WO2022201647A1

WO2022201647A1 - Method and system for correcting operation of target computer system by using timed requirement

Info

Publication number: WO2022201647A1
Application number: PCT/JP2021/044605
Authority: WO
Inventors: Reiya NOGUCHI; Thierry JERON; Nicolas MARKEY; Ocan SANKUR
Original assignee: Mitsubishi Electric Corp; Mitsubishi Electric R&D Centre Europe BV Netherlands
Current assignee: Mitsubishi Electric Corp; Mitsubishi Electric R&D Centre Europe BV Netherlands
Priority date: 2021-03-24
Filing date: 2021-11-30
Publication date: 2022-09-29
Anticipated expiration: 2023-09-24
Also published as: CN116982032A; JP7536199B2; EP4064057A1; JP2023552247A; US20240134771A1; EP4064057B1

Abstract

The present disclosure relates to a method for correcting the operation of a target computer system constrained by an inconsistent set of timed requirements, the set of timed requirements comprising a first subset and a second subset, said method comprising initializing a set of constraints based on a witness trace of the inconsistency, and iterating steps of: • - modifying the second subset of timed requirements to obtain an updated set of timed requirements for which each constraint in the set of constraints is satisfied; • - searching for a further witness trace of the inconsistency of the updated set of timed requirements; • - when a further witness trace is found: augmenting the set of constraints based on said further witness trace; wherein the operation of the target computer system is considered corrected when no further witness trace is found for an updated set of timed requirements.

Description

[DESCRIPTION]

[Title of Invention]

METHOD AND SYSTEM FOR CORRECTING OPERATION OF TARGET COMPUTER SYSTEM BY USING TIMED REQUIREMENT [Technical Field]

[0001]

This disclosure relates to requirement engineering for computer systems and relates more specifically to a method and system for correcting the operation of a target computer system by using timed requirements. [Background Art]

[0002]

In the process of developing computer systems, requirement engineering consists in defining, documenting and maintaining the requirements that a computer system needs to comply with. Requirements can be of different nature but, in computer systems, timed requirements are of importance. Basically, a timed requirement corresponds to constraints, including timing constraints, between outputs of the computer system and inputs to said computer system. In practice, timed requirements will be the basis of the design and development of the computer system. Also, timed requirements will partly drive the validation campaign in order to check that they are indeed complied by the actual computer system, once developed. [0003]

Of course, it is of primary importance to design timed requirements that are consistent, i.e. that are not contradictory such that implementations conforming with said timed requirements are indeed possible and may be designed and developed.

[0004]

In the scientific literature, there exist different consistency notions defined for timed requirements of real-time systems. For instance, real-time consistency (a.k.a. RT-consistency) [PHP11] requires that all finite execution sequences that do not already violate some timed requirement have an extension that satisfies all of them. Put differently, this means that if an implementation produces a finite execution sequence whose all continuations necessarily lead to the violation of some timed requirement, then there must be a timed requirement that is already violated by the finite execution sequence. [0005]

However, once an inconsistency of a set of timed requirements is detected, or another issue, the set of timed requirements needs to be corrected, which can be extremely complex even for an experienced requirement engineer. [Summary of Invention]

[0006]

The present disclosure aims at proposing a solution for correcting automatically, by a correcting computer system, inconsistencies of a set of timed requirements describing the operation of a target computer system. [0007]

According to a first aspect, the present disclosure relates to a computer implemented method for correcting the operation of a target computer system. The operation of the target computer system is constrained by a set of timed requirements, and an execution sequence of the target computer system, referred to as witness trace, satisfies a criterion for detecting a conflict between timed requirements of the set of timed requirements, referred to as inconsistency. The set of timed requirements comprises a first subset and a second subset of timed requirements. The method comprises initializing a set of constraints based on said witness trace, and iterating steps of:

- modifying the second subset of timed requirements to obtain an updated set of timed requirements for which each constraint in the set of constraints is satisfied;

- searching for a further witness trace of the inconsistency of the updated set of timed requirements;

- when a further witness trace is found: augmenting the set of constraints based on said further witness trace; wherein the operation of the target computer system is considered corrected when no further witness trace is found for an updated set of timed requirements. [0008]

The target computer system may be any computer system for which timed requirements may be defined, such as an embedded electronic system and/or mechatronic system and/or a mechanical control system, etc.

[0009]

The operation of the target computer system is constrained by a set of timed requirements. Correcting the operation of the target computer system relies on evaluating said operation by simulating the behavior of the target computer system at the timed requirement level, in order to detect e.g. inconsistencies among the timed requirements and/or vacuous timed requirements. Correcting the operation of the target computer system therefore corresponds to correcting the set of timed requirements which constrain the operation of said target computer system. Hence, it is emphasized that the correcting method does not interact with the actual target computer system, which may not be designed or developed yet, but evaluates the operation of the target computer system by simulating its behavior at the timed requirement level. Accordingly, the correcting method is carried out by a correcting computer system that is different from the target computer system.

[0010]

As discussed above, a timed requirement may be viewed as constraints, including timing constraints, between outputs of the target computer system and inputs to said target computer system.

[0011]

The correcting method uses execution sequences of the target computer system, referred to as “witness traces”, that lead to conflicts between timed requirements, i.e. that lead to at least one timed requirement being violated. An execution sequence basically corresponds a sequence of inputs to the target computer system and resulting outputs from said target computer system at successive time steps. A timed requirement is violated when the constraints it defines cannot be satisfied at some point. The witness trace itself does not violate a timed requirement yet. However, the witness trace is not prevented to occur by the considered timed requirements and yet it reaches a configuration of the target computer system from which at least one timed requirement will be necessarily violated at some point.

[0012]

When such a witness trace demonstrating the inconsistency (e.g. RT- inconsistency) of the set of timed requirements is found, it is used to define a (trace-based) constraint which is included in a set of constraints.

[0013]

Then the correcting method iteratively modifies a second subset of timed requirements, while maintaining unchanged a first subset of timed requirements, to obtain a modified second subset such that each constraint in the set of constraints is satisfied. For instance, for a witness trace σ , the constraint included in the set of constraints may require that said witness trace σ is prevented from occurring when considering the updated set (combining the first subset and the modified second subset) or that it ceases to be an inconsistency witness trace when considering the updated set.

[0014]

Once such a modified subset is found (satisfying all the constraints of the set of constraints), it is further verified whether further issues are detected for the updated set. For instance, it is verified whether a further witness trace of the inconsistency of the updated set can be found. If such a further witness trace can be found, then the set of constraints is incremented with a further constraint based on said further witness trace (i.e. this constraint is added to the other previous constraints present in the set of constraints).

[0015]

Hence, the set of constraints is iteratively incremented with constraints which are defined by witness traces. When modifying the second subset of timed requirements, such trace-based constraints can be easily verified, such that a modified second subset satisfying all the constraints can be searched for with a reasonable computational complexity. When no further witness trace is found for an updated set, then this updated set can replace the original set, thereby correcting the operation of the target computer system.

[0016]

In specific embodiments, the correcting method can further comprise one or more of the following features, considered either alone or in any technically possible combination.

[0017]

In specific embodiments, the correcting method comprises iterating steps of:

- searching for a timed requirement in the first subset, referred to as vacuous timed requirement, which cannot be triggered when considering the updated set of timed requirements;

- when a vacuous timed requirement is found: determining an execution sequence, referred to as triggering trace, which triggers the vacuous timed requirement when considering the first subset of timed requirements, and augmenting the set of constraints based on said triggering trace; wherein the operation of the target computer system is considered corrected when no further witness trace and no vacuous timed requirement is found for an updated set of timed requirements.

[0018]

Hence, it is also possible to correct not only the consistency of the updated set but also its non- vacuity. Once a modified second subset is found (such that the updated set satisfies all the constraints of the set of constraints), it is further verified whether one or more timed requirements of the first subset have become vacuous due to the modifications made to the second subset. If such a vacuous timed requirement is found, then an execution sequence that triggered said timed requirement before modifying the second subset, referred to as “triggering trace”, is identified and used to add a further constraint to the set of constraints. For instance, the added constraint may require that the modified second subset of subsequent iterations does not prevent said triggering trace to occur, thereby removing the vacuity. Again, such (triggering) trace-based constraint can be easily verified.

[0019]

In specific embodiments, augmenting the set of constraints based on a further witness trace of the inconsistency of the first subset of timed requirements comprises adding a constraint requiring that the modified second subset of timed requirements of subsequent iterations prevents said further witness trace to occur.

[0020]

In specific embodiments, augmenting the set of constraints based on a further witness trace of the inconsistency of the updated set of timed requirements which is not a witness trace of the inconsistency of the first subset of timed requirements comprises adding a constraint requiring that: - either the modified second subset of timed requirements of subsequent iterations prevents said further witness trace to occur;

- or said further witness trace is not a witness trace of the inconsistency of the updated set of timed requirements of subsequent iterations.

[0021]

In specific embodiments, the operation of a target computer system is initially constrained by the first subset of timed requirements and correcting the operation of the target computer system comprises adding the second subset of timed requirements to the first subset of timed requirements.

[0022]

In specific embodiments, the correcting method comprises determining a subset of parameters of the set of timed requirements based on the witness trace, and determining the first and the second subset based on the subset of parameters, wherein the second subset is modified by modifying only parameters in said subset of parameters.

[0023]

In specific embodiments, the second subset is modified such that a distance between any modified second subset and the initial second subset does not exceed a predetermined maximum distance.

[0024]

In specific embodiments, the criterion for detecting a conflict is satisfied when an RT-inconsistency is detected.

[0025]

In specific embodiments, the second subset of timed requirements is modified to obtain an updated set of timed requirements for which each constraint in the set of constraints is satisfied and for which all timed requirements in the modified second subset can be triggered when considering the updated set of timed requirements. [0026]

In specific embodiments, the correcting method comprises augmenting the set of constraints based on a desired trace that can occur when considering the original set of timed requirements but is prevented from occurring by an updated set of timed requirements. This is advantageous for it prevents from reducing too drastically the set of possible execution sequences (traces) when correcting the set of timed requirements. Indeed, defining a constraint based on a desired trace ensures that said desired trace will remain in the set of possible execution sequences (i.e. correcting the set of timed requirements will not prevent the desired trace from occurring). The constraint added to the set of constraints typically requires that the updated set of subsequent iterations does not prevent said desired trace to occur.

[0027]

In specific embodiments, searching for a witness trace or a triggering trace uses a Satisfiability Modulo Theories, SMT, solver.

[0028]

In specific embodiments, each timed requirement is modeled as a Simplified Universal Pattern, SUP. SUPs are a type of timed requirements, for which computationally efficient specific consistency checking tools exist. [0029]

According to a second aspect, the present disclosure relates to a computer program product comprising instructions which, when executed by at least one processor, configure said at least one processor to carry out a correcting method according to any one of the embodiments of the present disclosure.

[0030]

According to a third aspect, the present disclosure relates to a computer-readable storage medium comprising instructions which, when executed by at least one processor, configure said at least one processor to carry out a correcting method according to any one of the embodiments of the present disclosure.

[0031]

According to a fourth aspect, the present disclosure relates to a correcting computer system for correcting the operation of a target computer system, said correcting computer system comprising at least one processor configured to carry out a correcting method according to any one of the embodiments of the present disclosure.

[0032]

It should be noted that the present disclosure may also be applied when the original set is only vacuous, i.e. no conflict between timed requirements is detected but one or more timed requirements cannot be triggered in the original set of timed requirements.

[0033]

Hence, according to a fifth aspect, the present disclosure relates to a computer implemented method for correcting the operation of a target computer system, said operation of the target computer system being constrained by a set of timed requirements comprising a first subset and a second subset of timed requirements, wherein a timed requirement of the first subset, referred to as vacuous timed requirement, cannot be triggered when considering the set of timed requirements, and an execution sequence, referred to as triggering trace, triggers the vacuous timed requirement when considering the first subset, wherein said method comprises initializing a set of constraints based on said triggering trace, and iterating steps of:

- modifying the second subset of timed requirements to obtain an updated set of timed requirements for which each constraint in the set of constraints is satisfied; - searching for a further vacuous timed requirement in the first subset which cannot be triggered when considering the updated set of timed requirements;

- when a further vacuous timed requirement is found: determining a further triggering trace which triggers the further vacuous timed requirement when considering the first subset of timed requirements, and augmenting the set of constraints based on said triggering trace; wherein the operation of the target computer system is considered corrected when no further vacuous timed requirement is found for an updated set of timed requirements.

[0034]

The invention will be better understood upon reading the following description, given as an example that is in no way limiting, and made in reference to the figures.

[Brief Description of Drawings]

[0035]

[Fig. 1]

Figure 1 is a schematic representation of a timed requirement modeled as a Simplified Universal Pattern, SUP.

[Fig. 2]

Figure 2 is a schematic representation of an exemplary timed requirement modeled as a timed automaton.

[Fig. 3]

Figure 3 is a diagram representing the main steps of an exemplary embodiment of a correcting method.

[Fig. 4]

Figure 4 is a diagram representing the main steps of a preferred embodiment of a correcting method. [Description of Embodiments]

[0036]

In these figures, references identical from one figure to another designate identical or analogous elements. For reasons of clarity, the elements shown are not to scale, unless explicitly stated otherwise.

[0037]

The present disclosure relates to a method 30 and system for correcting the operation of a target computer system, wherein the operation of the target computer system is constrained by a set of timed requirements.

[0038]

We first introduce some definitions and conventions used in the following non-limitative description, and then we present different embodiments of the correcting method 30.

[0039]

(A. Definitions)

We consider target computer systems (such as Programmable Logic Controllers or PLCs) whose behaviors are driven by the observation of Boolean variables and are subject to discrete timing constraints. Intuitively, a run of the target computer system can be understood as a sequence of time steps at which the value of Boolean variables is observed, the evolution of the target computer system being governed by both timing constraints and the Boolean value of these Boolean variables.

[0040]

For this kind of target computer systems, timed requirements can for example be represented by timed automata such as those described in [AD90], with specific restrictions, but extended with Boolean variables.

[0041]

( A.1. Timed automata) Timed automata (TA) [AD90] extend finite-state automata with variables, called clocks, that can be used to measure (and impose constraints on) delays between various events along executions. More precisely, given a set

of clocks, the set of constraints allowed for a timed automaton is defined using the following grammar:

where c ranges over X, n ranges over N, ~ ranges over {<, <, =, >, >}, and the operator A corresponds to the logical “AND”. We consider integer-valued clocks. The semantics of such clock constraints may be defined as follows: given a clock valuation r: X ® M, that a constraint holds true at

v, denoted v\=g,is defined inductively as follows:

[0042]

For a valuation an integer d £ N, and a subset R <º X, we

define v -1- d as the valuation ( v + d)(c) = v(c ) + d for all c £ X , and

R. Finally, we let 0 be the valuation mapping all variables to 0.

[0043]

In our timed automata, we also consider the observation of the evolution of the target computer system through the values of Boolean variables. We thus consider a set of atomic propositions,

and we define the set of Boolean constraints ®(AP) as the set of all propositional formulas built on AP. Notice that those Boolean variables cannot be modified, but are only observed, since they belong to the target computer system itself, contrary to clocks that can be reset since they are owned by the timed requirement only and used by it to check timing constraints.

[0044] We consider timed automata over the alphabet 2^AP. For succinctness, transitions will be labelled with Boolean constraints on AP rather than with a list of sets of atomic propositions.

[0045]

A timed automaton is a tuple where S is a

finite set of states, S_{0 Q} S is a set of initial states, X is a finite set of clocks, is a finite set of transitions, and F Q S is

a subset of accepting states (F = S\E wherein F is a subset of error states. [0046]

A configuration of a timed automaton is a pair (s, v) where s E S and With a timed automaton _<A, we associate the infinite-state automaton

- the set of states Q contains all configurations

- the initial states are obtained by adjoining the null valuation (all clocks are mapped to zero) to initial states

-

is the alphabet of actions, i.e. valuations of all Boolean variables;

- transitions in D are combinations of a transition of the timed automaton and a 1 -time-unit delay. Formally, given a E å and two configurations (s, v) and (s', v'), there is a transition ((s, v), a, (s', i )) in D if, and only if, there is a transition (s, c, g, r, s') in T such that a\=c and v\ =g, and

-

is the set of accepting configurations.

[0047]

It should be noted that the transition system S (_{c /}V) is infinite because we impose no bound on the values of the clocks during executions. However, as is classical in the setting of timed automata [AD90], we may notice that the exact value of a clock is irrelevant as soon as it exceeds the largest integer constant with which it is compared. We could thus easily modify the definition of in such a way that it only contains finitely many states.

[0048]

A run of is a run of its associated infinite-state automaton It

can be represented as a sequence along which configurations and actions alternate:

[0049]

An execution sequence (or trace) of this sequence is its projection on the set of actions. In other terms, it is a finite or infinite sequence

of actions where is the length of σ, denoted with |s| . Finite

traces belong to and infinite ones to å^¥. A finite run is accepted if it ends

in

is accepted by A if there is an accepted run

[0050]

In the sequel, we will need to consider several timed requirements, each of them specified by a timed automaton. To this aim, we define the product of timed automata. Formally, given two timed automata A₁ = and with disjoint clock sets (i.e., X₁ n X₂ = 0), their product is a timed automaton A =

X = X₁ U X₂ , F = F₁ x F₂, and the set of transitions is defined as follows:

[0051] This product of timed automata can be easily generalized to an arbitrary number of timed automata, and timed requirements that they specify. For a set of timed requirements, each specified by a timed automaton

we note the timed requirement specified by the timed automaton

(A.2. Execution sequences)

In the sequel, we consider in a non-limitative manner that the timed automata are complete, meaning that from any (reachable) configuration (s, v), and for any subset s of AP, there is a transition in T such that

and Also, the timed automaton are considered in a non-limitative

manner to be deterministic, i.e. for any two configurations (a, c, g, r, s ) and (hence starting from the same state a) such that both c A c' and are satisfiable, then

[0053]

Also, we consider in a non-limitative manner that the timed automata are safe, meaning that there are no transitions from Under such

a condition, a run is accepted if and only if it never visits E = S\F.

[0054]

Notice that those properties are preserved when composing several timed automata. We use timed automata to encode timed requirements. Intuitively, entering an error state (i.e. leaving the subset F of accepted states) of a timed automaton corresponds to violating the corresponding timed requirement. In the sequel, for any timed automaton Α/I and any finite or infinite execution sequence (also referred to as “trace”) σ , we write satisfies

) if and only if σ does not violate A, i.e. running s on _<A does not visit E.

[0055]

As discussed above, we consider a set of atomic

propositions. A valuation is of type , wherein T means “true”

and _L means “false”. In preferred embodiments, a generalized valuation may be used, of type }. In such generalized valuations, some atomic

propositions are assigned to *, which stands for a “don’t care” value, i.e. it is not important whether the value is actually T or J_. We write v £ v' for two generalized valuations whenever for any

*, then v(x) = v'(x). In other words, v £ v' means that v is less generalized than v’ . We define DontCare(V) = {x G AP | v(x) =*}. This is the set of “don’t care” variables of the valuation. Intuitively, a generalized valuation v represents the set of valuations v' such that v' < v.

[0056]

A tracer is therefore a sequence of valuations of length \s\ and a generalized trace is a sequence of generalized valuations. A concretization of a generalized trace s is a trace s' such that for all A

generalized trace then represents a set of traces, i.e. the set of the concretizations of said generalized trace.

[0057]

We denote by A

the set of i -th copies of atomic propositions. A (generalized) trace of length k can be seen as a (generalized) valuation over AP_1, ... , AP_fc,. For a generalized trace s, let DontCare(σ) be the subset of AP₁ U ... U APk., that are assigned to

[0058]

(A.3. Simplified Universal Patterns (SUP))

In this subsection, we describe a pattern language called Simplified Universal Pattern (SUP) [Bee 19] that can be used to define timed requirements. Compared to timed automata, SUPs offer a more intuitive though less expressive way of writing timed requirements. All SUPs can be written as timed automata, but not all timed automata can be written using SUPs. [0059]

SUP instances can be denoted by:

[0060]

A SUP instance is thus defined by the choice of the Boolean formulas TSE, TC, TEE, ASE, AC, AEE, and durations Tmin, Tmax, Lmin, Lmax, Amin, Amax. The Boolean formulas are propositional formulas built from system Boolean variables in a set AP of atomic propositions. For simplicity, when talking about an individual SUP, we gather the values of these parameters in a vector P, and refer to its elements using the names of the parameters (e.g. P_TSE is the value of the first parameter TSE). But we should remember that they are valuations of formulas, and when several SUPs are considered, since they may refer to some common Boolean variables, their valuations may interfere on those variables.

[0061]

Figure 1 illustrates the intuitive semantics of SUP. Intuitively, the left part of a SUP defines a trigger phase, while the right part is the action phase. For a trigger phase to be realized, TSE (“Trigger Start Event”) has to be true, and then confirmed within a duration in [Tmin, Tmax] . Confirmation means that TC (“Trigger Condition”) holds until TEE (“Trigger End Event”) occurs. Otherwise the trigger is aborted.

[0062]

If the trigger phase is realized, for the SUP to be satisfied, its action phase should be started by ASE (“Action Start Event”) within [Lmin, Lmax] time units, and then confirmed. That an action phase is realized is defined as for triggers, with a confirmation duration within [Amin, Amax], during which both AC (“Action Condition”) holds until AEE (“Action End Event”) occurs. Otherwise, the SUP is violated.

[0063]

Figure 2 represents schematically an example of deterministic timed automaton that can be used to encode a SUP timed requirement, since a SUP timed requirement is a special case of a timed automata as defined above. [0064]

As can be seen in figure 2, the timed automaton encoding the SUP timed requirement has five states idle, trig, delay, act and err (wherein err is the only error state), and an associated clock c. Also, in figure 2, the operator V corresponds to the logical “OR” and the operator - corresponds to the logical operator “NOT”.

[0065]

This timed automaton clearly exhibits the successive phases of a SUP. However, the real timed automaton we use to encode a SUP is the transitive closure of the timed automaton depicted on Figure 2. For instance, if both TSE and TEE hold true at the same time and Tmin = 0, then the transitions from idle to trig and from trig to delay have to be taken at the same time. All maximal simple (i.e. where no transitions may appear twice) sequences of transitions have to be merged this way, provided that the conjunctions of their Boolean constraints and clock guards (taking intermediary clock resets into account) can be satisfied.

[0066]

For such a SUP, we define the set of Boolean parameters as 7_b = (TSE, TC, TEE, ASE, AC, AEE) , and the set of time parameters as 7_t = (Tmin, Tmax, Lmin, Lmax, Amin, Amax}, and their union As

discussed above, SUPs can be defined as a valuation P of those parameters. We write SUP (P) for the SUP with parameters defined by P, and cA_SUP(P) for the complete deterministic timed automaton corresponding to SUP (P). [0067]

In the rest, we consider in a non-limitative manner SUPs whose Boolean parameters are defined as conjunctive formulas. Also, we define the distance between two conjunctive formulas as:

where 0 denotes the symmetric difference. For two time bounds T, T', we extend this definition to d(T, T') = \T — T'\. The distance between two SUPs with parameters P and P' is the sum of the distances of their parameters: Furthermore, given two vectors of SUP requirements of the same size, and

[0068]

(A.4. RT-consistency and non-vacuity)

As discussed above, there exist different consistency notions defined for real-time systems’ timed requirements, such as RT-consistency [PHP11], partial consistency [Bee 19], etc. In the sequel, we consider in a non-limitative manner the case of RT-consistency notion introduced in [PHP11].

[0069]

For any requirement R defined by a complete deterministic timed automaton A, and any finite or infinite trace s, we denote s fails R if running s in R ultimately leaves the subset F of accepting states. Similarly, we denote s I-fails R if for all infinite traces s', the trace s. s' ultimately leaves the subset F of accepting states.

[0070]

Hence, a set 31 of SUP requirements is RT-consistent if, for any finite trace s, if s

A trace that demonstrates the RT- inconsistency, referred to as “witness trace”, is then a finite trace s such that s I-fails but not s fails [0071]

In the sequel, we will use also the notion of non-vacuity, which is basically existential consistency with a non- vacuity condition. A set R of SUP requirements is non-vacuous if for each R G 31, there exists a trace that satisfies R and that triggers R. Such a trace is referred to as “triggering trace”.

[0072]

(B. Correcting method)

Figure 3 represents the main steps of a method 30 for correcting the operation of a target computer system (not represented in the figures).

[0073]

The correcting method 30 is carried out by a correcting computer system (not represented in the figures). In preferred embodiments, the correcting computer system comprises one or more processors (which may belong to a same computer or to different computers) and storage means (magnetic hard disk, optical disk, electronic memory, or any computer readable storage medium) in which a computer program product is stored, in the form of a set of program-code instructions to be executed in order to implement all or part of the steps of the correcting method 30. Alternatively, or in combination thereof, the correcting computer system can comprise one or more programmable logic circuits (FPGA, PLD, etc.), and/or one or more specialized integrated circuits (ASIC), etc., adapted for implementing all or part of said steps of the correcting method 30. In other words, the correcting computer system comprises a set of means configured by software (specific computer program product) and/or by hardware (processor, FPGA, PLD, ASIC, etc.) to implement the steps of the correcting method 30.

[0074]

The operation of the target computer system is constrained by a set R timed requirements.

[0075]

As illustrated by figure 3, the correcting method 30 comprises a step S30 of evaluating a criterion for detecting a conflict between timed requirements of the set 72 of timed requirements. The conflict detection criterion may use different notions of inconsistency checking, but we consider in a non-limitative manner that RT-inconsistency is evaluated.

[0076]

If the set 72 is considered to be RT-consistent (reference S30a in figure 3), then the execution of the correcting method 30 may stop. If the set 72 is considered to be RT-inconsistent (reference S30b in figure 3), typically by finding a trace s demonstrating the RT-inconsistency referred to as “witness trace”, then the correcting method 30 comprises a step S31 of initializing a set of constraints by using the witness trace s. The set

gathers trace-based constraints (i.e. constraints derived from execution sequences) that need to be satisfied when modifying the set 72.

[0077]

The set 72 of timed requirements is assumed to comprise a first subset 72_x and a second subset 72₂ of timed requirements, and the correcting method 30 will then proceed to try and correct the set 72 of requirements by modifying the second subset 72₂ while maintaining the first subset 72 _a unchanged.

[0078]

It should be noted that, in some embodiments, the first subset 72_j may correspond to the original set of timed requirements constraining the operation of the target computer system, for which a RT-inconsistency is detected. In such a case, one or more new timed requirements, which compose the second subset 72₂, may be added to the first subset 72 _c in order to obtain a set 72 = 72_! U 72₂ . Hence, the original subset 72_x is not modified, and the RT- inconsistency is corrected by finding new timed requirements which, when added to the subset R enable to obtain a set JZ that is RT-consistent.

[0079]

In other embodiments, the set JZ may be the original set of timed requirements constraining the operation of the target computer system, for which a RT-inconsistency is detected. In such a case, one or more timed requirements of the set R , which compose the second subset R are modified in order to obtain a set that is RT-consistent. In preferred embodiments, the second subset R may be modified such that a distance between any modified second subset R and the original second subset R does not exceed a predetermined maximum distance d_m , i.e. . This

embodiment is advantageous in that it prevents from modifying too significantly the set R

[0080]

Also, it should be noted that it is possible to combine both approaches, i.e. by both modifying some of the original timed requirements constraining the operation of the target computer system and adding new timed requirements. In such a case, the second subset R , to be modified, comprises both timed requirements of the original set and new timed requirements.

[0081]

In the sequel, we assume in a non-limitative manner, the case of SUP timed requirements. Hence, the set R may be defined as:

wherein n is the number of timed requirements. Also, we assume that the set JZ is updated by modifying only a predetermined subset M of parameters of the set In such a case,

an be the subset of

requirements without any parameter in M, and

[0082]

As discussed above, the original set may correspond to e.g. the first subset R_t (in which case RT-inconsistency is solved by adding one or more new timed requirements) or the set R (in which case RT-inconsistency may be solved by modifying some of the timed requirements of the set R).

[0083]

If the original set corresponds to the first subset R₁ then each new timed requirement may be initialized as a timed requirement trivial which denotes the SUP timed requirement that is trivially satisfied in which all Boolean parameters are T and all time parameters are 0. In such a case, the subset M of parameters may be chosen to comprise all the parameters of each added timed requirement trivial.

[0084]

If the original set corresponds to the set R, the subset M of parameters may be e.g. chosen arbitrarily. Preferably, the subset M of parameters is chosen based on the witness trace used to initialize the set

of constraints. For instance, the subset M of parameters comprises all the parameters P_p that are involved in the proof of the RT-inconsistency of the set R.

[0085]

As illustrated by figure 3, the correcting method 30 then comprises the following steps, which are iterated:

- a step S32 of modifying the second subset R₂ of timed requirements to obtain an updated set of timed requirements for which each constraint in the set

of constraints is satisfied;

- a step S33 of searching for a further witness trace of the RT- inconsistency of the updated set of timed requirements;

- when a further witness trace is found (reference S33b in figure 3): a step S34 of augmenting the set of constraints based on said further witness trace.

[0086]

Hence, the second subset R₂ is iteratively modified to produce an updated set R' = R_t U R!₂ ( R'2 corresponding to the subset obtained by modifying the subset R₂) at each iteration. It should be noted that, if it is not possible to satisfy all the constraints in the set

(case not considered in figure 3), then the set R cannot be completely corrected. If an updated set R' is found that is both RT-consistent (i.e. no further witness trace found, reference S33a in figure 3) and that satisfies all the constraints in the set

of constraints, then the correcting method 30 returns the updated set R' which is used to constrain and validate the operation of the target computer.

[0087]

As discussed above, the set

of constraints is initialized and augmented based on (further) witness traces of the RT-inconsistency. The initializing S31 and augmenting S34 steps are similar, the main difference being that the set C_å is empty before the initializing step S31. Basically, for each new (further) witness trace s of the RT-inconsistency, a new constraint f is added to the set

of constraints. The added constraint f may depend on whether the witness trace demonstrates the RT-inconsistency of the first subset R₁ (i.e. without considering the timed requirements of the second subset R₂ or of the modified second subset R'₂) or not (the RT-inconsistency requires to take into account all the timed requirements of the set R or of the updated set R'). In the first case (RT-inconsistency of the first subset R ), since the timed requirements of the first subset R₁ are not modified, the added constraint f may require that the modified second subset R'₂ of subsequent iterations prevents said (further) witness trace s to occur. In the second case (first subset R₁ alone not RT-inconsistent), then the added constraint f may require that:

- either the modified second subset R'₂ of subsequent iterations prevents said further witness trace s to occur;

- or said further witness trace s is not a witness trace of the RT- inconsistency of the updated set R ' of subsequent iterations.

[0088]

It should be noted that other issues of the set R may be corrected, in addition to or instead of the (RT-)inconsistency. For instance, the set JZ may be initially vacuous, and the correcting method 30 may be used to try and correct this vacuity by modifying the second subset R

[0089]

Figure 4 represents the main steps of a preferred embodiment of the correcting method 30, in which an initial RT-inconsistency is to be corrected while simultaneously ensuring that the updated set R is not vacuous.

[0090]

As illustrated by figure 4, the correcting method 30 comprises, in addition to the steps discussed in reference to figure 3, the following steps which are also iterated:

- a step S35 of searching for a timed requirement in the first subset R referred to as vacuous timed requirement, which cannot be triggered when considering the updated set R

- when a vacuous timed requirement is found (reference S35b in figure 4): a step S36 of determining an execution sequence, referred to as triggering trace, which triggers the vacuous timed requirement when considering the first subset R , and a step S37 of augmenting the set

of constraints based on said triggering trace.

[0091]

Hence, the second subset R is similarly iteratively modified to produce an updated set R at each iteration. However, it is further checked that no timed requirement of the first subset R becomes vacuous (i.e. cannot be triggered) when considering the updated set R '. If one timed requirement of the first subset R ₁ becomes vacuous, a triggering trace is found (which triggers said vacuous timed requirement when considering only the timed requirements of the first subset R ₁ ), and a new constraint f is added to the set

of constraints for future iterations.

[0092]

It should be noted that, if the first subset R itself is vacuous, then it is not possible to correct the set 31 without modifying the timed requirements of the first subset R . In such a case, the execution of the correcting method 30 may stop. The partition of the timed requirements between the first and second subsets R₁ and R₂ may be modified to ensure the non- vacuity of the first subset R ₁, which comprises the timed requirements that are not to be modified. [0093]

If it is not possible to satisfy all the constraints in the set

(case not considered in figure 4), then the set 31 cannot be completely corrected. If an updated set 31' is found that is RT-consistent (i.e. no further witness trace found, reference S33a in figure 3), non-vacuous (reference S35a in figure 4) and that satisfies all the constraints in the set

[0094]

The set

of constraints may be further augmented based on any such triggering trace found for a vacuous timed requirement of the first subset R . Basically, for each new triggering trace s, a new constraint f is added to the set of constraints. Basically, the added constraint f requires that the modified second subset R ₂ of subsequent iterations does not prevent said triggering trace s to occur. Such a constraint f ensures that the timed requirement associated to the triggering trace s is no longer vacuous in the updated set 31' of subsequent iterations.

[0095]

In preferred embodiments, the second subset 3l₂ of timed requirements is modified to obtain an updated set 31' of timed requirements for which each constraint in the set of constraints is satisfied and for which all timed requirements in the modified second subset 31' ₂ can be triggered when considering the updated set 31' of timed requirements. This ensures that, if a timed requirement of the updated set 31' is vacuous, then it is necessarily a timed requirement of the subset 3l .

[0096]

Also, in preferred embodiments, searching for a witness trace and/or a triggering trace and/or determining a modified second subset 31' ₂ such that the updated set 31' satisfies the set

of constraints uses a Satisfiability Modulo Theories, SMT, solver. Indeed, such SMT solvers are efficient in finding variable assignments satisfying given constraints. They prove very efficient in bounded model checking, which consists in checking traces of bounded length, and thus for searching for witness and/or triggering traces of bounded length. [0097]

(C. Detailed embodiments of the correcting method)

In the sequel, we describe specific preferred embodiments of correcting method 30. It is emphasized that the present invention is not limited to the below exemplary embodiments. Variants of these embodiments are also within the scope of the present invention.

[0098]

In the present embodiments, we consider in a non-limitative manner that the set 31 corresponds to SUP timed requirements, and that a subset M of parameters can be modified to correct the set 31. Also, the set 31 is modified to further ensure that

s minimized. In other words, the goal is to correct the set R with minimal modifications in the allowed subset M. Also, we assume in the sequel, in a non-limitative the manner, that the correcting method 30 uses SMT solvers and that the traces considered (e.g. witness and/or triggering traces) are generalized traces.

[0099]

Although the set R may use arbitrary Boolean parameters, we assume in a non-limitative manner that the parameters of the subset M are conjunctive formulas. Hence, we thus assume that each Boolean parameter is

a conjunctive formula and thus has the form where F_x is a literal.

For instance, each F_x can have three values representing x, ^~x or true. The modification of the subset M is therefore performed by selecting one of the three values for each literal F_x for x E AR, as well as values for the timing parameters in M n T_t. Hence, the parameter F may be expressed as:

[0100]

We denote by -R(M) the set of requirements obtained from R by replacing each parameter in M by conjunctive formulas where each literal is a fresh free variable as described above. A model for R(M ) defines a new set of timed requirements obtained from R by modifying parameters in the subset M. [0101]

If a given set of requirements is RT-inconsistent, then the SMT solver may return a generalized witness trace. This means that all concretizations of the returned generalized witness trace are witness traces to RT-inconsistency. Hence, when e.g. modifying the timed requirements in order to prevent a generalized witness to occur, this implies that all the concretizations of such a generalized witness trace are to be excluded. Handling generalized traces is advantageous in that the correcting method 30 learns the new constraints with less iterations.

[0102]

Observe that if at each step i, defines a concrete valuation, then there is a unique execution on any complete deterministic timed automaton (CDTA). But for a non-concrete execution, there are several corresponding executions in general. It is possible to write a formula, by using e.g. universal quantifiers, that constrains all concrete executions of s to enter a given set of states in a given timed automaton.

[0103]

Based on the above, given a set 32 of timed requirements, and R another timed requirement, we may define:

- which corresponds to the formula

describing that all concretizations of the generalized trace s trigger the timed requirement R

- , which corresponds to the formula

describing that all concretizations of the generalized trace s lead to the error states when considering the set 32 (M);

- which corresponds to the

formula describing that all concretizations of the generalized trace s lead to the accepting states when considering the set 32 (M); we will also denote s

- stands for free variables

encoding a one-step extension of s.

[0104]

The non-vacuity checking for a timed requirement

may be performed by a bounded search for a trace that triggers R without violating 32. Non-vacuity checking may be performed in different ways, and we present below two different examples of checking non-vacuity.

[0105]

According to a first example, non-vacuity checking searches for a finite trace triggering R without violating Jl. For a given set of timed requirements Jl, R Jl, and a bound a > 0, we define nonva c(R, Jl) as:

[0106

]

Thus, the above non-vacuity formula checks the existence of a trace s of size at most a, satisfying Jl and such that some prefix triggers R. Note that this is a partial non-vacuity check since the bound a needs to be fixed. Moreover, even if s\ =Jl, it is possible that no infinite extension of s satisfies Jl. However, this is independently handled by RT-consistency checking. [0107]

According to a second example, non-vacuity checking may check whether a timed requirement R can be triggered infinitely often. For a given set of timed requirements J , R E Jl , and a > 0 , let c/Z denote a CDTA corresponding to Jl. Define nonva c_¥(R,Jl) as:

[0108]

Hence, the non-vacuity formula nonvac_¥ ( R , Jl) is true when there is a lasso-shaped execution satisfying Jl and triggering R infinitely often.

[0109]

Both non-vacuity formulas can be used depending on the context. It might be that some timed requirements are meant to be triggered only a finite number of times along an execution (e.g. for the initialization phase of the target computer system), while some others might be naturally required to be triggered infinitely often. Checking nonvac_¥ is computationally more expensive in general for large sets of timed requirements since large bounds a need to be considered in order to find cycles in the joint state space (that is, in c Z).

[0110]

In the present embodiments, we are going to consider finite traces that trigger a given timed requirement R . Such traces, referred to as “triggering traces”, demonstrate the non-vacuity of the set of timed requirements. Such a triggering trace is easy to compute since the satisfiability of nonvac is witnessed by such a triggering trace. If we use SMT solvers for non-vacuity checking, such triggering traces can be obtained directly.

[0111]

Based on the above, we consider that the first subset

contains the timed requirements without any parameter in M, and the second subset R₂ is defined as denote the subset of SUP requirements

in which the parameters in M are replaced with conjunctive formulas with a fresh free variable for each literal. Hence, the goal is to compute values for M and instantiate which modifies and replaces the second subset

_{2 1 2} corresponds to the updated set of timed requirements. [0112]

Assume that the set R “ is RT-inconsistent and consider an RT- inconsistency witness trace s . Then, as discussed above, two different situations may be considered:

- if s is an RT-inconsistency witness trace in R_t, then, we need R'₂ to reject s (i.e. to prevent s from occurring), which may be encoded with

- if s is not an RT-inconsistency witness trace in R then R!₂ must be such that s is rejected or that it admits some extension that satisfies R ₁ U R'₂, which may be encoded

[0113]

For any propositional formula F , we denote by SAT(0) the satisfiability check which returns true or false.

[0114]

An exemplary pseudo-code implementation for an exemplary embodiment is given below.

[0115]

At each iteration, it is checked whether values can be assigned to M such that the resulting new timed requirement set satisfies all constraints in

and such that the timed requirements in can all be triggered. If such a model exists, then we consider the updated set

[0116]

In the above pseudo-code, we compute a minimal model M₀ for the subset M, i.e. a model that minimizes the distance between the updated and original timed requirements. Since all parameters in M are in conjunctive form in the set , we can easily express the distance between the new and original timed requirements. For

, let F_x denote the value for the literal x in F in the subse _x denotes its new value in the subset 31' ₂. Given a bound the following constraints bounds the distance of

[0117]

To compute a minimal model M₀ for M, we can run a binary search on the bound d_m. Using an incremental solver may render the successive calls more efficient, since between two calls, only the constraint on the upper bound changes.

[0118]

If the updated set is vacuous, then a vacuous timed requirement R is determined. The set of constraints is augmented based on whether or not the

timed requirement R is also vacuous within 3l . If the subset is vacuous,

this vacuity cannot be resolved. If the subset

is not vacuous, then we determine a triggering trace s that triggers R while satisfying and we may

add a ( ) to the set C_å of constraints

[0119]

If the updated set is non-vacuous, then we check the RT-consistency of If it is RT-consistent, then we return this updated set 3

Otherwise, we consider a witness trace s to the RT-inconsistency. The set C_å of constraints is augmented based on whether the witness trace s demonstrates the RT-inconsistency of 3l , in which case we add the constraint r to the set

of constraints. Otherwise, we add rej_CT

J?₂(^0) to the set C_å of constraints.

[0120]

It should be noted that, in some cases, the new timed requirements fixing the RT-inconsistency might be unsatisfactory if they excessively restrict the set of possible execution sequences that satisfy the updated set Ή.'. In this case, it is possible to further augment the set

of constraints to ensure that additional execution sequences, referred to as “desired traces” are not prevented from occurring when modifying the second subset

is a set of timed requirements which is non-vacuous and RT-consistent, then it is possible to search for a desired trace s (of given size k ), e.g. using a SMT solver, such that s\ =31 (here the original set

We may then add ( ^ to the set C_å of constraints and continue

iterating. It is possible to continue until a satisfactory solution is found (e.g. the set of possible execution sequences is not excessively restricted), or until no such further desired trace s exists or no M satisfying the set

of constraints exists. Each successful termination of the correcting method 30 yields a non- vacuous and RT-consistent updated set, so a user can choose one of these. [0121]

In the above pseudocode one can pick one concretization s' of the generalized witness trace s and using This yields a small SMT

query which can be solved faster but requires a possibly large number of iterations since only a small piece of information is learned at each iteration. [0122]

Another approach would consist in using universal quantifiers to define a formula that rejects all concretizations of the generalized witness trace s. For a partial valuation v, let s[n] denote the trace obtained by replacing each x by v(x) when v(x ) is defined. The formula V DontCare then rejects all concretizations of

the generalized witness trace s. Using universal quantifiers means that each query of the SMT solver is slower, although all concretizations are addressed. [0123]

(References)

[AD90] Rajeev Alur and David L. Dill. “Automata for modeling real time systems”. In Mike Paterson, editor, Proceedings of the 17th International Colloquium on Automata, Languages and Programming (ICALP’90), volume 443 of LNCS, pages 322-335. Springer, 1990.

[Bee 19] Jan Steffen Becker. “Analyzing consistency of formal requirements”. In Proceedings of the 18th International Workshop on Automated Verification of Critical Systems (AVOCS’18). EASST, 2019.

[PHP11] Amalinda Post, Jochen Hoenicke, and Andreas Podelski. “RT -inconsistency: a new property for real-time requirements”. In Proceedings of the 14th International Conference on Fundamental Approaches to Software Engineering (FASE’ 11), volume 6603 of LNCS. Springer, 2011.

Claims

[CLAIMS]

[Claim 1]

A computer implemented method for correcting the operation of a target computer system, said operation of the target computer system being constrained by a set of timed requirements, wherein an execution sequence of the target computer system, referred to as witness trace, satisfies a criterion for detecting a conflict between timed requirements of the set of timed requirements, referred to as inconsistency, wherein the set of timed requirements comprises a first subset and a second subset of timed requirements, wherein said method comprises initializing a set of constraints based on said witness trace, and iterating steps of:

- when a further witness trace is found: augmenting the set of constraints based on said further witness trace; wherein the operation of the target computer system is considered corrected when no further witness trace is found for an updated set of timed requirements.

[Claim 2]

Method according to claim 1, comprising iterating steps of

[Claim 3]

Method according to claim 2, wherein augmenting the set of constraints based on a triggering trace comprises adding a constraint requiring that the modified second subset of timed requirements of subsequent iterations does not prevent said triggering trace to occur.

[Claim 4]

Method according to any one of claims 1 to 3 wherein augmenting the set of constraints based on a further witness trace of the inconsistency of the first subset of timed requirements comprises adding a constraint requiring that the modified second subset of timed requirements of subsequent iterations prevents said further witness trace to occur.

[Claim 5]

Method according to any one of claims 1 to 4, wherein augmenting the set of constraints based on a further witness trace of the inconsistency of the updated set of timed requirements which is not a witness trace of the inconsistency of the first subset of timed requirements comprises adding a constraint requiring that:

- either the modified second subset of timed requirements of subsequent iterations prevents said further witness trace to occur;

[Claim 6]

Method according to any one of claims 1 to 5, wherein the operation of a target computer system is initially constrained by the first subset of timed requirements and correcting the operation of the target computer system comprises adding the second subset of timed requirements to the first subset of timed requirements.

[Claim 7]

Method according to any one of claims 1 to 5, comprising determining a subset of parameters of the set of timed requirements based on the witness trace, and determining the first and the second subset based on the subset of parameters, wherein the second subset is modified by modifying only parameters in said subset of parameters.

[Claim 8]

Method according to claim 7, wherein the second subset is modified such that a distance between any modified second subset and the initial second subset does not exceed a predetermined maximum distance.

[Claim 9]

Method according to any one of claims 1 to 8, wherein the second subset of timed requirements is modified to obtain an updated set of timed requirements for which each constraint in the set of constraints is satisfied and for which all timed requirements in the modified second subset can be triggered when considering the updated set of timed requirements.

[Claim 10]

Method according to any one of claims 1 to 9, comprising augmenting the set of constraints based on a desired trace that can occur when considering the original set of timed requirements but is prevented from occurring by an updated set of timed requirements.

[Claim 11]

Method according to any one of claims 1 to 10, wherein, searching for a witness trace and/or a triggering trace uses a Satisfiability Modulo Theories, SMT, solver.

[Claim 12]

Method according to any one of claims 1 to 11, wherein each timed requirement is modeled as a Simplified Universal Pattern, SUP.

[Claim 13]

Computer program product comprising instructions which, when executed by at least one processor, configure said at least one processor to carry out a correcting method according to any one of claims 1 to 12.

[Claim 14]

Computer-readable storage medium comprising instructions which, when executed by at least one processor, configure said at least one processor to carry out a correcting method according to any one of claims 1 to 12.

[Claim 15]

Correcting computer system for correcting the operation of a target computer system, said correcting computer system comprising at least one processor configured to carry out a correcting method according to any one of claims 1 to 12.