𝒢\left(X\right)\times$2${}^X\times L$ is a finite set of edges composed of a source and a target state, a guard given by a finite conjunction of expressions of the form $x\sim c$ where $x$ is a clock, $c$ is a natural number and $\sim \in \{<,\le ,=,\ge ,>\}$, a set of resetting clocks, and $ℐ:ℒ\to 𝒢\left(𝒳\right)$ assigns an invariant to each location  [22] . The semantics of a timed automaton is given by a (infinite states) labelled transition system whose states are composed of a location and a valuation of clocks.

Also, for verification purposes, we use graph grammars that are a general tool to define families of graphs. Such grammars are formed by a set of rules whose left-hand sides are hyperedges and right-hand sides are hypergraphs. For graphs with finite degree, these grammars characterise transition graphs of pushdown automata (the correspondence between graphs generated by grammars and transition graphs of pushdown automata is bijective). Graph grammars provide a simple yet powerful setting to define and study infinite state systems.

In order to cope with models closer to practical specification languages, we also need higher level models encompassing both control and data aspects. We defined (input-output) symbolic transition systems ((IO)STS), which are extensions of (IO)LTS that convey or operate on data (i.e., program variables, communication parameters, symbolic constants) through message passing, guards, and assignments. Formally, an IOSTS is a tuple $(V,\Theta ,\Sigma ,T)$, where $V$ is a set of variables (including a counter variable encoding the control structure), $\Theta$ is the initial condition defined by a predicate on $V$, $\Sigma$ is the finite alphabet of actions, where each action has a signature (just like in IOLTS, $\Sigma$ can be partitioned as e.g. ${\Sigma }_{?}\cup {\Sigma }_{!}\cup {\Sigma }_{\tau }$), $T$ is a finite set of symbolic transitions of the form $t=(a,p,G,A)$ where $a$ is an action (possibly with a polarity reflecting its input/output/internal nature), $p$ is a tuple of communication parameters, $G$ is a guard defined by a predicate on $p$ and $V$, and $A$ is an assignment of variables. The semantics of IOSTS is defined in terms of (IO)LTS where states are vectors of values of variables, and transitions between them are labelled with instantiated actions (action with valued communication parameter). This (IO)LTS semantics allows us to perform syntactical transformations at the (IO)STS level while ensuring semantical properties at the (IO)LTS level. We also consider extensions of these models with added features such as recursion, fifo channels, etc. An alternative to IOSTS for specifying systems with data variables is the model of synchronous dataflow equations.

Our research is based on well established theories: conformance testing, supervisory control, abstract interpretation, and theorem proving. Most of the algorithms that we employ take their origins in these theories:

• graph traversal algorithms (breadth first, depth first, strongly connected components, ...). We use these algorithms for verification as well as test generation and control synthesis.

• BDDs (Binary Decision Diagrams) algorithms, for manipulating Boolean formulae, and their MTBDDs (Multi-Terminal Decision Diagrams) extension for manipulating more general functions. We use these algorithms for verification, test generation and control.

• abstract interpretation algorithms, specifically in the abstract domain of convex polyhedra (for example, Chernikova's algorithm for the computation of dual forms). Such algorithms are used in verification and test generation.

• logical decision algorithms, such as satisfiability of formulas in Presburger arithmetics. We use these algorithms during generation and execution of symbolic test cases.