The Experts below are selected from a list of 837 Experts worldwide ranked by ideXlab platform

Lunjin Lu - One of the best experts on this subject based on the ideXlab platform.

  • Required behavior of sequence diagrams: Semantics and conformance
    ACM Transactions on Software Engineering and Methodology, 2014
    Co-Authors: Lunjin Lu
    Abstract:

    Many reusable software artifacts such as design patterns and design aspects make use of UML sequence diagrams to describe interaction behaviors. When a pattern or an aspect is reused in an application, it is important to ensure that the sequence diagrams for the application conform to the corresponding sequence diagrams for the pattern or aspect. Reasoning about conformance Relationship between sequence diagrams has not been addressed adequately in literature. In this article, we focus on required behaviors specified by a UML sequence diagram and provide a semantic-based formalization of conformance Relationships between sequence diagrams. A novel trace semantics is first given that captures precisely required behaviors. A Refinement Relation between sequence diagrams is then defined based on the semantics. The Refinement Relation allows a sequence diagram to be refined by changing its structure so long as its required behaviors are preserved. A conformance Relation between sequence diagrams is finally given that includes the Refinement Relation as a special case. It allows one to introduce and rename lifelines, messages, and system variables when reusing sequence diagrams. Properties of the semantics, Refinement, and conformance Relations are studied. Two case studies are provided to illustrate the efficacy of semantic-based conformance reasoning.

  • SOFSEM - Refinement Inference for Sequence Diagrams
    Lecture Notes in Computer Science, 2013
    Co-Authors: Lunjin Lu
    Abstract:

    Refinement is fundamental to software development. An earlier work proposed a Refinement Relation between sequence diagrams based on their required behaviors. In this paper, we first generalize the Refinement Relation by taking into account system variable assignment and event hiding, renaming and substitution. We then give an algorithm as a system of inference rules that does not just verify Refinement Relationship between two sequence diagrams but also derives sufficient conditions under which such a Relationship holds. The algorithm makes use of a semantics preserving transformation on sequence diagrams. The usefulness of Refinement inference is demonstrated with a case study.

  • Required Behavior of Sequence Diagrams: Semantics and Refinement
    2011 16th IEEE International Conference on Engineering of Complex Computer Systems, 2011
    Co-Authors: Lunjin Lu
    Abstract:

    Sequence diagrams are a widely used design notation for describing software behavior. Many reusable software artifacts such as design patterns and design aspects make use of sequence diagrams to describe interaction behavior. When a pattern or an aspect is reused in an application, it is important to ensure that the sequence diagrams for the application correctly refines the corresponding sequence diagrams for the pattern or aspect. However, reasoning about Refinement of sequence diagrams has not been addressed adequately. In this paper, we focus on Refinement of required behavior specified by a UML sequence diagram. A novel trace semantics is given that captures precisely required behavior specified by a sequence diagram and a Refinement Relation between sequence diagrams is formalized based on the semantics. Properties of the trace semantics and the Refinement Relation are studied.

  • ICECCS - Required Behavior of Sequence Diagrams: Semantics and Refinement
    2011 16th IEEE International Conference on Engineering of Complex Computer Systems, 2011
    Co-Authors: Lunjin Lu
    Abstract:

    Sequence diagrams are a widely used design notation for describing software behavior. Many reusable software artifacts such as design patterns and design aspects make use of sequence diagrams to describe interaction behavior. When a pattern or an aspect is reused in an application, it is important to ensure that the sequence diagrams for the application correctly refines the corresponding sequence diagrams for the pattern or aspect. However, reasoning about Refinement of sequence diagrams has not been addressed adequately. In this paper, we focus on Refinement of required behavior specified by a UML sequence diagram. A novel trace semantics is given that captures precisely required behavior specified by a sequence diagram and a Refinement Relation between sequence diagrams is formalized based on the semantics. Properties of the trace semantics and the Refinement Relation are studied.

  • Semantics-based Refinement of Mandatory Behavior of Sequence Diagrams
    2010
    Co-Authors: Lunjin Lu
    Abstract:

    Sequence diagrams are a widely used design notation for describing software behavior. Many reusable software artifacts such as design patterns and design aspects make use of sequence diagrams to describe interaction behavior. When a pattern or an aspect is reused in an application, it is important to ensure that the sequence diagrams for the application correctly refines the corresponding sequence diagrams for the pattern or aspect. However, reasoning about Refinement of sequence diagrams has not been addressed adequately. In this paper, we focus on Refinement of required behavior specified by a UML sequence diagram. A novel trace semantics is given that captures precisely required behavior specified by a sequence diagram and a Refinement Relation between sequence diagrams is formalized based on the semantics. Properties of the trace semantics and the Refinement Relation are studied.

Olga Kouchnarenko - One of the best experts on this subject based on the ideXlab platform.

  • Refinement Preserves PL T L Properties
    2020
    Co-Authors: Christophe Darlot, Jacques Julliand, Olga Kouchnarenko, Fre Cnrs
    Abstract:

    We are interested in verifying dynamic properties of reactive systems. The reactive systems are specified by B event systems in a Refinement development. We use labelled transition systems to express the semantics of these event systems on which we define a Refinement Relation. The main advantage is that the user does not need to express a variant and a loop invariant to obtain automatic proofs of dynamic properties, at least for finite state event systems. Another advantage is that the model-checking is done on an abstraction with few states and the property is preserved in the following Refinements of the system. The originality of this work concerns the proof that this Refinement Relation preserves the properties expressed with propositional linear temporal logic.

  • MEMOCODE - How to compute the Refinement Relation for parameterized systems
    First ACM and IEEE International Conference on Formal Methods and Models for Co-Design 2003. MEMOCODE '03. Proceedings., 2003
    Co-Authors: Francoise Bellegarde, C. Charlet, Olga Kouchnarenko
    Abstract:

    In this paper, we present a Refinement verification for a class of parameterized systems. These systems are composed of an arbitrary number of similar processes. As in (Abdulla et al., 199) we represent the states by regular languages and the transitions by transducers over regular languages. If we can compute a symbolic model by acceleration of the actions, then we can also verify a Refinement Relation R between the symbolic models. We show that, under some conditions, if R is verified between two symbolic models, then Refinement is verified between concrete parameterized systems. Then, we can take advantage of the property (safety and PLTL properties) preservation by Refinement for their verification.

  • ZB - Refinement preserves PLTL properties
    Lecture Notes in Computer Science, 2003
    Co-Authors: Christophe Darlot, Jacques Julliand, Olga Kouchnarenko
    Abstract:

    We are interested in verifying dynamic properties of reactive systems. The reactive systems are specified by a B event systems in a Refinement development. We use labelled transition systems to express the semantics of these event systems on which we define a Refinement Relation. The main advantage is that the user does not need to express a variant and a loop invariant to obtain automatic proofs of dynamic properties, at least for finite state event systems. Another advantage is that the model-checking is done on an abstraction with few states and the property is preserved in the following Refinements of the system. The originality of this work concerns the proof that this Refinement Relation preserves the properties expressed with propositional linear temporal logic.

  • FASE - Ready-Simulation Is Not Ready to Express a Modular Refinement Relation
    Fundamental Approaches to Software Engineering, 2000
    Co-Authors: Francoise Bellegarde, Jacques Julliand, Olga Kouchnarenko
    Abstract:

    The B method has been successfully used to specify many industrial applications by Refinement. Previously, we proposed enriching the B event systems by formulating its dynamic properties in LTL. This enables us to combine model-checking with theorem-proving verification technologies. The model-checking of LTL formulae necessitates that the B event system semantics is a transition system. In this paper, we express the Refinement Relation by a Relationship between transition systems. A result of our study shows that this Relation is a special kind of simulation allowing us to exploit the partition of the reachable state space for a modular verification of LTL formulae. The results of the paper allow us to build a bridge between the above view of the Refinement and the notions of observability characterized as simulation Relations by Milner, van Glabbeek, Bloom and others. The Refinement Relation we define in the paper is a ready-simulation generalization which is similar to the refusal simulation of Ulidowsky. The way the Relation is defined allows us to obtain a compositionality result w.r.t. parallel composition operation. For complex systems, it is important in practice to associate a design by Refinement with a design by a parallel composition of their components. This Refinement Relation has two main applications: - it allows the splitting of the refined transition system into modules; - it allows the construction of complex systems by a parallel composition of components. It makes sense to qualify the Refinement Relation as being modular.

  • ready simulation is not ready to express a modular Refinement Relation
    Fundamental Approaches to Software Engineering, 2000
    Co-Authors: Francoise Bellegarde, Jacques Julliand, Olga Kouchnarenko
    Abstract:

    The B method has been successfully used to specify many industrial applications by Refinement. Previously, we proposed enriching the B event systems by formulating its dynamic properties in LTL. This enables us to combine model-checking with theorem-proving verification technologies. The model-checking of LTL formulae necessitates that the B event system semantics is a transition system. In this paper, we express the Refinement Relation by a Relationship between transition systems. A result of our study shows that this Relation is a special kind of simulation allowing us to exploit the partition of the reachable state space for a modular verification of LTL formulae. The results of the paper allow us to build a bridge between the above view of the Refinement and the notions of observability characterized as simulation Relations by Milner, van Glabbeek, Bloom and others. The Refinement Relation we define in the paper is a ready-simulation generalization which is similar to the refusal simulation of Ulidowsky. The way the Relation is defined allows us to obtain a compositionality result w.r.t. parallel composition operation. For complex systems, it is important in practice to associate a design by Refinement with a design by a parallel composition of their components. This Refinement Relation has two main applications: - it allows the splitting of the refined transition system into modules; - it allows the construction of complex systems by a parallel composition of components. It makes sense to qualify the Refinement Relation as being modular.

Ketil Stolen - One of the best experts on this subject based on the ideXlab platform.

  • ESORICS - Compositional Refinement of Policies in UML --- Exemplified for Access Control
    Computer Security - ESORICS 2008, 2008
    Co-Authors: Bjørnar Solhaug, Ketil Stolen
    Abstract:

    The UML is the de factostandard for system specification, but offers little specialized support for the specification and analysis of policies. This paper presents Deontic STAIRS, an extension of the UML sequence diagram notation with customized constructs for policy specification. The notation is underpinned by a denotational trace semantics. We formally define what it means that a system satisfies a policy specification, and introduce a notion of policy Refinement. We prove that the Refinement Relation is transitive and compositional, thus supporting a stepwise and modular specification process. The approach is exemplified with access control policies.

  • a Refinement Relation supporting the transition from unbounded to bounded communication buffers
    Mathematics of Program Construction, 1995
    Co-Authors: Ketil Stolen
    Abstract:

    This paper proposes a Refinement Relation supporting the transition from unbounded to bounded communication buffers. Employing this Refinement Relation, a system specification based on purely asynchronous communication can for example be refined into a system specification where the components communicate purely in terms of handshakes. First a weak version called partial Refinement is introduced. Partial Refinement guarantees only the preservation of safety properties — preservation in the sense that any implementation of the more concrete specification can be understood as an implementation of the more abstract specification if the latter is a safety property. This Refinement Relation is then strengthened into total Refinement which preserves both safety and liveness properties. Thus a total Refinement is also a partial Refinement. The suitability of this Refinement Relation for top-down design is discussed and some examples are given.

  • MPC - A Refinement Relation supporting the transition from unbounded to bounded communication buffers
    Lecture Notes in Computer Science, 1995
    Co-Authors: Ketil Stolen
    Abstract:

    This paper proposes a Refinement Relation supporting the transition from unbounded to bounded communication buffers. Employing this Refinement Relation, a system specification based on purely asynchronous communication can for example be refined into a system specification where the components communicate purely in terms of handshakes. First a weak version called partial Refinement is introduced. Partial Refinement guarantees only the preservation of safety properties — preservation in the sense that any implementation of the more concrete specification can be understood as an implementation of the more abstract specification if the latter is a safety property. This Refinement Relation is then strengthened into total Refinement which preserves both safety and liveness properties. Thus a total Refinement is also a partial Refinement. The suitability of this Refinement Relation for top-down design is discussed and some examples are given.

Antoine Girard - One of the best experts on this subject based on the ideXlab platform.

  • Safety controller design for incrementally stable switched systems using event-based symbolic models
    2019 18th European Control Conference (ECC), 2019
    Co-Authors: Zohra Kader, Adnane Saoud, Antoine Girard
    Abstract:

    In this paper, we investigate the problem of lazy safety controllers synthesis for event-based symbolic models of incrementally stable switched systems with aperiodic time sampling. First of all, we provide a novel event-based scheme for symbolic models design. The obtained symbolic models are computed while considering all transitions of different durations satisfying a triggering condition. In addition, they are related to the original switched system by a feedback Refinement Relation and thus useful for control applications. Then, using the particular structure of the obtained event-based symbolic model, a lazy safety controller is designed while choosing transitions of longest durations. Secondly, for the same state sampling parameter and desired precision, we show that the obtained event-based symbolic model is related by a feedback Refinement Relation to the classical symbolic model designed for incrementally stable switched systems with periodic time sampling. Based on this Relationship, we prove analytically that the size of the set of controllable states obtained with the lazy safety controller designed for an event-based symbolic model is larger than the one obtained with a safety controller designed for the classical symbolic model. Finally, an illustrative example is proposed in order to show the efficiency of the proposed method and simulations are performed for a Boost DC-DC converter structure.

  • ECC - Safety controller design for incrementally stable switched systems using event-based symbolic models
    2019 18th European Control Conference (ECC), 2019
    Co-Authors: Zohra Kader, Adnane Saoud, Antoine Girard
    Abstract:

    In this paper, we investigate the problem of lazy safety controllers synthesis for event-based symbolic models of incrementally stable switched systems with aperiodic time sampling. First of all, we provide a novel event-based scheme for symbolic models design. The obtained symbolic models are computed while considering all transitions of different durations satisfying a triggering condition. In addition, they are related to the original switched system by a feedback Refinement Relation and thus useful for control applications. Then, using the particular structure of the obtained event-based symbolic model, a lazy safety controller is designed while choosing transitions of longest durations. Secondly, for the same state sampling parameter and desired precision, we show that the obtained event-based symbolic model is related by a feedback Refinement Relation to the classical symbolic model designed for incrementally stable switched systems with periodic time sampling. Based on this Relationship, we prove analytically that the size of the set of controllable states obtained with the lazy safety controller designed for an event-based symbolic model is larger than the one obtained with a safety controller designed for the classical symbolic model. Finally, an illustrative example is proposed in order to show the efficiency of the proposed method and simulations are performed for a Boost DC-DC converter structure.

Ming Fu - One of the best experts on this subject based on the ideXlab platform.

  • Rely-Guarantee-Based Simulation for Compositional Verification of Concurrent Program Transformations
    ACM Transactions on Programming Languages and Systems, 2014
    Co-Authors: Hongjin Liang, Xinyu Feng, Ming Fu
    Abstract:

    Verifying program transformations usually requires proving that the resulting program (the target) refines or is equivalent to the original one (the source). However, the Refinement Relation between individual sequential threads cannot be preserved in general with the presence of parallel compositions, due to instruction reordering and the different granularities of atomic operations at the source and the target. On the other hand, the Refinement Relation defined based on fully abstract semantics of concurrent programs assumes arbitrary parallel environments, which is too strong and cannot be satisfied by many well-known transformations. In this article, we propose a Rely-Guarantee-based Simulation (RGSim) to verify concurrent program transformations. The Relation is parametrized with constraints of the environments that the source and the target programs may compose with. It considers the interference between threads and their environments, thus is less permissive than Relations over sequential programs. It is compositional with respect to parallel compositions as long as the constraints are satisfied. Also, RGSim does not require semantics preservation under all environments, and can incorporate the assumptions about environments made by specific program transformations in the form of rely/guarantee conditions. We use RGSim to reason about optimizations and prove atomicity of concurrent objects. We also propose a general garbage collector verification framework based on RGSim, and verify the Boehm et al. concurrent mark-sweep GC.

  • POPL - A rely-guarantee-based simulation for verifying concurrent program transformations
    Proceedings of the 39th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages - POPL '12, 2012
    Co-Authors: Hongjin Liang, Xinyu Feng, Ming Fu
    Abstract:

    Verifying program transformations usually requires proving that the resulting program (the target) refines or is equivalent to the original one (the source). However, the Refinement Relation between individual sequential threads cannot be preserved in general with the presence of parallel compositions, due to instruction reordering and the different granularities of atomic operations at the source and the target. On the other hand, the Refinement Relation defined based on fully abstract semantics of concurrent programs assumes arbitrary parallel environments, which is too strong and cannot be satisfied by many well-known transformations. In this paper, we propose a Rely-Guarantee-based Simulation (RGSim) to verify concurrent program transformations. The Relation is parametrized with constraints of the environments that the source and the target programs may compose with. It considers the interference between threads and their environments, thus is less permissive than Relations over sequential programs. It is compositional w.r.t. parallel compositions as long as the constraints are satisfied. Also, RGSim does not require semantics preservation under all environments, and can incorporate the assumptions about environments made by specific program transformations in the form of rely/guarantee conditions. We use RGSim to reason about optimizations and prove atomicity of concurrent objects. We also propose a general garbage collector verification framework based on RGSim, and verify the Boehm et al. concurrent mark-sweep GC.