Abstract We extend the notion of the Dyck language from words to two-dimensional arrays of symbols, i.e., pictures, using the row-column combination (also known as the crossword) of two Dyck languages over the same alphabet. In a Dyck crossword picture, each column and each row must be a word from the respective Dyck language. The pairing of open and closed parentheses in a Dyck word can be represented by edges connecting corresponding cells in the same row or column. This defines a matching graph, which serves as the two-dimensional analogue of the syntactic tree of a Dyck word. A matching graph is partitioned into simple circuits of unbounded length (always a multiple of four), whose labels form a regular language. These circuits exhibit a wide variety of forms and labelings, which we illustrate and partially classify. With a two-letter alphabet, a Dyck crossword is necessarily empty. The minimal non-trivial case, requiring an alphabet of size four, already generates all possible forms of matching graphs and is the primary focus of our study. We prove that the only picture with a single matching circuit (i.e., a Hamiltonian cycle) has size 2 by 2. Two key properties of Dyck words–cancellation and well-nesting–can be generalized to two dimensions, leading to two alternative definitions of 2D Dyck languages: neutralizable and well-nested. These languages are special cases of Dyck crossword pictures called quaternate, where all circuits have length 4 (i.e., are rectangles). This results in a strict language inclusion hierarchy: well-nested $$\subset $$ ⊂ neutralizable $$\subset $$ ⊂ quaternate $$\subset $$ ⊂ Dyck crosswords. When the alphabet size exceeds four, not all combinations of row and column Dyck languages yield non-empty crosswords. To identify productive combinations, we introduce an alphabetic graph, where nodes represent alphabet symbols and edges represent their couplings. A matching circuit corresponds to the unrolling of an alphabetic graph circuit. Finally, we prove that Dyck crosswords are not tiling-recognizable, as expected for a definition extending Dyck word languages to pictures.

The row-column combination RCC maps two (word) languages over the same alphabet onto the set of rectangular arrays, i.e., pictures, such that each row/column is a word of the first/second language. The resulting array is thus a crossword of the component words. Depending on the family of the components, different picture (2D) language families are obtained: e.g., the well-known tiling-system recognizable languages are the alphabetic projection of the crossword of local (regular) languages. We investigate the effect of the RCC operation especially when the components are context-free, also with application of an alphabetic projection. The resulting 2D families are compared with others defined in the past. The classical characterization of context-free languages, known as Chomsky-Schützenberger theorem, is extended to the crosswords in this way: the projection of a context-free crossword is equivalent to the projection of the intersection of a 2D Dyck language and the crossword of strictly locally testable language. The definition of 2D Dyck language relies on a new more flexible so-called Cartesian RCC operation on Dyck languages. The proof involves the version of the Chomsky-Schützenberger theorem that is non-erasing and uses a grammar-independent alphabet.

Timed Automata (TA) is de facto a standard modelling formalism to represent systems when the interest is the analysis of their behaviour as time progresses. This modelling formalism is mostly used for checking whether the behaviours of a system satisfy a set of properties of interest. Even if efficient model-checkers for Timed Automata exist, these tools are not easily configurable. First, they are not designed to easily allow adding new Timed Automata constructs, such as new synchronization mechanisms or communication procedures, but they assume a fixed set of Timed Automata constructs. Second, they usually do not support the Metric Interval Temporal Logic (MITL) and rely on a precise semantics for the logic in which the property of interest is specified, which cannot be easily modified and customized. Finally, they do not easily allow using different solvers that may speed up verification in different contexts. This article presents a novel technique to perform model checking of Metric Interval Temporal Logic (MITL) properties on TA. The technique relies on the translation of both the TA and the MITL formula into an intermediate Constraint LTL over clocks (CLTLoc) formula, which is verified through an available decision procedure. The technique is flexible, since the intermediate logic allows the encoding of new semantics as well as new TA constructs, by just adding new CLTLoc formulae. Furthermore, our technique is not bound to a specific solver as the intermediate CLTLoc formula can be verified using different procedures.

The problem of checking a logged event trace against a temporal logic specification arises in many practical cases. Unfortunately, known algorithms for an expressive logic like MTL (Metric Temporal Logic) do not scale with respect to two crucial dimensions: the length of the trace and the size of the time interval of the formula to be checked. The former issue can be addressed by distributed and parallel trace checking algorithms that can take advantage of modern cloud computing and programming frameworks like MapReduce. Still, the latter issue remains open with current state-of-the-art approaches.

Constraint LTL-over-clocks is a variant of CLTL, an extension of linear-time temporal logic allowing atomic assertions in a concrete constraint system. Satisfiability of CLTL-over-clocks is here shown to be decidable by means of a reduction to a decidable SMT (Satisfiability Modulo Theories) problem. The result is a complete Bounded Satisfiability Checking procedure, which has been implemented by using standard SMT solvers. The importance of this technique derives from the possibility of translating various continuous-time metric temporal logics, such as MITL and QTL, into CLTL-over-clocks itself. Although standard decision procedures of these logics do exist, they have never been realized in practice. Suitable translations into CLTL-over-clocks have instead allowed us the development of the first prototype tool for deciding MITL and QTL. The paper also reports preliminary, but encouraging, experiments on some significant examples of MITL and QTL formulae.

We introduce bounded satisfiability checking, a verification technique that extends bounded model checking by allowing also the analysis of a descriptive model , consisting of temporal logic formulae, instead of the more customary operational model , consisting of a state transition system. We define techniques for encoding temporal logic formulae into Boolean logic that support the use of bi-infinite time domain and of metric time operators. In the framework of bounded satisfiability checking, we show how a descriptive model can be refined into an operational one, and how the correctness of such a refinement can be verified for the bounded case, setting the stage for a stepwise system development method based on a bounded model refinement. Finally, we show how the adoption of a modular approach can make the bounded refinement process more manageable and efficient. All introduced concepts are extensively applied to a set of case studies, and thoroughly experimented through Zot, our SAT solver-based verification toolset.

This paper defines CLTLB(D), an extension of PLTLB (PLTL with both past and future operators) augmented with atomic formulae built over a constraint system D. The paper introduces suitable restrictions and assumptions that make the satisfiability problem decidable in many cases, although the problem is undecidable in the general case. Decidability is shown for a large class of constraint systems, and an encoding into Boolean logic is defined. This paves the way for applying existing SMT-solvers for checking the Bounded Reachability problem, as shown by various experimental results.

In bounded model checking (BMC) a system is modeled with a finite automaton and various desired properties with temporal logic formulae. Property verification is achieved by translation into boolean logic and the application of SAT-solvers. bounded satisfiability checking (BSC) adopts a similar approach, but both the system and the properties are modeled with temporal logic formulae, without an underlying operational model. Hence, BSC supports a higher-level, descriptive approach to system specification and analysis. We compare the performance of BMC and BSC over a set of case studies, using the Zot tool to translate automata and temporal logic formulae into boolean logic. We also propose a method to check whether an operational model is a correct implementation (refinement) of a temporal logic model, and assess its effectiveness on the same set of case studies. Our experimental results show the feasibility of BSC and refinement checking, with modest performance loss w.r.t. BMC.

A novel approach for extracting coarse-grained parallelism being represented with independent and synchronization-requiring slices is presented. Each slice is composed of dependent iterations of perfectly nested loops. Presented algorithms work for both uniform and non-uniform loops. Our approach, based on operations on relations and sets, requires exact dependence analysis. Examples illustrating the proposed algorithm and results of experiments are presented.

Model checking techniques have traditionally dealt with temporal logic languages and automata interpreted over ω-words, i.e., infinite in the future but finite in the past. However, time with also an infinite past is a useful abstraction in specification. It allows one to ignore the complexity of system initialization in much the same way as system termination may be abstracted away by allowing an infinite future. One can then write specifications that are simpler and more easily understandable, because they do not include the description of the operations (such as configuration or installation) typically performed at system deployment time. The present paper is centered on the problem of satisfiability checking of linear temporal logic (LTL) formulae with past operators. We show that bounded model checking techniques can be adapted to deal with bi-infinite time in temporal logic, without incurring in any performance loss. Our claims are supported by a tool, whose application to a case study shows that satisfiability checking may be feasible also on nontrivial examples of temporal logic specifications.

The article addresses the formal specification, design and implementation of the behavioral component of graphical user interfaces. The complex sequences of visual events and actions that constitute dialogs are specified by means of modular, communicating grammars called VEG (Visual Event Grammars), which extend traditional BNF grammars to make them more convenient to model dialogs.A VEG specification is independent of the actual layout of the GUI, but it can easily be integrated with various layout design toolkits. Moreover, a VEG specification may be verified with the model checker SPIN, in order to test consistency and correctness, to detect deadlocks and unreachable states, and also to generate test cases for validation purposes.Efficient code is automatically generated by the VEG toolkit, based on compiler technology. Realistic applications have been specified, verified and implemented, like a Notepad-style editor, a graph construction library and a large real application to medical software. It is also argued that VEG can be used to specify and test voice interfaces and multimodal dialogs. The major contribution of our work is blending together a set of features coming from GUI design, compilers, software engineering and formal verification. Even though we do not claim novelty in each of the techniques adopted for VEG, they have been united into a toolkit supporting all GUI design phases, that is, specification, design, verification and validation, linking to applications and coding.

The present paper reports the experience of a joint project between Politecnico di Milano and Italian State Railway FS, Infrastructure Department (became Rete Ferroviaria Italiana SpA: RFI SpA). The purpose of the project was to define procedures and rules for managing software procurement for safety-critical signalling equipment. The project covers all phases of system development, from requirements elicitation to implementation and final validation, providing requirements on methods, languages and tools to be used during software development, without any bias towards any particular technology or tool provider. The results are consistent with, and acceptable against, international standards. In particular, requirements/recommendations have been issued, tailored on various kinds of systems under examination, concerning: a) methods, techniques, languages and tools; b) organization of the provider company in terms of independence and responsibility of participating actors; c) documentation to be produced by the provider. An experimental evaluation of formal specification methods applied to signalling systems is also reported.

The paper addresses the formal specification, design and implementation of the behavioral component of graphical user interfaces. Dialogs are specified by means of modular, communicating grammars called VEG (Visual Event Grammars), which extend traditional BNF grammars to make the modeling of dialogs more convenient. A VEG specification is independent of the actual layout of the GUI, but it can be easily integrated with various layout design toolkits. The specification may be verified with the model checker Spin, in order to test consistency and correctness, to detect deadlocks and unreachable states, and also to generate test cases for validation purposes. Efficient code is automatically generated by the VEG toolkit, based on compiler technology. Realistic applications have been specified, verified and implemented, like a Notepad-style editor, a graph construction library and a large real application to medical software. The complete VEG toolkit is going to be available soon as free software.

We define methods for generating execution sequences for time-critical systems based on their modularized formal specification. An execution sequence represents a behavior of a time critical system and can be used, before the final system is built, to validate the system specification against the user requirements (specification validation) and, after the final system is built, to verify whether the implementation satisfies the specification (functional testing). Our techniques generate execution sequences in the large, in that we focus on the connections among the abstract interfaces of the modules composing a modular specification. Execution sequences in the large are obtained by composing execution sequences in the small for the individual modules. We abstract from the specification languages used for the individual modules of the system, so our techniques can also be used when the modules composing the system are specified with different formalisms. We consider the cases in which connections give rise to either circular or noncircular dependencies among specification modules. We show that execution sequence generation can be carried out successfully under rather broad conditions and we define procedures for efficient construction of execution sequences. These procedures can be taken as the basis for the implementation of (semi)automated tools that provide substantial support to the activity of specification validation and functional testing for industrially-sized time critical systems.

An effective means for analyzing and reasoning on software systems is to use formal specifications to simulate their execution. The simulation traces can be used for specification testing and reused, later in the development process, for functional testing of the system. It is widely acknowledged that, to deal with the complexity of industrial-size systems, specifications must be structured into modules providing abstraction mechanisms and clear interfaces. In past work (D. Mandrioloi et al., 1995), we defined and implemented a method for simulating specifications written in the TRIO temporal logic language, and applied it to functional testing of time-critical industrial systems. In this paper, we report on a tool for analyzing TRIO specifications taking advantage of their modular structure, overcoming the well-known state-explosion problem and making the proposed method really scalable. We discuss the fundamental operations and the algorithms on which the tool is based. Then we illustrate its use in a realistic case study inspired by an industrial application. Finally, we comment on the overall results in terms of the usability of the tool and the effectiveness of the approach, and we suggest some future improvements.

We address the problem of generating functional test cases for complex, highly structured time-critical systems starting from a modularized logic-based specification written in the TRIOR+ language, an object-oriented extension of the temporal logic TRIO.First, we present methods for producing test cases for a TRIO+ specification module, referring both to the internal, hidden, portion of the module and to its interface. Then, we discuss criteria to be used in the construction of test cases from a TRIO+ specification based on its composing modules and the connections among their interfaces. We formally define the notions related to test case derivation from TRIO+ modules and we introduce an executable language for describing a variety of strategies for constructing test cases for structured TRIO+ specifications starting from (parts of) the test cases of the composing modules. This language can be the basis for the implementation of an interactive tool for the semiautomatic construction of functional test cases from complex time-critical systems starting from their TRIO+ specification.

We define TRIO + , an object-oriented logical language for modular system specification. TRIO + is based on TRIO, a first-order temporal language that is well suited to the specification of embedded and real-time systems, and that provides an effective support to a variety of validation activities, like specification testing, simulation, and property proof. Unfortunately, TRIO lacks the ability to construct specifications of complex systems in a systematic and modular way. TRIO + combines the use of constructs for hierarchical system decomposition and object-oriented concepts like inheritance and genericity with an expressive and intuitive graphic notation, yielding a specification language that is formal and rigorous, yet still flexible, readable, general, and easily adaptable to the user's needs. After introducing and motivating the main features of the language, we illustrate its application to a nontrivial case study extracted from a real-life industrial application.