Deep reinforcement learning (DRL) has gained significant attention in autonomous systems, yet its black-box nature and lack of explainability hinder user trust in safety-critical domains such as autonomous driving. Existing experience replay approaches enhance sample efficiency but often fail to capture the internal causality of training data, leading to a convoluted training process that is difficult for humans to explain. In this work, we introduce Experience Replay with Causal Inference (ERCI), an explainable approach that integrates time series representation and causal inference to offer human-aligned explanations for DRL. Specifically, ERCI 1) introduces a novel multivariate time series representation to extract explainable Time Series Causal Factors (TSCF) from experimental data and 2) leverages internal causality in TSCFs with causal inference as a crucial standard for experience replay in DRL training. We evaluate ERCI using multiple baseline algorithms across diverse environments. Results show that ERCI provides human-aligned explanations and further improves sample efficiency through enhanced explainability. Notably, ERCI outperforms other state-of-the-art approaches by 15% in average performance, highlighting its effectiveness and generalizability.

Large language models (LLMs) have shown remarkable performance in reasoning tasks but face limitations in mathematical and complex logical reasoning.Existing methods to improve LLMs' logical capabilities either involve traceable or verifiable logical sequences that generate more reliable responses by constructing logical structures yet increase computational costs, or introduces rigid logic template rules, reducing flexibility.In this paper, we propose Reversal of Thought (RoT), a plug-and-play and cost-effective reasoning framework designed to enhance the logical reasoning abilities of LLMs during the warm-up phase prior to batch inference.RoT utilizes a Preference-Guided Reverse Reasoning warm-up strategy, which integrates logical symbols for pseudocode planning through meta-cognitive mechanisms and pairwise preference self-evaluation to generate task-specific prompts solely through demonstrations, aligning with LLMs' cognitive preferences shaped by RLHF.Through reverse reasoning, we utilize a Cognitive Preference Manager to assess knowledge boundaries and further expand LLMs' reasoning capabilities by aggregating solution logic for known tasks and stylistic templates for unknown tasks.Experiments across various tasks demonstrate that RoT surpasses existing baselines in both reasoning accuracy and efficiency.

This paper investigates $\sim_{\mathcal{L}_3}$-identifiability, a form of complete counterfactual identifiability within the Pearl Causal Hierarchy (PCH) framework, ensuring that all Structural Causal Models (SCMs) satisfying the given assumptions provide consistent answers to all causal questions. To simplify this problem, we introduce exogenous isomorphism and propose $\sim_{\mathrm{EI}}$-identifiability, reflecting the strength of model identifiability required for $\sim_{\mathcal{L}_3}$-identifiability. We explore sufficient assumptions for achieving $\sim_{\mathrm{EI}}$-identifiability in two special classes of SCMs: Bijective SCMs (BSCMs), based on counterfactual transport, and Triangular Monotonic SCMs (TM-SCMs), which extend $\sim_{\mathcal{L}_2}$-identifiability. Our results unify and generalize existing theories, providing theoretical guarantees for practical applications. Finally, we leverage neural TM-SCMs to address the consistency problem in counterfactual reasoning, with experiments validating both the effectiveness of our method and the correctness of the theory.

Imitation learning is a promising approach to acquiring autonomous driving policies by mimicking human driver behaviors. However, a major drawback of existing driving policies derived from imitation learning is their proneness to capturing spurious correlations, owing to the lack of an explicit causal model. Deploying such policies in unpredictable real-world environments poses severe risks, as spurious correlations may result in flawed decisions that compromise safety. To tackle this challenge, we introduce a novel approach called Multi-Task Invariant Representation Imitation Learning (MIRIL). MIRIL combines invariant learning with imitation learning to identify cross-environment invariant causal representations from driving demonstrations in various scenarios. These representations are then fed into multiple downstream branches for multi-task learning, including policy learning, perception prediction, invariant representation learning, and transition dynamics learning. Through the multi-task learning approach, the model not only makes consistent driving decisions across different environments but also perceives the vehicle's surroundings, thereby improving adaptability and robustness in diverse driving conditions. This enables MIRIL to effectively handle a wide range of driving scenarios, ensuring safety and efficiency. Supported by clear metrics, this paper details our comprehensive experimental setup, including datasets, benchmarks, and comparative analyses, underscoring the capability of MIRIL to significantly boost system generalization and excel in decision-making significantly.

End-to-end decision models based on deep learning have become increasingly prominent in automated driving systems. However, their black-box nature poses significant challenges to interpreting decision processes, especially in dynamic and complex scenarios. Existing approaches largely focus on post-hoc analyses or isolated single-step explanations, lacking comprehensive explanations from scenario understanding to decision-making and failing to address the complexity of real-world scenarios with coherent reasoning. To address these limitations, we propose ExplainDrive, a multimodal Chain-of-Thought reasoning framework that integrates causally optimized temporal representations with explainable decision-making. ExplainDrive follows a three-stage pipeline: (i) extracting spatio-temporal features via a Causal Temporal Former, (ii) constructing hierarchical scenario understanding, and (iii) progressively deriving driving decisions with interpretable rationales. This design enhances transparency at each intermediate step and mitigates spurious correlations through causal feature selection. Extensive experiments on the BDD-X and nuScenes datasets demonstrate that ExplainDrive consistently improves the quality of decision explanations and outperforms compared models across multiple key evaluation metrics.

Recent years have witnessed the success of recurrent neural network (RNN) models in time series classification (TSC). However, neural networks (NNs) are vulnerable to adversarial samples, which cause real-life adversarial attacks that undermine the robustness of AI models. To date, most existing attacks target at feed-forward NNs and image recognition tasks, but they cannot perform well on RNN-based TSC. This is due to the cyclical computation of RNN, which prevents direct model differentiation. In addition, the high visual sensitivity of time series to perturbations also poses challenges to local objective optimization of adversarial samples. In this paper, we propose an efficient method called TSFool to craft highly-imperceptible adversarial time series for RNN-based TSC. The core idea is a new global optimization objective known as “Camouflage Coefficient” that captures the imperceptibility of adversarial samples from the class distribution. Based on this, we reduce the adversarial attack problem to a multi-objective optimization problem that enhances the perturbation quality. Furthermore, to speed up the optimization process, we propose to use a representation model for RNN to capture deeply embedded vulnerable samples whose features deviate from the latent manifold. Experiments on 11 UCR and UEA datasets showcase that TSFool significantly outperforms six white-box and three black-box benchmark attacks in terms of effectiveness, efficiency and imperceptibility from various perspectives including standard measure, human study and real-world defense.

We propose an importance sampling method for tractable and efficient estimation of counterfactual expressions in general settings, named Exogenous Matching. By minimizing a common upper bound of counterfactual estimators, we transform the variance minimization problem into a conditional distribution learning problem, enabling its integration with existing conditional distribution modeling approaches. We validate the theoretical results through experiments under various types and settings of Structural Causal Models (SCMs) and demonstrate the outperformance on counterfactual estimation tasks compared to other existing importance sampling methods. We also explore the impact of injecting structural prior knowledge (counterfactual Markov boundaries) on the results. Finally, we apply this method to identifiable proxy SCMs and demonstrate the unbiasedness of the estimates, empirically illustrating the applicability of the method to practical scenarios.

While advanced classifiers have been increasingly used in real-world safety-critical applications, how to properly evaluate the black-box models given specific human values remains a concern in the community. Such human values include punishing error cases of different severity in varying degrees and making compromises in general performance to reduce specific dangerous cases. In this paper, we propose a novel evaluation measure named Meta Pattern Concern Score based on the abstract representation of probabilistic prediction and the adjustable threshold for the concession in prediction confidence, to introduce the human values into multi-classifiers. Technically, we learn from the advantages and disadvantages of two kinds of common metrics, namely the confusion matrix-based evaluation measures and the loss values, so that our measure is effective as them even under general tasks, and the cross entropy loss becomes a special case of our measure in the limit. Besides, our measure can also be used to refine the model training by dynamically adjusting the learning rate. The experiments on four kinds of models and six datasets confirm the effectiveness and efficiency of our measure. And a case study shows it can not only find the ideal model reducing 0.53% of dangerous cases by only sacrificing 0.04% of training accuracy, but also refine the learning rate to train a new model averagely outperforming the original one with a 1.62% lower value of itself and 0.36% fewer number of dangerous cases.

We present RoboSimVer, a tool for modeling and analyzing RoboSim models. It uses a graphical notation called RoboSim to describe platform-independent simulation models of robotic systems. For model analysis, we have implemented a model-transformation approach to translate RoboSim models into NTA (Network of Timed Automata) and their stochastic version based on patterns and mapping rules. RoboSimVer takes a RoboSim simulation model as input and provides different rigorous verification techniques to check whether the simulation models satisfy property constraints. For experimental demonstrations, we adopt the alpha algorithm for swarm robotics as a case study. We use an abstract robotic-platform model to describe a swarm in an uncertain environment and illustrate how our tool supports the verification of stochastic and hybrid systems. The demonstration video is at youtu.be/mNe4q64GkmQ.

Autonomous Driving Systems(ADS) require extensive evaluation of safety before they can come onto the market. However, since relying solely on field testing is practically infeasible due to the impossibility to cover sufficient distances to ensure adequate safety, the focus shifted to scenario-based testing. The challenge is to generate scenarios flexibly. We proposed Scenario Modeling Language for ADS (SML4ADS) as a Domain-Specific Modeling Language (DSML) for scenario representation and generation. Compared to other existing works, our approach simplifies the description of scenarios in a non-programming, user-friendly manner, allows modeling stochastic behavior of vehicles and generating executable scenario in CARLA. We apply SML4ADS in numerous typical scenarios to preliminarily demonstrate the effectiveness and feasibility of our approach in modeling and generating executable scenarios.

Modeling and verifying safety-critical scenarios of Autonomous Driving System (ADS) have increasingly attracted attention from academy and industry. The major challenge is lacking the domain-specific modeling language for ADS. To deal with this problem, we design and implement an Autonomous Driving Scenario Modeling Language (ADSML) based on the domain knowledge. The metamodel of ADSML describes the modeling elements and their relationships, which is used to capture the specific features of scenario. The concrete syntax of ADSML makes it easy to specify complex relationships among scenario elements, more important, we propose the contract module of ADSML to model the dynamic aspects of scenario. We use the semantics of Stochastic Hybrid Automata (SHA) to specify the dynamic behaviors in scenarios, which is seamlessly integrated with the model checker UPPAAL-SMC. With the help of the automatic model transformation, the ADSML models can be verified with UPPAAL-SMC to analyze the behaviors in scenarios. To demonstrate the feasibility, the scenario of lane change overtaking is modeled and some safety-critical properties are analyzed. The novelty of our approach is that it integrates the advantages of visual modeling and formal modeling. It helps the designers to model and verify the scenario models of autonomous driving systems.

RoboSim is a tool-independent notation for modeling software simulations of robots, and it can be verified by a variety of techniques and tools, including model checking and theorem proving. RoboSim has a formal tock-CSP (Communicating Sequential Processes) semantics, and so refinement checkers, such as FDR, can be used for verification of models. In this paper, we explore the use of UPPAAL, as a well-established tool for verification of time-dependent properties. We propose a model-transformation strategy to translate RoboSim models into NTA (Network of Timed Automata) based on some patterns and mapping rules. We implement our strategy as a plug-in for the RoboSim modeling and verification tool. Using examples, we compare the verification results of UPPAAL and FDR for a series of safety, reachability, and liveness properties. Moreover, we use a robotic platform model of swarm robots in an uncertain environment, to illustrate how our approach can be extended to the verification of stochastic and hybrid systems using UPPAAL SMC. Such an extension cannot be easily conceived for The original tock-CSP semantics of RoboSim.

Cyber-Physical Systems (CPS) connect the cyberworld with physical world with a network of interrelated el-ements, such as sensors and actuators. It is always runningin an open environment and the main characteristics of CPSis hybrid and stochastic. Domain-Specific Modeling Language(DSML) offers a tailor-made solution for modeling a specific field. However, there still lacks of DSML to model hybrid and stochasticbehavior in CPS. To address these issues, we propose a StochasticHybrid Modeling Language (SHML) based on domain modellanguage engineering, which supports modeling stochastic andhybrid behaviors in CPS. The abstract syntax, concrete syntax, and operational semantics of SHML are presented. The SHMLis implemented based on the GEMOC studio. With the help ofthe GEMOC execution engine and the Scilab plugin, the SHMLmodels can be executed to generate simulation traces of thesystem. These traces are fed into a statistical model checker whichsupports simulation-based verification to enable the qualitativeand quantitative analysis. The novelty of our work is that aDSML is proposed to model the behavior of CPS. Moreover, the tool prototype is implemented based on the model-drivenarchitecture. We illustrate the feasibility of our approach withan energy-aware building.

Assisted driving has always been a hot research issue. The existing work mainly focuses on modeling vehicles behavior. However, there still lacks research work of modeling and verifying driver behavior. To solve these problems, we are committed to modeling and analyzing the driver behavior with Markov Decision Process (MDP). The aim is to achieve safe driving by monitoring and predicting the driver's states. In this paper, we propose a novel approach to construct MDP models of driver behavior. It comprises four phases: (1) data preprocessing using Convolutional Neural Network (CNN), wherein we adopt CNN to extract the features of driver behavior with the simulation data; (2) Bayes-based learning, wherein we construct a training set and use the Naive Bayes algorithm to train the State Prediction Model (SPM); (3) MDP generating, wherein we propose an algorithm to generate MDP models for the driver behavior with the help of SPM; and (4) quantitative analysis, wherein we analyze the uncertain behavior of the driver with probabilistic model checking technology. The main novelty of our work is to model and verify the driver behavior by integrating the learning and the model checking technology. To implement our approach, we have developed the MDP generator. Moreover, the quantitative analyses of the driver behavior are conducted with the model checker PRISM. The experiment results show that our approach facilitates generating MDP models, which helps to model and analyze the uncertain behavior of the driver.

Cyber-physical systems (CPS) are generally defined as systems with integrated physical components and computational components. To simulate heterogeneous components of CPS, the Functional Mock-up Interface (FMI) standard provides the co-simulation technology to generate simulation traces. It play significant roles in analyzing and verifying behaviors of CPS. However, the FMI-based co-simulation algorithm called Master Algorithm with Step Revision (SRMA) is inefficient in some common scenarios. To improve the efficiency of SRMA, we propose an optimized Partial Rollback Co-simulation approach, which decreases the number of the rollback operations effectively. The novelty of our approach has two aspects. First, the Key FMUs Extractor and the Input/Output dependencies classification rules are proposed. They help to determine the minimum set of FMUs which are used to rollback for correcting the simulation error. Second, an optimized Master Algorithm with Partial Step Revision (PSRMA) is also proposed. To implement our approach, we also propose an extension for the FMI standard to check whether an FMU implements the function of the threshold crossing detector. The formal definition of the Zero Crossing Detector (ZCD) is presented to guide the construction of ZCD FMUs and evaluate the simulation error of the whole system. To illustrate the feasibility of our approach, two case studies are also discussed.

Autonomous driving is a safety critical system whose performance mainly depends on the recognition of the environment through a large amount of spatio-temporal data and driving policy based on the complex traffic conditions. Thus, it is important and necessary to build the abstract model of environment data and set the safety assessment method for autonomous driving policy. To address the problem, we propose a quantitative safety verification approach for the abstract decision-making model of autonomous driving. We extract the essential spatio-temporal features from both observation and estimation, and preserve them in the abstract model of decision-making. In the estimation, we adopt the explicit description of the uncertain driving decisions of vehicles by means of probability distributions. Based on these time-dependent spatial features, specification, reasoning, and verification of safety property are enabled. To evaluate the safety of the driving policy, we propose an operational verification approach based on Stochastic Hybrid Automata (SHA). Given the environmental information and the corresponding driving decisions according to the planned route on the basis of certain traffic laws, the single-lane roundabout scenario is introduced to illustrate how to verify quantitative safety property in our verification approach by using UPPAAL SMC which can validate the stochastic real-time model.

Cyber-Physical Systems (CPS) integrate discrete computational processes and continuous physical ones in a feedback loop. Design and analysis of CPS become difficult since their dynamic behaviors rely on heterogeneous descriptions from many fields. Domain-Specific Modeling Language (DSML) offers an effective and tailor-made solution for focusing on a specific field. However, to address CPS we need to bring together several DSMLs in a coordinated sensible way. The GEMOC Studio is meant to be an integration platform for putting together several DSMLs. This paper relies on it and brings a new DSML, called xSHS (for Executable Stochastic Hybrid Statechart), into the focus. It aims at modeling the stochastic and hybrid behaviors of CPS. We discuss here the abstract syntax, a proposed concrete syntax and an operational semantics that makes the language executable. We exploit both the language and modeling workbenches of the GEMOC Studio and we provide a simulation engine that implements the operational semantics. A temperature control system is used as a case study.

Cyber-Physical Systems (CPS) are networks of heterogeneous embedded systems immersed within a physical environment. Modeling such heterogeneous systems is actively researched. However, there still lacks a systematic approach to model characteristics of CPS. To solve the problem, we propose a flexible co-modeling approach that relies on SysML/MARTE/pCCSL to capture different aspects of CPS, including structure, behavior, clock constraints and NFP. The novelty of our approach lies in the use of logical clocks and SysML/MARTE/pCCSL to drive and coordinate different models, which supports a standard language-based modeling for CPS. To capture the characteristics of CPS such as stochastic behavior and continuous behavior, we extend some meta-models of SysML/MARTE. For the block diagram, we extend it with four new stereotypes of blocks and the type of model. We adopt a new stereotype FMIConnection to describe the information transmission between blocks, which denotes that the blocks will be exported as corresponding FMU components. It will be of great benefit to the co-simulation of CPS. For the state machine diagram, we attach Ordinary Differential Equation (ODE) and TimedDelay to a state, which models the continuous behavior and stochastic time delay. The consistency between various models is specified with pCCSL. To implement our approach, we develop the toolset based on GEMOC. Finally, to demonstrate the feasibility of our co-modeling approach, we present some multi-view models of an energy-aware building as a case study.

The growing complexity of Cyber-Physical Systems (CPS) increasingly challenges the existing methods and techniques. The correctness of coordination between heterogeneous components of CPS is still a challenging problem. The coordination of CPS could be implemented with co-simulation technology, which uses Functional Mock-up Interface (FMI) techniques to generate simulations of heterogeneous components in CPS. However, the master algorithm for co-simulation may cause livelock or deadlock. Moreover, the architecture modeling of CPS may also introduce an algebraic loop which is a feedback loop resulting in cyclic dependencies. To solve these problems, we propose a novel approach for model checking several properties of coordination such as deadlock, liveness and reachability. We model the architecture of CPS with SysML Block Definition Diagrams (BDDs) and Internal Block Diagrams (IBDs), which capture the dependence of Functional Mock-up Units (FMUs) and the orchestration of the master algorithm. According to BDD models, the coordination between components is implemented with the master algorithm. We model three various master algorithms with Timed Automata (TA). Besides, we encode FMU components with TA to bridge the semantics gap between FMU and TA. With the help of the model checker UPPAAL, we can analyse the correctness of the master algorithms and detect whether there is an algebraic loop in the architecture. In this way, the coordination of CPS is verified with model checking.

The equipment faults of the interlocking system in rail transit system has occurred frequently, and these faults can cause serious accidents.The modeling of the interlocking system must aim at the stochasticity and real-time characteristics of equipment faults.Therefore, this paper proposes to model the interlocking system using stochastic hybrid automata.In order to improve model efficiency, we try to extract the pattern of the interlocking system model, and reuses these patterns in system modeling.The main contributions include: (1) Based on the business analysis of the interlocking system, 12 model patterns of the interlocking system are extracted; and (2) the modeling process of the interlocking system based on patterns reuse is given to guide system modeling.Finally, a case study is presented to illustrate the feasibility and effectiveness of our approach.

For modelling hybrid systems, we have extended Event B based on its framework with the differential event. The differential event describes continuous behaviors of hybrid systems by differential equations and evolution constraint, whose proof obligations provide dynamical properties of a model. In order to ensure the safety and reliability of a model, proof obligations should be proved. It is difficult to prove proof obligation in state space, because there is no a complete method to solve differential equations in the field of mathematics. Thus we proposed an approach to proving proof obligation based on differential invariants. It is to avoid uncontrollable computation on solving differential equation. The main result is that we prove some theorems for proving proof obligations involving differential events within the framework of refinement calculus. Lastly, through the case of the Train Control System, we further show that the approach is well suited.

Cyber-Physical Systems (CPSs), inevitably exposed in open environment, are considered to be complex to analyze in terms of its intrinsic heterogeneity and potential stochastic behaviors. Some existing technologies like Functional Mock-up Interface (FMI) could mitigate the issue to some extent, however there are still some challenging problems, for example, effective and efficient co-simulation for stochastic models like markov chains. To facilitate co-simulation of stochastic CPSs, we present an improved co-simulation framework that focuses on the capture of nearest future event to reduce the number of running steps and the frequency of data exchange between models. The core implementation is an adaptive co-simulator that integrates two algorithms optimized with event detection for co-simulation between Functional Mock-up Unit (FMU) and two different types of markov chains: DTMC and CTMC. Meanwhile, a Prism wrapper is implemented for interpreting a markov chain as a fake FMU. To demonstrate the ability of our improved co-simulation, we study two extended Bouncing Ball cases respectively modelled by DTMC and CTMC. The experiment result turns out that our approach is effective in generating simulation traces of stochastic CPSs and the optimized algorithms are more efficient compared with original one.

The safety properties of Cyber-Physical Systems have characteristics of both time and spatial attributes. Although various hybrid logic languages have been proposed to represent and reason both time and spatial attribute, most of them are not concerned on the quantitative problem which is important for mission-critical CPSs to specify and verify safety properties. In this paper, we propose a language named metric temporal-spatial logic (MTSL) to solve the problem. MTSL is the combination result of the metric temporal logic (MTL) and the spatial logic S4u. It can represent and reason CPS safety properties with both temporal and spatial attributes in a time quantitative manner. Based on different expressivity requirements, we define two kinds of MTSL languages named MTSLtPC and MTSLtOC. Their computational complexity of satisfiability problem are analysed. Moreover, in order to construct a decidable metric temporalspatial logic which can be used to define safety properties, we also point out that one may use safety metric temporal logic (SMTL) as the temporal language. The application of MTSLs are illustrated by case studies coming from transportation domain.

Energy consumption evaluation is one of the most important steps in Cyber-Physical Energy System (CPES) development. However, due to the lack of accurate and effective modeling and evaluation approaches considering the uncertainty of environment, it is hard to conduct the quantitative analysis for the energy consumption of CPESs. To address the above issue, this paper proposes an environment-aware energy consumption evaluation framework based on the Statistical Model Checking (SMC). In our framework, the environment uncertainty of CPESs is modeled using the Stochastic Hybrid Automata (SHA). In order to describe various environment modeling patterns, we create a collection of parameterized SHA models and save them to a domain specific environment ontology. Based on the domain environment ontology and user designs in the form of UML sequence diagrams and activity diagrams, our framework can automatically guide the construction of CPES models using networks of SHA and conduct the corresponding energy consumption evaluation. A case study based on an energy-aware building design demonstrates that our approach can not only support the accurate environment modeling with various uncertain factors, but also can be used to reason the relations between the energy consumption and environment uncertainties of CPES designs.

Cyber-Physical Systems (CPSs) as advanced embedded systems integrating computation with physical process are increasingly penetrating into our life. Modeling and analysis for such systems closely involved with us are actively researched. A current challenging problem is how to take advantages of existing technologies like SysML/MARTE, Modelica and Statistical Model Checking (SMC) through effective integration. Moreover, the lack of efficient methodologies or tools for modeling and analysis of CPSs makes the gap between design and analysis models hard to bridge. To solve these problems, we present a framework named Modana to achieve an integrated process from modeling with SysML/MARTE to analysis with SMC for CPSs in terms of Non Functional Properties (NFP) such as time, energy, etc. Functional Mock-up Interface (FMI), as a connecting link between modeling and analysis, plays a major role in coordinating various tools for co-simulation to generate traces as the input of statistical model checker. To demonstrate the capability of Modana framework, we model energy-aware buildings as a case study, and discuss the analysis on energy consumption in different scenarios.

Modeling and Analysis of Real-Time and Embedded systems (MARTE) is a profile of United Modeling Language (UML), which provides support for specification, design and verification for Real-Time Embedded Systems (RTES). MARTE sequence diagram can deal with both discrete and dense time in which a clock can be either chronometric or logical. However it lacks the ability to describe the continuous behavior of a hybrid system. We propose a new method named Hybrid MARTE Sequence Diagram (HSD) to describe the communication between participants and the continuous evolution within the execution occurrence of a hybrid system. HSD combines the time model from MARTE and specification of the time-continuous behavior aspects from hybrid automata with MARTE sequence diagram. It improves the MARTE sequence diagram in that: the logical time and the chronometric time are unified. Besides, the description of continuous evolution of a hybrid system is provided. We firstly extend the basic MARTE elements to support both discrete and continuous aspects. Then we define the formal syntax and semantics of HSD based on hybrid transition system. Using this new method, we model an industrial application named Train Position Determination (TPD).

Automation and high coverage are two essential industrial technical requirements of qualified testing method for safety-critical systems. The ioco-testing method is a sound and well-defined formal automation testing technique for labelled transition system. However, when we apply this method to a train control system developed by our industrial partner, we find that some testing requirements are not covered for certain testing objects. Further analysis has shown that the ioco-testing method only generates test cases based on explicit specified system behaviors which may result in low coverage when the implementation under test includes code branches used to deal with faults which can't be defined thoroughly in the specification in practices. Therefore, we propose a labelled transition system testing method based on specification mutation to improve safety-critical system testing coverage. We firstly define the mutation operators for the Input output symbolic transition system (IOSTS) modeling language, then we construct the corresponding test generation algorithm and translate the derived test cases into xml files which can be directly applied to the implementation under test in a simulation and test platform developed by our partner. Preliminary experiments on a safety-critical function named train position determination have shown about 28.5% improvement on the testing coverage.

Cyber-Physical Systems (CPSs) face many challenges, one of which is the complexity of our world full of a variety of stochastic behavior. Due to the excess complexity the increasing number of need for autonomous long running components appears and gives rise to a special concern for energy so that a great challenge becomes open to us that how to model, analyze and make effective evaluation for either one or both of stochastic behavior and energy consumption. To solve the problem, we present a Stochastic Occurrence Hybrid Automata (SOHA) which unify all stochastic behavior into triggers among probabilistic events and use a unified way to describe both stochastic and deterministic events occurrence, besides introduce the energy function with time to model energy harvesting or consumption. In this paper, we give the formal syntax and semantics of SOHA based on labeled transition system and then propose a SOHA-based modeling approach that provides a more reasonable way to concisely model stochastic hybrid systems with the use of refinement and stochastic abstraction. This approach helps build a better model with hiding the details we may not concern, which is useful to the analysis in the future. To illustrate our approach and its benefit, we discuss a benchmark of hybrid systems Energy Aware Buildings as case study.

In the paper, we propose a method that can be applied to verify implementation in real-time reactive system. Different from other software model checking approaches, our method is based on testing. This approach allows the verification of safety property to be conducted directly on real code instead of models extracted from final implementation. Verifying that kind of models is a hard work and can only be applied to parts of the implementation. The method is done by establishing a connection between safety verification and conformance testing in real-time system. We first prove a theorem that in real-time system, under the input enabled precondition, if an implementation conforms to its specification and the specification satisfies the safety properties, the implementation satisfies it either. Then, based on contropositivity of the former conclusion, we present a test case generation framework which forms basis for generating test cases that can be used to detect violations of safety properties in the implementation. In addition, this test generation framework can also detect more nonconformance defects when compared with other real time test generation methods. The method is illustrated with a train gate control system.

Assuring the consistency between collaborative services is a challenge problem in service oriented architecture. In this paper, we propose an approach to verifying the consistency of collaborative services based upon model checking. We first introduce an Extended UML Sequence Diagram for modeling dynamic behavior of collaborative service combining with UML State Chart Diagram. And then we define Collaboration-Contracts and obtain the verification model from the dynamic behavior models. Finally, wean automatically verify the consistency of collaborative services in behavior models by using an integrated SPIN-binding modeling tool Trustable MDA we developed to, In addition, a user-friendly service simulator is provided to locate the position of inconsistency.

Coordination model facilitates the composition of components by separating the coordination aspects of an application from its computation aspects. In this paper we present a probabilistic coordination language based on the Linda model to describe the dynamic composition of components. In the language, sequence composition, parallel composition, conditional choice and probabilistic choice are defined. Operational semantics of the language is given. Finally, we demonstrate the language with an example.

How can we effectively measure the complexity of a modern complex software system has been a challenge for software engineers. Complex networks as a branch of complexity science are recently studied across many fields of science, and many large-scale software systems are proved to represent an important class of artificial complex networks. So, we introduce the relevant theories and methods of complex networks to analyze the topological/structural complexity of software systems, which is the key to measuring software complexity. Primarily, basic concepts, operational definitions, and measurement units of all parameters involved are presented respectively. Then, we propose a qualitative measure based on the structure entropy that measures the amount of uncertainty of the structural information, and on the linking weight that measures the influences of interactions or relationships between components of software systems on their overall topologies/structures. Eventually, some examples are used to demonstrate the feasibility and effectiveness of our method.