The UML  Timed Automata track

1. The UML  Timed Automata track Gergely Pintér, Balázs Polgár, István MajzikBME

2. Objectives and contributions • Complementary to the UML2OOAS track • Test generation for modules (functions) with real-time requirements • Cross-validation of new OOAS features (time triggers) • Scientific contribution: • Transformation from UML State Machines with time extensionsto Timed Automata (finite automata with concurrent clocks) • Supporting a rich set of UML state machine features • Concurrency, state hierarchy, inter-level transitions, compound transitions, ... • Based on a precisely formalized UML state machine semantics • Practical contribution: • Input: UML state machines (almost the same as for the OOAS track) • Known limitations: Less expressive than OOAS considering data structures, OO features, and state space handling • Test generation: Using the UPPAAL tool-set, tests according to various coverage criteria (state, location, edge, def-use etc.) • Output: Abstract test sequences (traces) with delay steps

3. Input conventions • Supported: UML State Machine specification • State-based event-driven behavior of active objects • Conventions and limitations on static features: • Packages • Containing primitive types, classes, instances, signals, signal and time events • Classes • Attributes (of Boolean or Integer type in case of Uppaal output) • References to other classes • Inheritance not yet supported due to target language limitations • Instances • Exactly one classifier • Slots defining values of properties (literals or instance values)

4. Input conventions • Conventions on state machines • State hierarchy (concurrency, sub-machines supported) • Well formed fork, join, junction structures • Choices interpreted as junctions • Histories not supported in Uppaal output • Guards • Opaque expressions with AGSL functions in bodies • Effects • Opaque behaviors with AGSL methods in bodies • Triggers (optional) • Signal events • Time events: relative with a time expression specified by a literal • Signal and event attributes not yet supported in Uppaal output • State machine inheritance not supported

5. The Prolan State Decoder module • Overview of the behaviour (requirements): • Collecting input signals (received from railway periphery) • Time-based filtering of transient signals (states) • Generation of output signals (status of the railway object) by a predefined mapping • Core part of the UML state machine model: • Decoder and database classes and instances • Signals representing railway telegrams

6. classes Decoder Database recentWLR: Integer recentWLL: Integer … sw1VPV: Boolean sw1VMV: Boolean … The Prolan State Decoder module • Decoder attributes • Most recent values of WLL, WLR, WUWa, … • Three state values as integers: false (0), true (1), unknown (2) • Database attributes • Bits of status word #1 • Boolean values

7. classes Decoder Database recentWLR: Integer recentWLL: Integer … sw1VPV: Boolean sw1VMV: Boolean … instances theDecoder: Decoder theDatabase: Database recentWLR = 2recentWLL = 2 … sw1VPV = falsesw1VMV = false … The Prolan State Decoder module • Decoder instance • Most recent values of WLL, WLR, WUWa, … initialized to unknown state • Database instance • Bits of status word #1 initialized to false

8. signals <<signal>> WLRisTrue <<signal>> WLRisFalse <<signal>> WLLisTrue <<signal>> WLLisFalse … The Prolan State Decoder module classes Decoder Database recentWLR: Integer recentWLL: Integer … sw1VPV: Boolean sw1VMV: Boolean … • “WLR is True” • Signal • One signal for each device state instances theDecoder: Decoder theDatabase: Database recentWLR = 2recentWLL = 2 … sw1VPV = falsesw1VMV = false …

9. events <<signalevent>> WLRisTrueEvent <<timeevent>> FiveSecondsElapsed when: 5 The Prolan State Decoder module classes signals Decoder Database <<signal>> WLRisTrue <<signal>> WLRisFalse recentWLR: Integer recentWLL: Integer … sw1VPV: Boolean sw1VMV: Boolean … <<signal>> WLLisTrue <<signal>> WLLisFalse • “WLR is True” • Signal Event • One signal event for each signal … • “5 Sec. Elapsed” • Time Event • Time event with a time expression specified by a literal instances theDecoder: Decoder theDatabase: Database recentWLR = 2recentWLL = 2 … sw1VPV = falsesw1VMV = false …

10. classes signals Decoder Database <<signal>> WLRisTrue <<signal>> WLRisFalse recentWLR: Integer recentWLL: Integer … sw1VPV: Boolean sw1VMV: Boolean … <<signal>> WLLisTrue <<signal>> WLLisFalse State Machine of the Decoder Class Connected … Disconnected events Filtering instances WLRisTrueEvent / recentWLR = 1 WLRisTrueEvent / recentWLR = 1 Idle <<signalevent>> WLRisTrueEvent Internal theDecoder: Decoder theDatabase: Database … … RTUConnectedEvent recentWLR = 2recentWLL = 2 … sw1VPV = falsesw1VMV = false … <<timeevent>> FiveSecondsElapsed FiveSecondsElapsed / doDecode() RTUDisconnectedEvent when: 5 The Prolan State Decoder module • After 5 Seconds Spent in Filtering • Time event trigger • Method doDecode() specified in AGSL: • if ((1 == recentWLR) && • (0 == recentWLL) && • (1 == recentWUWa) && • (0 == recentWUWv)) { • database.sw1VME = false; • database.sw1VPE = false; • database.sw1VMV = false; • database.sw1VPV = true; • } • ... • First Railway Telegram • Takes the state machine to the Filtering state’s Internal substate • Effect updates the appropriate member variable (AGSL): • recentWLR = 1; • Filtering state • Decoder is filtering (i.e., some un-decoded telegrams are pending) • Dummy internal substate • Subsequent Telegram • Effect updates the appropriate member variable (AGSL): • recentWLR = 1; • Idle state • Decoder is idle (i.e., no un-decoded telegram)

11. Mapping to Timed Automata • Structure of the Uppaal model • Declaration section • Classes mapped to Uppaal structures • Instances mapped to Uppaal structure instances • Guards and activities mapped to functions • AGSL bodies translated to Uppaal • Timed automata (Uppaal “templates”) • Event queue • RTC behavior, event queue management • Clock observer • Inserting time events into the event queue • Environment • Inserting external events into the queue • State machines transformed to timed automata • System declaration • Template instances

12. Automated test generation • Model checking approach, CoVer tool • Input: UPPAAL Timed Automata • Specification of coverage criteria: Observers • Predefined patterns for state, location, transition, def-use coverage; user-defined coverage criteria can be added • Output: Abstract test sequence (configurable XML)

13. Status • Actual status • Prolan State Decoder module was modelled • Transformation tool to Timed Automata is ready • First tests were generated • using the model checker of UPPAAL • Next steps: • Integration with CoVer • Mapping XML traces to MOGENTES abstract tests • ... • Mapping abstract test cases to concrete test cases (Prolan test environment)