AT521931A1 - Procedure for comparing two models that describe concurrent systems - Google Patents

Abstract

Method for comparing two models (M; M1, M2) that describe concurrent systems, a) each of the models (M; M1, M2) being described by a number of variables (V) and actions (A), b ) whereby for at least parts of the two models to be compared (M; M1, M2) an event structure (ES; ES1, ES2) comprising a number of events (E) is defined, c) where event structures (ES; ES1, ES2) iteratively be built up by carrying out at least parts of the two models (M; M1, M1) starting with the initial event (EI) and the initial state (I) permissible actions (A), d) being a first event structure (ES1) of a first Model (M1) with a second event structure (ES2) of a second model (M2) is compared to determine whether the first set of possible sequences of actions (A) described by the first event structure (ES1) in the second set of possible sequences caused by the second event structure r (ES2) is described, and e) the result of the comparison of the two models (M1, M2) is regarded as positive if, for each partial event structure (TE1), the first event structure (ES1) of the first model (M1) a compatible partial event structure (TE2) of the second event structure (ES2) of the second model (M2) is found.

Description

For example, machines or complex industrial systems such as signal boxes, which are accordingly from z. B. Inputs that are transmitted to the respective machine or system can generate various outputs, for example on B. to check their functional state, models of the systems are often created and with a model of the system in z. B. compared a target state. Methods for comparing two models are known from the prior art, in which paths are explicitly extracted from the individual models and compared with one another. Furthermore, methods for comparing two models are known, in which the Cartesian product is formed from the models to be examined, it being necessary to specify the condition of each model precisely. A disadvantage of the known procedures, however, is that they are computationally expensive since a large number of paths have to be searched in order to ensure that identical paths are actually determined.

In addition, the equality of the structure, i.e. Events and relations, two event structures are compared, for example by finding an embedding of one structure in the other (see e.g. Winskel, Glynn. "An introduction to event structures." Workshop / School / Symposium of the REX Project (Research and Education in Concurrent Systems). Springer, Berlin, Heidelberg, 1988). The disadvantage of this method is that event structures that depict the same sequence of actions using different structures are not recognized as the same.

The object of the invention is therefore to provide a method with which models which contain non-deterministic and concurrent decisions can be made quickly and

can be reliably compared.

The invention solves this problem in a method for comparing two models that describe concurrent systems with the features of claim 1. According to the invention, it is provided that a) each of the models is described by a number of variables and actions, - a finite number of possible values is assigned to each variable, whereby a set of states is defined, one state for each variable indicating the assignment of one of its possible variable values,

- where a new event is inserted and added to a set of existing events via a set of causality relations, if

- the events can occur together according to the existing conflict relation,

- there is no direct or indirect causality relation between two events in the set,

the action corresponding to the new event is permissible in the state which arises from the execution of all actions of the events of the set, including all those events preceding the causality relation, and

- either the amount of events consists only of the initial event, or each action conflicts with the action of the event to be inserted, depending on the amount of existing events,

- after inserting a new event, a new conflict relation is added to a previously inserted event,

- if the events are not in a direct or indirect

Stand causality relation and

if the actions of the two events conflict with each other, d) a first event structure of a first model being compared with a second event structure of a second model to determine whether the first set of possible sequences of actions is described by the first event structure is contained in the second set of possible sequences described by the second event structure, whereby the first event structure and the second FE event structure are each separated into conflict-free partial event structures for comparison of the first model with the second model, so that such a first one and result in a second set of conflict-free sub-event structures,

by recursively dividing each event structure at each conflict relation into two sub-event structures until there are conflict relations between no two events of a sub-event structure by

- Events that are directly or indirectly caused by one of the events involved in the respective conflict relation, only one of the

Is found,

becomes.

This approach enables two models that contain non-deterministic and concurrent decisions to be compared efficiently. The method according to the invention also enables a particularly compact and thus memory-saving representation of the possible sequences of actions of the systems to be compared by creating event structures and advantageously saves time compared to known methods for comparing models for e.g. physical systems, so that faster statements about the functional status or possible malfunctions in complex control systems are possible. Explicitly using concurrency for certain types of models makes it much more efficient.

In order to compare test cases for checking systems for e.g. To be able to derive disturbances, it can be provided that in step d) test cases are created by comparing two models, the first model and the second model each being created by modifying the respective other model or by modifying a common predecessor model, the Types of actions of the models include at least inputs and outputs, wherein a test case is a sequence of inputs and outputs, in which at least one input and one output occurs in the sequence and optionally a list of alternative outputs for each input / output of the sequence, which are permissible at this point, but do not correspond to the test case, can be specified, - whereby when comparing the models according to step d) it is found that - there are differences in the sequences of inputs and outputs, in which case a partial event structure of the event structure of the first model exists, the sequences of inputs and outputs be writes that are not permitted due to the event structure of the second model, - a test case is created on the basis of the partial event structure of the first model, which contains invalid sequences of inputs and outputs, in order to test the occurrence of such illegal sequences, and / or a test case is created on the basis of a partial event structure of the event structure of the second model, in order to avoid incorrect sequences

to test,

For example, in order to check the correct functioning of a system with the help of test cases, it can be provided that when a test case is executed in a system to be tested, the inputs are fed to the system and observed outputs are compared with the test case, with a test case being correct is considered to be executed if the sequence of inputs is observed in the correct sequence of the input - the test case is considered to be non-conclusive if the sequence of inputs is correctly followed by an output which is observed by the sequence deviates, but is present in the optional list of alternative editions - the test case is considered to have failed if an output that deviates from the sequence is observed with the correct sequence of the inputs and not in the optional list of alternative editions Spending exists.

This procedure advantageously enables e.g. Checking whether the input to a system is subject to the outputs expected according to a given test case, so that the correct functioning of the system can be checked in this way. Such a test can be carried out, for example, on a control system or also on a physical system, whereby it is observed how the system reacts, i.e. which outputs are made on the input of the sequence of the test cases executed.

7763

Test cases can be provided for test cases to be created by

- targeted insertion of errors in a model, in particular mutation of the model, and / or

- further development of a model and / or

- Independent development of a model in several ways and / or

- Different levels of abstraction of a model.

A simple modeling of intermediate steps that are carried out by a system without this leading to an externally visible change in the behavior of the system can be achieved if

- the types of actions of the models, in addition to inputs and outputs, include internal actions,

- where internal actions indicate actions that bring the system into a new state without being recognizable and / or controllable from outside the system, and

- Whereby when building event structures, no events are created for internal actions, in particular their effects flow into all events following an internal action, which correspond to inputs and outputs.

In this way, systems of this type can be represented simply and compactly as models, the model creation at the same time being easy to carry out.

A further acceleration of the comparison of two models can be achieved if the comparison of the first event structure of the first model with the second event structure of the second model is terminated after step d) after a predetermined number of events.

A further acceleration of the comparison of two models can be achieved by a targeted selection of the model parts to be compared if - when building event structures according to step b), a model to be compared, in particular both models to be compared, is partially converted into an event structure, whereby partial event structures are built which, starting from a given state, correspond to partial versions of the model at

necessary to receive further editions of the model, and - and these event structures represent parts of a first model, and parts of a second model, in particular parts of a modification of the first model or a model created by modification of a common predecessor model, which represent the respective partial event structures , starting from a common state,

- whereby only the subset of all sequences of actions according to differences

examined, which are contained in the event structures.

An efficient selection of model parts to be compared can be ensured if the selection of the subsets of sequences to be examined is made by inputs

- heuristics and / or

- random selection and / or

- complete selection.

An increased efficiency of the comparison of two models can be achieved by using a static analysis of accesses to variables when building event structures according to step c), whereby two actions are assumed to be conflicting if the one action uses a variable that the other action assigns a value, or both actions assign a value to the same variable, and - whereby information about access to variables of an action is used to limit the amount of other actions, the admissibility of which may have changed after the execution of the action, whereby the permissibility of a first action can only change when a second action is carried out if the condition for permissibility of the first action contains a variable that is changed by the second action, - in particular a variable being changed only by an action can, if the execution of the action of the variable a We rt assigns, - whereby when building event structures after the insertion of an event corresponding to an action, only the restricted amount of actions, the admissibility of which may have changed, and all events that conflict with the inserted event are checked whether a new event with such an action is inserted.

an object encapsulation of the model under consideration is used to create multiple instances of the same common object type,

- A distinction is made between the same variables of different instances of the same object type for the analysis of accesses to variables by dynamically carrying the instance of a variable with the respective object type at the time of execution

becomes.

A simple model building for physical systems can be achieved, though

- the states of each model are indicated by measurements of state variables of the system represented by the model and

- The execution of the actions of each model causes the change of an actuator of the respective system.

In order to check whether test cases are carried out correctly in a physical system and, for example, the correct outputs observed on a reference system are carried out on predefined inputs, it can be provided that a system created on the basis of a reference model is examined by:

- another model is generated by mutating the reference model,

that test cases according to the invention are created by comparing the further model with the reference model,

- The system is tested according to the invention on the basis of the test cases thus generated, it being provided in particular that

when executing a test case in the system to be tested, the inputs are fed to the system by applying physical variables to the system's sensors for which they are sensitive,

- determining the expenditure of the system by checking whether an actuator is performing an action, and

- observed inputs and outputs are compared with the respective test case.

Turnouts, for example, despite correct entries in the implementation of the respective

Test cases the actual expenditure from the expected expenditure, this is an indication that the examined physical system, e.g. the tested

Control electronics, has errors that must be remedied to ensure trouble-free and accident-free control of the controlled system or machine.

A derivation of a reliable reference model can be guaranteed if the reference model is learned from the observation of a physical reference system

becomes.

Further advantages and refinements of the invention result from the description and the accompanying drawings.

The invention is shown schematically in the following with the aid of particularly advantageous, but not restrictive, exemplary embodiments in the drawings and is described by way of example with reference to the drawings.

The following shows schematically:

1 shows the initial state of a first model,

FIGS. 2 to 13 show the structure of an event structure for the first model.

14a the event structure of a first model,

14b shows the event structure of a second model

15, FIG. 16 the partial event structures of the first model from FIG. 14 a,

17 to 22 show the partial event structures of the second model from FIG. 14b,

23 to FIG. 28 the comparison of the event structures of the first and the second model from FIGS. 14a and 14b,

29 to 38 the comparison of two event structures with revisions of assignments,

39 shows an example of an event structure with internal actions,

40 to 42 the reduction of the event structure from FIG. 39 by the internal actions,

43 shows an example of an event structure with internal actions and conflict relations,

44, 45 the resolution of conflict relations in the event structure from FIG. 43, FIGS. 46 to 48 show an example of the partial structure of event structures,

49 to 54 show an example of a static analysis for the construction of event structures,

55 an example of an object-specific static analysis for the construction of event structures,

Fig. 56, Fig. 57 Example of creating test cases by mutating a model.

In the following, a method according to the invention for comparing two models is described by way of example using a model M created for an intersection.

Model M

In the exemplary embodiment shown, a railway crossing and the associated safety elements are modeled. In the example, the model M of the railroad crossing contains a barrier as a safety element, and a warning light for arriving cars, as well as a stop signal that allows incoming trains to pass only when the barrier is down and the warning light is on.

In addition, the situation is modeled that there is rubble on the track. In this case, the train cannot pass through.

To compare two models M, each of the models M is described according to the invention by a number of variables V and a number of actions A. Each variable V is assigned a number of possible values W, which results in a set of states in which each variable V has exactly one of these possible values W. Furthermore, each variable V has exactly one initial state |.

Each model M describes the execution of, possibly infinite, sequences of its actions A, there being a current state at any time during the execution of the model M. At the beginning, this is the initial state |, which is changed by actions A following this. Each action A is described by a number of conditions of variable values W corresponding to the current state of the model M, which must be fulfilled in order to perform an action A in the current state, and which are provided by propositional-logical links (e.g. conjunction, disjunction, ( Bi-) implication, negation), as well as a number of effects which indicate how an action A carried out in each case changes the variable values W of the state. The effects can also be empty, which can be used for actions A, the execution of which only signals the fulfillment of a condition.

In the exemplary embodiment shown, the model M created for the railroad crossing comprises the following variables V:

Table 1: Variables V of the model M Variable V Possible variable values W | Initial value I

Position of the train Pos Fern / Nah / Fern On the crossing (cross)

Light signal L True / False False Barrier position S Angle from 0 to 90 degrees 90

Stop signal for train stop True / False True Rubble at the intersection G True / False False

Table A describes the actions A of the model M of the railroad crossing. In the exemplary embodiment shown, an action A in each case comprises at least one condition and an effect which occurs when the condition is fulfilled and the action is carried out. For the sake of simplicity, the conditions and effects are given in a pseudocode, which, however, is not intended to imply any particular programming language. For example, the condition of action LAn is "Pos == Near", meaning that the train is just before the intersection, and the effect is L: = True, meaning that the variable light signal L has the value

"True" is assigned.

Table 2: Actions of model M

Action A | Action type | Description Condition Effect

Znear input The train is approaching | Pos == Fern Pos: = Near intersection

ZCross entry The train travels via | Pos == Nah && Pos: = cross

Intersection, provided that | Stop == False stop signal is off

ZFern input The train leaves the | Pos == Kreuz Pos: = Fern

Crossing out

GCross entry rubble reaches the | G == False G: = True crossing

LAn Issue The warning light comes on, | Pos == Nah && L: = True as soon as a train | L == False is approaching

LAaus Issue The warning light goes out | Pos == Fern && L: = False as soon as the train | Stop == True && removed and that | L == True

Stop signal of the train is on

SOUTH EDITION The barrier closes | Pos == Close && S: = 0 as soon as a train | S == 90 is approaching

Above issue The barrier opens | Pos == Fern && S: = 90 as soon as the train | Stop == True && removed and that | S == 0

Stop signal of the train is on

Stop output The stop signal for the | Pos == Fern && Stop: = True train starts as soon as | Stop == False the train is removed

Go output The stop signal for the | Pos == Close && Stop: = False train goes out as soon as | Stop == True && the train approaches that | S == 0 && barriers closed, | L == True && the warning light on and | G == False no scree on the

Crossing is

In the exemplary embodiment shown, actions A are inputs and outputs, although it is not mandatory in the method according to the invention to categorize action types in this way.

The model M of the railroad crossing describes the execution of the actions A listed in Table 2 in a sequence that can be continued as long as there is a permissible action A. Actions A initially change the predefined, initial state | of the model M (see table 2), in which the train is removed from the train crossing (Pos: Fern), the light signal L off (L: False), the barrier is open (S: 90) and the stop signal for the train is switched on ( Stop: True) and there is no rubble G on the tracks (G: False).

Following the initial state | It is only possible in the model M shown as action A (see table 2, FIG. 2 and FIG. 3) that the train is approaching the railroad barrier (ZNah), since only for this action all conditions are met, namely specifically that the Train is away from the barrier (Pos == Fern). For all other possible actions of the system, at least parts of the respective conditions are not met. As a further action following the initial state | would also be possible that

Scree (GKreuz) arrives at the crossing, but this will only be explained at a later point in time.

After the further actions LAn, that is, the approach of the train to the intersection, SO down, that is to say the closing of the barrier, and Go, that is to say the switching off of the stop signal, the state of the model is, [Pos: Nah, L: True, S: 0, Stop: False, G: False], which means that the train is near the crossing, the light signal L on, the barrier closed and the stop signal for the train switched off and there is no rubble on the tracks (G: False).

The same state is reached when the barrier is closed when the train approaches the crossing and the light signal is then switched on, i.e. the sequence is carried out. After the sequence, the state of the model is identical to the initial state |, which is why the sequence can theoretically continue indefinitely. Event structures ES In order to be able to carry out a comparison of two models M quickly and with little computing effort, an event structure ES comprising a number of events E is defined for each of the models M in accordance with the invention. There is a unique initial event E1 that occurs first among all events E and indicates that no other event E has yet occurred. Each event E, which is different from the initial event E1, is uniquely identified by an action A and a set of previous events E. Causality relationships KaR are defined between a conditional event and a conditional event if the occurrence of the conditional event is necessary for the occurrence of the conditional event. In the following figures, such causal relationships KaR are shown as solid arrows, which indicate that in order for event E to occur at the end of the arrow, event E must have occurred at the beginning of the arrow. One or more causal relations KaR are possible for each event E. Conflict relations KoR are determined between two events E if the occurrence of one event E the future occurrence of the other event E

After the sequence, the state of the model is identical to the initial state |, which is why the sequence can theoretically continue indefinitely. Event structures ES In order to be able to carry out a comparison of two models M quickly and with little computing effort, an event structure ES comprising a number of events E is defined for each of the models M according to the invention. There is a unique initial event E1, which occurs first among all events E and indicates that no other event E has yet occurred. Each event E that is different from the initial event E1 is uniquely identified by an action A and a set of previous events E. Causality relationships KaR are defined between a conditional event and a conditional event if the occurrence of the conditional event is necessary for the occurrence of the conditional event. In the following figures, such causal relationships KaR are shown as solid arrows, which indicate that for event E to occur at the end of the arrow, event E must have occurred at the beginning of the arrow. One or more causal relations KaR are possible for each event E. Conflict relations KoR are determined between two events E if the occurrence of one event E the future occurrence of the other event E

Event structures ES

In order to be able to carry out a comparison of two models M quickly and with little computing effort, an event structure ES comprising a number of events E is defined for each of the models M according to the invention. There is a unique initial event E1 that occurs first among all events E and indicates that no other event E has yet occurred. Each event E, which is different from the initial event E1, is uniquely identified by an action A and a set of previous events E.

Causality relationships KaR are defined between a conditional event and a conditional event if the occurrence of the conditional event is necessary for the occurrence of the conditional event. In the following figures, such causal relationships KaR are shown as solid arrows, which indicate that in order for event E to occur at the end of the arrow, event E must have occurred at the beginning of the arrow. One or more causal relations KaR are possible for each event E.

Conflict relations KoR are determined between two events E if the occurrence of one event E the future occurrence of the other event E

excludes. Such conflict relations KoR are shown in the figures as dashed lines, which indicate that if one of the two events E connected by such a line has occurred, the other may not occur. Such a conflict relation KoR is not aimed at.

A state can be assigned to each event E which arises by starting from the initial state | Actions corresponding to event E as well as events that directly or indirectly cause event E through causality relations KaR are carried out in any order, so that actions corresponding to conditional events are carried out before actions corresponding to the conditional events. This state is referred to as the state associated with the event.

Furthermore, a state can be assigned to a set of events between which there is no conflict relation KoR and which have no directly or indirectly related events, which arises from actions corresponding to all events of the set, as well as all events that an event of the set directly or indirectly due to causal relationships KaR, are carried out in any order so that actions corresponding to conditional events are carried out before actions corresponding to the conditional events. This state is referred to as the state associated with the set of events.

In the exemplary embodiment shown, event structures ES as shown in Table 3 are shown:

Table 3: Events E of the model M Concept Description

Event E Each event is given a unique number and is labeled with an action.

Initial event El No action is assigned to the initial event.

Causality relation KaR A causality relation is transformed from a conditional event (here the initial event) to a conditional event (here event 1) by means of an arrow.

Conflict relation KoR A conflict relation is shown with a dashed line between the events.

Structure of event structures ES

Event structures ES are built iteratively, starting from the initial event

El, and the initial state I, permissible actions A are carried out. Doing so

a new event E with causality relations KaR to a quantity

existing events E is added when

- the events (E) can occur together according to the existing conflict relation (KoR),

- there is no direct or indirect causality relation (KaR) between two events (E) of the set,

- the action corresponding to the new event is permissible in the state which arises from the execution of all actions corresponding to the events of the crowd, including all previous events according to the causality relation (KaR), and

- either the set of events (E) consists only of the initial event (El), or each action conflicts with the action of the event to be inserted, depending on the set of existing events.

Two actions are in conflict if, starting from any valid state of possible variable values, - both actions are permitted in this state and the actions generate different states if they are executed in a different order, or - both actions are permitted in this state and the Execution of one action makes the other action impossible, since after the execution of one action the state of the condition for the execution of the other action is no longer sufficient, or - exactly one of the two actions is permitted in this state and in the state after the execution of the permitted action the other action is allowed.

A necessary criterion for the existence of a conflict between actions A1 and A2 is that there is a variable V that is required to check the admissibility of action A1, or to determine the new variable values W after execution of action A1, and by Action A2 is changed, or vice versa, or that both actions A1 A2 assign a value to the variable V.

All actions in Table 2 conflict with each other because each action assigns a new value to a variable, so that in the successor state the variable values of the

The condition of the action is no longer sufficient. For the present example, this means that two identical actions cannot be carried out immediately one after the other.

There is a conflict relation KoR between two successively inserted events E if these are not in a direct or indirect causality relation KaR and the execution of the actions assigned to the events conflict.

The structure of such an event structure ES is explained in more detail below with reference to FIGS. 1 to 13. When an event structure ES is constructed, it initially only consists of the initial event E1 (FIG. 1). In the exemplary embodiment shown, the event “ZNah” is possible after the initial event E1 (see conditions in Table 2), since all conditions for its occurrence are met and the event “ZNah” becomes initial with the number 1 and with a causality relation KaR Event El

inserted (Fig. 2).

The event "GKreuz" is also possible after the initial event El (see Table 2) and is inserted with the number 2 and a causality relation KaR for the initial event El. There is no overlap of the variables V, which are required to check the conditions of the two actions A, or which are changed by the two actions A, since the actions do not meet the above-mentioned necessary condition for the existence of a conflict relation. Therefore, no conflict relation KoR is inserted between events "1" and "2" (see Fig. 3).

The “ZNah” action enables the “LAn” actions, for which an event “3” and a causality relation KaR for the event with the number “1” are inserted (FIG. 4). The "ZNah" action also enables the "SUnten" actions, for which an event with the number "4" and a causal relationship KaR for event "1" are inserted. Similar to the actions "ZNah" and "GKreuz", actions "LAn" and "SUnten" have no overlap of the relevant variables V, which is why there is no conflict relation KoR between these events (Fig. 5).

The actions "SUnten" alone do not allow any further action, however events "3" and "4" enable the action "Go" (Fig. 6). An event for this action with the number "5" is inserted with causal relations KaR for both necessary events "3" and "4". There is also a conflict with event "5" for event "5" because this action changes the variable "G" to true, and thereby the

Action "Go" can no longer be carried out. For this reason, a conflict relation KoR is inserted between the corresponding events "2" and "5".

The "Go" action also enables the "ZKreuz" action, for which an event with the number "6" is inserted (Fig. 7). In addition, the "GKreuz" action is still permissible, which is why an event with the number "7" is also inserted for this action.

The action "ZKreuz" enables the action "ZFern" (Fig. 8), which in turn the actions "Stop", as well as the action "ZNah" (Fig. 9). The corresponding events are in conflict because "ZNah" sets the variable "Pos" to "Close" and thus makes the "Stop" action impossible. Therefore, a conflict relation KoR between the events with the

Numbers "9" and "10" introduced.

The "ZNah" action in turn enables the "ZKreuz" action after the stop signal for the train in this event is still switched off (Fig. 10). Event "10" is the same state and the same action as event "6" assigned. Accordingly, the event structure ES could be extended indefinitely at this point. The "Stop" action enables "LAus" and "SOben" actions, which, like "LAn" and "SUnten", have no conflict or are not connected by a KoR conflict relation. In addition, the "ZNah" campaign is still permitted. This action conflicts with both "LAus" and "SOben" because it changes the variable "Pos" to "Nah" and thus makes it impossible for the other two to execute (Fig. 11).

The "ZNah" action is still permissible after the "LAus" and "SOben" actions. The action is permissible both after the execution of one of the two and after the execution of both actions. Three events are added for the "ZNah" action, which have corresponding causal relationships KaR to one or both of the events "12" and "13". "ZNah" conflicts with "LAus" and "SOben" because it changes the variable "Pos" so that the two actions are no longer permitted. Therefore there is a conflict between "15" and "13" and between "17" and "12". Event "16" has no conflict, since it is causally dependent on "12" and "13" and therefore there is no conflict relation to these events by definition. In addition, the “Go” action is permitted in event “14” and a corresponding event is added (FIG. 12).

According to their history of actions performed, events "14" enable

"15" and "16" the actions "LAn", "Go" and "SUnten", whereby after the events for "LAn" and "SUnten" action "Go" is permitted.

The states assigned to events "18", "23", "24" and "25" are identical to the state assigned to event "5", which is why these events can be extended in an identical manner and for any length. In addition, all of these events conflict with event "/" (Fig. 13).

Comparison of event structures ES

The aim of the method according to the invention is, inter alia, to be able to use the at least partial conversion of two models M1 and M2 to be compared into event structures ES1 and ES2 to determine quickly with little computation whether the amount of possible sequences of actions A caused by the one event structure ES1 is described, is contained in the set of possible sequences described by the other event structure ES2.

By carrying out the comparison in both directions, it can additionally be determined whether the set of possible sequences of actions of the two event structures is identical.

For this purpose, the event structures ES1, ES2 of the two models M1, M2 to be compared are first separated into conflict-free partial event structures TE. A first and a second set of conflict-free partial event structures TE thus result for the two models M1, M2 to be compared.

The event structures ES are separated into partial event structures TE by recursively dividing them into two partial event structures TE for each conflict relation KoR. For this purpose, events E that are directly or indirectly caused by one of the events E involved in the conflict relation KoR are each assigned to the one partial event structure TE and all other events E that are not involved in the conflict relation KoR are assigned to both partial event structures TE.

For each sub-event structure TE of the first set, a sub-event structure TE of the second set is then sought, the actions A of which are compatible according to the causality relations KaR and events E of the first set. Compatible in this context means that an unequivocal assignment of events E of the partial event structure TE1 of the first model M1 to a partial event structure TE2 of the second model M2 is found, so that the pairs of events assigned to one another each have the same assigned actions.

Furthermore, by adding all causality relations KaR of the partial event structure TE2 of the second model M2 to the partial event structure TE1 of the first model M1, the pairs of corresponding ones of

Events E of the partial event structure TE1 of the first model M1 do not result in any cycles in the causality of the partial event structure TE1.

Such an assignment can be made by a search method that visits each event once, such as depth or breadth search (see Tarjan, Robert. "Depth-first search and linear graph algorithms." SIAM journal on computing 1.2 (1972): 146-160 }, on the partial event structure TE1 of the first model M1 with added causality relations KaR of the partial event structure TE2 of the second model M2, definition of assignments of individual events E. When visiting an event, the search method assigns an assignment to an event of the other event structure with the same action, which As soon as each event has been visited and is thus assigned, causality relations KaR of the part event structure TE2 can be clearly added to the part event structure TE1. The new part event structure thus created from part event structure TE1 by adding causality relations is based on cycles in the common Causalite relations examined. The search for cycles can be carried out with depth search, in which it is only necessary to check during the search whether a visited event is already contained in the active path of the search. Associations between events where there are several valid options are saved and revised when a cycle is found.

Furthermore, in the event that a causality relation KaR is added, where there was no direct or indirect causality relation KaR, the partial event structures TE1, TE2 are only considered compatible, even if for a new partial event structure TE, which is created by adding an additional causality relation KaR in the opposite direction as the added causality relation KaR arises, a compatible partial event structure can be found in the set of partial event structures of the second model M2.

The result of the comparison is then viewed positively, i.e. All sequences of actions of the event structure ES1 are also preserved in the set of sequences of event structure ES2 if a compatible partial event structure TE2 of the second model M2 or of the other event structure is found for each partial event structure TE1 of the first model M1 or the one event structure.

The comparison of two event structures is explained in more detail below with reference to FIGS. 14a to 38. For a better overview, only a part of the event structure of the previous example is compared with a similar structure.

Event structure E1 in FIG. 14b describes a model in which the actions “LAn” and “SUnten” must not happen at the same time, which means that the signal light is always switched on first and then the barrier is closed, or vice versa. 14a describes the model in which these actions are independent of one another

as it was introduced above.

To compare the two models M1, M2 or the two event structures E1, E2 of models M1, M2, the event structures E1, E2 must first be divided into conflict-free partial event structures TE, as described above. This is explained in more detail using the two event structures E1, E2 in FIGS. 14a and 14b.

14a, there is only one conflict or a conflict relation KoR in the first event structure E1 between the events with the numbers “2” and “5”. These events do not result in further events. For this reason, dividing the first event structure E1 creates two sub-event structures TE1a, TE1b, to which only one of the two events “2” and “5” is assigned, as shown in FIGS. 15 and 16.

The second event structure E2 in FIG. 14b has three conflict relations KoR, between the events “8” and “9”, “7” and “12”, and “7” and “13”. As described above, the conflict relations KoR are divided until the resulting partial event structures TE are conflict-free.

For this purpose, the conflict relation KoR between events "8" and "9" is resolved, which respectively causes events "10" and "12", as well as "11" and "13". This initially results in two sub-event structures TE2a, TE2b (FIGS. 17 and 18) for the second event structure E2, in which the conditional events “10” and “12”, and “11” and “13” are only one of the corresponding sub-event structures of the conditional

Event. However, both event structures TE2a, TE2b contain further conflict relations KoR,

which is why they are shared further. First of all, the conflict relation KoR between the events "/" and "12" is separated in the partial event structure TE2a, which results in two

result in further partial event structures TE2a ', TE2a ”(FIGS. 19 and 20), in which the conditional events“ / ”and“ 12 ”are each assigned to only one of the corresponding partial event structures TE. The same procedure is used for the partial event structure TE2b, which has a conflict relation KoR between the events “7” and “13”, which results in two further partial event structures TE2b ', TE2b ”(FIGS. 21 and 22) of the second event structure E2.

The set of partial event structures TE1a, TE1b of the first event structure E1 is then compared with the set of partial event structures TE2a ', TE2a ”, TE2b', TE2b" of the second event structure E2. This comparison can be used to determine whether the set of sequences from Actions of the first event structure E1 is contained in the set of sequences of actions of the second event structure E2.

For each partial event structure TE1a, TE1b of the first event structure E1, a compatible partial event structure TE2a ', TE2a ", TE2b', TE2b" of the second event structure E2 is sought. For this purpose, for example, the partial event structures TE1a of the first event structure E1 (FIG. 15) and TE2a 19 of the second event structure E2 (FIG. 19) The order in which the partial event structures are compared is arbitrary.

On the partial event structure TE1a of the first event structure E1, a depth search with the causality relations KoR of suitable events, i.e. Events E, which go hand in hand with the same actions A, of the partial event structure TE2a 'of the second event structure E2. Suitable events E of the two sub-event structures TE1a, TE2a 'are assigned to one another. If several events E are suitable, one of them is first selected and the decision for possible later revision is secured. The sequence of decisions made is noted more precisely. As soon as there is a cycle in the causality relations, the last decision made is changed, whereby already tried decisions are no longer made. If there is no other decision option, the last decision made before it will be revised, if one exists. If there is no decision to be revised and no assignment could be found, the comparison fails.

If a cycle arises in the common causalities or causal relations KaR during the search, the decisions made in the assignment must be revised. If no decisions have alternatives, the comparison of the partial event structures TE is negative. Can every event of one

If the partial event structure with the common causalities or causality relations KaR of the other partial event structure is achieved without a cycle in the causalities, the comparison is positive.

Causality relationships KaR, which also exist in the partial event structure TE2a 'of the second event structure E2, that is to say can be imported from the partial event structure TE2a', are marked with dots in the figures. Starting from the initial event E1, in the partial event structure TE1a it is first possible to arrive at event “1” via a causality relation KaR, which exists in the partial event structure TE2a ′ between the initial event and the event “6”. Event "6" is assigned to event "1" (Fig. 23).

From event “1” in the partial event structure TE1a of the first event structure E1, an imported or adopted causality relation KaR can be used to get from the partial event structure TE2a ′ of the second event structure E2 to event “3”, which occurs in the partial event structure TE2a 'of the second event structure E2 the events "6" and "8". In this way, event “8” is assigned to event “3” (FIG. 24).

From event "3" in the partial event structure TE1a of the first event structure E1 to event "4" can be reached by means of the imported causality relation KaR, which exists in the partial event structure TE2a ’of the second event structure E2 between events" 8 "and" 10 ". The event “4” of the partial event structure TE1a is thus assigned the event “10” of the partial event structure TE2a '(FIG. 25).

From event "4" in the partial event structure TE1a to event "5" can be reached by means of the imported causality relation KaR, which exists in the partial event structure TE2a 'of the second event structure E2 between events "10" and "12". The event “5” of the partial event structure TE1a is thus assigned the event “12” of the partial event structure TE2a ’(FIG. 26).

In this way, all events of the sub-event structures TE1a, TE2a 'can be assigned to each other with the respective causality relationships KaR. The comparison of the partial event structures TE1a of the first event structure E1 and TE2a 'of the second event structure E2 is therefore positive.

The causality relation KaR between event "3" and event "4" imported into the part event structure TE1a of the first event structure E1 from the part event structure TE2a 'of the second event structure E2 does not, however, directly or indirectly connect these events in the part event structure TE1a by means of causality relations, which also in the first event structure E1 exist. This is a case in which a causality relation KaR is added, where previously there was no direct or indirect causality relation KaR in the partial event structure TE1a of the first event structure E1.

As described above, the partial event structures TE1a, TE2a 'are only considered compatible, even if for a new partial event structure TE1a *, which is added by adding an additional causality relation KaR in the partial event structure TE1a in the opposite direction (FIG. 27) as the newly added one or from the causality relation KaR imported from the part event structure TE2a ', a compatible part event structure can be found in the set of part event structures of the second event structure E2.

Therefore, a compatible part event structure is also sought for the new part event structure TE1a * (FIG. 28). The partial event structure TE2b '(FIG. 21) of the second event structure E2 is compatible with this new partial event structure TE1a * of the first event structure E1, the imported causality relations KaR again being shown in FIG. 28.

The partial event structures TE1b of the first event structure E1 and TE2a 'of the second event structure E2 are not compatible, since no assignment for the event “2” can be found (see FIGS. 16 and 19). Therefore, the search for a compatible part event structure for TE1b continues.

The comparison is positive if there is a compatible one for each partial event structure of the event structure E1, as well as for each partial event structure created in the course of the comparison by adding reverse imported causality relationships

Part event structures of the event structure E2 can be found.

The comparison is negative if a compatible partial event structure cannot be found in the set of partial event structures of the event structure E2 for a partial event structure of the event structure E1, or for a partial event structure resulting from the comparison by adding reverse imported causality relationships. In this case the comparison can be stopped immediately.

Comparison of event structures ES - revision of assignments

The above-described embodiment of a comparison of two event structures E1, E2 is expanded in the following, so that the light signal L lights up twice before the train is released to cross by means of the “Go” action.

For this purpose, a first event structure E1 (Fig. 29), in which the action "switching on the light signals" LAn and the action "closing the barrier" S may be carried out in any order. In the second event structure E2, one of the light signals L must be switched on after the barrier has been closed (FIG. 30).

For the sake of clarity, the causality relations KoR of the second event structures E2 are given unique names K1, K2, K3 in FIGS. 31 to 38 in order to clarify which causality relations KoR are imported into the event structure E1 when compared with the event structure E2.

The aim of the comparison of the two event structures E1, E2, as described above, is to investigate whether the set of sequences of actions A, described by the event structure E1, is contained in the corresponding set of sequences of actions A, event structure E2. It can be expected that this comparison will fail because event structure E2 does not allow the sequence <LAn, LAn, SUnten>, which is possible in event structure E1.

The first step of the comparison works because all causality relations K1, K2, K3 of the event structure E2 can be adopted or imported into the event structure E1 without any problems (FIG. 31). The imported causality relation K3, however, creates a causality between the events “2” and “3” in the event structure E1, which is not originally contained in the event structure 1. For this reason, a new event structure E1 *, created by reversing the imported causality relation K3, is created and also compared with the event structure 2 (FIG. 33). The causality relation KaR between the initial event E1 and event "3" does not need to be drawn in, since this transitive causality exists implicitly.

First in the event structure E1 * is the causality relation K1, which in the

Event structure E2 exists between the initial event and event "4", imported or inserted. There are two ways to do this: Either event "1" or event "2"

event "4" can be assigned. In the exemplary embodiment shown, event “1” is first selected (FIG. 34).

Next, the causality relation K2, which exists in the event structure E2 between the initial event E1 and event "5", is imported into the event structure E1 *, whereby only event "3" can be used as an assignment for event "5" (Fig. 35).

Finally, the causality relation K3, which exists in the event structure E2 between the events “5” and “6”, is adopted in the event structure E1 *. Since event "1" is already assigned, event "2" must be assigned to event "6" (Fig. 36). This results in a cycle between event "2" and event "3" in the event structure E1 * from original and imported causality relations. As described above, by adding all causality relations KaR of one sub-event structure or event structure E1 to the other sub-event structure or event structure E2 for the corresponding pairs of events E of the first sub-event structure, no cycles may result in the causality of the first sub-event structure .

The decision to assign event “1” of event structure E1 * to event “4” of event structure E2 is thus revised and event “4” is instead assigned event “2” of event structure E1 * (FIG. 37). When the assignment is revised, all assignments made afterwards and imported conflict relation KoR are also removed from E1 *. The new assignment leads to a positive result of the comparison.

In this case, however, a causality relation K3 was imported from the event structure E2, which creates a non-existent causality between the events "3" and "1" in the event structure E1 *. Therefore, as previously described, is a comparison for a new event structure E1 ** (Fig. 38) in which the causality between the

Events "3" and "1" in the opposite direction are to be carried out. In this case, however, the comparison of the event structures E1 **, E2 fails because the causality relation K3 imported from the event structure E2 always generates a cycle,

no matter between which events K1 and K2 are imported.

The resulting event structure E1 ** does not represent all sequences of actions that are possible in event structure 1, but not in event structure 2. In particular, these are both sequences, which initially have two light signals L and only then close the barrier.

Internal actions

Actions A can be internal actions in addition to inputs and outputs. Internal actions model actions A, which bring the system into a new state without being visible or controllable from outside the system. For example, internal actions can provide implementation details for modeling.

The comparison should be agnostic towards internal actions. That is, sequences of actions should be considered identical if the sequences of actions that arise when internal actions are deleted from the original sequences are identical

are.

To achieve this, event structures must be reduced before the comparison and events to which internal actions are assigned must be deleted. To preserve the semantics of the event structure, care must be taken when deleting events that causality and conflict relations of deleted events are correctly transferred to existing events.

The internal actions listed in Table 4 are introduced to expand the exemplary embodiment described above. In this version of the M model, the light signal and barrier must first carry out a self-test before the light comes on or the barrier closes. In this exemplary embodiment, it is not taken into account how the tests actually run, but only whether they are carried out

were.

Table 4: Internal actions of the model M Action A Action type Description | Condition Effect

LTest Intern Performs a | LTest == False LTest: = True self-test on light off.

STest Intern Runs a | STest == False STest: = True self-test at the barrier

out.

LAn Issue The warning light | Pos == Nah && | L: = On comes on as soon as | LTest == True a train is approaching and the self test of the light has been carried out

has been

Bottom edition The barrier | Pos == Close && | S: = 0 closes | STest == True as soon as a train approaches and the barrier self-test is carried out

has been

The expanded first part of the event structure E1 is shown in FIG. 39. Internal behavior or internal actions are not considered relevant for the comparison of models M. It is only of interest whether two models M1, M2 allow the same sequences of inputs and outputs. That is why internal actions are hidden. For this purpose, each event structure ES can be reduced to an event structure ES without internal actions by redirecting causality relations KaR or conflict relations KoR to conditional events E.

The embodiment shown is reduced in the following steps:

First, event "1" and all outgoing causal relations KaR are removed from event structure E1 and causal relation KaR between the initial one

Event El and event "1" are redirected to all conditional events, which in

In this case, event "5" is only (Fig. 40). Event "3" and all outgoing causality relations KaR are then removed from event structure E1 and the causality relation KaR between initial event E1 and event "3" is redirected to all conditional events, which in this case is merely

Event is "6" (Fig. 41).

Indirect causal relationships KaR need not be drawn. The resulting event structure E1 '(Fig. 42) is equivalent to the event structure E1, i.e. apart from the numbering of events, it is the same as the corresponding part of the event structure E1 of the original model.

In the same way, conflict relations KoR are redirected, which is demonstrated using the following example of an event structure E3 (FIG. 43). First, event "2" is removed from event structure E3, since this is an internal action, testing the light signal "and the causal relationships between events" 1 "and" 2 "are related to conditional events" 1 "and" 4 ”and conflict relations are redirected to conditional events“ 4 ”and“ 3 ”(Fig. 44).

Event "3", the testing of the barrier, is then removed from the event structure E3, since this is an internal action, the testing of the barrier "and the causality relationships between the events" 1 "and" 3 "are conditional Events "1" and "5" are redirected and conflict relations are redirected to conditional events "4" and "5" (Fig. 45).

As expected, the result of these reductions in the event structure E3 is equivalent to the corresponding event structure E3 'without internal actions.

Partial construction and comparison of models M

In the construction of an event structure ES described above, the event structure ES can theoretically continue indefinitely. Even if this were not the case, models M can become enormously large, which makes both the structure and the comparison of such event structures ES extremely computational and time-consuming and therefore practical

makes impossible.

In order to counter this problem, the structure and comparison of event structures ES is structured into small parts. An event structure ES is starting

from a predefined or selected state of the model M, built up until only events E can be added that have inputs as an action. The comparison also only takes place on the partial event structures TE, which correspond to a section of such a structure.

For this purpose, the model M1 to be compared is only partially converted into an event structure ES and compared with corresponding parts or event structures ES of the model M2 used for the comparison. Partial event structures are built up which, starting from a given state of the model, correspond to partial executions of the model, in which all possible outputs of the system have been made and the model requires input in order to

to produce further editions.

Parts of one version of the model to be compared are compared with parts of the model used for the comparison, which give the respective partial event structures with the same input, starting from a common one

Condition, conform.

In the example of a railway crossing given above, the structure is made up of the following parts: First, the events with the numbers “1” corresponding to the inputs “ZNah” and “2” corresponding to “GKreuz” are inserted for the initial event El, as shown in FIG. 3 is.

Entering "GKreuz" does not lead to any further events E. Entering "ZNah" induces the event structure shown in Fig. 46 in possible outputs. With this event structure, "ZKreuz" and "GKreuz" are possible entries that can be made following action 5 "Go". If “ZKreuz” is selected, the one shown in Fig. 47 is displayed

Event structure induced.

Again, "ZFern" and "GKreuz" are possible entries in this event structure, which can be made after action 6 "ZKreuz". The choice of "ZFern" induces the event structure shown in Fig. 48. There are 5 different histories for the “ZNah” campaign (Fig. 48), which differ in whether the barrier has opened in the meantime or the light has come on.

Depending on the planned search effort, search target and model size, individual, several or all of these histories and entries can be followed up and compared.

The selection of the histories and inputs can be carried out randomly, heuristically or comprehensively, as described in Fellner, Andreas, et al. "Model-based, mutation-driven test case generation via heuristic-guided branching search." Proceedings of the 15th ACM-IEEE International Conference on Formal Methods and Models for System Design. ACM, 2017.

Static analysis

In order to only have to check a limited number of events E when comparing event structures ES, or to ensure an efficient structure of event structures ES, a static analysis can optionally be used in a method according to the invention to determine which events E occur in a particular state of model M are possible and which actions are potentially in conflict.

In this context, static analysis refers to the extraction and use of information based on static elements of model M, for example the conditions, effects of actions, and the variables that they access. Specifically, the variable accesses of actions A are used to determine when building the event structure ES for which actions A possibly new events E have to be inserted and to determine between which events conflict relations have to be inserted. As an alternative, which would require more time and computation, it would be possible, for example, after inserting an event E, to check each event E available in the model M to determine whether an insertion following the event E inserted before it is permissible.

It is therefore easy to determine which actions are potentially in conflict. E.g. the actions "LAn" and "Go" conflict because "LAn" assigns a value to the variable "L" that "Go" uses. On the other hand, the actions "SUnten" and "LAus" are certainly not in conflict, since the only variable that both use is "Pos" and neither assign any value to it. The use of a conflict relation is a conservative approximation of the conflict relation as described above. Two actions, which according to static analysis do not conflict with each other, are certainly not in conflict in the above sense. However, there can be actions that conflict according to static analysis, but not in the above sense. However, the calculation of conflicts using static analysis is far less computationally expensive, since the results of different execution orders do not affect a potentially large amount

Conditions must be checked.

If an event is now inserted, conflict relations must be created with all other events if the actions that carry out these events have a conflict and the events are not (indirectly) in a causal relationship. Although this method potentially overestimates the number of conflicts and in some cases more events than necessary are inserted, it is still more efficient than an exact analysis of the actions, which requires a mathematical analysis instead of a syntactical analysis.

Static analysis uses information about accesses to variables V by an action A in question in order to limit the amount of other actions A whose admissibility may have changed after the action A in question has been carried out. The permissibility of an action can only change through the execution of another action if the condition for the admissibility of the action includes a variable V which is changed by the other action. A variable V can only be changed by an action A if there is a partial effect of the action that the

Assigns a new value to variable V.

This restriction is used in the construction of event structures ES, in that after the insertion of an event E corresponding to an action A, only for the restricted amount of actions, the admissibility of which may have changed, plus all events that conflict with the inserted event E, check whether a new event E with such an action A is to be inserted.

In the exemplary embodiment of a railroad crossing shown, part of the structure of the event structure ES is repeated in order to clarify the advantageous use of a static analysis and to illustrate the actions A is checked for, for example, whether new events E are added, these events E having a “? "-

Numbering can be symbolized.

In the initial state | (Fig. 1) all possible actions A of the model M are to be checked first. In the exemplary embodiment shown, the event with the number “1” or “ZNah”, that is to say that a train is approaching the railway crossing, is first inserted, as can be seen in FIG. 2. "ZNah" changes the variable "Pos", which in

the condition for checking the admissibility of all actions A (except "GKreuz", see Table 2) is required.

Accordingly, it must be checked for all actions A whether they are permissible after event "1". It is not analyzed which value “Pos” has after the execution of “ZNah”, since in general the value of variables depends on which actions were carried out beforehand and an analysis that includes the entire history is computationally expensive, but only which variables V can be changed. So only nine instead of all ten possible actions (Fig. 49) need to be checked for their admissibility. The "GKreuz" action does not need to be checked, since the conditions of the variable Pos are not required to check its admissibility.

The examination of the admissibility shows that the actions "LAn" and "SUnten" are actually permitted. Events can therefore be added for these actions. First, however, the event with the number "2" is inserted for the "Cross" action (Fig. 50), since this event is permissible. This action changes the variable "G", which is only required to check the admissibility of the actions "Go" and "GKreuz", which are now checked for admissibility in the state corresponding to event "2". Both actions are not allowed, so no new event following event "2"

added.

An event for "LAn" with a causality relation KaR to event "1" is inserted (Fig. 51). This action changes variable "L", which is only used to check the admissibility of the actions "Go", "LAus" and "LAn". Accordingly, only this action needs to be checked for admissibility. However, the "Go" action is not allowed because the value of "S" is not 0. There is also no event independent of event "2" that could establish admissibility. Likewise, "LAn" and "LAus" are not permitted because their conditions are not met.

An event for "SUnten" with causality relation to event "1" is inserted (Fig. 52). This action changes variable "S", which is only used for checking the actions "Go", "SUnten" and "SOben". The "Go" action is not permitted after event "3" because the value of "L" is not "True". However, with event "4" there is an event that also potentially changes the admissibility of the action. Therefore, it must also be checked whether the events with the numbers "4" and "3" together the action "Go"

allow what is the case. The actions "SUnten" and "SOben" are not permitted at this point.

An event for "Go" with a causality relation to both conditional events and a conflict relation to event "2" is inserted (Fig. 53). The "Go" action changes the "Stop" variable, which is used to check the admissibility of the "SOben", "LAus", "Stop", "Go" and "ZKreuz" actions (Fig. 54). In addition to checking the admissibility of these five actions, the admissibility of the "GKreuz" action must also be checked, since there is an event corresponding to this action which conflicts with the event "4" (Fig. 53). Unlike the actions that may have changed their admissibility, actions that are in conflict do not need to change their admissibility to be allowed after the event. Only the order of execution makes a difference. Action "GKreuz" is permitted in event "4", which is why an event for the action will be inserted (see above).

Object-specific static analysis

When comparing models according to the invention, an object encapsulation can optionally be used for a more compact representation of the models, for example in Marcello M. Bonsangue, Joost N. Kok, and Kaisa Sere. 1998. An Approach to Object Orientation in Action Systems. In Mathematics of Program Construction, MPC'98, Marstrand, Sweden, June 15-17, 1998, Proceedings (MPC), Johan Jeuring (Ed.), Vol. 1422. Springer, 68-95 or http: /link.springer. de / link / service / series / 0558 / bibs / 1422 / 14220068.htm.

There are classes that describe which variables V each instance of this class has. For each class there are a lot of instances and there are variables that can be of the type of a class, that is, refer to instances of this class. In principle, different instances of the same class act independently. This independence

should be used by the built event structures.

However, for naive static analysis, variables of an object type and the variables of these instances are identical, which is why the associated actions are identified as conflicting. This fact is said to be due to a more detailed static

Analysis can be avoided and between variables referring to different instances

a distinction should be made.

This distinction between variables is made by carrying out the instances of variables with an object type, starting with the initial state of the comparison, and keeping any changes to these instances accurate through the effects of actions. The instance-specific variable breakdown is then used for conflict analysis, so that two variables with object type are only identified as ident,

if they refer to the same instance.

For illustrative purposes, the exemplary embodiment shown is expanded and the situation is modeled that there are several tracks. There is a class "track", with a variable "G", which indicates whether there is scree on the track. The class has two instances "Gleis1" and "Gleis2". New variables "AktGleis" of the type "Gleis" and "GIlSet", for example of the type Boolean, are added to the model M. The in Table 5

summarized actions are changed or added.

Table 5: Further actions A in model M

Action A | Action type | Description Condition Effect

GKreuz1 | Enter scree on track1 | TRUE Track1.G: = True

GKreuz2 | Enter rubble on platform 2 | TRUE Track2.G: = True

AktGI1 input The train moves on Track1 | GISet == False AktGleis: = Track 1 GlSet: = True

AktGI2 input The train moves on track2 | GISet == False AktGleis: = Gleis2 GlSet: = True

Go output The stop signal for the | Pos == Fern && Stop: = Off

Train goes out as soon as Stop == True && | GISet == False

the train is approaching

Barrier closed, S == 0 && warning light is on, the | L == True && active track set | aıset- True && was and is active

AktGleis.G == False track is not a scree '

When setting up the event structure ES, it must first be clarified which variable V requires the "Go" action to check the admissibility. Table 5 shows that "AktGleis.G" == False. "AktGleis" is, however, a variable of the type "Gleis". Depending on whether "AktGleis" is currently assigned to "Gleis1" or "Gleis2", either the variable "Gleis1.G" or "Gleis2.G" is accessed. This has a special effect on whether there is a conflict relation between events with the "Go" or "GKreuz1" and "GKreuz2" actions.

The event structure in FIG. 55 shows the result of an object-specific variable analysis. There are two events with the "Go" action, depending on which track has been activated. The events only conflict with the corresponding event "1" or "5". Event "8" can occur, for example, independently of event "5". The same analysis is also used, for example, to limit the number of possible permissible actions A.

Test cases T

Event structures ES created according to the invention or their comparison can or can advantageously also be used for test case generation. A test case T is to be understood as a sequence of inputs, outputs and expected outputs. When executing a test case T on a system to be tested, the inputs from the executing entity are to be fed to the system and the observations

Outputs are to be compared with test case T.

A test case T is considered to have been carried out correctly if, when the sequence of inputs is correct, the predetermined sequence of outputs is observed. A test case T is considered to be non-conclusive if, when the sequence of inputs is correctly followed, there is an output which is stored as a possible output but does not correspond to the predetermined sequence of inputs and outputs. A test case T fails if, if the sequence of inputs is correct, there is an output that is neither stored as the currently possible output nor corresponds to the predetermined sequence of inputs and outputs.

Test cases T result, for example, from the comparison of two versions of a model M, which can arise, among other things, from:

- targeted insertion of errors in model M or mutations, which will be discussed later, or

- Further development of the model M, or

- independent development of the model M in several ways, e.g. through different modeling approaches, from different people, through different translations

from different modeling languages etc., or

- different levels of abstraction of the model M.

In this way, two models M1 and M2 are created. The above-described conversion of the two models M1, M2 into event structures ES and their comparison either results in there being no differences in permitted sequences of inputs and outputs, in which case no test case T is generated, or that there are differences in permitted There are sequences of inputs and outputs, in which case there is a partial event structure of the event structure of one version of the model M or model M1, which describes sequences of inputs and outputs which, according to the event structure of the other version of the model M or of the Model M2 does not

are permitted.

The occurrence of such sequences can thus be tested by converting these sub-event structures to test cases T. Additionally or alternatively, the absence of incorrect sequences can be tested by converting a partial event structure of the event structure of the other version of model M or model M2 to test cases T, whereby this partial event structure is intended to enable sequences of actions A which are identical for a maximum of the prohibited sequences of actions A.

Conflict-free sub-event structures can be converted into test cases T by collecting sequences of actions corresponding to events that, according to the causality relations KaR, ranks conditional events before conditional events, and these with possible outputs that correspond to events that according to the causality relations KaR and / or Conflict relations KoR of the entire event structure ES can occur after the current event. These sequences can be completed into test cases by reading the amount of permitted, alternative outputs from the event structure for each output and adding them to the test case

become.

In general, interesting test cases T are considered in industrial practice to be those which distinguish one version of a model M from another version of the model M. As already stated, a test case T comprises a sequence of inputs and outputs, as well as possible outputs that are permitted by the model M, but are not provided by the test case T at this point in the sequence.

The following sequences are test cases T, the sequence consisting of pairs, the first part of which is the expected input or output and the second part of which is the list of permissible, alternative outputs.

T1: <ZNah / {}, LAn / {SUnten}, SUnten / {}, Go / {}> T2: <ZNah / {}, SUnten / {LAn}, LAn / {}, Go / {}>

T3: <ZNah / {}, LAn / {SUnten}, SUnten / {}, Go / {}, ZKreuz / {}, ZFern {}, Stop / {}, LAus / {SOben}, SOben / {}>

T4: <GKreuz / {}>

Sequences of elements or actions are indicated in angle brackets <>, whereby the actions are separated by slashes / and in the curly brackets {} respectively permissible, alternative editions are listed which may occur instead of the action. If the sequence contains several pairs, they are separated by commas.

If test case T1 is tested on a system, the entry "ZNah" must be made first. If the sequence of outputs <LAn, SUnten, Go> is observed in this order, the test is considered to have been carried out correctly. If “SUnten” is observed as the first issue, the test does not end conclusively. "South" is permitted at this point, but not provided, which is why no further statements can be made about the test procedure. Any other issue, or lack of any issue, will result in the test failing. Test case T2 rows the actions "LAn" and "SUnten" in the opposite direction to test case T1. Test case T3 is a test with multiple inputs. Test case T4 tests another first entry.

In the exemplary embodiment shown above, the comparison of the two event structures E1 (FIG. 29) and E2 (FIG. 30) yielded a negative result. In the event of a negative result of the comparison of event structures, it could be shown that event structure E1 has more sequences of inputs and outputs than event structure E2.

Such partial event structures TE, such as the partial event structure E1 **, which caused the comparison of two event structures E to fail, can be interpreted as test cases T. For this purpose, only the event structure ES is brought into a linear order and the possible alternative outputs, which come from the entire original event structure ES, are collected. Out of it

In this case, the following test case T5 results: T5: <LAn / {SUnten}, LAn / {SUnten}, SUnten / {}>

Test case T5 checks the occurrence of the additional sequence <LAn, LAn, SUnten>.

The model M2 from which the event structure E2 arises cannot successfully execute this test case T5, since at the latest after the first occurrence of “LAn” “SUnten” occurs. The sequence of inputs and outputs is taken from the event structure, the possible outputs relate to the original event structure, which is why, for example, "SUnten" is possible right from the start.

Event structure E2 (FIG. 30) can also be interpreted analogously as test case T. A possible test case is T6

T6: <LAn / {SUnten}, SUnten / {}, LAn / {}>

This test case T6 checks for the absence of the additional sequence <LAn, LAn, SUnten>. Executing test case T6 of the model that induces event structure E1 can cause this test to fail if, for example, it provides the sequence. Mutations As mentioned above, different versions of a model can be created by mutation. A mutation is a small, syntactic change in the model.

Mutations

As mentioned above, different versions of a model can be created by mutation. A mutation is a small, syntactic change in the model.

The specified mutation changes the "Go" action so that the action does not check whether the barrier is below. The mutant only sets a partial condition to "True".

Table 6: Mutation in model M

Action A | Action Type Description Condition Effect Go Output Mutated Version | Pos == Close && Stop: = False (Mutant) replaces "S == 0" Stop == True & 8 & with "True" True && L == False && G == False Go Edition Original Version | Pos == Close && Stop: = False (original) has "S == 0" as Stop == True && partial condition S == 0 && L == False && G == False

The part of the event structure relevant to the “Go” action changes as shown in FIG. 56, so that a mutated event structure EM of the original event structure E4 shown in FIG. 57 is created. The comparison of the event structures shows that the mutated event structure EM has more sequences of actions than the original event structure E4. In particular, the sequence <ZNah, LAn, Go, SUnten> is possible in the mutated event structure EM, but not in the original event structure E4.

A test case is created by transforming a conflict-free partial event structure of the original event structure into a sequence that corresponds as closely as possible to the sequences that are possible in the mutant but not possible in the original. In this example there is only one such partial event structure, which is the entire original event structure E4. The events E are brought into a linear sequence and the possible alternative outputs are collected from the entire event structure ES. The resulting test case T7 is:

T7: <ZNah / {}, LAn / {SUnten}, SUnten / {}, Go / {}>

Test case T7 checks for the absence of the sequence <ZNah, LAn, Go, SUnten>.

In this way, a system such as the control and regulation system of an intersection described above can be tested. The open-loop and closed-loop control system is designed to measure state variables of sensors of the system and to control actuators of the system.

In the exemplary embodiment shown, a model for the control and regulation system to be tested of an intersection described above is created for the test in the exemplary embodiment shown. The states of the model will be specified, for example, by measurements of state variables of the web crossing, which are determined by the control and regulation system, and the execution of actions A of the model will, for example, change an actuator of the system controlled by the control and regulation system.

The reference model can be learned based on the observation of a physical reference system, or made available in another way. For example, a control and regulation system for railroad gates can be used as the physical reference system, which has an error-free functioning.

For this purpose, a further model is generated, for example, by mutating the reference model d, and test cases T are created by combining the further model with the

Reference model is compared, as previously described.

A test adapter can be used, which is, for example, a control unit on which the test cases T are stored. This test adapter is connected, for example, to the control and regulation system of the railroad crossing to be tested and carries out the test cases T previously created in order to test the system on the basis of the test cases T thus generated, as described above.

This means that the inputs are transmitted from the test adapter to the control and regulation system in accordance with the test cases T and the outputs generated by the system to be tested are recorded in response to the inputs. Preferably, when a test case T is executed, the inputs are fed to the system by applying physical quantities to which the sensors of the system are sensitive, and the outputs of the system are preferably determined by

it is checked whether an actuator performs an action. The observed inputs and outputs are compared with the respective test case T, for example by the test adapter.

This comparison of the inputs and outputs with the test cases T provides information as to whether the outputs during the test execution differ from the expected outputs, which the reference system generates, for example. If this is the case, this indicates an error in the control and regulation system, which can be determined and eliminated by executing the test cases, and in this way malfunctions or accidents at the tested railway crossing can be prevented.

Claims (1)

1. Method for comparing two models (M; M1, M2) that describe concurrent systems, a) each of the models (M; M1, M2) being described by a number of variables (V) and actions (A), - each variable (V) is assigned a finite number of possible values (W), a quantity of states is specified, a state for each variable (V) indicating the assignment of one of its possible variable values (W), each model describes the execution of, in particular infinite, sequences of actions (A), an initial state (I) is determined, - Whereby there is a current state at every point in time of execution of each model (M; M1, M2), starting from the initial state (I) by executing actions (A) of the model (M; M1, M2) that are permitted in the current state ) is changed, - whereby each action (A) is described by - a condition that the variable values (W) in the current state of the respective model (M; M1, M2) must meet in order for the respective action (A) to be permissible in this state, and - a number of instructions that indicate how the action (A) changes the variable values (W) of the state, - two actions (A; A1, A2) are said to be in conflict if, based on any valid state of possible variable values, - both actions are permitted on this state and the actions produce different states if they are executed in a different order, or - in this state both actions are permissible and the execution of one action makes the other action impossible by, after executing the one action, the state of the condition for executing the other action is no longer sufficient, or - in this state exactly one of the two actions is permissible and in the state after executing the permissible action the other action is permissible is appropriate 44/63 - whereby a clear initial event (El) is defined, which among all Events (E) occurs first, - With each non-initial event (El) through an action (A) and a set of previous events are clearly identified, - whereby, for the occurrence of an event, the occurrence of all events of the set of past events is necessary, what a causality relation (KaR) between the conditional event and the previous conditional Events, - whereby each event is a direct or indirect (transitive) causality relation to the initial event (El), a conflict relation (KoR) between two events (E) is determined, if the occurrence of one event the future occurrence of the other Event, c) whereby event structures (ES; ES1, ES2) are constructed iteratively by carrying out permissible actions (A) for at least parts of the two models (M; M1, M1) starting from the initial event (El) and the initial state (I) , - whereby a new event is inserted and added via a set of causality relations (KaR) to a set of existing events (E) if - the events (E) can occur together in accordance with the existing conflict relation (KoR), - there is no direct or indirect causality relation (KaR) between two events (E) of the set, - the action is permitted in accordance with the new event in the state, which arises from the execution of all actions of the events of the set, including all events preceding these according to the causality relation (KaR), and - either the set of events (E) consists only of the initial event (El), or each action accordingly the amount of existing events conflicts with the action of the event to be inserted, - after inserting a new event (E) a new conflict relation (KoR) is added to a previously inserted event (E), Causality relation (KaR) stand and - If the actions of the two events conflict, d) a first event structure (ES1) of a first model (M1) is compared with a second event structure (ES2) of a second model (M2) to determine whether the first The set of possible sequences of actions (A) described by the first event structure (ES1) is contained in the second set of possible sequences described by the second event structure (ES2), - for comparison of the first model (M1 ) with the second model (M2) the first event structure (ES1) and the second event structure (ES2) are each separated into conflict-free partial event structures (TE1, TE2), so that a first and a second set of conflict-free partial event structures (TE1, TE2) surrender - in that each event structure (ES1, ES2) at each conflict relation (KoR) is recursively divided into two partial event structures (TE1, TE2) until there are no conflict relations (KoR) between two events (E) of a partial event structure (TE1; TE2), by doing - Events (E), which are directly or indirectly caused by one of the events involved in the respective conflict relation (KoR), are only assigned to one of the two sub-event structures (TE1, TE2) and all other events (E), except the other The event of the conflict relation (KoR) and the events directly or indirectly related to it according to the causality relation (KaR) are assigned to both partial event structures (TE1, TE2), - For each partial event structure (TE1) of the first set, a partial event structure (TE2) of the second set is sought, the causal relationships (KaR) and events (E) corresponding actions (A) are compatible, partial event structures (TE1, TE2) are then regarded as compatible, - If a clear assignment of events (E) of a first sub-event structure (TE1) to events (E) of a second sub-event structure (TE2) is found, so that pairs of mutually associated events (E) each have the same assigned actions (A), and - If, by adding all causality relations (KaR) of the second sub-event structure (TE2) to the first sub-event structure (TE1) for the pairs of events (E) corresponding to the assignment, the no partial cycles in the causality of the first partial event structure (TE1) result in the first partial event structure (TE1), whereby such an assignment is carried out by a depth search on the first partial event structure (TE1), with added causality relations (KaR) of the second partial event structure (TE2), definition of assignments of individual events (E), is found by - the assigned assignments are systematically revised until either no more cycles occur, or - the depth search is canceled because no cycle-free assignment is possible, in which case the differences in the event structures and of the models is determined, and - in the event that a causality relation (KaR) was added at a point where there was no direct or indirect causality relation (KaR), the partial event structures (TE1, TE2) are only considered compatible, albeit for a new partial event structure (TE1a *), which is an additional causality relation (KaR) in the opposite direction as the added causality relation (KaR) arises, a compatible partial event structure (TE2) is found in the second set of partial event structures, e) the result of the comparison of the two models (M1, M2) is regarded as positive if a compatible partial event structure (TE2) of the second event structure (ES2) of the second model (M2) is found for each partial event structure (TE1) of the first event structure (ES1) of the first model (M1). 2, Method according to claim 1, characterized in that in step d) test cases (T) are created by comparing two models (M1, M2), the first model (M1) and the second model (M2) in each case by modification of the other models or by modifying a common predecessor model, the types of actions (A) of the models (M1, M2) comprise at least inputs and outputs, - wherein a test case (T) is a sequence of inputs and outputs, at least one input and one output occurs in the sequence and for each input / output 3. The method according to claim 2, characterized in that when executing a test case (T) in a system to be tested, the inputs are fed to the system and observed outputs are compared with the test case (T), - wherein a test case (T) as is considered correctly executed if the expected sequence of outputs is observed with a correct sequence of the inputs, the test case (T) being regarded as non-conclusive if an output is observed with a correct sequence of the inputs, the - wherein the test case (T) is considered to have failed if, when the sequence of inputs is correctly followed, an output is observed that deviates from the sequence and not in the optional list of alternative outputs is available. 4. The method according to claim 2 or 3, characterized in that test cases (T) are created by, - targeted insertion of errors in a model (M; M1; M2), in particular mutation of the model (M; M1; M2), and / or - further development of a model (M; M1; M2) and / or - independent development of a model (M; M1; M2) in several ways and / or - different levels of abstraction of a model (M; M1; M2). 5. The method according to any one of the preceding claims, characterized in that - the types of actions (A) of the models (M; M1; M2), in addition to inputs and outputs, include internal actions, - whereby internal actions indicate actions (A) which bring the system into a new state without being recognizable and / or controllable from outside the system, and - When building event structures (ES; ES1; ES2), no events (E) are created for internal actions, in particular their effects flow into all events (E) following an internal action, which correspond to inputs and outputs. 6. The method according to any one of the preceding claims, characterized in that the comparison of the first event structure (ES1) of the first model (ES1) with the second event structure (ES2) of the second model (M2) according to step d) after a predetermined number of events (E) is canceled. 7. The method according to any one of the preceding claims, characterized in that - when building event structures (ES; ES1; ES2) according to step b) one model to be compared, in particular both models to be compared (M; M1; M2), partially into one Event structure (ES; ES1; ES2) is transferred, whereby partial event structures are built up which, starting from a predetermined state, partially implement the model (M; M1; M2) correspond, in which all possible outputs of the system have been made and an input is required in order to obtain further outputs of the model (M; M1; M2), and - and these event structures (ES; ES1; ES2) are parts of a first model (M1 ), and parts of a second model (M2), in particular parts of a modification of the first model (M1) or models created by modifying a common predecessor model, which correspond to the respective partial event structures, starting from a common state, - whereby only the Subset of all sequences of actions are examined for differences that are contained in the event structures (ES; ES1; ES2). 8. The method according to claim 7, characterized in that the selection of the subsets of sequences to be examined is made by inputs - heuristics and / or - random selection and / or - complete selection. 9. The method according to any one of the preceding claims, characterized in that when building event structures (ES; ES1; ES2) according to step c), a static analysis of accesses to variables (V) is used, - two actions being assumed to be conflicting if one action uses a variable to which the other action assigns a value, or both actions assign the same variable a value, and - whereby information on access to variables (V) of an action (A) is used to determine the amount restrict other actions, the admissibility of which may have changed after the execution of the action, - whereby the admissibility of a first action can only change through the execution of a second action if the condition for the admissibility of the first action contains a variable that is different from the second action is changed, - in particular a variable (V) can only be changed by an action if the execution assigns a value to the action of the variable (V), - when building event structures (ES; ES1; ES2) after the insertion of an event (E) corresponding to an action, only the restricted amount of actions (A), the admissibility of which may have changed, and all events (E) which conflict with the inserted event are checked whether a new event (E) with such an action (A) is inserted. an object encapsulation of the model in question (M; M1; M2) is used to create several instances of the same common object type, - A distinction is made between analyzing accesses to variables (V) between the same variables (V) of different instances of the same object type, by dynamically carrying the instance of a variable (V) with the respective object type at the time of execution. 11. The method according to any one of the preceding claims, characterized in that - the states of each model (M; M1, M2) are indicated by measurements of state variables of the system represented by the model (M; M1, M2) and - By performing the actions (A) of each model (M; M1, M2) the change of an actuator of the respective system is effected. 12. The method according to any one of the preceding claims, characterized in that a system created on the basis of a reference model is examined by - another model is generated by mutating the reference model, that test cases (T) are created by comparing the further model with the reference model, - The system is tested on the basis of the test cases (T) thus generated according to claim 3, it being provided in particular that when executing a test case (T) in the system to be tested, the inputs are fed to the system by applying physical variables to the system's sensors for which they are sensitive, - determining the expenditure of the system by checking whether an actuator is performing an action, and - observed inputs and outputs are compared with the respective test case (T). 13. The method according to claim 12, characterized in that the reference model is learned from the observation of a physical reference system.