Omer Landry Nguena Timo

Runtime enforcement of timed properties revisited

Runtime enforcement is a powerful technique to ensure that a running system satisfies some desired properties. Using an enforcement monitor, an (untrustworthy) input execution (in the form of a sequence of events) is modified into an output sequence that complies with a property. Over the last decade, runtime enforcement has been mainly studied in the context of untimed properties. This paper deals with runtime enforcement of timed properties by revisiting the foundations of runtime enforcement when time between events matters. We propose a new enforcement paradigm where enforcement mechanisms are time retardants: to produce a correct output sequence, additional delays are introduced between the events of the input sequence. We consider runtime enforcement of any regular timed property defined by a timed automaton. We prove the correctness of enforcement mechanisms and prove that they enjoy two usually expected features, revisited here in the context of timed properties. The first one is soundness meaning that the output sequences (eventually) satisfy the required property. The second one is transparency, meaning that input sequences are modified in a minimal way. We also introduce two new features, (i) physical constraints that describe how a time retardant is physically constrained when delaying a sequence of timed events, and (ii) optimality, meaning that output sequences are produced as soon as possible. To facilitate the adoption and implementation of enforcement mechanisms, we describe them at several complementary abstraction levels. Our enforcement mechanisms have been implemented and our experimental results demonstrate the feasibility of runtime enforcement in a timed context and the effectiveness of the mechanisms.

Runtime Enforcement of Timed Properties

Runtime enforcement is a powerful technique to ensure that a running system respects some desired properties. Using an enforcement monitor, an (untrustworthy) input execution (in the form of a sequence of events) is modified into an output sequence that complies to a property. Runtime enforcement has been extensively studied over the last decade in the context of untimed properties.

Conformance testing of variable driven automata

In this paper, we address the conformance testing problem for timed constrained critical systems. We propose a new model adapted to describe such systems. The model is called Variable Driven Timed Automata (VDTA) and is a variant of timed automata in which events are variable assignments and all transitions are urgent. We present a sound and exhaustive on the fly testing algorithm for such systems. As an application of our approach, we propose a case study on a “Bi-manual command” system.

Test Generation by Constraint Solving and FSM Mutant Killing

The problem of fault model-based test generation from formal models, in this case Finite State Machines, is addressed. We consider a general fault model which is a tuple of a specification, conformance relation and fault domain. The specification is a deterministic FSM which can be partially specified and not reduced. The conformance relation is quasi-equivalence, as all implementations in the fault domain are assumed to be completely specified FSMs. The fault domain is a set of all possible deterministic submachines of a given nondeterministic FSM, called a mutation machine. The mutation machine contains a specification machine and extends it with mutated transitions modelling potential faults. An approach for deriving a test suite which is complete (sound and exhaustive) for the given fault model is elaborated. It is based on our previously proposed method for analyzing the test completeness by logical encoding and SMT-solving. The preliminary experiments performed on an industrial controller indicate that the approach scales sufficiently well.

Remote Testing of Timed Specifications

We present a study and a testing framework on black box remote testing of real-time systems using Uppaal-TIGA. One of the essential challenges of remote testing is the communication latency between the tester and the system under test (SUT) that may lead to interleaving of inputs and outputs. This affects the generation of inputs for the SUT and the observation of outputs that may trigger a wrong test verdict. We model the overall test setup using Timed Input-Output Automata (TIOA) and present an adapted asynchronous semantics with explicit communication delays. We propose the \(\varDelta\)-testability criterion for the requirement model where \(\varDelta\) describes the communication latency. The test case generation problem is then reduced into a controller synthesis problem. We use Uppaal-TIGA for this purpose to solve a timed game with partial observability between the tester and the communication media together with the SUT. The objective of the game corresponds to a test purpose.

Multiple Mutation Testing from Finite State Machines with Symbolic Inputs

Recently, we proposed a mutation-testing approach from a classical finite state machine (FSM) for detecting nonconforming mutants in a given fault domain specified with a so-called mutation machine. In this paper, we lift this approach to a particular type of extended finite state machines called symbolic input finite state machine (SIFSM), where transitions are labeled with symbolic inputs, which are predicates on input variables possibly having infinite domains. We define a well-formed mutation SIFSM for describing various types of faults. Given a mutation SIFSM, we develop a method for evaluating the adequacy of a test suite and a method for generating tests detecting all nonconforming mutants. Experimental results with the prototype tool we have developed indicate that the approach is applicable to industrial-like systems.

Checking Sequence Generation for Symbolic Input/Output FSMs by Constraint Solving

The reset of reactive systems in testing can be impossible or very costly, which could force testers to avoid it. In this context, testers often want to generate a checking sequence, i.e., a unique sequence of inputs satisfying a chosen test criterion. This paper proposes a method for generating a checking sequence with complete fault coverage for a given fault model of reactive systems. The systems are represented with an extension of Finite State Machines (FSMs) with symbolic inputs and outputs which are predicates on input and output variables having possibly infinite domains. In our setting, a checking sequence is made up of symbolic inputs and the fault domain can represent complex faults. The method consists in building and solving Boolean expressions to iteratively refine and extend a sequence of symbolic inputs. We evaluate the efficiency of the approach with a prototype tool we have developed.

Y Nut, a Phonetic-based Learning System for Spoken Languages

Communication between humans is of importance for our societies. It requires constant learning of new languages, e.g., by travellers whose extended stay in foreign locations facilitate learning. When a language possesses a written form, much of the meaning necessary for its learning is directly provided by the text. In spoken languages however, the meaning is only vehicled by the sounds. Nonetheless, learning spoken languages can take advantage of linguistic contents available in audio or video media which abound on the Internet and the social networks. We open a discussion and describe a system that enables to enrich a phonetic database so as to ease learning of basic expressions of spoken languages. Such a system could be useful for the survival of the plethora of spoken languages in Africa. The purpose of such a system is to provide within a reasonable period, automatic syntactic translation services.

On characteristic formulae for Event-Recording Automata

A standard bridge between automata theory and logic is provided by the notion of characteristic formula. This paper investigates this problem for the class of event-recording automata (ERA), a subclass of timed automata in which clocks are associated with actions and that enjoys very good closure properties. We first study the problem of expressing characteristic formulae for ERA in Event-Recording Logic (ERL ), a logic introduced by Sorea to express event-based timed specifications. We prove that the construction proposed by Sorea for ERA without invariants is incorrect. More generally, we prove that timed bisimilarity cannot in general be expressed in ERL for the class of ERA , and study under which conditions on ERA it can be. Then, we introduce the logic WT μ  , a new logic for event-based timed specifications closer to the timed logic ℒ ν  that was introduced by Laroussinie, Larsen and Weise. We prove that it is strictly more expressive than ERL , and that its model-checking problem against ERA is EXPTIME -complete. Finally, we provide characteristic formulae constructions in WT μ  for characterizing the general class of ERA up to timed (bi)similarity and study the complexity issues.