AT521931B1 - Procedure for comparing two models that describe concurrent systems - Google Patents

Abstract

Method for comparing two models (M; M1, M2) that describe concurrent systems, a) each of the models (M; M1, M2) being described by a number of variables (V) and actions (A), b ) wherein an event structure (ES; ES1, ES2) comprising a number of events (E) is defined for at least parts of the two models (M; M1, M2) to be compared, c) wherein event structures (ES; ES1, ES2) iteratively be set up by at least for parts of the two models (M; M1, M1) starting from the initial event (EI) and the initial state (I) permissible actions (A) are executed, d) wherein a first event structure (ES1) of a first Model (M1) with a second event structure (ES2) of a second model (M2) is compared to determine whether the first set of possible sequences of actions (A) described by the first event structure (ES1) is in the second set of possible sequences caused by the second event structure r (ES2) is described, and e) the result of the comparison of the two models (M1, M2) being considered positive if for each partial event structure (TE1) of the first event structure (ES1) of the first model (M1) a compatible partial event structure (TE2) of the second event structure (ES2) of the second model (M2) is found.

Description

description

The invention relates to a method for comparing models or systems according to patent claim 1.

For example, machines or complex industrial systems such as interlockings corresponding to z. B. inputs that are transmitted to the respective machine or system can generate various outputs, e.g. B. to check their functional status, models of the systems are often created and with a model of the system in z. B. compared to a target state. Methods for comparing two models are known from the prior art, in which paths are explicitly extracted from the individual models and compared with one another. Furthermore, methods for comparing two models are known, in which the Cartesian product is formed from the models to be examined, it being necessary to specify the state of each model precisely. A disadvantage of the known procedures, however, is that they are computationally expensive, since a large number of paths have to be searched through in order to ensure that identical paths are actually determined.

In addition, the identity of the structure, ie events and relations, of two event structures can be compared, for example by finding an embedding of one structure in the other (see e.g. Winskel, Glynn. "An introduction to event structures." Workshop/School/Symposium of the REX Project (Research and Education in Concurrent Systems). Springer, Berlin, Heidelberg, 1988). The disadvantage of this method is that event structures that represent the same sequences of actions using different structures are not recognized as the same.

The object of the invention is therefore to provide a method with which models containing non-deterministic and concurrent decisions can be compared quickly and reliably.

The invention solves this problem with a method for comparing two models that describe concurrent systems, with the features of patent claim 1. According to the invention, it is provided that

a) each of the models is described by a number of variables and actions,

- where each variable is assigned a finite number of possible values,

- where a set of states is defined, where a state for each variable indicates the assignment of one of its possible variable values,

- where each model describes the execution of, especially infinite, sequences of actions,

- whereby an initial state is defined,

- where there is a current state at each point in time of the execution of each model, which, starting from the initial state, is changed by the execution of actions of the model that are permissible in the current state,

- where each action is described by

- a condition that the variable values in the current state of the respective model must satisfy in order for the respective action to be permissible in that state, and - a number of instructions that specify how the action changes the variable values of the state, - where two actions are defined as be said to be in conflict if, starting from any valid state of possible variable values, - at that state both actions are legal and the actions produce different states when executed in different order, or - at this state both actions are legal and execution one action makes the other action impossible because, after the execution of the one action, the state of the condition for the execution of the other action is no longer sufficient, or - in this state exactly one of the two actions is permissible and in the state after the execution of the permissible action the other action is allowed

b) an event structure comprising a number of events is defined for at least parts of the two models to be compared,

- where a unique initial event is set, which among all events is defined as

first occurs

- where each non-initial event is preceded by an action and a set of

n events is clearly marked,

- where, for the occurrence of an event, the occurrence of all events of the set

past events is necessary, which establishes a causal relationship between the conditional

contingent event and the preceding contingent events,

- where each event has a direct or indirect, especially transitive, causality rule

relation to the initial event,

- whereby a conflict relation between two events is established when the occurrence

of one event excludes the future occurrence of the other event,

c) where event structures are constructed iteratively, by carrying out permissible actions at least for parts of the two models, starting with the initial event and the initial state,

- where a new event is inserted and added to a set of existing events via a set of causality relations if

- the events can occur together according to the existing conflict relation,

- there is no direct or indirect causal relationship between any two events in the set,

- the action corresponding to the new event is permissible in the state resulting from the execution of all actions of the events of the set, including all events preceding these events according to the causality relation, and

- either the set of events consists only of the initial event, or each action corresponding to the set of existing events conflicts with the action of the event to be inserted,

- after inserting a new event, a new conflict relation is added to a previously inserted event,

- if the events are not in a direct or indirect causal relationship

and

- if, the actions of the two events conflict with each other, d) comparing a first event structure of a first model with a second event structure of a second model to determine whether the first set of possible sequences of actions described by the first event structure is contained in the second set of possible sequences, which is described by the second event structure, - the first event structure and the second event structure being separated into conflict-free partial event structures in order to compare the first model with the second model, so that a first and result in a second set of conflict-free partial event structures,

- By recursively dividing each event structure into two partial event structures at each conflict relation until there are no conflict relations between any two events of a partial event structure by

- Events that are directly or indirectly caused by one of the events involved in the respective conflict relation are only assigned to one of the two partial event structures and all other events, except for the other event in the conflict relation and the events directly or indirectly caused by it according to the causality relation , are assigned to both partial event structures,

- where for each partial event structure of the first set, a partial event structure of the second set is searched for, whose causality relations (KaR) and actions corresponding to events are compatible,

- whereby sub-event structures are then regarded as compatible,

- If a clear assignment of events of a first partial event structure to events of a second partial event structure is found, so that pairs of a

events assigned to each other each have the same assigned actions, and - if by adding all causality relations of the second partial event structure to the first partial event structure for the corresponding pairs of events of the first partial event structure according to the assignment, no cycles in the causality of the first partial event structure result, - wherein such Allocation through a depth-first search on the first partial event structure, with added causality relations of the second partial event structure, determination of assignments of individual events, is found by - the assignments made are systematically revised until either no more cycles occur, or - the depth-first search is terminated, since no cycle-free assignment is possible, in which case the difference in the event structures and the models is determined, and - in the event that a causality relation is added at one point was added, on which no direct or indirect causality relation previously existed, the sub-event structures are only considered compatible if, for a new sub-event structure resulting from the addition of an additional causality relation in the opposite direction to the added causality relation, a compatible sub-event structure in the second set of sub-event structures is found, e) the result of the comparison of the two models being considered positive if for each sub-event structure of the first event structure of the first model a compatible sub-event structure of the second event structure of the second model is found.

[0005] This procedure makes it possible to efficiently compare two models that contain non-deterministic and concurrent decisions. The method according to the invention also enables a particularly compact and thus memory-saving representation of the possible sequences of actions of the systems to be compared by creating event structures and advantageously saves time compared to known methods for comparing models for e.g. physical systems, so that statements about the Functional status or possible malfunctions in complex control systems are possible. Much more efficient by explicitly exploiting concurrency for certain types of models.

In order to be able to derive test cases for checking systems for faults, for example, by comparing two models or systems, it can be provided that in step d) test cases are created by comparing two models, the first model and the second model were each created by modifying the other model or by modifying a common predecessor model, - where the types of actions of the models include at least inputs and outputs, - where a test case is a sequence of inputs and outputs, in the sequence at least one input and an output occurs and for each input/output of the sequence, a list of alternative outputs that are permissible at this point but do not correspond to the test case can optionally be specified, - whereby when comparing the models according to step d) it is determined that - There are differences in the sequences of inputs and outputs, in which case a partial event structure of the event structure of the first model exists, which describes sequences of inputs and outputs that are not allowed because of the event structure of the second model, - whereby a test case is created because of the partial event structure of the first model, which contains sequences of inputs and outputs that are not allowed is used to test the occurrence of such impermissible sequences and/or a test case is created based on a partial event structure of the event structure of the second model in order to test the absence of incorrect sequences,

where the partial event structure is chosen in such a way that it enables sequences of actions that are identical to the impermissible sequences of actions for as long as possible, and - whereby test cases are created on the basis of conflict-free partial event structures by sequences of actions corresponding to events being collected, wherein according to the Events that cause causality relations are ranked before conditional events, and these are supplemented with possible alternative outputs that correspond to events that can occur after the current event according to the causality relations and/or conflict relations of the entire event structure, but are not part of the sequence or - if there are no differences in the sequences of inputs and outputs, no test case is created.

In order to check, for example, the correct functioning of a system using test cases, it can be provided that when a test case is executed in a system to be tested, the inputs are fed to the system and observed outputs are compared with the test case, - with a Test case is considered to have been correctly executed if, given the correct order of the sequence of inputs, the expected sequence of outputs is observed, - whereby the test case is considered to be inconclusively executed if, given the correct order of the sequence of inputs, an output is observed which out-of-sequence but is present in the optional list of alternative outputs, - where the test-case is considered failed if, with the sequence of inputs correctly sequenced, an out-of-sequence output is observed, and not in the optional List of alternative editions is available.

This procedure advantageously makes it possible, for example, to check whether the inputs made in a system produce the expected outputs according to a specified test case, so that the correct functioning of the system can be checked in this way. Such a test can be carried out, for example, on a control system or on a physical system, whereby it is observed how the system reacts, i.e. what outputs are made to the inputs of the sequence of executed test cases.

[0009] For a simple creation of two models to be compared for the determination of test

cases it can be provided that test cases are created by

- targeted use of errors in a model, in particular mutation of the model, and/or

- Further development of a model and/or

- independent development of a model in several ways and/or

- Different levels of abstraction of a model.

A simple modeling of intermediate steps that are executed by a system without these entailing an externally visible change in the behavior of the system can be achieved if

- the types of actions of the models, in addition to inputs and outputs, include internal actions,

- where internal actions specify actions that bring the system to a new state without being detectable and/or controllable from outside the system, and

- whereby when building event structures, no events are created for internal actions, in particular their effects in all events following an internal action, which include or Expenditures correspond to flow in.

[0011] In this way, such systems can be represented as models in a simple and compact manner, the model creation being easy to carry out at the same time.

A further acceleration of the comparison of two models can be achieved if the comparison of the first event structure of the first model with the second event structure of the second model according to step d) is terminated after a predetermined number of events

will.

A further acceleration of the comparison of two models by a targeted selection of the model parts to be compared can be achieved if - when building event structures according to step b), a model to be compared, in particular both models to be compared, is partially converted into an event structure, whereby partial event structures are built which, starting from a given state, correspond to partial executions of the model in which all possible outputs of the system have occurred and require an input to obtain further outputs of the model, and - and these event structures are parts of a first Model, and parts of a second model, in particular parts of a modification of the first model or model created by modification of a common predecessor model, which correspond to the respective partial event structures, starting from a common state, - only the subset of all sequences of actions are examined for differences contained in the event structures.

An efficient selection of model parts to be compared can be ensured if the selection of the subsets of input sequences to be examined is carried out by heuristics and/or

- random selection and/or

- complete selection.

An increased efficiency of the comparison of two models can be achieved by using a static analysis of accesses to variables in the construction of event structures according to step c), - where two actions are assumed to be in conflict if one action is a variable that assigns a value to the other action, or both actions assign a value to the same variable, and - where information about accesses to variables of an action is used to restrict the set of other actions whose permissibility has changed after the action has been executed can, - whereby the admissibility of a first action can only change through the execution of a second action if the condition for the admissibility of the first action contains a variable that is changed by the second action, - whereby in particular a variable can only be changed by a Action can be changed when executing the action of the variable e assigns a value, - whereby when building event structures, after inserting an event corresponding to an action, it is checked only for the so restricted set of actions, the permissibility of which may have changed, and all events that conflict with the inserted event, whether a new event with such an action is inserted.

For simplified modeling of, for example, object-oriented software systems, an object-specific static analysis of accesses to variables can be used when setting up event structures according to step c),

- where an object encapsulation of the model under consideration is used to create multiple instances of the same common object type,

- A distinction is made between the same variables of different instances of the same object type for the analysis of accesses to variables, in that the instance of a variable with the respective object type is carried along dynamically at the time of execution.

[0017] Ease of modeling physical systems can be achieved if

- the states of each model are indicated by measurements of state variables of the system represented by the model, and

- the execution of the actions of each model causes the change of an actuator of the respective system.

[0018] To verify that test cases are correctly executed on a physical system

and, for example, the correct outputs observed on a reference system follow given inputs, it can be provided that a system created on the basis of a reference model is examined by

- another model is generated by mutation of the reference model,

- that, according to the invention, test cases are created by comparing the further model with the reference model,

- The system is tested according to the invention using the test cases generated in this way, it being provided in particular that

- when executing a test case in the system to be tested, the inputs are supplied to the system by subjecting the system's sensors to physical quantities to which they are sensitive,

- where the outputs of the system are determined by checking whether an actuator performs an action, and

- Observed inputs and outputs are compared with the respective test case.

Deviate, for example, despite correct inputs in the implementation of the respective test cases, the actual outputs from the expected outputs, this is an indication that the physical system examined, such as the tested electronic control system, has errors that need to be corrected to a to ensure trouble-free and accident-free regulation of the respectively controlled system or machine.

A derivation of a reliable reference model can be guaranteed if the reference model is learned from the observation of a physical reference system.

Further advantages and refinements of the invention result from the description and the accompanying drawings.

The invention is illustrated below with reference to particularly advantageous, but not to be understood as limiting exemplary embodiments in the drawings and is described by way of example with reference to the drawings.

The following shows schematically:

1 shows the initial state of a first model,

Figures 2 to 13 show the structure of an event structure for the first model. 14a the event structure of a first model,

Figure 14b shows the event structure of a second model

Figures 15, 16 show the partial event structures of the first model of Figure 14a, Figures 17 to 22 show the partial event structures of the second model of Figure 14b,

Figures 23 to 28 compare the event structures of the first and second models of Figures 14a and 14b, respectively

Figures 29 to 38 compare two event structures with revising assignment

ments

39 shows an example of an event structure with internal actions,

40 to 42 the reduction of the event structure from FIG. 39 by the internal actions,

43 shows an example of an event structure with internal actions and conflict relations,

44, 45 the resolution of conflict relations in the event structure from FIG. 43,

46 to 48 an example of the partial structure of event structures,

Figures 49 to 54 show an example of a static analysis for the construction of event structures,

55 shows an example of an object-precise static analysis for the construction of event structures,

Figures 56, 57 Example of creating test cases by mutating a model.

In the following, a method according to the invention for comparing two models is described by way of example using a model M created for a railroad crossing.

MODEL M

In the exemplary embodiment shown, a railway crossing and the security elements associated with it are modeled. In the example, the model M of the level crossing contains a barrier and a warning light for oncoming cars as safety elements, as well as a stop signal that only allows incoming trains to pass if the barrier is down and the warning light is on.

In addition, the situation is modeled that there is rubble on the track. In this case, the train is not allowed to pass through.

In order to compare two models M, each of the models M is described according to the invention by a number of variables V and a number of actions A. In this case, each variable V is assigned a number of possible values W, which results in a set of states in which each variable V has exactly one of these possible values W in each case. Furthermore, each variable V has exactly one initial state |.

Each model M describes the execution of, possibly infinite, sequences of its actions A, with there being a current state at any time during the execution of the model M. At the beginning, this is the initial state I, which is changed by actions A that follow it. Each action A is described by a number of conditions on variable values W according to the current state of the model M, which must be fulfilled in order to carry out an action A in the current state, and which are linked by propositional logic (e.g. conjunction, disjunction, ( Bi-)implication, negation) are linked, as well as a number of effects that indicate how an action A that is carried out changes the variable values W of the state. The effects can also be empty, which can be used for actions A, the execution of which only signals the fulfillment of a condition.

In the exemplary embodiment shown, the model M created for the level crossing includes the following variables V:

Table 1: Variables V of the model M

Variable V Possible variable values W |Initial value I Position of the train Pos Far / Near / Far

On the crossing (cross) Light signal L True / False False Barrier position S Angle from 0 to 90 degrees 90 stop signal for train stop True / False True Rubble on the crossing G True / False False

In Table 2, the actions A of the model M of the level crossing are described. In the exemplary embodiment shown, an action A comprises at least one condition and one effect that occurs when the condition is met and the action is executed. For the sake of simplicity, the conditions and effects are specified in a pseudocode, which, however, is not intended to imply a specific programming language. For example, the condition of the LAn action is "Pos==Nah", meaning that the train is about to cross, and the effect is L:=True, meaning that

the variable light signal L is assigned the value "True". [0047] Table 2: Actions of the model M

Action A | Action Type | Description Condition Effect

ZNah Input The train is approaching the|Pos==Far Pos:=Near crossing

Z cross input The train travels over the | Pos==Near && Pos:=Cross

Intersection provided the | Stop==False Stop signal is off

ZFern input The train leaves the | Pos==Cross Pos:=Far Crossing off

GCross Input Rubble gets to the |G==False G:=True level crossing

LAn output The warning light comes on as- | Pos==Near && L:=True soon a train is approaching |L==False

LOff Output The warning light goes out as- | Pos==Remote && L:=False

soon the train takes off | Stop==True && and the stop signal of the |L==True

train is on

SBelow Output The barrier is closing | Pos==Near && S:=0 as soon as a train approaches | S==90

SOben Edition The barrier opens | Pos==Remote && S:=90

as soon as the train departs-| Stop==True && removes and the stop signal | S==0 of the train is on

Stop output The stop signal for the | Pos==Fern && Stop:= True Train starts as soon as | Stop==False the move removed

Go output The stop signal for the | Pos==Nah && Stop:=False Train stops as soon as | Stop== True && the train is approaching|S==0 && barriers closed, | L==True && the warning light on and no | G==False Scree on the crossing is

In the exemplary embodiment shown, the actions A are inputs and outputs, although in a method according to the invention it is not mandatory to undertake such a categorization of action types.

The model M of the railway crossing describes the execution of the actions A listed in Table 2 in a sequence that can be continued as long as there is a permissible action A. The actions A first change the specified, initial state | of model M (see Table 2) in which the train is removed from the level crossing (Pos:Fern), the light signal L is off (L:False), the barrier is open (S:90) and the stop signal for the train is on ( Stop: True) and there is no debris G on the tracks (G:False).

Following the initial state | In the model M shown, the only possible action A (see Table 2, Fig. 2 and Fig. 3) is that the train approaches the level crossing (ZNah), since all the conditions are only met for this action, specifically that the train is away from the level crossing (Pos==Fern). For all other possible actions of the system, at least parts of the respective conditions are not met. As a further action following the initial state | It would also be possible for rubble (GKreuz) to get onto the level crossing, but this will only be explained at a later point in time.

After the further actions LAn, ie the approaching of the train to the crossing,

SDown, ie the closing of the barrier, and Go, ie the stop signal is switched off, is the state of the model, [Pos:Near, L:True, S:0, Stop:False, G:False], ie that the train is close to the level crossing, the light signal L is on, the barriers are closed and the stop signal for the train is off and there is no debris on the tracks (G:False).

The same state is reached when, following the approach of the train to the crossing, the barriers are first closed and then the light signal is switched on, ie the sequence is carried out. After the sequence, the state of the model is identical to the initial state |, which is why the sequence can theoretically be continued indefinitely. EVENT STRUCTURES ES In order to be able to compare two models M quickly and with little computing effort, an event structure ES including a number of events E is defined for each of the models M according to the invention. There is in each case a unique initial event El, which occurs first among all events E and indicates that no other event E has occurred. Each event E, which is different from the initial event El, is clearly identified by an action A and a set of previous events E. [0055] In this context, causality relations KaR are defined between a conditional event and a conditional event if the occurrence of the conditional event is necessary for the occurrence of the conditional event. In the following figures, such causality relations KaR are shown as solid arrows, which indicate that in order for event E to occur at the end of the arrow, event E at the beginning of the arrow must have occurred. One or more causality relations KaR are possible for each event E. Conflict relations KoR are defined between two events E if the occurrence of one event E excludes the future occurrence of the other event E. Such conflict relations KoR are shown in the figures as dashed lines, which indicate that when one of the two events E connected by such a line has occurred, the other must not occur. Such a conflict relation KoR is not directed. It can be assigned to each event E, a state that arises by starting from the initial state | Actions corresponding to the event E and events that directly or indirectly condition the event E through causality relations KaR can be executed in any order, so that actions corresponding to the conditional events are executed before actions corresponding to the conditional events. This state is referred to as the state associated with the event. Furthermore, a state can be assigned to a set of events between which there is no conflict relation KoR and which have no directly or indirectly causing events, which arises by actions corresponding to all events of the set, as well as all events that an event of the set caused directly or indirectly by causality relations KaR, can be executed in any order such that actions corresponding to conditional events are executed before actions corresponding to the conditional events. This state is referred to as the state associated with the set of events. In the exemplary embodiment shown, event structures ES are shown as specified in Table 3: Table 3: Events E of model M

After the sequence, the state of the model is identical to the initial state |, which is why the sequence can theoretically be continued indefinitely. EVENT STRUCTURES ES In order to be able to compare two models M quickly and with little computing effort, an event structure ES including a number of events E is defined for each of the models M according to the invention. There is in each case a unique initial event El, which occurs first among all events E and indicates that no other event E has occurred. Each event E, which is different from the initial event El, is clearly identified by an action A and a set of previous events E. [0055] In this context, causality relations KaR are defined between a conditional event and a conditional event if the occurrence of the conditional event is necessary for the occurrence of the conditional event. In the following figures, such causality relations KaR are shown as solid arrows, which indicate that in order for event E to occur at the end of the arrow, event E at the beginning of the arrow must have occurred. One or more causality relations KaR are possible for each event E. Conflict relations KoR are defined between two events E if the occurrence of one event E excludes the future occurrence of the other event E. Such conflict relations KoR are shown in the figures as dashed lines, which indicate that when one of the two events E connected by such a line has occurred, the other must not occur. Such a conflict relation KoR is not directed. It can be assigned to each event E, a state that arises by starting from the initial state | Actions corresponding to the event E and events that directly or indirectly condition the event E through causality relations KaR can be executed in any order, so that actions corresponding to the conditional events are executed before actions corresponding to the conditional events. This state is referred to as the state associated with the event. Furthermore, a state can be assigned to a set of events between which there is no conflict relation KoR and which have no directly or indirectly causing events, which arises by actions corresponding to all events of the set, as well as all events that an event of the set caused directly or indirectly by causality relations KaR, can be executed in any order such that actions corresponding to conditional events are executed before actions corresponding to the conditional events. This state is referred to as the state associated with the set of events. In the exemplary embodiment shown, event structures ES are shown as specified in Table 3: Table 3: Events E of model M

EVENT STRUCTURES IT

In order to be able to carry out a comparison of two models M quickly and with little computational effort, an event structure ES comprising a number of events E is defined according to the invention for each of the models M. There is in each case a unique initial event El, which occurs first among all events E and indicates that no other event E has occurred. Each event E, which is different from the initial event El, is clearly identified by an action A and a set of previous events E.

[0055] In this context, causality relations KaR are defined between a conditional event and a conditional event if the occurrence of the conditional event is necessary for the occurrence of the conditional event. In the following figures, such causality relations KaR are shown as solid arrows, which indicate that in order for event E to occur at the end of the arrow, event E at the beginning of the arrow must have occurred. One or more causality relations KaR are possible for each event E.

Conflict relations KoR are defined between two events E if the occurrence of one event E excludes the future occurrence of the other event E. Such conflict relations KoR are shown in the figures as dashed lines, which indicate that when one of the two events E connected by such a line has occurred, the other must not occur. Such a conflict relation KoR is not directed.

It can be assigned to each event E, a state that arises by starting from the initial state | Actions corresponding to the event E and events that directly or indirectly condition the event E through causality relations KaR can be executed in any order, so that actions corresponding to the conditional events are executed before actions corresponding to the conditional events. This state is referred to as the state associated with the event.

Furthermore, a state can be assigned to a set of events between which there is no conflict relation KoR and which have no directly or indirectly causing events, which arises by actions corresponding to all events of the set, as well as all events that an event of the set caused directly or indirectly by causality relations KaR, can be executed in any order such that actions corresponding to conditional events are executed before actions corresponding to the conditional events. This state is referred to as the state associated with the set of events.

In the exemplary embodiment shown, event structures ES are shown as specified in Table 3:

Table 3: Events E of model M

concept description

Event E Each event is given a unique number and labeled with an action.

Initial event El No action is assigned to the initial event.

Causality relation KaR A causality relation is represented by an arrow from

conditional event (here the initial event) to conditional event (here event 1).

Conflict relation KoR A conflict relation is shown with a dashed line between the events.

CONSTRUCTION OF EVENT STRUCTURES ES

Event structures ES are constructed iteratively, starting from the initial event

El, and the initial state |, permissible actions A are executed. In each case one

new event E with causality relations KaR to a set of existing events E

is added when

- the events (E) can occur together according to the existing conflict relation (KoR),

- there is no direct or indirect causality relation (KaR) between any two events (E) of the set,

- the action corresponding to the new event is permissible in the state resulting from performing all actions corresponding to the events of the set, including all previous events according to the causality relation (KaR), and

- either the set of events (E) consists only of the initial event (El), or each action corresponding to the set of existing events conflicts with the action of the event to be inserted.

Two actions are in conflict if, starting from any valid state of possible variable values, - both actions are legal at this state and the actions produce different states when executed in different orders, or - both actions are legal at this state and the execution of one action makes the other action impossible, in that, after execution of one action, the state of the condition for execution of the other action is no longer sufficient, or - exactly one of the two actions is permissible in this state and in the state after execution the allowed action the other action is allowed.

A necessary criterion for the existence of a conflict between actions A1 and A2 is that there is a variable V that is needed to check the validity of action A1, or to set the new variable values W after execution of action A1 and is changed by action A2, or vice versa, or that both actions A1 A2 assign a value to the variable V.

All of the actions in Table 2 conflict with themselves since each action assigns a new value to a variable, so that in the successor state the variable values no longer satisfy the condition of the action. For the present example, this means that two identical actions cannot be carried out immediately one after the other.

A conflict relationship KoR exists between two events E that are inserted one after the other if they are not in a direct or indirect causality relationship KaR and the execution of the actions associated with the events conflict.

The structure of such an event structure ES is explained in more detail below with reference to FIGS. 1 to 13. When setting up an event structure ES, this consists at the beginning only of the initial event El (FIG. 1). In the exemplary embodiment shown, the event "ZNah" is possible after the initial event EI (see conditions in Table 2), since all the conditions for its occurrence are met and the event "ZNah" is numbered 1 and with

inserted a causality relation KaR to the initial event El (Fig. 2).

The event “GKreuz” is also possible subsequent to the initial event El (see Table 2) and is inserted with the number 2 and a causality relation KaR for the initial event El. There is no overlap of the variables V, which are needed to check the conditions of the two actions A, or are changed by the two actions A, since the actions do not fulfill the above-mentioned necessary condition for the existence of a conflict relation. Therefore, no conflict relation KoR is inserted between events "1" and "2" (see Fig. 3).

The action "ZNah" enables the actions "LAn" for which an event "3" and a causality relation KaR to the event with the number "1" are inserted (FIG. 4). The "ZNah" action also enables the "SUnten" action, for which an event with the number "4" and a causality relation KaR for event "1" are inserted. Analogously to the actions "ZNah" and "GKreuz", actions "LAn" and "SUnten" do not overlap the relevant variables V, which is why no conflict relation KoR is inserted between these events (Fig. 5).

The actions “SUnten” alone do not allow any further action, but the events “3” and “4” enable the action “Go” (FIG. 6). An event for this action with the number "5" is inserted with causality relations KaR to both necessary events "3" and "4". In addition, there is a conflict with the "GKreuz" action for event "5" because this action changes the "G" variable to true, which means that the "Go" action can no longer be executed. Therefore, a conflict relation KoR is inserted between the corresponding events "2" and "5".

The "Go" action also enables the "ZKreuz" action, for which an event with the number "6" is inserted (FIG. 7). In addition, the "GCross" action is still allowed, so an event with the number "7" is also inserted for this action.

The action "ZKreuz" enables the action "ZFern" (Fig. 8), which in turn the actions "Stop" and the action "ZNah" (Fig. 9). The corresponding events are in conflict because "ZNah" sets the variable "Pos" to "Near" and thus makes the "Stop" action impossible. Therefore, a conflict relation KoR between the events with the numbers "9" and "10" is introduced.

The "ZNah" action in turn enables the "ZKreuz" action after the stop signal for the train is still switched off in this event (FIG. 10). Event "10" is assigned the same state and action as event "6". Accordingly, the event structure ES could be infinitely extended at this point. The "Stop" action enables "LAus" and "SOben" actions, which, analogous to "LAn" and "SUnten", have no conflict or are not connected by a conflict relation KoR. In addition, the "ZNah" action is still allowed. This action conflicts with both "LOut" and "SOben" because it changes the variable "Pos" to "Near" and thus makes it impossible to execute the other two (Fig. 11).

The "ZNah" action is still permitted after the "LAus" and "SOben" actions. The action is permitted both after one of the two actions has been carried out and after both actions have been carried out. Three events are added for the action "ZNah" that have corresponding causality relations KaR to one or both of events "12" and "13". Here, "ZNah" conflicts with "LAus" and "SOben" respectively, because it changes the variable "Pos" so that the two actions are no longer allowed. Therefore, there is a conflict between "15" and "13" and between "17" and "12". Event "16" has no conflict because it is causally dependent on "12" and "13" and therefore there is no conflict relation to these events by definition. In addition, in event "14" the action "Go" is allowed and a corresponding event is added (Fig. 12).

According to their history of actions performed, events "14", "15" and "16" enable the actions "LAn", "Go" and "SUnten", with following the events for "LAn" and "SUnten", respectively Action "Go" is allowed.

The states associated with events “18”, “23”, “24” and “25” are identical to the state associated with event “5”, which is why these events are extended in an identical manner and for any length be able. Also, all of these events conflict with event "/" (Fig. 13).

COMPARISON OF EVENT STRUCTURES ES

The aim of the method according to the invention is, among other things, to be able to determine quickly with little computational effort, by at least partially converting two models M1 and M2 to be compared into event structures ES1 and ES2, whether the set of possible sequences of actions A, which which is described by an event structure ES1, is contained in the set of possible sequences which is described by the other event structure ES2.

By performing the comparison in both directions, it can also be determined whether the set of possible sequences of actions of the two event structures is identical. For this purpose, the event structures ES1, ES2 to be compared of the two models M1, M2 to be compared are first separated into conflict-free sub-event structures TE. A first and a second set of conflict-free partial event structures TE thus result for the two models M1, M2 to be compared.

The event structures ES are separated into partial event structures TE by being divided recursively into two partial event structures TE for each conflict relation KoR. For this purpose, events E that are caused directly or indirectly by one of the events E involved in the conflict relation KoR are assigned to one partial event structure TE and all other events E that are not involved in the conflict relation KoR are assigned to both partial event structures TE.

For each sub-event structure TE of the first set, a sub-event structure TE of the second set is then sought whose actions A are compatible according to the causality relations KaR and events E of the first set. In this context, compatible means that events E of the partial event structure TE1 of the first model M1 are unambiguously assigned to a partial event structure TE2 of the second model M2, so that the pairs of mutually assigned events each have the same assigned actions.

Furthermore, by adding all causality relations KaR of the partial event structure TE2 of the second model M2 to the partial event structure TE1 of the first model M1 for the corresponding pairs of events E of the partial event structure TE1 of the first model M1 according to the assignment, no cycles in the causality of the partial event structure TE1 may result .

Such a mapping can be done by a search method that visits each event once, such as depth or breadth-first search (see Tarjan, Robert. "Depth-first search and linear graph algorithms." SIAM journal on computing 1.2 (1972): 146-160), on the partial event structure TE1 of the first model M1 with added causality relations KaR of the partial event structure TE2 of the second model M2, determination of assignments of individual events E. When visiting an event, the search method places an assignment on an event of the other event structure with the same Action to which no event has yet been assigned. As soon as each event has been visited and is thus assigned, causality relations KaR of the partial event structure TE2 can also be added unambiguously to the partial event structure TE1. The new partial event structure created from partial event structure TE1 by adding causality relations is examined for cycles in the common causality relations. Searching for cycles can be accomplished with depth-first search, which only needs to be checked during the search whether a visited event is already included in the active path of the search. Associations between events where there are multiple valid possibilities are saved and revised when a cycle is found.

Furthermore, in case a causality relation KaR is added where no direct or indirect causality relation KaR previously existed, the sub-event structures TE1, TE2

only considered compatible if a compatible partial event structure can also be found in the set of partial event structures of the second model M2 for a new partial event structure TE, which is created by adding an additional causality relation KaR in the opposite direction to the added causality relation KaR.

The result of the comparison is then considered positive, ie all sequences of actions of the event structure ES1 are also preserved in the set of sequences of event structure ES2 if for each sub-event structure TE1 of the first model M1 or one event structure a compatible Sub-event structure TE2 of the second model M2 or the other event structure is found.

The comparison of two event structures is explained in more detail below with reference to FIGS. 14a to 38. For clarity, only part of the event structure from the previous example is compared to a similar structure.

event structure E1 in Fig. 14b describes a model in which the actions "LAn" and "SUnten" must not happen simultaneously, which means that the signal light is always switched on first and then the barrier is closed, or vice versa. Figure 14a describes the model in which these actions are independent of each other as introduced above.

For the comparison of the two models M1, M2 or the two event structures E1, E2 of the models M1, M2, the event structures E1, E2 must first be divided into conflict-free sub-event structures TE, as described above. This is explained in more detail using the two event structures E1, E2 in FIGS. 14a and 14b.

In FIG. 14a there is only one conflict or one conflict relation KoR between the events with the numbers “2” and “5” in the first event structure E1. These events do not cause other events. Therefore, by dividing the first event structure E1, two partial event structures TE1a, TE1b are created, to which only one of the two events “2” or “5” is assigned, as shown in FIGS. 15 and 16.

The second event structure E2 in FIG. 14b has three conflict relations KoR between the events “8” and “9”, “7” and “12” and “7” and “13”. As described above, the conflict relations KoR are divided until the resulting partial event structures TE are conflict-free.

For this purpose, the conflict relation KoR between events “8” and “9” is first resolved, which respectively cause events “10” and “12” and “11” and “13”. This initially results in two partial event structures TE2a, TE2b (FIGS. 17 and 18) for the second event structure E2, in which the conditional events “10” and “12” and “11” and “13” are only one of the corresponding partial event structures of the conditional event.

However, both event structures TE2a, TE2b contain further conflict relations KoR, which is why they are further divided. First, the conflict relation KoR between the events "/" and "12" in the partial event structure TE2a is separated, resulting in two further partial event structures TE2a', TE2a" (FIG. 19 and FIG. 20), in which the conditional events "/ " and "12" can only be assigned to one of the corresponding partial event structures TE. The same procedure is used for the partial event structure TE2b, which has a conflict relation KoR between the events "/" and "13", whereby two further partial event structures TE2b', TE2b" ( 21 and 22) of the second event structure E2.

The set of partial event structures TE1a, TE1b of the first event structure E1 is then compared to this breakdown with the set of partial event structure TE2a ', TE2a ", TE2b', TE2b "of the second event structure E2. This comparison can be used to determine whether the set of sequences of actions of the first event structure E1 is contained in the set of sequences of actions of the second event structure E2.

For each partial event structure TE1a, TE1b of the first event structure E1, a compatible partial event structure TE2a′, TE2a″, TE2b′, TE20b″ of the second event structure E2 is sought.

For this purpose, for example, the partial event structures TE1a of the first event structure E1 (FIG. 15) and TE2a' of the second event structure E2 (FIG. 19) are compared with one another at the beginning. The order in which the partial event structures are compared is arbitrary.

A depth-first search with the causality relations KoR of suitable events, i.e. events E that are associated with the same actions A, of the partial event structure TE2a' of the second event structure E2 is now carried out on the partial event structure TE1a of the first event structure E1. Matching events E of the two partial event structures TE1a, TE2a' are assigned to one another. If several events E are suitable, one of them is first selected and the decision is saved for possible later revision. More specifically, the sequence of decisions made is noted. As soon as a cycle occurs in the causality relations, the last decision made is changed, with decisions that have already been tried no longer being made. If there is no other decision option, the last decision made beforehand will be revised, if such a decision exists. If there is no decision to be revised and no assignment could be found, the comparison fails.

Should a cycle arise in the common causalities or causality relations KaR during the search, decisions made on the assignment must be revised. If no decisions have alternatives, the comparison of the partial event structures TE turns out to be negative. If each event of one partial event structure can be reached with the common causalities or causality relations KaR of the other partial event structure without a cycle occurring in the causalities, then the comparison is positive.

Causality relations KaR, which also exist in the partial event structure TE2a' of the second event structure E2, i.e. can be quasi imported from the partial event structure TE2a', are marked with dots in the figures. Starting from the initial event El, in the partial event structure TE1a, one can first arrive at the event "1" via a causality relation KaR, which exists in the partial event structure TE2a' between the initial event and the event "6". Event “6” is thus assigned to event “1” (FIG. 23).

Event "1" can be reached in the partial event structure TE1a of the first event structure E1 by means of an imported or adopted causality relation KaR from the partial event structure TE2a' of the second event structure E2 to event "3", which is in the partial event structure TE2a' of the second Event structure E2 between events "6" and "8". In this way, event “8” is assigned to event “3” (FIG. 24).

From event "3" can be reached in the partial event structure TE1a of the first event structure E1 to the event "4" by means of the imported causality relation KaR, which exists in the partial event structure TE2a' of the second event structure E2 between events "8" and "10". . The event “4” of the partial event structure TE1a is thus assigned the event “10” of the partial event structure TE2a′ (FIG. 25).

From event "4" can be reached in the sub-event structure TE1a to the event "5" by means of the imported causality relation KaR, which exists in the sub-event structure TE2a' of the second event structure E2 between events "10" and "12". The event “5” of the partial event structure TE1a is thus assigned the event “12” of the partial event structure TE2a' (FIG. 26).

In this way, all events of the partial event structures TE1a, TE2a' can be assigned to one another with the respective existing causality relations KaR. The comparison of the partial event structures TE1a of the first event structure E1 and TE2a' of the second event structure E2 is therefore positive.

The causality relation KaR between event “3” and event “4” imported into the partial event structure TE1a of the first event structure E1 from the partial event structure TE2a′ of the second event structure E2 does not, however, directly or indirectly connect these events in the partial event structure TE 1a by means of causality relations, which also exist in the first event structure E1. So this is a case in which a causality relation KaR is added where no direct or indirect causality relation was previously found in the partial event structure TE1a of the first event structure E1.

relation KaR inventory.

As previously described, the sub-event structures TE1a, TE2a' are only considered compatible if also for a new sub-event structure TE1a* obtained by adding an additional causality relation KaR in the sub-event structure TE1a in the opposite direction (Fig. 27) as the causality relation KaR that has been newly added or imported from the partial event structure TE2a' is created, a compatible partial event structure can be found in the set of partial event structures of the second event structure E2.

Therefore, a compatible partial event structure is also sought for the new partial event structure TE1a* (FIG. 28). The partial event structure TE2b' (FIG. 21) of the second event structure E2 is compatible with this new partial event structure TE1a* of the first event structure E1, with the imported causality relations KaR again being drawn in FIG.

The partial event structures TE1b of the first event structure E1 and TE2a' of the second event structure E2 are not compatible since no assignment can be found for the event "2" (see FIGS. 16 and 19). Therefore, the search for a compatible partial event structure for TE1b continues.

The comparison turns out to be positive if a compatible partial event structure of event structure E2 is found for each partial event structure of event structure E1 and each partial event structure created in the course of the comparison by adding reverse imported causality relations.

The comparison is negative if no compatible partial event structure can be found in the set of partial event structures of event structure E2 for a partial event structure of event structure E1, or for a partial event structure created in the course of the comparison by adding reverse imported causality relations. In this case, the comparison can be aborted immediately.

COMPARISON OF EVENT STRUCTURES ES - REVISING ASSIGNMENTS

The previously described embodiment of a comparison of two event structures E1, E2 is expanded below so that the light signal L lights up twice before the train is allowed to cross using the action "Go".

For this purpose, a first event structure E1 (FIG. 29) in which the action "switching on the light signals" LAn and the action "closing the barriers" SUnten may take place in any order. In the second event structure E2, one of the light signals L must be switched on after the barrier has been closed (FIG. 30).

For the sake of clarity, the causality relations KoR of the second event structures E2 are provided with unique names K1, K2, K3 in FIGS. 31 to 38 in order to clarify which causality relations KoR are imported into the event structure E1 when compared with the event structure E2 .

The aim of the comparison of the two event structures E1, E2 is, as described above, to examine whether the set of sequences of actions A, described by the event structure E1, is contained in the corresponding set of sequences of actions A event structure E2. It is to be expected that this comparison will fail, since event structure E2 does not permit the sequence <LAn, LAn, SUnten>, which is possible in event structure E1.

The first step of the comparison succeeds because all causality relations K1, K2, K3 of the event structure E2 can be taken over or imported into the event structure E1 without any problems (FIG. 31). However, the imported causality relation K3 creates a causality between the events "2" and "3" in the event structure E1, which is not originally contained in the event structure 1. For this reason, a new event structure E1*, which is created by reversing the imported causality relation K3, is created and also compared with the event structure 2 (FIG. 33). The causality relation KaR between the initial event El and event "3" does not need to be drawn in separately, since this transitive causality exists implicitly.

First, the causality relation K1, which exists in the event structure E2 between the initial event and event “4”, is imported or inserted into the event structure E1*. There are two possibilities for this: Either event "1" or event "2" can be assigned to event "4". In the exemplary embodiment shown, event “1” is first selected (FIG. 34).

Next, the causality relation K2, which exists in the event structure E2 between the initial event E1 and event “5”, is imported into the event structure E1*, with only event “3” coming into question as an assignment for event “5”. (Figure 35).

Finally, the causality relation K3, which exists in the event structure E2 between the events “5” and “6”, is transferred to the event structure E1*. Since event "1" is already assigned, event "2" must be assigned to event "6" (Fig. 36). This results in a cycle between event "2" and event "3" from original and imported causality relations in the event structure E1*. As described above, adding all causality relations KaR of one partial event structure or event structure E1 to the other partial event structure or event structure E2 for the corresponding pairs of events E of the first partial event structure according to the assignment must not result in cycles in the causality of the first partial event structure .

The decision to assign event "1" of event structure E1* to event "4" of event structure E2 is thus revised and event "4" is assigned to event "2" of event structure E1* instead (FIG. 37). When revising the assignment, all assignments made afterwards and imported conflict relation KoR are also removed from E1*. The new assignment leads to a positive result of the comparison.

In this case, however, a causality relation K3 was imported again from the event structure E2, which produces a nonexistent causality between the events “3” and “1” in the event structure E1*. Therefore, as previously described, a comparison is to be carried out for a new event structure E1** (FIG. 38) in which the causality between events “3” and “1” is in the opposite direction. In this case, however, the comparison of the event structures E1**, E2 fails, since the causality relation K3 imported from the event structure E2 always generates a cycle, regardless of which events K1 and K2 are imported between.

The resulting event structure E1** represents all sequences of actions that are possible in event structure 1 but not in event structure 2. In particular, these are both sequences that first have two light signals L and only then close the barriers.

INTERNAL ACTIONS

In addition to inputs and outputs, actions A can also be internal actions. Internal actions model actions A that bring the system into a new state without being visible or controllable from outside the system. For example, internal actions can specify implementation details for modeling.

The comparison is intended to be agnostic to internal actions. That is, sequences of actions should be considered identical if the sequences of actions that result from deleting internal actions from the original sequences are identical.

To achieve this, event structures must be reduced before the comparison and events to which internal actions are assigned must be deleted. In order to preserve the semantics of the event structure, care must be taken when deleting events that causality and conflict relations from deleted events are correctly transferred to existing events.

The internal actions listed in Table 4 are introduced to extend the embodiment described above. In this version of the M model, the light signal and barrier must first carry out a self-test before the light comes on or the

barrier closes. In this exemplary embodiment, it is not taken into account how the tests actually run, only whether they have been carried out.

Table 4: Internal actions of the model M

Action A Action Type Description |Condition Effect LTest Internal Performs a | LTest==False LTest:=True Self test on light off. STest Internal Runs a | STest==False STest:=True

self-test at the barrier.

LAn Edition The MWarning Light| Pos==Nah && |L:=On turns on as soon as|LTest==True a train is approaching and the light's self-test has been performed

SBelow Edition The Barrier | Pos==Nah && |S:=0 closes so- | STest==True as soon as a train is approaching and the self-test of the barrier has been carried out

The extended first part of the event structure E1 is shown in FIG. Internal behavior or internal actions are not considered relevant for the comparison of models M. It is only of interest whether two models M1, M2 allow the same sequences of inputs and outputs. Therefore, internal actions are hidden. For this purpose, each event structure ES can be reduced to an event structure ES without internal actions by causality relations KaR or conflict relations KoR being redirected to conditional events E.

The exemplary embodiment shown is reduced in the following steps: First, the event “1” and all outgoing causality relations KaR are removed from the event structure E1 and the causality relation KaR between the initial event E1 and event “1” is redirected to all conditional events , which in this case is only event "5" (Fig. 40). Event "3" and all outgoing causality relations KaR are then removed from the event structure E1 and the causality relation KaR between the initial event El and event "3" is redirected to all conditional events, which in this case is only event "6" (Fig .41).

Indirect causality relations KaR do not need to be drawn. The resulting event structure E1' (Fig. 42) is equivalent to the event structure E1, i.e. it is the same as the corresponding part of the event structure E1 of the original model except for the numbering of events.

Conflict relations KoR are diverted in the same way, which is demonstrated using the following example of an event structure E3 (FIG. 43). First, event "2" is removed from the event structure E3 because it is an internal action, "testing the light signal" and the causality relations between events "1" and "2" are set to the conditional events "1" and " 4” and conflict relations are redirected to conditional events “4” and “3” (Fig. 44).

Event "3", the testing of the barriers, then becomes event structure E3

removed because it is an internal action, testing the "boundary" and causality relations between events "1" and "3" are redirected to conditional events "1" and "5" and conflict relations are related to conditional events " 4” and “5” (Fig. 45).

The result of these reductions of the event structure E3 is, as expected, equivalent to the corresponding event structure E3' without internal actions.

PARTIAL CONSTRUCTION AND COMPARISON OF MODELS M

In the structure of an event structure ES described above, the event structure ES can theoretically be continued indefinitely. Even if this were not the case, models M can become enormously large, which makes both the construction and the comparison of such event structures ES extremely computationally and time-consuming and thus practically impossible.

[00126] In order to counteract this problem, the construction and comparison of event structures ES is structured into small parts. An event structure ES is built up, starting from a predetermined or selected state of the model M, until only events E can be added that have inputs as action. The comparison is also only made on the partial event structures TE that correspond to a section of such a structure.

For this purpose, the model M1 to be compared is only partially converted into an event structure ES and compared with corresponding parts or event structures ES of the model M2 used for the comparison. In doing so, partial event structures are constructed which, starting from a given state of the model, correspond to partial executions of the model, in which all possible outputs of the system have taken place and the model requires an input in order to produce further outputs.

Parts of the one version of the model to be compared are compared to parts of the model used for comparison corresponding to respective partial event structures with the same input starting from a common state.

In the example of a railroad crossing given above, the construction takes place in the following parts: First, the events with the numbers “1” corresponding to the inputs “ZNah” and “2” corresponding to “GKreuz” are inserted for the initial event El, as shown in Fig 3 is shown.

The input "GKreuz" does not lead to any further events E. The input "ZNah" induces the event structure shown in FIG. 46 at possible outputs. In this event structure, "ZKreuz" and "GKreuz" are possible entries that can be made following action 5 "Go". When selecting "Zcross" the event structure shown in Fig. 47 is induced.

Again, "ZFern" and "GKreuz" are possible entries in this event structure, which can be made after action 6 "ZKreuz". Choosing "ZFern" induces the event structure shown in Fig. 48. There are 5 different histories (Fig. 48) for the "ZNah" action, which differ according to whether the barrier has opened in the meantime or the light has come on.

Depending on the planned search effort, search target and model size, one, several, or all of these histories and entries can be followed up and compared.

The selection of histories and inputs can be random, heuristic, or comprehensive, as described in Fellner, Andreas, et al. "Model-based, mutation-driven test case generation via heuristic-guided branching search." Proceedings of the 15th ACM-IEEE International Conference on Formal Methods and Models for System Design. ACM, 2017.

STATIC ANALYSIS Around only a restricted set of events E when comparing event structures 18/40

To have to check structures ES, or to ensure an efficient construction of event structures ES, a static analysis can optionally be used in a method according to the invention in order to determine which events E are possible in a specific state of the model M and which actions are potentially in conflict stand.

In this context, static analysis refers to the extraction and use of information based on static elements of the model M, for example the conditions, effects of the actions, and the variables that access them. In concrete terms, the variable accesses of the actions A are used in order to establish, during the construction of the event structure ES, for which actions A new events E may have to be inserted and in order to determine between which events conflict relations must be inserted. As an alternative to this, which is more time-consuming and computationally expensive, it would be possible, for example, after the insertion of an event E, to check each event E available in the model M to determine whether an insertion following the event E inserted before it is permissible.

It is thus easy to determine which actions are potentially in conflict. For example, the actions "LAn" and "Go" conflict because "LAn" assigns a value to the variable "L" that "Go" uses. On the other hand, the actions "SDown" and "LOut" certainly do not conflict, since the only variable that both use is "Pos" and neither of them assigns a value to it. The use of a conflict relation is a conservative approximation of the conflict relation as described above. Two actions that are not in conflict with each other according to the static analysis are certainly not in conflict in the above sense. However, there can be actions which, according to static analysis, are in conflict, but not in the above sense. However, the calculation of conflicts using static analysis is far less computationally intensive, since the results of different execution orders do not have to be checked on a potentially large number of states.

If an event is now inserted, then conflict relations are to be created with all other events if the actions that carry out these events have a conflict and the events are not (indirectly) in a causal relationship. Although this method potentially overestimates the number of conflicts and thus in some cases inserts more events than necessary, it is still more efficient than an exact analysis of the actions, which requires a mathematical analysis instead of a syntactic analysis.

In the static analysis, information about accesses to variables V from a relevant action A is used to restrict the set of other actions A, the permissibility of which may have changed after the relevant action A has been carried out. The permissibility of an action can only change when another action is carried out if the condition for the permissibility of the action contains a variable V that is changed by the other action. A variable V can only be changed by an action A if there is a partial effect of the action that assigns a new value to the variable V.

This constraint is used in the construction of event structures ES by after inserting an event E corresponding to an action A only for the restricted set of actions whose admissibility may have changed, plus all events associated with the inserted event E in Are conflicting, it must be checked whether a new event E with such an action A is to be inserted.

In the illustrated embodiment of a railroad crossing, part of the structure of the event structure ES is repeated to illustrate the advantageous use of a static analysis and to illustrate for which actions A, for example, it is checked whether new events E are added, these events E with be symbolized by a "?" numbering.

In the initial state | (Fig. 1), all possible actions A of the model M must first be checked. In the exemplary embodiment shown, the event with the number “1” or “ZNah”, ie that a train is approaching the level crossing, is first inserted, as can be seen in FIG. "ZNah" changes the variable "Pos", which is used in the condition for checking the

Admissibility of all actions A (except "Gcross", see Table 2) is required.

Accordingly, it must be checked for all actions A whether they are permissible following event "1". It is not analyzed which value "Pos" has after the execution of "ZNah", because in general the value of variables depends on which actions were previously executed and an analysis that includes the entire history is too computationally expensive, but only which variables V to be changed. So only nine instead of all ten possible actions (FIG. 49) need to be checked for their admissibility. The "GCross" action does not need to be checked because it does not need the Pos variable in its conditions to check its admissibility.

[00143] The examination of the permissibility shows that the actions “LAn” and “SUnten” are actually permissible. Events can therefore be added for these actions. First, however, the event with the number "2" for the "Gcross" action is inserted (Fig. 50), since this event is permissible. This action changes the variable "G", which is only required for checking the admissibility of the actions "Go" and "GKreuz", which are now checked for admissibility in the state corresponding to event "2". Both actions are not allowed, so no new event is added after event "2".

An event for "LAn" with a causality relation KaR to event "1" is inserted (Fig. 51). This action changes variable "L", which is only used to check the admissibility of the actions "Go", "LAus" and "LAn". Accordingly, only this action needs to be checked for admissibility. However, the action "Go" is not allowed because the value of "S" is not 0. There is also no event independent of event "2" that could establish admissibility. "LAn" and "LAus" are also not permitted because their conditions are not met.

An event for "SDown" with causality relation to event "1" is inserted (Fig. 52). This action changes variable "S", which is only used for checking the actions "Go", "SUnder" and "SOben". The action "Go" is not allowed after event "3" because the value of "L" is not "True". However, with event "4" there is an event that also potentially changes the admissibility of the action. Therefore, it must also be checked whether the events numbered "4" and "3" together make the action "Go" permissible, which is the case. The actions "SUnten" and "SOben" are not permitted at this point.

An event for “Go” with a causality relation to both conditional events and a conflict relation to event “2” is inserted (FIG. 53). The "Go" action changes the "Stop" variable, which is used to check the permissibility of the actions "SOben", "LAus", "Stop", "Go" and "ZKreuz" (Fig. 54). In addition to checking the legitimacy of these five actions, the legitimacy of action "GCross" must also be checked, since there is an event corresponding to this action that conflicts with event "4" (Fig. 53). Contrary to actions that may potentially have their legality changed, conflicting actions need not change their legality in order to be legal after the event. The only difference is the order of execution. Action "GCross" is allowed in event "4", so an event will be inserted for the action (see above).

OBJECT ACCURATE STATIC ANALYSIS

When comparing models according to the invention, an object encapsulation can optionally be used for a more compact representation of the models, for example in Marcello M. Bonsangue, Joost N. Kok, and Kaisa Sere. 1998. An Approach to Object-Orientation in Action Systems. In Mathematics of Program Construction, MPC'98, Marstrand, Sweden, June 15-17, 1998, Proceedings (MPC), Johan Jeuring (Ed.), Vol. 1422. Springer, 68-95 or http://link.springer .de/link/service/series/0558/bibs/1422/14220068.htm.

There are classes that describe which variables V each instance of this class has. For every class there are a set of instances and there are variables that can be of the type of a class, ie refer to instances of this class. In principle, act

different instances of the same class independently. This independence should be used by the event structures that have been set up.

[00149] However, for naive static analysis, variables of an object type and the variables of these instances are identical, which is why the associated actions are identified as conflicting. This circumstance should be avoided by a more detailed static analysis and a distinction should be made between variables that should refer to different instances.

[00150] This differentiation of variables takes place in that, starting from the initial state of the comparison, the instances of variables are carried along with an object type and any changes to these instances are kept accurate by the effects of actions. The instance-precise variable breakdown is then used for conflict analysis, so that two object-type variables are identified as ident only if they refer to the same instance.

For the purpose of illustration, the exemplary embodiment shown is expanded and the situation is modeled in which there are several tracks. There is also a class "track" with a variable "G" that indicates whether there is rubble on the track. The class has two instances "Gleis1" and "Gleis2". New variables "AktGleis" of the "Gleis" type and "GlSet" of the Boolean type, for example, are added to the M model. The actions summarized in Table 5 are changed or added.

Table 5: Further actions A in model M

Action A action type | Description Condition Effect

GKreuz1 input rubble reaches track1 | TRUE Track1.G := True

GCross2 | Input rubble arrives on track2 | TRUE Track2.G := True

AktGI1 Input The train is running on track 1 |GISet==False AktGleis:=Track 1 GlSet:=True

AktGI2 input The train is running on track2 |GISet==False AktGleis:=Gleis2 GlSet:=True

Go output The stop signal for the | Pos==Remote && Stop:=Off

Train goes out as soon as | Stop==True & | GISet==False the train is approaching, | S__9 8&

barrier closed,

warning light is on. the ak | L== True &&

tive track was set | G'Set==True && and no | on the active track AktGleis.G==False is scree

When setting up the event structure ES, it must first be clarified which variable V requires the action “Go” to check the admissibility. As a condition, Table 5 shows that "AktGleis.G"==False. However, "AktGleis" is a variable of the "Gleis" type. Depending on whether "AktGleis" is currently assigned to "Gleis 1" or "Gleis2", either the variable "Gleis 1.G" or "Gleis2.G" is accessed. This has a special effect on whether there is a conflict relationship between events with the action "Go" or "GSKreuz1" and "GKreuz2".

The event structure in FIG. 55 shows the result of an object-specific variable analysis. There are two events with the action "Go", depending on which track was activated. The events only conflict with the corresponding event "1" or "5". For example, event "8" can occur independently of event "5". The same analysis is also used, for example, to restrict the number of possible permissible actions A.

TEST CASE

Event structures ES created according to the invention or their comparison can or can advantageously also be used for test case generation. A test case T is included

to be understood as a sequence of inputs, outputs and expected outputs. When executing a test case T on a system to be tested, the inputs from the executing entity are to be fed to the system and the observed outputs are to be compared with the test case T.

A test case T is considered to have been executed correctly if the specified sequence of outputs is observed given a correct sequence of the sequence of inputs. A test case T is considered not to have been executed conclusively if, given the correct sequence of inputs, an output occurs that is stored as a possible output, but does not correspond to the specified sequence of inputs and outputs. A test case T fails if, given the correct sequence of inputs, an output occurs that is neither stored as currently possible output nor corresponds to the specified sequence of inputs and outputs.

Test cases T result, for example, from the comparison of two versions of a model M, which can arise, among other things, from:

- Targeted use of errors in the model M or mutations, which will be discussed later, or

- Further development of the model M, or

- independent development of the model M in several ways, e.g. by different modeling approaches, by different people, via different translations from different modeling languages, etc., or

- different levels of abstraction of the model M.

In this way, two models M1 and M2 are created. The above-described transfer of the two models M1, M2 into event structures ES and their comparison results in either that there are no differences in permitted sequences of inputs and outputs, in which case no test case T is generated, or that there are differences in permitted There are sequences of inputs and outputs, in which case there is a partial event structure of the event structure of one version of the model M or of the model M1, which describes sequences of inputs and outputs which, according to the event structure of the other version of the model M or of the model M2 are not permitted.

The occurrence of such sequences can thus be tested by converting these partial event structures into test cases T. In addition or as an alternative to this, the absence of incorrect sequences can be tested by converting a partial event structure of the event structure of the other version of the model M or the model M2 to test cases T, with this partial event structure being intended to enable sequences of actions A that are identical to the maximum length are the impermissible sequences of actions A.

Conflict-free sub-event structures can be transformed into test cases T by collecting sequences of actions corresponding to events which, according to the causality relations KaR, precede conditional events, and these with possible outputs corresponding to events which according to the causality relations KaR and/or conflict relations KoR of the entire event structure ES can occur after the current event. These sequences can be completed into test cases by reading the number of permissible, alternative outputs from the event structure for each output and adding them to the test case.

In general, test cases T that distinguish one version of a model M from another version of the model M are considered to be interesting test cases T in industrial practice. As already explained, a test case T includes a sequence of inputs and outputs, as well as possible outputs that are permitted by the model M, but are not intended by the test case T at this point in the sequence.

The following sequences are test cases T, where the sequence consists of pairs, the first part of which is the expected input or output and the second part of which is the list of permissible, alternative outputs.

T1:< ZNear / {}, LAn / {SDown}, SDown / {}, Go/{} >

T2: < ZNear / {}, SDown / {LAn}, LAn / {}, Go /{} >

T3: < ZNear / {}, LAn / {SDown}, SDown / {}, Go / {}, ZCross / {}, ZFern {}, Stop / {}, LOut / {SOup)}, SOup/{}>

T4: < GCross / {} >

In this case, sequences of elements or actions are specified in the angle brackets <>, the actions being separated by slashes / and in the curly brackets {} permissible alternative outputs which may occur instead of the action. If the sequence contains multiple pairs, these are separated by commas.

[00164] If test case T1 is tested on a system, the input “ZNah” must first be made. If the sequence of outputs < LAn, SUnten, Go > is then observed in this order, the test is considered to have been carried out correctly. If “SUnten” is observed as the first output, the test does not end conclusively. "SDown" is permitted at this point, but not intended, which is why no further statement can be made about the test procedure. Any other output, or the absence of any output, will result in the test failing. Test case T2 sequences the actions "LAn" and "SUnten" in the opposite direction compared to test case T1. Test case T3 is a multi-input test. Test case T4 tests a different first input.

In the exemplary embodiment shown above, the comparison of the two event structures E1 (FIG. 29) and E2 (FIG. 30) yielded a negative result. In case of a negative result of the comparison of event structures, it could be proven that event structure E1 has more sequences of inputs and outputs than event structure E2.

Such partial event structures TE, such as partial event structure E1**, which caused the comparison of two event structures E to fail, can be interpreted as test cases T. To do this, the event structure ES is simply placed in a linear order and the possible alternative outputs, which originate from the entire original event structure ES, are collected. In this case, this results in the following test case T5:

T5: < LAn / {SDown}, LAn / {SDown}, SDown / {} >

Test case T5 checks the occurrence of the additional sequence <LAn, LAn, SUnten>.

The model M2 from which the event structure E2 is created cannot successfully execute this test case T5, since at the latest after the first occurrence of “LAn” “SUnten” occurs. The sequence of inputs and outputs is taken from the event structure, the possible outputs refer to the original event structure, which is why, for example, "SDown" is already possible at the beginning.

Event structure E2 (FIG. 30) can also be interpreted analogously as test case T. A possible test case is T6

T6: < LAn / {SDown}, SDown / {}, LAn / {} >

This test case T6 checks the absence of the additional sequence <LAn, LAn, SUnten>. Executing test case T6 from the model that induces event structure E1 can cause this test to fail if, for example, it returns the sequence. MUTATIONS As mentioned above, different versions of a model can be created by mutation. A mutation is a small, syntactic change in the model. This will be explained in more detail using the following example. The mutation given in Table 6 changes the action "Go" so that the action does not check whether the barrier is down. The mutant only sets a partial condition to "True".

MUTATIONS

As mentioned above, different versions of a model can be created by mutation. A mutation is a small, syntactic change in the model.

This will be explained in more detail using the following example. The mutation given in Table 6 changes the action "Go" so that the action does not check whether the barrier is down. The mutant only sets a partial condition to "True".

Table 6: Mutation in model M

Action A | Action Type Description Condition Effect Go Output Mutated version | Pos==Nah && Stop:=False (Mutant) enforces "S==0" | Stop==True && "True" True && L==False && G==False Go Output Original Version | Pos==Nah && Stop:=False (Original) has "S==0*" as part | Stop==True && condition S=-0 && L==False && G==False

The part of the event structure relevant to the action “Go” changes as shown in FIG. 56, so that a mutated event structure EM of the original event structure E4 shown in FIG. 57 is created. The comparison of the event structures shows that the mutated event structure EM has more sequences of actions than the original event structure E4. Specifically, the sequence <ZNah, LAn, Go, SUnten> is possible in the mutated event structure EM, but not in the original event structure E4.

A test case is created by transforming a conflict-free partial event structure of the original event structure into a sequence that corresponds as closely as possible to the sequences that are possible in the mutant but not possible in the original. In this example there is only one such partial event structure, which is the entire original event structure E4. The events E are put into a linear sequence and the possible alternative outputs are collected from the entire event structure ES. The resulting test case T7 is:

T7: < ZNear / {}, LAn / {SDown}, SDown / {}, Go/{} >

Test case T7 checks the absence of the sequence <ZNah, LAn, Go, SUnten>.

In this way, a system such as the control and regulation system of a level crossing described above can be tested. The open-loop and closed-loop control system is designed to measure state variables from sensors in the system and to control actuators in the system.

In the exemplary embodiment shown, a model for the control and regulation system to be tested of a level crossing described above is created for the test on the basis of a reference model. The states of the model are indicated, for example, by measurements of state variables of the level crossing, which are determined by the control and regulation system, and the execution of the actions A of the model causes, for example, the change in an actuator of the system controlled by the control and regulation system.

The reference model can be learned based on the observation of a physical reference system, or be made available in some other way. A control and regulation system for railway barriers, for example, can be used as a physical reference system, which has an error-free function.

For this purpose, a further model is generated, for example by mutating the reference model d, and test cases T are created by comparing the further model with the reference model, as has already been described above.

A test adapter can be used, which is, for example, a control device on which the test cases T are stored. This test adapter is connected, for example, to the control and regulation system of the level crossing to be tested and carries out the previously created test cases T in order to test the system using the test cases T thus created, as described above.

24/40

[00179] This means that the test adapter transmits the inputs corresponding to the test cases T to the open-loop and closed-loop control system and the outputs generated by the system to be tested in response to the inputs are recorded. When executing a test case T, the inputs are preferably supplied to the system by subjecting the sensors of the system to physical quantities to which they are sensitive, and the outputs of the system are preferably determined by checking whether an actuator takes an action executes The observed inputs and outputs are compared with the respective test case T, for example by the test adapter.

[00180] This comparison of the inputs and outputs with the test cases T provides information as to whether the outputs during the test execution deviate from the expected outputs which, for example, the reference system generates. If this is the case, this indicates an error in the control and regulation system, which can be determined and corrected by executing the test cases, and such faults or accidents on the tested level crossing can be prevented.

Claims (1)

patent claims 1. Method for comparing two models (M; M1, M2) that describe concurrent systems, a) each of the models (M; M1, M2) being described by a number of variables (V) and actions (A). , - where each variable (V) is assigned a finite number of possible values (W), - where a set of states is defined, where a state for each variable (V) indicates the assignment of one of its possible variable values (W), - where each model describes the execution of, in particular infinite, sequences of actions (A), - where an initial state (I) is defined, - whereby at each point in time of the execution of each model (M; M1, M2) there is a current state which, starting from the initial state (I), is carried out by the execution of actions (A) of the model (M; M1, M2 ) is changed, - where each action (A) is described by - a condition that the variable values (W) in the current state of the respective model (M; M1, M2) must satisfy in order for the respective action (A) to be permissible in this state, and - a number of instructions that indicate how the action (A) changes the variable values (W) of the state, - whereby two actions (A; A1, A2) are said to be in conflict if, starting from any valid state of possible variable values, - at this state both actions are permissible and the actions generate different states if they are executed in a different order, or - in this state both actions are permissible and the execution of one action makes the other action impossible, in that after the execution of one action the state of the condition for the execution of the other action is no longer sufficient, or - exactly one of the two actions is permitted in this state and the other action is permitted in the state after the execution of the permitted action b) where for at least parts of the two models to be compared (M; M1, M2) in each case an event structure (ES; ES1, ES2) comprising a number of events (E) is specified, - wherein a unique initial event (El) is specified, which occurs first among all events (E), - wherein each non-initial event (El) is uniquely characterized by an action (A) and a set of previous events, - where, for the occurrence of an event, the occurrence of all events of the set of past events is necessary, which is a causality relation (KaR) between the conditional event and the preceding conditional events, - with each event having a direct or indirect (transitive) causality relation to the initial event (El), - with a conflict relation (KoR) between two events (E) being established if the occurrence of the an event excludes the future occurrence of the respective other event, c) event structures (ES; ES1, ES2) being constructed iteratively, inde m at least for parts of the two models (M; M1, M1) starting from the initial event (El) and the initial state (I), permissible actions (A) are executed - whereby a new event is inserted and via a set of causality relations (KaR) to a set of existing events (E ) is added if - the events (E) can occur together according to the existing conflict relation (KoR), - there is no direct or indirect causality relation (KaR) between any two events (E) of the set, - the action corresponding to the new event is permissible in the state resulting from the execution of all actions of the events of the set, including all events preceding these events according to the causality relation (KaR), and - either the set of events (E) consists only of the initial event (El), or each action according to the set of existing events conflicts with the action of the event to be inserted, - after inserting a new event (E), a new conflict relation (KoR) is added to a previously inserted event (E), - if the events (E) are not in a direct or indirect causal relationship lation (KaR) stand and - if the actions of the two events conflict with each other, d) comparing a first event structure (ES1) of a first model (M1) with a second event structure (ES2) of a second model (M2) to determine whether the first Set of possible sequences of actions (A) that is described by the first event structure (ES1), is contained in the second set of possible sequences that is described by the second event structure (ES2), - where for comparison of the first model (M1 ) with the second model (M2), the first event structure (ES1) and the second event structure (ES2) are separated into conflict-free partial event structures (TE1, TE2), so that a first and a second set of conflict-free partial event structures (TE1, TE2) result, - By recursively dividing each event structure (ES1, ES2) into two partial event structures (TE1, TE2) at each conflict relation (KoR) until there are no conflict relations (KoR) between any two events (E) of a partial event structure (TE1; TE2), by doing - Events (E) that are directly or indirectly caused by one of the events involved in the respective conflict relation (KoR) are only assigned to one of the two partial event structures (TE1, TE2) and all other events (E), except for the other one Event of the conflict relation (KoR) and the events directly or indirectly caused by it according to the causality relation (KaR) are assigned to both partial event structures (TE1, TE2), - wherein for each partial event structure (TE1) of the first set, a partial event structure (TE2) of the second set is sought, whose causality relations (KaR) and events (E) corresponding actions (A) are compatible, - whereby partial event structures (TE1, TE2) are then regarded as compatible, - if a clear assignment of events (E) of a first partial event structure (TE1) to events (E) of a second partial event structure (TE2) is found, so that pairs of mutually assigned events (E) each have the same assigned actions (A), and - if no cycles in the causality of the first partial event structure (TE1 ) result, - whereby such an assignment is found by a depth search on the first partial event structure (TE1), with added causality relations (KaR) of the second partial event structure (TE2), determination of assignments of individual events (E), by - the assignments made systematically be revised until either no more cycles occur, or - the tie fen search is aborted, since no cycle-free assignment is possible, in which case the difference in the event structures and the models is determined, and - in the event that a causality relation (KaR) was added at a point where no direct or indirect causality relation tion (KaR), the sub-event structures (TE1, TE2) are only considered compatible if also for a new sub-event structure (TE1a*) created by adding an additional causality relation (KaR) in the opposite direction as the added causality relation (KaR ) arises, a compatible partial event structure (TE2) is found in the second set of partial event structures, e) the result of the comparison of the two models (M1, M2) being considered positive if for each partial event structure (TE1) of the first event structure (ES1 ) of the first model (M1) a compatible partial event structure (TE2) of the second event structure (ES2) of the second model (M2) is found. 2. The method according to claim 1, characterized in that in step d) test cases (T) are created by comparing two models (M1, M2), the first model (M1) and the second model (M2) each being created by modifying the different models or by modifying a common predecessor model, - wherein the types of actions (A) of the models (M1, M2) include at least inputs and outputs, - wherein a test case (T) is a sequence of inputs and outputs, in which sequence at least one input and one output occurs and to A list of alternative outputs that are permissible at this point but do not correspond to the test case (T) can optionally be specified for each input/output of the sequence, - with the comparison of the models (M1, M2) according to step d) being determined becomes that - there are differences in the sequences of inputs and outputs, in which case a partial event structure (TE1) of the event structure (ES1) of the first model (M) is present, which describes sequences of inputs and outputs which, due to the event structure ( ES2) of the second model (M) are not permissible, - whereby a test case (T) is created due to the partial event structure (TE1) of the first model (M), which contains impermissible sequences of inputs and outputs, to test the occurrence of such impermissible sequences, and/or a test case (T) is created on the basis of a partial event structure (TE2) of the event structure (ES2) of the second model (M) in order to test the absence of incorrect sequences, with the Partial event structure (TE1) is chosen in such a way that it enables sequences of actions (A) that are identical to the impermissible sequences of actions (A) for as long as possible, and - test cases (T) based on conflict-free partial event structures (TE1; TE2) are constructed by collecting sequences of actions (A) corresponding to events (E), ranking events conditional before conditional events according to the causality relations (KaR), and these with possible alternative outputs corresponding to events determined according to the causality relations (KaR) and/or conflict relations (KoR) of the entire event structure (ES1, ES2), each can occur after the current event (E), but are not part of the sequence, are added to test cases (T), or - just in case that there are no differences in the sequences of inputs and outputs, no test case (T) is created. 3. The method according to claim 2, characterized in that when executing a test case (T) in a system to be tested, the inputs are supplied to the system and observed outputs are compared with the test case (T), - where a test-case (T) is considered correctly executed if, given the correct order of the sequence of inputs, the expected sequence of outputs is observed, - where the test-case (T) is considered inconclusively executed if with the correct order of the sequence at inputs, an output is observed that deviates from the sequence but is present in the optional list of alternative outputs, - where the test-case (T) is considered failed if, with the sequence of inputs correctly sequenced, an output that deviates from the sequence is observed and is not present in the optional list of alternative outputs. 4. The method according to claim 2 or 3, characterized in that test cases (T) are created by - targeted use of errors in a model (M; M1; M2), in particular mutation of the model (M; M1; M2), and /or - further development of a model (M; M1; M2) and/or - independent development of a model (M; M1; M2) in several ways and/or - different levels of abstraction of a model (M; M1; M2). 5. Method according to one of the preceding claims, characterized in that - the types of actions (A) of the models (M; M1; M2), in addition to inputs and outputs, include internal actions, - wherein internal actions include such actions (A) indicate that bring the system into a new state without being recognizable and/or controllable from outside the system, and - whereby no events (E) for internal actions are created when event structures (ES; ES1; ES2) are set up, in particular, the effects of which flow into all events (E) that follow an internal action and that correspond to inputs and outputs. 6. The method according to any one of the preceding claims, characterized in that the comparison of the first event structure (ES1) of the first model (ES1) with the second event structure (ES2) of the second model (M2) according to step d) after a predetermined number of events (E) is aborted. 7. The method according to any one of the preceding claims, characterized in that - in the construction of event structures (ES; ES1; ES2) according to step b) a model to be compared, in particular both models to be compared (M; M1; M2), partially in a Event structure (ES; ES1; ES2) is transferred, with partial event structures being built which, starting from a given state, correspond to partial executions of the model (M; M1; M2), in which all possible outputs of the system have taken place and an input is required makes in order to obtain further outputs of the model (M; M1; M2), and - and these event structures (ES; ES1; ES2) parts of a first model (M1), and parts of a second model (M2), in particular parts of a modification of the first model (M1) or models created by modifying a common predecessor model, which correspond to the respective partial event structures, starting from a common state, - where only the subset of all sequences of actions are examined for differences that are in the event structures (ES; ES1; ES2) are included. 8. The method as claimed in claim 7, characterized in that the subsets of input sequences to be examined are selected by - heuristics and/or - random selection and/or - complete selection. 9. The method according to any one of the preceding claims, characterized in that a static analysis of accesses to variables (V) is used when setting up event structures (ES; ES1; ES2) according to step c), - where two actions are assumed to conflict if one action uses a variable that the other action assigns a value to, or both actions assign a value to the same variable, and - whereby information about access to variables (V) of an action (A) is used to limit the number of other actions whose admissibility may have changed after the action has been executed, - where the admissibility of a first action can only change through the execution of a second action if the condition for admissibility of the first action includes a variable that is changed by the second action, - where in particular a variable (V) only then of of an action can be changed if the execution of the action assigns a value to the variable (V), - whereby when building event structures (ES; ES1; ES2) after the insertion of an event (E) corresponding to an action only for the quantity restricted in this way actions (A) whose permissibility may have changed, and all events (E) that conflict with the inserted event, it is checked whether a new event (E) with such an action (A) is inserted. 10. The method according to claim 9, characterized in that an object-precise static analysis of accesses to variables (V) is used when setting up event structures (ES; ES1; ES2) according to step c), - where an object encapsulation of the respectively considered model (M; M1; M2) is used to create multiple instances of the same common object type, - A distinction is made between the same variables (V) of different instances of the same object type for the analysis of accesses to variables (V), in that the instance of a variable (V) with the respective object type is carried along dynamically at the time of execution. 11. Method according to one of the preceding claims, characterized in that - the states of each model (M; M1, M2) are indicated by measurements of state variables of the system represented in each case by the model (M; M1, M2) and - by the execution the actions (A) of each model (M; M1, M2) cause the change in an actuator of the respective system. 12. The method according to any one of the preceding claims, characterized in that a system created on the basis of a reference model is examined by - a further model is generated by mutation of the reference model, - that according to claim 2 test cases (T) by comparing the further model with are created using the reference model, - the system is tested using the test cases (T) generated in this way according to claim 3, with particular provision being made for - when executing a test case (T) in the system to be tested, the inputs are supplied to the system by the Sensors of the system are subjected to physical quantities to which they are sensitive, - the outputs of the system are determined by checking whether an actuator is performing an action, and - the observed inputs and outputs are compared with the respective test case (T). will. 13. The method according to claim 12, characterized in that the reference model is learned from the observation of a physical reference system. 10 sheets of drawings 30 / 40