Technical interoperability is the first and foremost requirement for the Industrial Internet of Things. It ensures connectivity and networking between heterogeneous devices and systems, enabling their collaboration across different network protocols, both locally and over the Internet. Devices designed for industrial use are well known for their robustness, precision, and high-quality finish; however, they typically come with one or a few fixed industrial network protocols. One traditional method of connecting two devices using different protocols is to use a converter that translates messages between the two network interfaces. This paper proposes a unified protocol translation method for multiple network interfaces. The method is validated in a product assembly line use case, in which the involved devices use four different industrial Ethernet protocols and frameworks: Modbus TCP, EtherNet/IP Class 1, OPC UA PubSub, and ROS 2. Moreover, the correctness of such a complex networking system is verified using a runtime verification approach grounded in a formal interaction model, ensuring that the observed communication behaviors conform to the expected specification.

Interaction languages such as MSC are often associated with formal semantics by means of translations into distinct behavioral formalisms such as automatas or Petri nets. In contrast to translational approaches we propose an operational approach. Its principle is to identify which elementary communication actions can be immediately executed, and then to compute, for every such action, a new interaction representing the possible continuations to its execution. We also define an algorithm for checking the validity of execution traces (i.e. whether or not they belong to an interaction’s semantics). Algorithms for semantic computation and trace validity are analyzed by means of experiments.

Data flow formalisms are commonly used to model systems in order to solve problems of buffer sizing and task scheduling. A prerequisite for static analysis of a modeled system is the existence of a periodic schedule in which the sizes of communication channels can be bounded for an unbounded execution (consistency), and that communication dependencies do not introduce a deadlock in such an execution (liveness). In the context of Cyber-Physical Systems, components are often interfaced with the physical world and have frequency constraints. The existing data flow formalisms lack expressiveness to fully cover the expected behavior of these components. We propose an extension to Synchronous Data Flow (SDF) formalism, called Polygraph, that includes frequency constraints and adjustable communication rates. We show that with these extensions, the conditions for a model to be consistent and live are no longer sufficient, and we extend the corresponding theorems with necessary and sufficient conditions to preserve these properties. We also introduce a framework to check the liveness of a Polygraph model, implemented in the tool DIVERSITY, along with preliminary experiments to validate this approach.

The progressive integration of software-based components into the electricity grid has given raise to what is known as Smart Grids. As long as Smart Grids gain on connectivity and automation, new concerns on their safety and security have arisen. It is agreed that non-negligible risks and enlarged impact due to misbehaviors and intrusions exist. Following a model driven paradigm, a method is proposed to reinforce the security of these complex widely distributed systems. The method guides system re-engineering and is based upon timed models. It encompasses reverse engineering, symbolic, and testing techniques to model, analyze, and deploy attack testing. In early stages of the method, a reference timed model to support security analyses is designed via reverse engineering and symbolic execution. During latter stages, the nominal models are enriched so as to specify attack scenarios which are symbolically executed to prove the ability of the system to detect attacker intrusions. In final stages, the attack scenarios are used to specify test cases which are later deployed to test the system. The method and main outcomes are presented relying upon a Smart Grid subsystem analyzed in the scope of a joint academy-industry project.

Remotely-communicating software-based systems are tightly present in modern industrial society and securing their complex architecture is recognized as crucial. In particular, the perspectives to reinforce their security by monitoring are promising. However, monitoring schemes still face challenges as the presence of untrusted components seems unavoidable. Specially, since untrusted components may be placed in unsupervised areas, making them ideal targets for attackers. In this work, we propose a framework intended to support designers during systems conception. The approach mainly relies upon Security Watchdogs committed to detect and signal distrustful activity. A model-based framework is introduced to ease attacks descriptions upon scenarios in the form of UML sequence diagrams. The scenarios endowed with predefined attack patterns are analyzed using models transformations and symbolic techniques. By doing so, the effectiveness of watchdogs is confronted against attacks and the results can be used to reinforce the overall security of the system. The applicability of the proposed method is also shown by means of a Smart Grid case study.

Modern industrial systems are often large and distributed. Consequently, building the test harness for them can be technically challenging. A compositional approach attempts to overcome this problem by partitioning the system into smaller parts easier to test separately. And in particular, compositionality helps to avoid as much as possible testing the whole monolithic system thanks to mathematical results which relate the global correctness of the system to the correctness of its constituent parts. In this paper, we present a compositionality result for model-based testing in the setting of the conformance relation tioco which is dedicated to timed systems. We show how to exploit this result in practice by extending a previously defined symbolic testing framework.

In this paper, we pursue our works on generic modeling and testing of component-based systems. Here, we extend our conformance testing theory to the testing of component-based systems. We first show that testing a global system can be done by testing its components thanks to the projection of global behaviors onto local ones. Secondly, based on our projection techniques, we define a framework to build adequate test purposes automatically for testing components in the context of the global system where they are plugged in. The basic idea is to identify from any trace try of the global system, the trace of any component involved in tr. Those projected traces can be then seen as test cases that should be tested on individual components.

In early design phases, system models can be characterized as intended interactions between black box components. Moreover, when dealing with embedded systems, it is usual that interactions are constrained by timing issues. We propose to represent such system models as structured scenarios by using UML sequence diagrams specialized with the MARTE profile to handle timing constraints. By using symbolic execution techniques, we show how to analyze these system models and how to extract behavioral constraints concerning components. Those constraints can be used as unitary test purposes to select components of the system.

An orchestrator in a Web Service system is a locally deployed piece of software used both to allow users to interact with the system and to communicate with remote components (Web Services) in order to fulfill a goal. We propose a symbolic model based approach to test orchestrators in the context of the systems they pilot. Our approach only takes as input a model of the orchestrator and no models of the Web Services. Besides, the testing architecture is a parameter: communications between Web Services and the orchestrator can be either simulated, or hidden or observable. When they are simulated, the orchestrator is tested in isolation and our approach comes to already defined classical model-based unit testing approaches. When the System Under Test is connected with Web Services (that is, in actual usage) it is no longer fully controlled by the tester, but tested in context In that case two situations may occur: either communications with Web Services are observable or they are hidden. Our approach copes with those cases. We give theorems relating our notion of conformance in context with regard to classical conformance of components in isolation. We present a test case generation algorithm based on symbolic execution techniques: it takes into account the status (controllable, hidden, or observable) of communication channels between the orchestrator and Web Services. The algorithm has been implemented and is illustrated on a small case study.

This paper presents a symbolic execution framework devoted to system models, recursively defined by interconnecting component models. Our concern is to allow one to explicitly define interaction rules between components, while taking into account those rules at the symbolic execution phase. The paper introduces a small set of primitives dedicated to this purpose, together with their associated symbolic execution rules.

We present an institution of feature logics which generalises our earlier approach (2001) and define a refinement theory to deal with the complexity of feature interactions in this generic framework, which is one of the main problems encountered when dealing with feature interaction detection. The study of interactions through implementation techniques is still an open problem. The authors furnish answers to encounter this purpose in a logic-independent framework, using algebraic refinement techniques.