6.1.1 CADP

• Name:
  Construction and Analysis of Distributed Processes
• Keywords:
  Formal methods, Verification
• Functional Description:

  CADP (Construction and Analysis of Distributed Processes – formerly known as CAESAR/ALDEBARAN Development Package) 4 is a toolbox for protocols and distributed systems engineering.

  In this toolbox, we develop and maintain the following tools:

  • CAESAR.ADT  38 is a compiler that translates LOTOS abstract data types into C types and C functions. The translation involves pattern-matching compiling techniques and automatic recognition of usual types (integers, enumerations, tuples, etc.), which are implemented optimally.
  • CAESAR  44, 43 is a compiler that translates LOTOS processes into either C code (for rapid prototyping and testing purposes) or finite graphs (for verification purposes). The translation is done using several intermediate steps, among which the construction of a Petri net extended with typed variables, data handling features, and atomic transitions.

  • OPEN/CAESAR  42 is a generic software environment for developing tools that explore graphs on the fly (for instance, simulation, verification, and test generation tools). Such tools can be developed independently of any particular high level language. In this respect, OPEN/CAESAR plays a central role in CADP by connecting language-oriented tools with model-oriented tools. OPEN/CAESAR consists of a set of 16 code libraries with their programming interfaces, such as:

    • CAESAR  GRAPH, which provides the programming interface for graph exploration,
    • CAESAR  HASH, which contains several hash functions,
    • CAESAR  SOLVE, which resolves Boolean equation systems on the fly,
    • CAESAR  STACK, which implements stacks for depth-first search exploration, and
    • CAESAR  TABLE, which handles tables of states, transitions, labels, etc.

    A number of on-the-fly analysis tools have been developed within the OPEN/CAESAR environment, among which:

    • BISIMULATOR, which checks bisimulation equivalences and preorders,
    • CUNCTATOR, which performs steady-state simulation of continuous-time Markov chains,
    • DETERMINATOR, which eliminates stochastic nondeterminism in normal, probabilistic, or stochastic systems,
    • DISTRIBUTOR, which generates the graph of reachable states using several machines,
    • EVALUATOR, which evaluates MCL formulas,
    • EXECUTOR, which performs random execution,
    • EXHIBITOR, which searches for execution sequences matching a given regular expression,
    • GENERATOR, which constructs the graph of reachable states,
    • PROJECTOR, which computes abstractions of communicating systems,
    • REDUCTOR, which constructs and minimizes the graph of reachable states modulo various equivalence relations,
    • SIMULATOR, XSIMULATOR, and OCIS, which enable interactive simulation, and
    • TERMINATOR, which searches for deadlock states.
  • BCG (Binary Coded Graphs) is both a file format for storing very large graphs on disk (using efficient compression techniques) and a software environment for handling this format. BCG also plays a key role in CADP as many tools rely on this format for their inputs/outputs. The BCG environment consists of various libraries with their programming interfaces, and of several tools, such as:
    • BCG  CMP, which compares two graphs,
    • BCG  DRAW, which builds a two-dimensional view of a graph,
    • BCG  EDIT, which allows the graph layout produced by BCG  DRAW to be modified interactively,
    • BCG  GRAPH, which generates various forms of practically useful graphs,
    • BCG  INFO, which displays various statistical information about a graph,
    • BCG  IO, which performs conversions between BCG and many other graph formats,
    • BCG  LABELS, which hides and/or renames (using regular expressions) the transition labels of a graph,
    • BCG  MIN, which minimizes a graph modulo strong or branching equivalences (and can also deal with probabilistic and stochastic systems),
    • BCG  STEADY, which performs steady-state numerical analysis of (extended) continuous-time Markov chains,
    • BCG  TRANSIENT, which performs transient numerical analysis of (extended) continuous-time Markov chains, and

    • XTL (eXecutable Temporal Language), which is a high level, functional language for programming exploration algorithms on BCG graphs. XTL provides primitives to handle states, transitions, labels, successor and predecessor functions, etc.

      For instance, one can define recursive functions on sets of states, which allow evaluation and diagnostic generation fixed point algorithms for usual temporal logics (such as HML  45, CTL 34, ACTL 35, etc.) to be defined in XTL.

  • PBG (Partitioned BCG Graph) is a file format implementing the theoretical concept of Partitioned LTS  41 and providing a unified access to a graph partitioned in fragments distributed over a set of remote machines, possibly located in different countries. The PBG format is supported by several tools, such as:
    • PBG  CP, PBG  MV, and PBG  RM, which facilitate standard operations (copying, moving, and removing) on PBG files, maintaining consistency during these operations,
    • PBG  MERGE (formerly known as BCG  MERGE), which transforms a distributed graph into a monolithic one represented in BCG format,
    • PBG  INFO, which displays various statistical information about a distributed graph.
  • The connection between explicit models (such as BCG graphs) and implicit models (explored on the fly) is ensured by OPEN/CAESAR-compliant compilers, e.g.:
    • BCG  OPEN, for models represented as BCG graphs,
    • CAESAR.OPEN, for models expressed as LOTOS descriptions,
    • EXP.OPEN, for models expressed as communicating automata,
    • FSP.OPEN, for models expressed as FSP  46 descriptions,
    • LNT.OPEN, for models expressed as LNT descriptions, and
    • SEQ.OPEN, for models represented as sets of execution traces.

  The CADP toolbox also includes TGV (Test Generation based on Verification), which has been developed by the VERIMAG laboratory (Grenoble) and Inria Rennes – Bretagne-Atlantique.

  The CADP tools are well-integrated and can be accessed easily using either the EUCALYPTUS graphical interface or the SVL  40 scripting language. Both EUCALYPTUS and SVL provide users with an easy and uniform access to the CADP tools by performing file format conversions automatically whenever needed and by supplying appropriate command-line options as the tools are invoked.

• URL:
  http://­cadp.­inria.­fr/
• Contact:
  Hubert Garavel
• Participants:
  Hubert Garavel, Frederic Lang, Radu Mateescu, Wendelin Serwe

6.1.2 TRAIAN

• Keywords:
  Compilation, LOTOS NT
• Functional Description:

  TRAIAN is a compiler for translating LOTOS NT descriptions into C programs, which will be used for simulation, rapid prototyping, verification, and testing.

  The current version of TRAIAN, which handles LOTOS NT types and functions only, has useful applications in compiler construction  39, being used in all recent compilers developed by CONVECS.

• URL:
  http://­convecs.­inria.­fr/­software/­traian/
• Contact:
  Hubert Garavel
• Participants:
  Hubert Garavel, Frederic Lang, Wendelin Serwe

7.1.1 LNT Specification Language

Participants: Hubert Garavel, Frédéric Lang, Wendelin Serwe.

LNT 533 is a next-generation formal description language for asynchronous concurrent systems. The design of LNT at CONVECS is the continuation of the efforts undertaken in the 80s to define sound languages for concurrency theory and, indeed, LNT is derived from the ISO standards LOTOS (1989) and E-LOTOS (2001). In a nutshell, LNT attempts to combine the best features of imperative programming languages, functional languages, and value-passing process calculi.

LNT is not a frozen language: its definition started in 2005, as part of an industrial project. Since 2010, LNT has been systematically used by CONVECS for numerous case studies (many of which being industrial applications — see § 7.4). LNT is also used as a back-end by other research teams who implement various languages by translation to LNT. It is taught in university courses, e.g., at University Grenoble Alpes and ENSIMAG, where it is positively accepted by students and industry engineers. Based on the feedback acquired by CONVECS, LNT is continuously improved.

In 2021, the LNT language has continued to evolve, mainly to become a better language and to achieve convergence with the LOTOS NT language supported by the TRAIAN compiler (see § 7.1.2):

• The syntax of LNT was brought closer to classical programming languages. The priority rules for infix operators were changed to make LNT expressions more in line with mathematical conventions, reducing the need of parentheses wherever there should be no ambiguity, similarly to the Ada language. The predefined LNT operator for string concatenation (formerly noted “+”) was renamed to “&”, which is the notation used in LOTOS NT, but also in Ada, AppleScript, and VisualBasic. The syntax of the “case” instruction changed from “case ...in var ...in ...” to “case ...var ...in ...” to avoid the sequence of two consecutive keywords “in var”. The pragmas related to the translation of LNT types and functions in the C language were improved to make clear that the target identifiers respect the rules of C.
• The LNT2LOTOS Reference Manual has been updated to document these changes of LNT, and the CADP demo examples have been upgraded to the latest version of LNT. Six new CADP demo examples have been translated from LOTOS to LNT. The “upc” shell script was extended to ease the migration of LNT programs, in particular the over $15,000$ LNT examples used for non-regression testing of LNT2LOTOS.
• Also, in addition to seven bug fixes, the LNT2LOTOS compiler was enhanced in several manners. It emits more warnings about potentially erroneous use of the new priorities of infix operators and deprecated use of LNT constructs in a way that does not exist in LOTOS NT (e.g., channel definitions without field names, “any $T$” used in a pattern on the left-hand side of an infix operator and without parentheses, etc.). It now takes into account the existence of pre-conditions and post-conditions in functions and processes in its data-flow analysis to warn about unused parameters.

7.1.2 LOTOS NT Specification Language

Participants: Hubert Garavel, Frédéric Lang, Wendelin Serwe.

We continued working on the TRAIAN compiler for the LOTOS NT language (a predecessor of LNT), which is used for the construction of most CADP compilers and translators. Since TRAIAN 3.0, the lexer and parser of TRAIAN are built using the SYNTAX compiler-generation system developed at Inria Paris and the abstract syntax tree of LOTOS NT, the library of predefined LOTOS NT types and functions, the static semantics checking (identifier binding, type checking, dataflow analysis, etc.), and the C code generation are implemented in LOTOS NT itself, so that TRAIAN is capable of bootstrapping itself.

In 2021, our efforts led to the release of three new major versions of TRAIAN:

• TRAIAN 3.3 brings five language changes to LOTOS NT in order to further align it with LNT, six changes in the dataflow analysis to prevent users from making common programming errors, and five code generation changes in order to improve the C code generated by LOTOS NT. Two bugs were fixed and one demo was updated to get it accepted by TRAIAN 3.3.
• TRAIAN 3.4 brings nine language changes to LOTOS NT, mostly to extend the syntax of processes, which was so far limited w.r.t. the LNT language, and to introduce preconditions and postconditions for both functions and processes. It also brings six code generation changes, in order to make the generated C code smaller, more structured, more readable, and safer. Four bugs were fixed.
• TRAIAN 3.5 brings two language changes and four code generation changes to LOTOS NT. Above all, it brings 24 changes in the static semantics analysis, in order to provide users with more relevant warnings and error messages. Ten bugs were fixed, mostly in the dataflow analysis.

In all versions of TRAIAN, the “traian_upc” conversion tool was extended to ease the upgrade of existing LOTOS NT source code whenever possible, and the user manual of TRAIAN was constantly updated.

7.1.3 Nested-Unit Petri Nets

Participants: Pierre Bouvier, Hubert Garavel.

Nested-Unit Petri Nets (NUPNs) are a model of computation that can be seen as an upward-compatible extension of P/T nets, which are enriched with structural information on their concurrent and hierarchical structure. Such structural information can easily be produced when NUPNs are generated from higher-level specifications (e.g., process calculi) and allows logarithmic reductions in the number of bits required to represent reachable states, thus enabling verification tools to perform better. For this reason, NUPNs have been so far implemented in thirteen verification tools developed in four countries, and adopted by two international competitions (the Model Checking Contest and the Rigorous Examination of Reactive Systems challenge). The complete theory of NUPNs is formalized in a journal article 6 and their PNML representation is described here.

Our prior work on the computation of concurrent places in Petri nets led to a publication in an international conference 15, and enabled us to decompose  30 all the ordinary, safe Petri Nets of the MCC contest, including the largest ones, which could not be processed previously.

In 2021, the NUPN format and its associated software tools were enhanced as follows:

• In addition to three bug fixes, the CAESAR.BDD tool was enhanced in multiple ways. New internal data structures have been introduced to store the transitions going in and out of each place, which makes the tool (usually two times) faster on large NUPNs.
• The BDD exploration of reachable markings was made more efficient by no longer attempting to fire transitions known to be dead. A new, more efficient strategy for dynamic reordering of BDDs has been devised, which better reflects the structure and the intrinsic complexity of a NUPN. These changes, combined to other enhancements, increased the performance of many CAESAR.BDD options, which have been made faster and, possibly, more precise.
• CAESAR.BDD now accepts NUPNs with an empty initial marking. It has been also extended with three new options intended to characterize NUPNs that are equivalent modulo net isomorphism. These options have been continuously improved during year 2021 in order to better detect symmetries.
• In addition to three bug fixes, the NUPN_INFO tool was enhanced in various ways. Its code was made simpler and more modular, and the tool is now able to put NUPNs under a canonical form that helps detecting duplicate models in large collections of Petri nets and NUPNs. Eleven new options have also been added, whose combined use enabled to strengthen the behaviour of the “-canonical-nupn” option of NUPN_INFO.
• The manual pages for CAESAR.BDD, NUPN_INFO, and the NUPN format have been updated accordingly and modified at various places to resolve ambiguities.

We also studied two alternative approaches for the detection of isomorphic NUPNs: one approach reduces this problem to graph isomorphism and uses software tools dedicated to this problem; another approach encodes the isomorphism of two NUPNs in a quantifier-free integer-difference logic formula that can be passed to an SMT solver. Finally, we implemented an approach for translation of NUPNs into a process calculus such as LNT.

7.1.4 Formal Modeling and Analysis of BPMN

Participants: Gwen Salaün [correspondent], Ahang Zuo.

BPMN is a workflow-based notation that has been published as an ISO standard and has become the main language for business process modeling. However, specifying processes with BPMN is not an easy task for non-experts and this is still an issue to make BPMN widely used in any company around the world. Process mining techniques are helpful to automatically infer processes from execution logs, but this is not a solution to make users more at ease with BPMN.

In the context of the MOAP project (see § 9.5.1), in collaboration with Yliès Falcone (CORSE project-team), we proposed a different approach supporting the modelling of business processes in a semi-automated way. We focus on a timed version of BPMN, where to each task is associated a range indicating the minimum and maximum duration it takes to execute that task. In a first step, the user defines the tasks involved in the process and possibly gives a partial order between some of these tasks. A first algorithm then generates an abstract graph, which serves as a simplified version of the process being specified. Given such an abstract graph, a second algorithm computes the minimum and maximum time for executing the whole graph. The user can rely on this information for refining the graph. For each version of the graph, these minimum/maximum execution times are computed. Once the user is satisfied with a specific abstract graph, s/he can use our third algorithm to synthesize the BPMN process from that graph. This approach was implemented in a tool, validated on several case studies, and led to a publication in an international conference 20.

In 2021, we also improved this work by developing probabilistic model checking techniques of BPMN processes at runtime. Before running a BPMN process, the user has no clue of the probability of executing some task or specific combination of tasks. This is however of prime importance for adjusting resources associated with tasks and thus optimizing costs. In this work, we first transform the BPMN model into an LTS (Labelled Transition System). Then, by analyzing the execution traces obtained when running multiple instances of the process, we can compute the probability of executing each transition in the LTS model, and thus generate a Probabilistic Transition System (PTS). Finally, we perform probabilistic model checking for verifying that the PTS model satisfies a given probabilistic property. This verification loop is applied periodically to update the results according to the execution of the process instances. All these ideas are implemented in a tool chain, which was applied successfully to several real-world BPMN processes.

Business process optimization is a strategic activity in organizations because of its potential to increase profit margins and reduce operational costs. One of the main challenges in this activity is concerned with the problem of optimizing allocation and sharing of resources. Companies are continuously adjusting their resources to their needs following different strategies. However, the dynamic provisioning strategies are hard to compare. In collaboration with Francisco Durán (University of Málaga, Spain) and Camilo Rocha (Universidad Pontificia Javeriana, Cali, Colombia), we proposed an automatic analysis technique to evaluate and compare the execution time and resource occupancy of a business process relative to a workload and a provisioning strategy. Four different strategies are presented, which are guided—respectively—by recent resource usage, recent resource request, predicted behavior, and a combination of available strategies. Such analysis is performed on models conforming to an extension of BPMN with quantitative information, including resource availability and constraints. Within this framework, the approach is fully mechanized using a formal and executable specification in the Maude rewriting logic framework, which relies on existing techniques and tools for simulating probabilistic and real-time specifications. This work led to a publication in an international journal 11.

7.2.1 Debugging of Concurrent Systems using Counterexample Analysis

Participants: Irman Faqrizal, Gwen Salaün.

Designing and developing distributed software has always been a tedious and error-prone task, and the ever increasing software complexity is making matters even worse. Model checking is an established technique for automatically finding bugs by verifying that a model satisfies a given temporal property. When the model violates the property, the model checker returns a counterexample, which is a sequence of actions leading to a state where the property is not satisfied. Understanding this counterexample for debugging the specification or program is a complicated task because the counterexample gives only a partial view of the source of the problem, and because there is usually little support beyond that counterexample to identify the source of the problem.

In 2021, we proposed some techniques for simplifying the debugging of concurrent system specifications by exploiting their underlying behavioural model, represented as an LTS (Labeled Transition System). We start by extracting from the whole LTS the part which does not satisfy the given property. Then, in that LTS part, we detect specific states (called faulty states) where a choice is possible between executing a correct behaviour or falling into an erroneous part of the LTS. Based on this annotated LTS part, we devised an approach for counting the number of bugs in the original specification. The core idea of the approach is to change the specification for some specific actions that may cause the property violation, and compare the LTS model before and after modification to detect whether this potential bug is a real bug or not. A tool was implemented for automating all the steps of the approach and applied on realistic examples for validation purposes.

7.2.2 Verification of Emergent Properties in Multi-agent Systems

Participants: Luca Di Stefano, Frédéric Lang, Wendelin Serwe.

Multi-agent systems are collections of autonomous components that interact with each other and with their shared environment. These systems may display collective properties that arise from the interplay between agents. Reasoning about these properties turns out to be hard, due to the very large state space that these systems usually exhibit. Therefore, automatic procedures to formally guarantee the emergence of such properties may prove helpful in the design of reliable artificial multi-agent systems.

In 2021, we contributed to this topic as follows:

• We improved an existing, fully-automated translation procedure  37 from the LAbS specification language  49 to the LNT formal description language. These improvements extend the range of supported temporal properties, reduce verification times, and allow us to use compositional verification to achieve further performance gains. These results led to a publication in an international conference 16.
• We described the above translation procedure in another paper, which has been accepted for publication in an international journal  53.
• We described the implementation and usage of SLiVER-CADP, i.e., the CADP-based automated verification tool for multi-agent systems, in another manuscript which is currently under review by an international journal.

7.2.3 Other Developments

Participants: Pierre Bouvier, Hubert Garavel.

VLSAT (“Very Large Boolean SATisfiability problems”) is a benchmark suite to be used in scientific experiments and software competitions addressing SAT and SMT (Satisfiability Modulo Theories) solving issues. We obtained these SAT and SMT formulas from the automatic conversion  30 into Nested-Unit Petri Nets (NUPNs) 6 of a large collection of Petri nets modelling real-life problems, such as communication protocols and concurrent systems.

In 2021, we enriched VLSAT with two new benchmarks:

• VLSAT-2 2731 contains 100 benchmarks (50 satisfiable and 50 unsatisfiable formulas) of increasing complexity, proposed in DIMACS CNF format under a permissive Creative Commons license (VLSAT-2 is also available via its DOI). 25% of these benchmarks have been used during the 2020 and 2021 editions of the International SAT Competition.
• VLSAT-3 28 contains 1200 (600 satisfiable and 600 unsatisfiable) quantifier-free first-order logic formulas of increasing complexity, proposed in SMT-LIB format under a permissive Creative Commons license (VLSAT-3 is also available via its DOI). More than 90% of these benchmarks have been used during the 16th International Satisfiability Modulo Theories Competition (SMT-COMP 2021).

7.3.1 Compositional Verification

Participants: Frédéric Lang.

The CADP toolbox contains various tools dedicated to compositional verification, among which EXP.OPEN, BCG_MIN, BCG_CMP, and SVL play a central role. EXP.OPEN explores on the fly the graph corresponding to a network of communicating automata (represented as a set of BCG files). BCG_MIN and BCG_CMP respectively minimize and compare behavior graphs modulo strong or branching bisimulation and their stochastic extensions. SVL (Script Verification Language) is both a high-level language for expressing complex verification scenarios and a compiler dedicated to this language.

In 2021, we corrected one bug in SVL, one bug in EXP.OPEN, and one bug in the ALDEBARAN shell script (which calls BCG_MIN and BCG_CMP). In addition, we implemented minimisation with respect to sharp bisimulation in BCG_MIN, using a new signature-based partition-refinement algorithm that replaces the partial reduction algorithm implemented in 2020. This new algorithm computes the sharp equivalence classes of an LTS, which allows the smallest LTS of its sharp equivalence class to be obtained. Also, this algorithm allowed us to extend the BCG_CMP tool to compare two LTSs modulo sharp bisimulation. The SVL language and compiler were extended to support LTS comparison modulo sharp bisimulation. A paper about sharp bisimulation was published in an international journal 13.

7.3.2 On-the-fly Test Case Extraction

Participants: Radu Mateescu, Nathan Miscopein, Wendelin Serwe.

The CADP toolbox provides support for conformance test case generation by means of the TGV tool. Given a formal specification of a system and a test purpose described as an input-output LTS (IOLTS), TGV automatically generates test cases, which assess using black box testing techniques the conformance of a system under test w.r.t. the formal specification. A test purpose describes the goal states to be reached by the test and enables one to indicate parts of the specification that should be ignored during the testing process. TGV does not generate test cases completely on the fly (i.e., online), because it first generates the complete test graph (CTG) and then traverses it backwards to produce controllable test cases.

To address these limitations, we developed the prototype tool TESTOR to extract test cases completely on the fly. TESTOR presents several advantages w.r.t. TGV: (i) it has a more modular architecture, based on generic graph transformation components taken from the OPEN/CAESAR libraries ($\tau$-compression, $\tau$-confluence, $\tau$-closure, determinization, resolution of Boolean equation systems); (ii) it is capable of extracting a test case entirely on the fly, by exploiting the diagnostic generation features of the Boolean equation system resolution algorithms; (iii) it enables a more flexible expression of test purposes, taking advantage of the multiway rendezvous, a primitive to express communication and synchronization among a set of distributed processes.

In 2021, we rerun the benchmarks used to compare the original version of TESTOR to TGV, so as to thouroughly evaluate the impact the recent improvements brought to TESTOR. The results show that for the generation of a CTG, the new version of TESTOR requires on average almost three times less memory than TGV, with, on average, comparable execution times. This is a significant improvement with respect to the previous version of TESTOR, which was for some examples several orders of magnitude slower than TGV.

7.3.3 Runtime Enforcement

Participants: Gwen Salaün.

Runtime enforcement is a technique that analyzes a trace of actions (events) produced by the execution of a concurrent system, detects when this execution deviates from its expected behaviour w.r.t. a given property, and corrects the trace to make it satisfy the property. In collaboration with Yliès Falcone (CORSE project-team), we devised new runtime enforcement techniques that reorder actions in the trace when necessary, inject actions to the application to ensure progress of the property, and discard actions to avoid storing too many unnecessary actions. At any step of the enforcement, we provide a verdict, called enforcement trend, which takes its value in a 4-valued truth domain. Our approach has been implemented in a tool and validated on several application examples. Experimental results show that our techniques better preserve the application actions, hence ensuring better service continuity. This work led to a publication in an international conference 19.

7.3.4 Other Component Developments

Participants: Hubert Garavel, Frédéric Lang, Radu Mateescu, Wendelin Serwe.

In 2021, several components of CADP have been improved as follows:

• The FSP2LOTOS compiler now accepts the definition of local processes named ERROR or STOP, but only if they have a non-empty set of parameters. The CAESAR, CAESAR.ADT, and XTL compilers now reject C identifiers that collide with the reserved keywords of the C99 and C11 versions of the C language.
• In addition to nine bug fixes, the CADP tools have been updated to use, whenever possible, the HTTPS protocol instead of the FTP and HTTP protocols, and to use “gzip” and “xz” compression (instead of “compress” and “.Z” files). The installation tools of CADP now support the Oarsh/Oarcp commands for deployment on large clusters, such as Grid'5000.
• CADP was ported to macOS 11 "Big Sur" and macOS 12 "Monterey", and was adapted to support recent Linux distributions based on Glibc 2.32, as well as Linux distributions available from the Microsoft Store and running on top of Windows/WSL2 (Windows Subsystem for Linux).

7.4.1 Rigorous Design, Reconfiguration, and Deployment of (I)IoT Applications

Participants: Irman Faqrizal [correspondent], Radu Mateescu [correspondent], Ajay Muroor Nadumane [correspondent], Gwen Salaün [correspondent].

The Internet of Things (IoT) consists of devices and software interacting altogether in order to build powerful and added-value services. One of the main challenges in this context is to support end-users with simple, user-friendly, and automated techniques to design such applications. In 2021, we continued our work on this challenge in the framework of the Nokia Bell Labs collaboration (see § 8.1.1):

• Given the dynamicity of IoT applications, it is necessary consider at design time that often these applications are not built once and for all, but they can evolve over time and objects may be added or removed for various reasons (replacement, loss of connectivity, upgrade, failure, etc.). In collaboration with Francisco Durán (University of Málaga, Spain), we proposed new techniques for supporting the reconfiguration of running IoT applications, by comparing two versions of the application (before and after reconfiguration) to check if several properties related to reconfiguration are preserved. The analysis techniques have been implemented using the Maude framework and integrated into the WebThings platform. This work led to two publications in international conferences 17, 18.
• Industrial automation is a complex process involving various stakeholders. The two important aspects to consider during the automation system development are its business production goals and its technical implementation. The international standard IEC 61499 helps to specify distributed automation using a generic architectural model, targeting the technical development of the automation. However, it is not easy to analyse whether these IEC 61499 models satisfy production goals due to their informal semantics and inherent complexities of distributed logic. We devised a transformation from an IEC 61499 specification to a BPMN (Business Process Model Notation) model, which presents the automation from a business point of view, and also enables quantitative analysis of process models. Specifically, it allows business process designers to analyze the automation w.r.t. cost, resource allocation, and time. This analysis is achieved by transforming the business processes to formal models in the Maude rewriting logic. This work led to a publication in an international conference 23.

7.4.2 Autonomous Car

Participants: Jean-Baptiste Horel [correspondent], Radu Mateescu [correspondent], Lucie Muller, Wendelin Serwe.

A common practice to evaluate autonomous vehicles is simulation, which requires to specify realistic scenarios, in particular critical ones, occurring rarely and potentially dangerous to reproduce on the road. Such scenarios may be either generated randomly, or specified manually. Randomly generating scenarios is easy, but their relevance might be difficult to assess. Manually specified scenarios can focus on a given feature, but their design might be difficult and time-consuming, especially to achieve satisfactory coverage.

In the framework of the ArchitectECA2030 (see § 9.3.1) and PRISSMA (see § 9.4.1) projects and in collaboration with Lina Marsso (University of Toronto, Canada), Christian Laugier, Anshul Paigwar, and Alessandro Renzaglia (CHROMA project-team), we proposed an automatic approach to generate a large number of relevant critical scenarios for autonomous driving simulators. The approach is based on the generation of behavioral conformance tests, using the TESTOR tool (see  § 7.3.2) from an LNT model (specifying the ground truth configuration with the range of vehicle behaviors) and a test purpose (specifying the critical feature to focus on). The obtained abstract test cases cover, by construction, all possible executions exercising a given feature, and can be automatically translated into the inputs of autonomous driving simulators. We illustrated our approach by generating thousands of behavior trees for the CARLA simulator for several realistic configurations. This work led to a paper accepted for publication in an international conference 22.

8.1.1 Nokia Bell Labs

Participants: Ajay Muroor Nadumane [correspondent], Gwen Salaün [correspondent].

A. Muroor Nadumane was supported by a post-doctorate grant (from January 2021 to August 2021) from Nokia Bell Labs (Nozay) on the formal modeling and analysis of industrial IoT (see § 7.4.1).

8.1.2 ST Microelectronics

Participants: Philippe Ledent [correspondent], Radu Mateescu [correspondent], Wendelin Serwe.

Ph. Ledent is supported by a CIFRE PhD grant (from October 2020 to September 2023) from ST Microelectronics (Grenoble) on the formal validation of security requirements for Systems-on-Chip, under the supervision of Hajer Ferjani (ST Microelectronics), Radu Mateescu (CONVECS), and Wendelin Serwe (CONVECS).

9.1.1 Inria International Partners

9.2.1 Visits of international scientists

• Nicolas Amat (LAAS-CNRS, Toulouse) visited us on September 27-29, 2021.
• Hugues Evrard (Google) visited us on November 15, 2021. He gave a seminar entitled “Specifying and Testing GPU Workgroup Progress Models”.

9.2.2 Other international collaborations

In 2021, we had scientific relations with several universities and institutes abroad, including:

• University of Málaga, Spain (Francisco Durán),
• University of Cali, Colombia (Camilo Rocha),
• University of Toronto, Canada (Lina Marsso),
• Saarland University, Germany (Holger Hermanns),
• ISTI/CNR, Pisa, Italy (Franco Mazzanti),
• IMT Lucca, Italy (Rocco De Nicola),
• GSSI, L'Aquila, Italy (Omar Inverso).

9.3.1 FP7 & H2020 projects

9.3.2 Collaborations with major European organizations

The CONVECS project-team is member of the FMICS (Formal Methods for Industrial Critical Systems) working group of ERCIM. H. Garavel and R. Mateescu are members of the FMICS board, H. Garavel being in charge of dissemination actions.

9.4.1 Fonds pour l'innovation et l'industrie

9.4.2 Other national collaborations

We had sustained scientific relations with the following researchers:

• Fabrice Kordon and Lom Messan Hillah (LIP6, Paris),
• Michel Le Pallec (Nokia Bell Labs, Nozay),
• Nicolas Amat, Silvano Dal Zilio, and Bernard Berthomieu (LAAS-CNRS, Toulouse).

9.5.1 Pack ambition recherche région Auvergne-Rhône-Alpes

9.5.2 Persyval labex

10.1.1 Scientific events: organisation

10.1.2 Scientific events: selection

10.1.3 Journal

10.1.4 Software Dissemination and Internet Visibility

The CONVECS project-team distributes several software tools, among which the CADP toolbox.

In 2021, the main facts are the following:

• We prepared and distributed twelve successive versions (2021-a to 2021-l) of CADP.
• We granted CADP licenses for 290 different computers in the world.

The CONVECS Web site was updated with scientific contents, announcements, publications, etc.

By the end of December 2021, the CADP forum, opened in 2007 for discussions regarding the CADP toolbox, had over 466 registered users and over 1972 messages had been exchanged.

Also, for the 2021 edition of the Model Checking Contest, we provided one family of models (totalling 17 Nested-Unit Petri Nets) derived from our LNT models.

Other research teams took advantage of the software components provided by CADP (e.g., the BCG and OPEN/CAESAR environments) to build their own research software. We can mention the following developments:

• Debugging and verification tools for Lingua Franca  36
• Explaining safety violations in real-time systems  47

Other teams also used the CADP toolbox for various case studies:

• Compositional verification of synchronous reactive systems  32
• Compatibility checking for asynchronously communicating software  50
• Specifying and testing GPU workgroup progress models  52
• Accelerating the computation of dead and concurrent places  29
• Radiomic features for prostate cancer grade detection  51

10.1.5 Invited talks

• P. Bouvier gave a talk entitled “Trois problèmes d'accessibilité dans les réseaux de Petri saufs” at the MeFoSyLoMa seminar held at LIP6, Paris on June 11, 2021.

10.1.6 Research administration

• F. Lang is chair of the “Commission du développement technologique”, which is in charge of selecting R&D projects for Inria Grenoble, and giving an advice on the recruitment of temporary engineers. In 2021, he also participated to the recruitment jury of the new head of Inria Grenoble' SED (Service d'Expérimentation et de Développement).
• R. Mateescu is the scientific correspondent of the International Partnerships for Inria Grenoble.
• R. Mateescu is a member of the “Comité d'Orientation Scientifique” for Inria Grenoble. In 2021, he also participated to the recruitment jury for CRCN (Chargé de Recherche de Classe Normale) and ISFP (Inria Starting Faculty Positions) at Inria Grenoble.
• R. Mateescu was appointed as representative of Inria Grenoble at the International Relations and Outreach of Université Grenoble Alpes.
• R. Mateescu was appointed as member of the council of the Mathematics, Information and Communication Sciences (MSTIC) research department of Université Grenoble Alpes.
• G. Salaün is a member of the Scientific Committee of the PCS (Pervasive Computing Systems) action of the PERSYVAL Labex.
• G. Salaün is a member of the council of the LIG laboratory.
• W. Serwe is correspondent in charge of the 2021 Inria activity reports at Inria Grenoble.
• W. Serwe is a member of the “Comité de Centre” at Inria Grenoble.

10.2.1 Teaching

CONVECS is a host team for the computer science master MOSIG (Master of Science in Informatics at Grenoble), common to Grenoble INP and Université Grenoble Alpes (UGA).

In 2021, we carried out the following teaching activities:

• P. Bouvier gave a course on “Théorie des langages 1” (18 hours “équivalent TD”) to 1st year students of ENSIMAG (started in 2020, completed in 2021).
• L. Di Stefano taught a course on “Modelling and Verification” (42 hours “équivalent TD”) to 5th year “filière apprentissage” Master's students in Computer Engineering at Polytech Paris-Saclay, April-May 2021.
• F. Lang gave a course on “Formal Software Development Methods” (7.5 hours “équivalent TD”) in the framework of the “Software Engineering” lecture given to 1st year students of the MOSIG.
• F. Lang and R. Mateescu gave a lecture on “Modeling and Analysis of Concurrent Systems: Models and Languages for Model Checking” (27 hours “équivalent TD”) to 3rd year students of ENSIMAG and second year students of the MOSIG.
• G. Salaün taught about 240 hours of classes (algorithmics, Web development, object-oriented programming) at the department MMI of IUT1 (UGA). He is also headmaster of the “Services Mobiles et Interface Nomade” (SMIN) professional licence (3rd year of university) at IUT1/UGA.
• W. Serwe supervised a group of six teams in the context of the “projet Génie Logiciel” (55 hours “équivalent TD”, consisting in 13.5 hours of lectures, plus supervision and evaluation) at ENSIMAG.
• W. Serwe participated to a course on “Embedded Systems: From High-Confidence Design to Safe Execution” (3 hours “équivalent TD” on behavioural testing) to 2nd year students of the MOSIG.
• A. Zuo gave a course on “Introduction to Java/Android programming” (34 hours “équivalent TD”) to L2 students of IUT1/UGA and on “Computer sciences applied to life sciences” (27 hours “équivalent TD”) to L1 students of UGA.

10.2.2 Supervision

• PhD in progress: P. Bouvier, “Implémentation et vérification des langages concurrents de nouvelle génération”, Université Grenoble Alpes, since October 2019, H. Garavel and R. Mateescu
• PhD in progress: I. Faqrizal, “Monitoring and Deployment of IIoT Applications”, Université Grenoble Alpes, since October 2021, G. Salaün and Yliès Falcone
• PhD in progress: J-B. Horel, “Validation des composants de perception basés sur l'IA dans les véhicules autonomes”, Université Grenoble Alpes, since April 2021, R. Mateescu, Alessandro Renzaglia, and Christian Laugier
• PhD in progress: P. Ledent, “Formal Validation of Security Requirements for a System-on-Chip Architecture”, Université Grenoble Alpes, since October 2020, R. Mateescu, W. Serwe, and Hajer Ferjani
• PhD in progress: L. Muller, “Formal Modelling and Validation for Electric, Connected, and Automated Vehicles”, Université Grenoble Alpes, since September 2020, R. Mateescu and W. Serwe
• PhD in progress: A. Zuo, “Modelling, Optimization and Predictive Analysis of Business Processes”, Université Grenoble Alpes, since October 2020, G. Salaün and Y. Falcone

10.2.3 Juries

• G. Salaün was reviewer of Jose Manuel Carrasco Mora's PhD thesis, entitled “Unified Management of Applications on Heterogeneous Clouds”, defended at University of Málaga (Spain) on May 27, 2021.
• G. Salaün was reviewer of Erwan Mahé's PhD thesis, entitled “An Operational Semantics of Interactions for Verifying Partially Observed Executions of Distributed Systems”, defended at Université Paris-Saclay on July 15, 2021.
• G. Salaün was reviewer of Laetitia Laversa's PhD thesis, entitled “La synchronisabilité pour les systèmes distribués”, defended at Université Côte d'Azur on December 14, 2021.
• G. Salaün was reviewer of Sara Houhou's PhD thesis, entitled “Parameterised Verification from Formal Specifications of Information Systems”, defended at Sorbonne Université on December 22, 2021.

International journals

• 9 articleG.Gianluca Barbon, V.Vincent Leroy and G.Gwen Salaün. Debugging of Behavioural Models using Counterexample Analysis.IEEE Transactions on Software Engineering476June 2021, 1184-1197
  HALDOI
• 10 articleL.Luca Di Stefano, R.Rocco De Nicola and O.Omar Inverso. Verification of Distributed Systems via Sequential Emulation.ACM Transactions on Software Engineering and Methodology2022
  HAL
• 11 articleF.Francisco Durán, C.Camilo Rocha and G.Gwen Salaün. Resource Provisioning Strategies for BPMN Processes: Specification and Analysis using Maude.Journal of Logical and Algebraic Methods in ProgrammingNovember 2021, 1-50
  HALDOIback to text
• 12 articleA.Ajay Krishna, M.Michel Le Pallec, R.Radu Mateescu and G.Gwen Salaün. Design and Deployment of Expressive and Correct Web of Things Applications.ACM Transactions on Internet of Things3February 2022, 1 - 30
  HALDOI
• 13 articleF.Frederic Lang, R.Radu Mateescu and F.Franco Mazzanti. Compositional Verification of Concurrent Systems by Combining Bisimulations.Formal Methods in System DesignFebruary 2021
  HALDOIback to text
• 14 articleG.Gwen Salaün. Quantifying the Similarity of Non-bisimilar Labelled Transition Systems.Science of Computer Programming202February 2021
  HALDOI

International peer-reviewed conferences

• 15 inproceedingsP.Pierre Bouvier and H.Hubert Garavel. Efficient Algorithms for Three Reachability Problems in Safe Petri Nets.Proceedings of the 42nd International Conference on Applications and Theory of Petri Nets and Concurrency (PETRI NETS 2021)PETRI NETS 2021 - 42nd International Conference on Application and Theory of Petri Nets and ConcurrencyParis, FranceSpringerJune 2021, 339-359
  HALDOIback to text
• 16 inproceedingsL.Luca Di Stefano and F.Frédéric Lang. Verifying Temporal Properties of Stigmergic Collective Systems Using CADP.ISoLA 2021 - 10th International Symposium on Leveraging Applications of Formal Methods13036Lecture Notes in Computer ScienceRhodes, GreeceSpringer International PublishingOctober 2021, 473-489
  HALDOIback to text
• 17 inproceedingsF.Francisco Durán, A.Ajay Krishna, M.Michel Le Pallec, R.Radu Mateescu and G.Gwen Salaün. R-MOZART: A Reconfiguration Tool for WebThings Applications.2021 IEEE/ACM 43rd International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)Madrid / Virtual, SpainIEEEMay 2021, 41-44
  HALDOIback to text
• 18 inproceedingsF.Francisco Durán, A.Ajay Krishna, M.Michel Le Pallec, R.Radu Mateescu and G.Gwen Salaün. Seamless Reconfiguration of Rule-Based IoT Applications.SEAMS 2021 - 16th International Symposium on Software Engineering for Adaptive and Self-Managing Systems1Madrid / Virtual, SpainMay 2021, 142-148
  HALback to text
• 19 inproceedingsY.Yliès Falcone and G.Gwen Salaün. Runtime Enforcement with Reordering, Healing, and Suppression.SEFM 2021 - 19th IEEE International Conference on Software Engineering and Formal MethodsVirtual, United KingdomIEEEDecember 2021, 1-20
  HALback to text
• 20 inproceedingsY.Yliès Falcone, G.Gwen Salaün and A.Ahang Zuo. Semi-automated Modelling of Optimized BPMN Processes.SCC 2021 - IEEE International Conference on Services ComputingCHICAGO / Virtual, United StatesIEEESeptember 2021, 1-6
  HALback to text
• 21 inproceedings H.Hubert Garavel, F.Frederic Lang, R.Radu Mateescu and W.Wendelin Serwe. Is CADP an Applicable Formal Method? AppFM 2021 - 1st International Workshop on Applicable Formal Methods Bejing, China November 2021
  HAL
• 22 inproceedingsJ.-B.Jean-Baptiste Horel, C.Christian Laugier, L.Lina Marsso, R.Radu Mateescu, L.Lucie Muller, A.Anshul Paigwar, A.Alessandro Renzaglia and W.Wendelin Serwe. Using Formal Conformance Testing to Generate Scenarios for Autonomous Vehicles.DATE/ASD 2022 - Design, Automation and Test in Europe - Autonomous Systems DesignAntwerp, BelgiumIEEEMarch 2022
  HALback to text
• 23 inproceedingsA.Ajay Krishna and G.Gwen Salaün. Business Process Models for Analysis of Industrial IoT Applications.IoT 2021 - 11th International Conference on the Internet of ThingsSt. Gallen, SwitzerlandNovember 2021, 1-8
  HALDOIback to text
• 24 inproceedingsG.Gwen Salaün. Consistent Substitution of Object in Rule-based IoT Applications.COMPSAC 2021 - Computer Software and Applications ConferenceVirtual, United StatesJuly 2021, 1-9
  HAL

Edition (books, proceedings, special issue of a journal)

• 25 bookP. C.Peter Csaba C Ölveczky and G.Gwen Salaün. Preface: Special issue on Software Engineering and Formal Methods.Software and Systems Modeling202Springer VerlagApril 2021, 291-292
  HALDOI
• 26 proceedingsG.Gwen SalaünA.Anton WijsFormal Aspects of Component Software: Proceedings of the 17th International Conference on Formal Aspects of Component Software (FACS 2021).13077Lecture Notes in Computer ScienceSpringer International Publishing2021
  HALDOI

Reports & preprints

• 27 reportP.Pierre Bouvier and H.Hubert Garavel. The VLSAT-2 Benchmark Suite.RT-0514INRIA Grenoble Rhône-AlpesSeptember 2021, 1-8
  HALback to text
• 28 reportP.Pierre Bouvier. The VLSAT-3 Benchmark Suite.RT-0516INRIA Grenoble Rhône-AlpesDecember 2021, 1-20
  HALback to text