Academia.eduAcademia.edu
All Topics
Computer Science
Theoretical Computer Science
Process Algebra

Process Algebra

description2,689 papers
group174 followers
lightbulbAbout this topic
Process Algebra is a formal mathematical framework used to model and analyze the behavior of concurrent systems. It provides a set of algebraic operations to describe processes and their interactions, enabling the study of system properties such as equivalence, deadlock, and synchronization in a rigorous manner.
lightbulbAbout this topic
Process Algebra is a formal mathematical framework used to model and analyze the behavior of concurrent systems. It provides a set of algebraic operations to describe processes and their interactions, enabling the study of system properties such as equivalence, deadlock, and synchronization in a rigorous manner.

Key research themes

1. How can process algebra be extended or adapted to practically verify real-world timed and resource-constrained systems?

This research theme investigates the applicability of process algebra frameworks, particularly those extended with notions of time and resources, for rigorous verification of real-world protocols and systems demanding timeliness guarantees. It bridges the theoretical underpinnings of timed/quantitative process algebras with practical verification challenges, such as mutual exclusion protocols and distributed system timeliness, emphasizing formal specifications, operational semantics, and algebraic reasoning about system behaviors under time constraints.

Fischer's Protocol in Timed Process Algebra
by Jan Joris Vereijken

2024

Key finding: This paper demonstrates that existing discrete-time (ACP dt) and dense-time (ACP ur) process algebra variants can specify and verify Fischer's mutual exclusion protocol by transforming recursive specifications into linear... Read more
articleView PaperdownloadDownload
Algebraic Reasoning About Timeliness
by Peter Van Roy

2024, Electronic Proceedings in Theoretical Computer Science

Key finding: The paper establishes formal algebraic structures for outcome expressions in the ∆Q Systems Development framework, proving distributive laws and equivalences pertinent to stochastic timeliness analysis. It introduces novel... Read more
articleView PaperdownloadDownload
Proving trust in systems of second-order processes
by Mads Dam

2024, Proceedings of the Thirty-First Hawaii International Conference on System Sciences

Key finding: The authors model security and authentication protocols, including key management schemes, as higher-order process algebra terms with dynamic resource generation. They propose modal logic-based specifications for correctness... Read more
articleView PaperdownloadDownload
keyboard_arrow_downShow more

2. How can process algebra formalize and support analysis of complex workflow and business process modeling patterns?

This theme encompasses efforts to extend process algebra and related mathematical structures to precisely model, analyze, and integrate complex workflow patterns and business processes. It focuses on capturing control flow intricacies such as concurrency, synchronization, cancellation, and compensation in models like Event-Driven Process Chains (EPCs) and BPEL, formalizing their semantics to improve correctness verification, merging, reduction, and simplification of realistic business process models.

Yet Another Event-Driven Process Chain
by hương trần

2016

Key finding: This work presents yEPCs, an extended Event-Driven Process Chain class incorporating empty connectors, multiple instantiations, and cancellation constructs to fully support the 20 classic workflow control-flow patterns... Read more
articleView PaperdownloadDownload
Merging Event-driven Process Chains
by Wil van der Aalst

2022

Key finding: This paper devises an algorithm to merge two EPC models into a single unified EPC that preserves all behaviors of the originals without restriction. The approach formalizes identification of overlapping tasks and control flow... Read more
articleView PaperdownloadDownload
Toward a Formalization of BPEL 2.0 : An Algebra Approach
by Hanifa Boucheneb

2024, International Journal on Web Service Computing

Key finding: The authors provide a rigorous operational semantics-based formalization of BPEL 2.0's complex EFCT (Event, Fault, Compensation, Termination) handlers using process algebra. This work resolves ambiguities and undefined cases... Read more
articleView PaperdownloadDownload
Simplifying Discovered Process Models in a Controlled Manner
by Wil van der Aalst

2022

Key finding: By unfolding a discovered Petri net process model into a branching process according to event logs and then folding it back into a simpler process while balancing overfitting and underfitting, this approach provides... Read more
articleView PaperdownloadDownload
Simplified Computation and Generalization of the Refined Process Structure Tree
by Artem Polyvyanyy

2019

Key finding: This paper simplifies the computation of the Refined Process Structure Tree (RPST) by splitting nodes with multiple incoming and outgoing edges and linking it to triconnected components, enabling a linear-time parsing... Read more
articleView PaperdownloadDownload
keyboard_arrow_downShow more

3. How can process algebra and formal methods facilitate comparison, querying, and conformance checking of complex process models?

This research theme addresses formal techniques grounded in process algebra and automata theory that enable the comparison, conformance assessment, and systematic querying of process models, especially in declarative and stochastic settings. It emphasizes methods to measure behavioral similarity and difference, understand flexible process specifications, and improve the precision and diagnostics of conformance between observed behaviors and modeled ones.

Automaton-based comparison of Declare process models
by Sebastian Petter

2023, Software and Systems Modeling

Key finding: The paper translates declarative Declare process models into finite state automata to decide behavioral equivalence, containment, and overlap between models without exhaustive simulation, enabling efficient comparison and... Read more
articleView PaperdownloadDownload
Stochastic Process Mining: Earth Movers' Stochastic Conformance
by Wil van der Aalst

2023

Key finding: Introducing a conformance checking technique based on the earth movers' distance for stochastic process models, the authors quantify differences between observed event logs (frequencies) and probabilistic process models... Read more
articleView PaperdownloadDownload
Introduction to Process Querying
by Artem Polyvyanyy

2024, Process Querying Methods

Key finding: This chapter conceptualizes process querying as the identification and reuse of core algorithmic methods for automated manipulation and management of processes and related artifacts. It delineates a framework comprising... Read more
articleView PaperdownloadDownload
keyboard_arrow_downShow more

Related Topics

  • Deiberative Democracy
  • Formal Semantics
  • Dynamic Software Architectures
  • Formal Methods (Formal Verification)
  • Software Architecture Description
  • Formal Specification
  • Computer Science
  • Real Time Systems
  • Programming Language Semantics
  • Levels of Abstraction

    • All papers in Process Algebra

    Williamson on Fine on Prior
    by Kit Fine
    I respond to the criticisms Williamson makes in his book 'Modal Logic as Metaphysics' to my proposed Priorian reduction of possibilist discourse.
    descriptionView Paperarrow_downwardDownload
    The Algebra of Timed Processes, ATP: Theory and Application
    by Joseph Sifakis

    1994, Information and Computation/information and Control

    We study a process algebra ATP for the description and analysis of systems of timed processes. An important feature of the algebra is that its vocabulary of actions contains a distinguished element . An occurrence of is a time event... more
    descriptionView Paperarrow_downwardDownload
    Composition semantics for executable and evolvable behavioral modeling in MDA
    by Ella Roubtsova and 
    3 more
    Elvinia Riccobene
    Audris Kalnins
    Ashley McNeile

    2009, Proceedings of the 1st Workshop on …

    Fig. 1 shows a very small fragment of the AsmM metamodel representing the structure of an ASM model. In addition to its mathematical-based foundation, a metamodel-based definition for ASMs is also available. The ASM metamodel, called AsmM (Abstract State Machines Metamodel) [33,15,17,2], provides an abstract syntax for an ASM language in terms of MOF concepts, and has been defined with the goals ot developing a unified abstract notation for the ASMs, independent from any specific implementation syntax and allowing a more direct encoding of the ASM mathematical concepts and constructs.
    Fig. 2. Using operation bodies as join points between data and behaviour Fig. 2 shows how simply the composition may be carried out. The MOF Operation class resembles the AsmM RuleDeclaration class. The name Opera- tion has been kept instead of RuleDeclaration to ensure UML conformance; similarly, the name Parameter has been kept instead of VariableTerm. Finally, the new property isMain has been added in order to designate, when set to true, a closed (i.e. without formal parameters) operation as (unique) main rule of an active class (the main class) to start model execution.
    Fig. 3. Using properties as join point for ASM adornments static or monitored, and that if a property is derived (attribute isDerived is set to true) then the attribute kind is empty.
    R1.3 This means that you will not receive two entry ows (orders, entries it stock). The stock and the set of orders are always given to you in an up-to-dat state!!.
    Fig. 1. Sequence diagram example.
    We assume here that the Facade Controller pattern [4] was used in the desigr process. The user interaction was built according to the general MVC pattern. We repeat once more that the PIM level is assumed so no specific GUI framework i: chosen and so on. Due to all this we represent the whole GUI layer by one “abstract’ GUI controller class SystemGUI. The class FacilityManager plays the role of Fagad« Controller for this use case. The sole domain-specific class visible in the sequenc« fragment is Facility. According to general principles frequently used in MVC, al invocations from/to GUI level are asynchronous (more precisely, without return), bu all other ones are synchronous (with return).
    An operation invocation is specified in a textual style, with arguments as in sequence diagrams. The invocation without return (a thick filled arrow head at one end) has no more options, but for invocation with return (an open arrow head at the other end too) an assignment can be combined with the invocation (in a syntax similar to the one used in UML 1.4 sequence diagrams). If required, the returned value can be specified on the invoke-return arrow. Explicit assignments are not frequently needed in this notation but can be used if required. Other data related actions (Add action in Fig. 3) are defined in the same Java-like style we propose in sequence diagrams. The syntax for loop head is also the same as we propose for sequence diagrams. If required, subdiagram invocation can be used for structuring of the description as in standard activity diagrams. One more specific facility is the definition of local variables within operation bodies. In contrast to attributes, such variables can not be defined in the class diagram. Certainly, the use of Boolean variables (available in Fig. 3) is not very typical at this level of abstraction, but nevertheless it illustrates the intended use of
    Fig. 1. UML Behavior Diagrams
    Fig. 2. CSP Composition
    Fig. 4. Bank Account with a Derived State Because there is no restriction on how the state of a protocol machine may be determined, we allow machines to have derived states as well as the more usual stored states driven by the transitions of the state machine. Figure 4 shows an example of a Bank Account described as two machines composed using CSP ||. The right hand machine, A2, uses derived states (in credit and overdrawn) calculated on the basis of the balance attribute owned and maintained by Al.
    Fig. 5. Mobile Phone - Dynamic View
    Fig. 6. Mobile Phone - Static View
    Fig. 1. Architecture: models and their meta-layer relationships A second aspect in the framework’s architecture is the differentiation between the (fixed) abstract syntax of a language and its evolving runtime configurations. Runtime models are again defined by a metamodel (the runtime metamodel) and manipulated through actions. Note that although there is technically no differ- ence between abstract syntax models and runtime models, changes shall only be applied to the runtime model for ease of having a clear separation between language concepts and execution concepts. Hence, all information required for model execution goes into the latter, for example value domains, program coun- ters, data structures such as stacks-frames, and so on. The (meta-)models and their relationships are shown in figure 1.
    Fig. 2. The Ping-Pong state machine model: (right) sender, (left) responder This section illustrates the application of M3Actions along an example DSL: a finite state-machine language. The language was inspired by Martin Fowler’s upcoming book on DSLs (currently published on his website [17]). The DSL defines a typical state/transition language with state-machines communicating via exchanged events. The approach how to define the execution semantics will be explained along a simple Ping-Pong example model shown in Figure 2.
    Fig. 3. Simple StateMachine Metamodel The structure of the state machines is defined by the metamodel shown in figure 3 (blank classes). The definition of all concepts should be intuitive and straightforward, except that labels as defined in (1) are mapped as string values to corresponding attributes <guard> and <action> of metaclass Transition.
    Fig. 4. EventBroker#dispatchEvents
    Fig. 6. StateMachinelnstance#evalGuards
    Fig. 2. Diagrams of II(a, 6), A(a, a, 6), Q(a, a) and respective syntax tree construction
    In this section we consider the structuring problems imposed by our common example. The first problem is a very complicated graph structure of the flow diagram.
    Theorem 2. Every flow diagram can be transformed into an equivalent strongly decomposable (well-formed) flow diagram by node duplication (proof see [13]).
    Fig. 6. Two strongly decomposable (well-formed) extended flow graphs equivalent to the flow graph in Fig. | and respective final syntax trees.
    generation of the behavior parts of a model; bottom-up approaches that can be don by extending programming environments, and top-down approaches that can be don by extending the modeling language, i.e. UML. This article proposes a combine approach; the top-down approach by applying recursive refinements of activit elements in an activity diagram and the bottom-up approach by defining executors o the lowest level of activities. The reminder of the article is organized as follows: Section 2 gives a brief definition of models. Next, in Section 3 we present an overview of what modeling and programming languages are. In Section 4 we present our approach to how the code can be generated from both structure and behavior models, including an example of modeling a simple calculator application. We use UML2.1 notations and Java in the example. Section 5 is devoted to related work including the ISIS project. Finally, we draw our conclusions in Section 6.
    Fig.2. Models and modeling languages
    Figure 3 shows the modeling process that is done in an interlaced (weaving) way between the structural and behavior parts. The behavior models are used to strengthen the structural models. For example, an activity entity in an activity diagram could be transformed into an operation in a class diagram. Fig.3. Weaving between structural and behavioral.
    The table above shows examples of possible translation code of different patterns of activity in Java. Note that the X0, X1, and X2 are objects that can be type of any. The notion of the transformation rules follow patterns as shown in Table 2. We consider that an activity diagram can be seen as a collection of patterns. Here the patterns are used to simplify the code generation from activity diagrams.
    Fig.5. Activity diagram of the Calculator To add more code, we need to model the behavior part. In this first iteration, we can model the calculator behavior in a high abstraction level, as for example shown in the following figure. Behavior modeling
    The basic rule is very simple (see Table 1, Section 4.1). All activities are transformed into operations of classes. The complete transformation, i.e. including the operation arguments, is presented in Table 2, Section 4.2. Based on the activity and class diagrams above, one possible generated code for the Calculator class (Figure 4) is demonstrated as follows. We now have more lines of code in the Calculator class. We do not, at the moment, think about race condition, for example interpretation of flows outgoing from a fork.
    To interpret the activity diagram above, we need explicit labels to indicate whether the flow is control flow or object flow. In the example we use X1, X2, X3, X4, and X5 to indicate the object flows. The following figure shows the structure part of the model as a result of automatic refinement of the activity diagram. Here, the activity diagram (behavior) is used to strengthen the structure.
    Fig.8. Sub activity diagram of Compute operation At the same iteration step, we refine manually the behavior part of the model. The refinement is done by defining sub activities of all activities we have defined, for example defining a sub activity of compute, shown in Figure 8. Note that not all activities notations are shown as in add activity.
    4.3.3 Third to n™ Iteration The following shows an example of possible generated code (expanded) for compute operation on the Processor class, based on the sub-activity we have defined above. Note that some lines (other operations) are not shown in this code. The more iteration and the deeper refinement of the activity are done the more code that can be obtained. However, the code is not complete enough regarding the arithmetical operations. The reason is there are no mathematical expressions in the model. To amend this situation, we propose notations for basic logical operations, basic arithmetical operations, and basic string manipulation as shown in Table 3.
    From this sub activity diagram we can refine the structural model by introduce new classes, as we did in the previous iteration. In this case, the Compute activity is automatically be transformed into Compute class which has operations of add(), sub(), mul(), div(), and error();
    activities at implementation levels should be abstracted into models. In this context as long the activities are not mapped into executors then the model is still PIM. See Figure 10 for a more complete behavior model, which includes the arithmetic notations. SysML (UML profile) [14] has defined a parametric to model mathematical expressions. But the expression itself uses text which might be difficult to interpret.
    Fig 11. An example of Arctis models Fig 10. More completed behavior model of the Calculator
    Fig. 1. A process node represented in the design pattern. The single program code fragments refer to the node’s name and type, a transition declaration and an empty guard. [he foundation of process models is the graph structure of process nodes and tran sitions between them. In the object-oriented program code fragments for the patterr -ach process node is represented by a class definition which implements the given in erface 1processNode (“node class” in the following). This interface defines no methods yut allows to distinguish between node classes and arbitrary other classes type-safely [he class name corresponds to the process node name. Process nodes (except activit 10des, see below) are decorated with meta data denoting their type (one of the enumer ition constants START, END, FORK, JOIN, DECISION, or MERGE).
    Fig. 2. Two exemplary activity methods. The first returns a value which is used as an output parameter of this activity node by calling a setter method in the variables facade. The second has an input parameter which is represented by a getter method. First, the actor which is a type that encapsulates business logic of the surrounding ap plication; second, an implementation of the variables interface.
    Fig. 3. A guard represented by an expression in the body of a transition method. tions of variable values to allow for decisions. For our pattern we define that these are represented by the method body of transitions methods. The body can therefore contain expressions as defined in section 2.2, but with calls to getter methods of the variables type. For example, the guard expression value1>value2 would be represented in the source code as variables.getValuel () >variable.getValue2(). The according rules apply for interleaving of expressions. An example is shown in figure 3.
    Fig. 4. A process model extracted from a pattern in the JWT editor. The example application shown here is discussed in detail in section 5.
    Listing 1.1. The variables interface for the load generator example with the according get and set methods
    Table 1. W mapping: from UML*t to AsmM
    Listing 1.1. IOS behaviour: single-order strategy Many other strategies and particular scheduling algorithms can be defined and refined as well, in order to get a sufficiently precise, complete and minimal. executable PIM model which can serve as a basis for the implementation of var- ious PSMs. Appendix A reports the complete AsmetaL specification associated to the IOS class model in Fig. 4.
    Table 1. Example cases for the complexity measuring implementation (n is the number of nodes in the flow graph and V is the complexity measure proposed in the Section 3.3). The bold line (case #3) represents the example from Figure 1. transitions, respectively (as compared with 8 transitions for the first simple case). This shows that the potential advantages of the approach, in terms of graph transformations, could be applied in practice.
    Of course, there are many other activity entities (elements). With this transformation rules, a developer has defined implicitly structural models when he models the behavior part.
    descriptionView Paperarrow_downwardDownload
    Generalization/Specialization and Role in Object Oriented Conceptual Modeling
    by Guido Dedene

    1996, Data & Knowledge Engineering

    The "IS A"-relationship and the mechanism of inheritance are powerful concepts that help to reduce complexity of models and redundancy in specifications. However, in the area of conceptual modeling, it seems that current Object Oriented... more
    figure 3: occurrences of EMPLOYEE, DEPARTMENT and HEAD-OF
    figure 2: Some employees manage a department. Every department has exactly one manager. Some employees are the manager of one department. This is illustrated in figure 2 As the relationship type HEAD OF is optional for employees, some employees will not participate in a relation of this type (see figure 3). The set of employees can thus be split in two disjoint subsets: employees that are a manager and employees that are not, as shown in figure 4. As a result, the relationship type HEAD_OF is now mandatory for MANAGER.
    figure 5: ER-schema for the CRIS-case The CRIS-case describes the organization of an IFIP Working Conference. This example shows part of the schema for this case-study. Figure 5 shows a schema without generalization/specialization and figure 6 shows a solution with generalization/specialization as proposed by [9]. ‘he CRIS-case describes the organization of an IFIP Working Conference. This example shows part of the Example 4.
    It can be argued that the mere fact of participating in a relationship is not a sufficient reason to define a generalization/specialization hierarchy. Hence, in honour of the principle that a specification should be kept as simple as possible, the solution with the optional relationship type is to be preferred in our opinion. The more that both solutions have an identical semantic content. The constraint that only managers can head a department can be modelled by means of sequence restrictions, by requiring that the event ‘assign to department’ be preceded by an event ‘promote to manager’. In addition, being a manager may in fact be a temporal property of employees: usually an employee is promoted to manager only after a few years and possibly a manager can be demoted to rank of employee. It can be argued that the mere fact of participating in a relationship is not a sufficient reason to define a
    figure 6: Specializations for PERSON in the CRIS-case In [9] ATTENDEE, REFEREE, AUTHOR, CO-AUTHOR, ... are defined as roles of PERSON, motivated by the fact that being an attendee, referee, author, ... and so on are temporal rather than permanent aspects of a person. In our opinion, the use of the role-concept is only needed if behaviour restrictions are to complicated to be modelled in a single lifecycle for person.
    In [9] SUBMITTED PAPER is modelled as a subtype because being considered as a permanent aspect of a paper while ACCEPTED PAPER is modelled as a role type because being accepted is considered to be a temporal aspect. Authors can respond to a call for papers by submitting a paper. The submitted papers are classified and then refereed by two persons. The outcome of the refereeing process is rejection or acceptation of the paper. Accepted papers will be published in the proceedings of the conference. This sequence of events is shown in the finite state machine in figure 8 that models the lifecycle of a paper. In [20] the classes SUBMITTED PAPER and ACCEPTED PAPER are defined. These classes correspond to the subclasses of PAPER consisting of all papers which state is in the set {1, 2,..., 9} or {7, 8} respectively.
    figure 7: Banning a ship and rescinding the ban.
    figure 9: Guide-lines for using the role concept and the generalization/specialization concept In turns out that in case at least one of the four conditions C2 to C5 is satisfied, the question of additional attributes is irrelevant. In case none of the four conditions is satisfied (column 7) the mere fact that A has other attributes than B is not a sufficient condition to model B as a specialization or role type. Indeed, if A has additional attributes, we can expect that there are also additional of different methods that can handle these additional attributes. If no such methods are present, we assume that the additional attributes belong to the base class and can possibly be assigned a null value. In turns out that in case at least one of the four conditions C2 to Co is satisfied, the question of additional
    Note that a DESTINATION is existence dependent of RooM with cardinality 1: a room can have only one destination at one point in time. But with this solution we have also the flexibility to allow rooms to have more than one destination at one point in time by changing the cardinality to Many.
    descriptionView Paperarrow_downwardDownload
    Probabilistic model-checking support for FMEA
    by Lars Grunske

    2007, Quantitative Evaluation of …

    for assessing cause-consequence relations between component faults and hazards that may occur during the lifetime of a system. The analysis is typically time intensive and informal, and for this reason FMEA has been extended with... more
    descriptionView Paperarrow_downwardDownload
    The Logic of Identity and Copy for Computational Artefacts
    by Giuseppe Primiero and 
    1 more
    Nicola Angius

    Journal of Logic and Computation (forth)

    Defining identity for entities is a longstanding logical problem in philosophy, and it has resurfaced in current investigations within the philosophy of technology. The problem has not yet been explored for the philosophy of information,... more
    descriptionView Paperarrow_downwardDownload
    An�lisis Comparativo de Metodolog�as Orientadas a Agentes basado en Evaluaci�n de Perfiles
    by Luca Cernuzzi

    2005

    En el mundo actual cada vez se exigen soluciones software de mayor calidad y con menores costes y tiempos de desarrollo. En este contexto, la reutilización de componentes software es una línea de trabajo prioritaria. No obstante, la... more
    descriptionView Paperarrow_downwardDownload
    Non-functional properties in the model-driven development of service-oriented systems
    by Philip Mayer

    2011, Software & Systems Modeling

    Systems based on the service-oriented architecture (SOA) principles have become an important cornerstone of the development of enterprise-scale software applications. They are characterized by separating functions into distinct software... more
    descriptionView Paperarrow_downwardDownload
    A formal verification environment for railway signaling system design
    by Alessandro Fantechi

    1998, Formal Methods in …

    A fundamental problem in the design and development of embedded control systems is the verification of safety requirements. Formal methods, offering a mathematical way to specify and analyze the behavior of a system, together with the... more
    descriptionView Paperarrow_downwardDownload
    Experiences with formal engineering: Model-based specification, implementation and testing of a software bus at Neopost
    by Marielle Stoelinga

    2014, Science of Computer Programming

    Amd Hartmanns, Holger Hermanns, and Joost- Pieter K atoen Fig. 10 Automaton for the channel with transmission delay and probabilities
    Probabilistic Analysis of Embedded Systems Fig. 13 mime, the integrated modelling environment for MODEST
    Fig. 1: The process and concepts of model-based testing. This section discusses these concepts of model-based testing in general; the next two sections will elaborate them for particular model-based testing approaches using labeled transition systems and Timed Automata, respectively.
    Fig. 1: Quantitative Resources and Constraints in Embedded Systems On the other hand, embedded systems must also satisfy a multitude of quantita- tive constraints as illustrated by Figure 1, that determines how well it performs its functions. By a quantitative constraints we mean a constraint that can be measured and expressed as a number. Existing development techniques tend to emphasize only functionality and is weak in correct construction of the quantitative aspects {Henzinger and Sifakis(2006)].
    Fig. 3: Effort and Cost in Model Based Development testing it, or for diagnosing it, and when they are expressed in an executable lan- guage, they can be simulated (simulation models). Models can be made a priori to guide and analyze the design, or a posteriori to analyze, test, or diagnose an exist- ing system. Different models can be made of the same system, each focusing on a different kind of properties, e.g., a functional model, a performance model, or an energy-consumption model.
    Fig. 4: Establishment of quantitative properties using MDD. A main benefit of model-based development is that given a concise model, ad- vanced tools can analyze it and help automate a number of difficult engineering tasks, see Figure 4.
    Fig. 5: Structure of a simple transmission system
    Fig. 6: Sender and Receiver Components
    Fig. 7: Different Quantitative Aspects of a Simple Transmission Medium
    Fig. 1.1 State space for 3 gossiping girls. Figure 1.1 shows a state-transition diagram or automaton for the simplified ver- sion of the problem in which there are 3 girls. A state consists of a 3 by 3 matrix knows that records for each girl the gossips she knows. If girl i knows the gossip of girl j then we write a | in the entry for row i and column j: knows[i][j] == Otherwise we write a 0: knows[i][j] == 0. In the initial state, at the top of the dia- gram, each girl only knows her own gossip, and hence there are 1’s on the diagonal and 0’s elsewhere. Transitions between states occur whenever girls have a conver- sation. In the initial state three transitions are possible: girls 1 and 2 call each other,
    Fig. 1.2 Solution for gossiping girls puzzle found by model checker Uppaal. Uppaal is available for free for non-commercial applications in academia and for private persons via www. uppaal .org. For commercial applications a commercial license is required, see www.uppaal.com. The software runs under Windows,
    Fig. 1.3 A jobshop (picture taken from [10)]).
    1 A First Introduction to Uppaal Fig. 1.4 Uppaal after starting the toolkit.
    mode : Jobber. Next we right click (with the Select tool) on the location which Uppaal has already placed in the drawing window. We can then give this location a name, for instance begin. Each automaton has at most one initial location, marked by a double circle. During simulation or in verifications the automaton will always start in this location. By checking the box Jnitial in the menu for a location, we specify that this location is the initial location of the automaton. The menu contains a cou ple of other fields and options Unvariant, Urgent and Committed), but for the moment we will not use these. Fig. 1.6 A first version of the model.
    Fig. 1.7 Declaration of system components. At this point, we have not specified in our model how the choice between the transitions from location begin to location easy, average or hard is made. Also, we have not specified how the choice between the transitions from loca- tion average to location work_av_mallet and work_av_hammer is made. Choices for which the model does not specify how they are resolved are called nondeterministic. Nondeterminism is very useful for maintaining a high level of abstraction in descriptions of the behavior of physical systems and machines [6].
    Fig. 1.8 Screenshot of the simulator.
    Fig. 1.10 Models of hammer and mallet. We have now completed our first Uppaal model! We can open the model in the simulator and convince ourselves that it indeed behaves as specified in the informal description. Once we are satisfied with the model, we can save it by selecting in the File menu the option Save System As.... Uppaal models are stored as . xm1 files.
    Fig. 1.9 Model of jobber, extended with synchronization labels.
    Fig. 1.11 Screenshot of the Verifier. The Simulator is extremely useful for playing with a model and obtaining insight, but it does not answer questions like “Is it possible to reach a state in which (some given) property Bad holds”? Even if we have not seen a Bad state after hours of simulation, this does not guarantee that no such state exists! Fortunately, Uppaal’s Verifier allows us to rigorously answer this type of questions.
    Fig. 1.12. Model of jobber in which exactly J jobs are carried out. from begin to done, which is taken whenever jobs has reached the value J and al jobs are done.
    Fig. 1.13. Model of conveyor belt that delivers 10 jobs.
    Fig. 1.14 Model of jobber extended with a clock.
    Fig. 1.15 Fastest schedule for completing the 10 jobs. When Uppaal computes a diagnostic trace which demonstrates that this property is satisfied, this will, in general, not be the shortest trace. After all, we have only specified lower bounds for the timing in our model and no upper bounds. Thus the belt may wait indefinitely before delivering a job, a jobber may dawdle for days before he starts with the job, and for years before completing it. However, if we select in the menu Options under Diagnostic Trace the option Fastest, then Uppaal will produce the fastest execution that leads to the specified state. In the simulator we can see that in the final state of this execution now >= 100. This means that the jobbers need at least 100 time units to complete the 10 jobs. The easiest way to understand the schedule that has been computed by Uppaal is via the so-called “message sequence chart” in the lower right window of the simulator: here we see which jobber handles which job. Figure 1.15 visualizes this fastest schedule in an even more compact way as a “Gantt chart”.* We see that one jobber is permanently busy with the hammer, whereas the other jobber has a relaxed schedule in which he is idling most of the time but also completes some jobs with his hands or with the mallet. It is easy to come up with an equally fast schedule in which the work load is more evenly distributed. We may decide, for instance, to give the third job to Jobber2.
    Fig. 1.16 Model of jobber with upper bounds on timing.
    Fig. 1.17 Slowest schedule for completing the 10 jobs. Hence, the diagnostic trace for the last property gives the slowest possible schedule, which takes exactly 126 time units. In this schedule, the final transitions from the jobbers back to the begin state are missing, but these transitions take no time. So even when the jobbers always start working on jobs as soon as they can, and imme- diately grab tools whenever they become available, the worst case schedule is still 26 time units slower than the fastest schedule from Figure 1.15. Figure 1.17 visu- alizes the slowest schedule as a Gannt chart. At time 0, Jobber1 grabs the first (hard) job, and Jobber2 grabs the second (average) job. Of course, in any rea- sonable scenario, Jobber1 would use the hammer and Jobber2 the mallet. But
    Fig. 1.18 Generic model of template Tool. In the jobshop model, we have defined a single template Jobber with two instances Jobber! and Jobber2. Likewise, we would like to have a single template Tool with two instances Hammer and Mallet. It is possible to define this in Uppaal using the notion of Parameters. Parameters can be declared to have either call-by- value or call-by-reference semantics, that is, a template may have access to either a local copy of the argument or to the original. The syntax is taken from C++, where the identifier of a call-by-reference parameter is prefixed with an ampersend in the parameter declaration. Clocks and channels must always be call-by-reference parameters.
    Fig. 1.1 The train gate problem. Trains run on their own tracks except on the bridge. Trains may be stopped before 10 time units, after which they must proceed to the bridge. If stopped a train will take some time to reach the bridge (7-15 time units). Crossing takes some time (3-5 time units).
    Fig. 1.2 Template for the trains (a) and the gate (b). correspond to the states in Fig. [1.1] The communication with the gate is done with the channels with this identifier. When trains are approaching, the gate con- troller is notified with appr [id] ! and when they leave the bridge they notify with leave [id] !. The gate controller can stop a train and then restart it. Trains listen on stop [id] ? and go [id] ? forthis purpose. The different timing constraints of Fig. [Tare modelled with invariants on states and guards. Trains have a local clock x for this purpose (the purpose of the additional clock z will be explained later).
    Fig. 1.4 Window for editing edges showing the different editable labels.
    Fig. 1.5 Screenshot of the simulator running of the train-gate example.
    Fig. 1.6 Exploration of symbolic states. Starting from the origin (0,0), (a) shows all the states reachable by delaying, (b) depicts the reset on the clock y, (c) shows a subsequent delay, and (d) shows the states that can take a transition guarded by y > 2.
    Fig. 1.7 The different types of logic formulas supported by UPPAAL.
    Fig. 1.10 State space representation (a) and hash table size (b) options.
    Table 1.1 Performance comparison with different options. The option def corresponds to the de- fault setting, which is breadth-first search, compact data structure, and conservative state-space representation. The option dfs only changes the search order to depth-first. The option S2 is the default setting changed with aggressive state-space representation. Finally the option -C is the de- fault setting without the compact data-structure. We show results in seconds and MBytes obtained on a PentiumD running at 2.8GHz. The entries ’*’ mark an experiment that was stopped because it was taking more than 3 minutes. Table[I.1|shows the impact of some of these options on a few examples that can be found on http: //www.uppaal.org under examples/benchmarks. The example csma is a collision detection protocol, here with 10 nodes. Then we experiment with Fis- cher’s protocol, a mutual exclusion protocol with 10 nodes here. Finally we use a token ring FDDI (fiber distributed data interface) protocol with 25 nodes. The prop- erties checked here are safety properties and the depth-first search option makes the search a lot slower. This is explained by inclusion of symbolic states that will not be effective with that order. However, in other cases where a simple schedule is wanted, this order will work well. Deactivating compact data-structures will in- cura small speed improvement and a large loss in memory compared to the default setting. The aggressive state-space representation stores fewer states and can some- times (in these cases) give speed improvements. This is explained by the inclusion check that is done on fewer states.
    Fig. 1.13 First attempt for modelling the gossipping girls. The model consists in different instances of the same template with different identifiers to differentiate the girls. This is the template of a girl, taking as argument an identifier of type girl1_t. The girl template is named Girl and has girl_t id as parameter. A first version of the the template is shown in figure [1.13] Every girl has a different ID. The system declaration is simply: system Girl;. This makes use of the auto-instantiation fea- ture of UPPAAL. All instances of the template Girl ranging over its parameters are generated. The number of instances is controlled by the constant GIRLS.
    Fig. 1.14 Improved model of the gossipping girls. The updated model is shown in Fig. [1.14] This update is for both boolean (gos- sip3) and integer (gossip2) encodings. The template keeps as an invariant that the variable g is always equal to id whenever it is not sending. In addition, when a channel j is selected, then it corresponds to exactly girl j. Only one committed location is enough but it is a good practice to mark them both. It is more explicit when we read the model. The previous versions could only be checked up to 4 girls, now we can check 5 within roughly the same time. This is a very good improvement considering the exponential complexity of the problem.
    Fig. 1.15 Abstract model of the gossipping girls. message already contains the sent secrets. The global declaration is updated with only chan call; for the channel. The updated automaton is depicted in Fig. [1.15] The integer version of the model (gossip4.xml) has the following local functions:
    Table 1.2 Resource consumption for the different models with different number of girls. Result: are in seconds/M-bytes. Table[I.2]shows the resource consumption for the different models with different number of girls. Experiments are run on an AMD Opteron 2.2GHz with UPPAAL rev. 2842. The results show how important it is to be careful with the model and to optimise the model to reduce the state-space whenever possible. We notice that the model is not even using clocks. The model with integers is faster due to its simplicity but consumes marginally less memory. The two last models (gossip6 and gossip7) are discussed in the next paragraph. 1.8.7 Improving Verification with Symmetry and Progress Measures
    Fig. 1.16 Pattems for checking bounded liveness (a) and non-zeno behaviours (b). A model is zeno if it allows an infinite number of discrete transitions to take place in a finite amount of time. In other words, it contains a loop where time does not diverge. This is an undesirable behaviour for a real system but it is very easy to obtain with timed automata. It is sometimes useful to check that a model does not allow such behaviours.
    Fig. 1.1 Chess MyriaNode 2.4 Ghz wireless sensor node However, a big advantage is that the full state space of the model can be explored and worst case scenarios can be found. Within the context of the Quasimodo project, Chess therefore proposed the analysis of gMAC, the clock synchronization algo- rithm for its wireless sensor networks, as a case study for timed automata tech- nology. An informal description of the case study was made available by Chess as a deliverable of the project [14]. Figure 1.1 displays a sensor node developed by Chess on which the gMAC algorithm runs.
    Fig. 1.2 The structure of a time frame The algorithm that we consider is part of the Medium Access Control (MAC) layer, which is responsible for the access to the wireless shared channel. Within its so- called gMAC protocol, Chess uses a Time Division Multiple Access (TDMA) pro- tocol. Time is divided in fixed length frames, and each frame is subdivided into slots (see Figure 1.2). Slots can be either active or sleeping (idle). During active slots, a
    Fig. 1.3 The need for introducing guard times
    end_sending|id] signal is sent to the controller to indicate that the message has been sent. Receiver The automaton Receiver|id] models the receiving behavior of the radio. The automa- ton is shown in Figure 1.7. Again the behavior is rather simple. When the controller asks the receiver to start receiving, the receiver first switches to receiving mode (this takes r ticks). After that, the receiver may receive messages from all its neighbors. A function neighbor is used to encode the topology of the network: neighbor(j, id) holds if messages sent by j can be received by id. Whenever the receiver detects the end of a message transmission by one of its neighbors, it immediately informs the synchronizer via a message_received|id] signal. At any moment, the controller can switch off the receiver via an end_receiving[id] signal.
    Controller
    The task of the Controller[id] automaton, displayed in Figure 1.8, is to put the radio in sending and receiving mode at the appropriate moments. Figure 1.9 shows the definition of the predicates used in this automaton. The radio should be put in send- ing mode r ticks before message transmission starts (at time g in the transmission slot of id). If r > g then the sender needs to be activated r — g ticks before the end of the slot that precedes the transmission slot. Otherwise, the sender must be activated at tick g —r of the transmission slot. If the first slot in a frame is an RX slot, then the radio is switched to receiving mode r time units before the start of the frame to ensure that the radio will receive during the full first slot. However if there is an RX slot after the TX slot then, as described in Section 1.2.4, the radio is switched to the receiving mode only at the start of the RX slot. The controller stops the radio receiver whenever either the last active slot has passed or the sender needs to be switched on. All the channels used in the Controller{id] automaton (start_sending, end_sending, start_receiving, end_receiving and synchronize) are urgent, which means that these signals are sent at the moment when the transitions are enabled.
    Fig. 1.13 Another problematic network configuration with two communities However, variations of the above scenario may occur in practice, even in a setting with dynamic slot allocation. In fact, the above synchronization problem is also not restricted to line topologies. We call a subset C of nodes in a network a community if each node in C has more neighbors within C than outside C [12]. For any network in which two disjoint communities can be identified, the Median algorithm allows for scenarios in which these two parts become unsynchronized. Due to the median voting mechanism, the phase errors of nodes outside a community will not affect the nodes within this community, independent of the slot allocation. Therefore, if nodes in one community A run slow and nodes in another community B run fast then the network will become unsynchronized eventually, even in a setting with infinitesimal clock drifts. Figure 1.13 gives an example of a network with two communities.
    Fig. 1.14 A network with two communities that we analyzed using UPPAAI
    Fig. 1 Synoptic view of the self-balancing scooter The following figure shows a simplified overview of the mechanical system.
    Programmable Gate Array) is the programmable logic that runs the commutation, the real time control and the system behaviour logic. The FPGA also reads the sen- sor and input data and forwards this to the other FPGA board such that both con- trollers operate based on the same information. The FPGA boards are connected by a parallel bus interface with error detection. Fig. 2 Overview of the self-balancing scooter electronics architecture
    The user process models the behaviour of the user during nominal behaviour and it triggers abnormal behaviour. With /gnition! the user toggles the discrete control from IDLE state to CHECK state or from any of the discrete control states back to IDLE. After switching on, the user must hold the vehicle upright to let the controller power the motors. The transition angle = 0 is used to simulate holding the self- balancing scooter upright. The user may cause an accident and fall, in which case the vehicle angle becomes too large. This is modelled with the transition angle = 2 setting the angle to a larger angle, for example 0.2 rad. Similarly, when the driver falls off he/she will unplug the Safety Key. The person, holding the vehicle pulls out the safety key, using the transition SafetyKey = false. Both the transitions that simulate en error set a global clock to 0, to measure the time needed between causing an error and the system reaching a safe mode. Either one of the error transitions fire, meaning a single failure is modelled.
    Fig. 4 UPPAAL safety switch model 4 The safety switch is the electronics that closes and opens the power lines to the motor. The controller for start-up and shutdown normally does the operation of this switch. In case of emergency, the safety monitor process overrules the con- troller. The idea is that in case of an emergency, the vehicle control should go to the safest situation. Instead of locking (braking) we have chosen to let the wheels rotate freely. That means that the power lines to the motor will be switched to open loop. The safety switch process models the closing and opening of the switch. In the nominal behaviour, the discrete control opens and closes this switch with the open? and close? events. The safety monitor can override normal control and open the switch, with the error? event. A Boolean signal enable telling other parts (the controller) whether the safety switch is in the OPEN or in the CLOSE state. A timer openDelay models the time needed to open the safety switch.
    vehicle must be hold upright by the user (sbsAngle j= 1). If the conditions are met then the state may progress to the state SYNCHRONISE. In this state, both left and right controller signal that they are in this state and wait until this signal from the other side, to simultaneously progress to the DRIVE state. This last transition closes the safety switch and thus powers the motor. The controller not in IDLE state should return to the CHECK state when unsafe becomes true. The user must be able to toggle the ignition switch in each of the states, which makes the controller to return to the IDLE state. This ignition has been blocked for the transition from DRIVE to IDLE in case of an error to give preference to the state change from DRIVE to CHECK in case of an error. A transition was added to the DRIVE state to lower the battery level every 1 time unit. This battery reduction could have been modelled in other states as well, but as the motors are the main power consuming devices this was simplified to model the power consumption in the DRIVE state only.
    Note that the monitored variables are modelled as signals not as events. For ar event to take place both sides, the sender and the receiver, must be available to pass the transition. In physics the event of a Safety Key being pulled out or an angle out of bounds will not wait for the state machine to allow this error to happen; it just happens.
    Figure 1: Task (a) and scheduler (b) templates. In our scheduling model that is based on [2], we have a number of tasks modeled by a Task template and one or more schedulers modeled by a Scheduler tem- plate. The idea here is that we need one scheduler per process and the scheduler decides which task to run.
    Figure 2: Synchronization between tasks and a scheduler. The scheduler en- queues ready tasks and run the tasks at the front of its internal queue.
    Figure 3: Task template extended with resource sharing. resource. The other tasks can run in parallel, provided that one scheduler is available.
    Figure 4: Gantt charts that show the run with one and two schedulers with resource sharing.
    Figure 5: Extensions of the task (a) and scheduler (b) templates to model preemptive scheduling.
    Fig. 2: Work-flow of schedulability analysis. Figure 2 shows the work-flow of response-time analysis (performed by Terma A/S) and schedulability analysis using UPPAAL: the task timing informations are obtained from ASW and BSW documentation, worst-case execution times (WCET) of BSW are obtained from BSW documentation [Terma A/S(Issue 9)] and ASW timings are obtained from simulation measurements. In addition the UPPAAL model uses information about the individual task flows, i.e. the timing of resource locks, CPU execution and suspension.
    Schedulability Analysis of Herschel/Planck Software Using Uppaal Fig. 4: MainCycle task: periodically starts ASW functions.
    Fig. 6: Global process enforce invariants on stopwatches and cyclic progress.
    Fig. 7: Gantt chart of the first cycle, generated by UPPAAL TIGA: task T(i) is green when ready, blue - executing, red - blocked, cyan - suspended, resource R(j) is blue when locked and owner uses CPU, green - locked but the owner is preempted, cyan - locked but owner is suspended. A Gantt chart can be used to visualise a trace of the system, thus providing a rich picture for inspection. For example, the generated Gantt chart in Figure 7 shows that Cmd_P is blocked more than 5 times during the first cycle, while blocking times for PrimaryF (21) and StsMon_P (25) are significantly long only starting from the second cycle.
    1 An Introduction to Automatic Synthesis of Discrete and Timed Controllers Fig. 1.1 A Chinese juggler (cartoon courtesy of Jean Cardinal.)
    Armd Hartmanns, Holger Hermanns, and Joost- Pieter K atoen Fig. 12 Simulation results for the communication scenario
    Fig. 1.2 An example of a game structure Example 1. Fig. 1.2 depicts a game structure. The set of locations is L = {L0,L1,L2, L3}. In location LO, Player 1 can choose between action a or action b, while Player 2 can choose between action u1 and action u2. LO (inner circle) is the initial location of the game. The edge (L0,a,L1) belongs to Player 1 and the edge (LO, u1,L1) belongs to Player 2.
    fig. 1.3 Controllable and uncontrollable predecessors Example 5. To illustrate the definition of controllable predecessors, we use Fig. 1.3. First, let us consider the set of locations T; = {L1,L3}. The location LO is a con- trollable predecessor of T;. Indeed, in LO if Player 1 chooses a, no matter what is the choice of Player 2 (to move the pebble using an edge labeled with a or to play an edge labeled with her own actions) the pebble will be either in L1 or L3 after the round, so it will lie in T;. Second, let us consider the set of locations T; = {L1,L2}. The location LO is not a controllable predecessor of Tz. Indeed, neither a nor b en- sures that the pebble will lie in T2 as Player 2 can choose to go to L3 using a or u2 in the first case, and Player 2 can decide to go to L1 using ul in the second case.
    Fig. 1.4 An example of a timed game automaton
    Fig. 1.5 Computation of the timed controllable states. The sets of states that we have to handle are infinite, so they cannot be repre- sented in extension. We need a symbolic data structure able to represent infinite sets. Those sets can be represented symbolically using formulas in an adequate con- straint language. All sets manipulated during the computation of the timed control- lable predecessors are representable by union of clock constraints. To illustrate the use of clock constraints and how the computation of the controllable predecessor in the timed setting is done, we consider our running example of Fig. 1.4.
    Fig. 1.6 A model for the plate. Fig. 1.6 shows the timed automaton model for Plate i € {1,2}. The timed game automaton has the set of locations {Stable, Spinning, Longspinning, Crashed}. The location Stab1Le intends to model the situation when the plate is stable, the lo- cation Crashed models the situation when the plate has crashed, Spinning mod- els the situation when the juggler does spin the plate spin fora timet < STABSHORT seconds (where STABSHORT is a constant equal to 2), and Longspinning when the juggler does spin the plate for more than STABSHORT seconds.
    Fig. 1.1 Overview of the system. The design of controllers for embedded systems is a difficult engineering task. Con- trollers have to enforce properties like safety properties (e.g. “nothing bad will hap- pen’), or reachability properties (e.g. “something good will happen”), and ideally they should do that in an efficient way, e.g. consume the least possible amount of energy. The foundations of have been presented application of these in the approac automatic synthesis of discrete and timed controllers preceding chapter 1. In this chapter, we illustrate the hes with an industrial case study provided by the Hy- DAC ELECTRONIC GMBH company in the context of the European research project Quasimodo [?]. We present in the sequel how to use (in a systematic way) the tool UPPAAL-TIGA [?] (see cha pter | for an introduction to the tool) for the synthesis, together with tools for the verification and the simulation of a provable correct and near optimal control er for real industrial applications. The system to be controlled is depicted in Fig. 1.1 and is composed of:
    Fig. 1.6 Model of the cyclic consumption of the machine
    Results. It is worth noticing that the value Score is computed using the variable V_acc which is deduced from intermediary values of variable V. Since V corresponds to the value of the volume with no noise, V_acc represents the mean value of the accumulated volume for a given execution.
    Fig. 1.12 Cyclic Behavior of the Bang-Bang controller with Noise
    Fig. 1.15 Smart Controller / fluctuations Fig. 1.14 Smart Controller / no fluctuations
    Fig. 1.16 The Pump Controlled over 3 Cycles To make sure that our strategies are implementable, we have verified them in presence of fluctuations of the rate consumption and two types of imprecision: on the time-stamp of start/stop of the pump (we use A = 0.01 second), and on the measure of the initial volume, the imprecision being 0.06 /. Fig. 1.16 shows how the volume is controlled over 3 cycles: after the first one at tf = 20, we measure the real volume with uncertainty (0.06 /) and use the corresponding controller from 20 to 40 and for 40 we again switch to another one.
    Fig. 1.18 The overall SIMULINK model.
    Fig. 1.19 The three controller types with SIMULINK 1 Timed Controller Synthesis: An Industrial Case Study
    Fig. 2 Hidden node problem and its detection
    Fig. 9 Three different initiator positions Latency vs. energy consumption. A TDMA protocol is by design very predictable with respect to energy consumption: since only in the active slots the energy drain of the radio is non-negligible, and the number of active slots per frame is constant, also the power consumption is close to constant, depending linearly on the number of active slots. Energy consumption is therefore constant over time. However, tl question is how energy-efficiently the network fulfils its task. We thus focus on tl atency of message dissemination and the energy consumed by that. We consid the average time required and the total average energy consumed until a message nitially, only one node is infected, the initiator. To get insight into the effect of t delivered to all network nodes. We say a node is infected if it has received a message. he he el is Ne position in the network of the message initiator, we considera corner node, a midd gMAC’s energy consumption. le node at the border, and a center node (cf. Figure 9). Again, the simulations are run for different values of r and A to investigate the influence of these parameters on
    Energy Consumption in the Chess WSN: A MoDeST Case Study
    Fig. 5 LTS of the parallel composition of sender, receiver and communication channels Fig. 4 MODEST code for the parallel composition of sender, receiver and communication channels
    Probabilistic Analysis of Embedded Systems Fig. 8 Automaton for the channel with transmission delay
    coffee is produced, modeled as cof!, or tea is output, modeled as tea!. Both bring the machine back into its initial state s9. The observable behaviour of s is expressed by its set of traces, of which there are infinitely many:
    Fig. 3: Test case as a labeled transition system.
    where a? is an input (output of the test case) such that at least one transi- tion with a? is enabled in some state of S. The test case tg is obtained by re- cursively applying the algorithm for the set of states S' reachable from S via a?: S' = Saftera?. Analogously, each t,, is obtained by recursively applying the algorithm for S,, = S after x;. The single-state test case pass is always a valid test case.
    This test case awaits and checks the next output x;! from the SUT. If x;! is correct, i.e., x;! € out(S), then the algorithm continues recursively; otherwise the test fails. If no output arrives then quiescence 6 has been observed, and the corresponding test-case transition is taken. This test case attempts to supply input a? to the SUT, but if the SUT is faster and produces an output x! before a? could be supplied, then the tester checks whether this output is correct, x;! € out(S), or not.
    High? temperature indication it switches on the compressor relay within a reac- tion time of RelayLatency, which is controlled by clock x and the clock invariant x<=RelayLatency in location goOn. Dually, in the On-location it will transit towards the goOff location. Fig. 6: Alarm Monitor Model.
    Fig. 4: System Diagram of Cooling Controller Model.
    Fig. 5: Compressor Controller Model.
    Fig. 7: Universal Environment Model for Cooling Controller Figure 6 shows the Alarm Monitor. When it detects a High? temperature it moves from the Off location to the Triggered location, where it remains for AlarmDelay time units, controlled by the clock z, unless it observes a Low? temperature in the mean time, after which the high temperature situation is ignored. If the high temper- ature remains for AlarmDelay time units, the automaton moves to the HighTooLong location with an internal transition. Here it sounds the alarm, allowing for a small timing tolerance up to AlarmSoundLatency. It remains Sounding until the user clears the alarm by pressing the ClearAlarm? key.
    Fig. 8: Alternative, more realistic Environment Model speed bounded by MinTempDelay. Thus our framework enables the test engineer to use different environment models of varying strengths. Taken further, this can be used to focus testing on restricted, important scenarios, or on specific test purposes.
    Fig. 1 Desktop applications, logger and a franking machine are connected to the central XBus. 2.2 Model-based testing
    Fig. 3 The V-model that was used for development of XBus.
    Fig. 4 High level architecture of the XBus system. It contains a server side package, and a client side package. Furthermore, it has functionality for TCP connections and XBus messages. Both server and client implement the Protocol interfaces. All interfaces are indicated with <i>.
    Fig. 7 Chosen solution: JTorX providing stimuli to XBus via generic clients (c) over TCP, and observing responses via test interface (t), also connected via TCP. of this solution is that the actual test architecture very closely resembles the model. However, it has the disadvantage that the XBus implementation has to be extended in multiple places.
    Fig. 8 Screen shot of configuration pane of JTorX, set up to test XBus. JTorX will connect to (the adapter that provides access to) the system under test via TCP on the local machine, at port 1234. The bottom two input fields list the input and output messages.
    Table 1.1 Some logical operators in Uppaal
    Table 1.2 Model checking experiments 1 An Industrial Application of Uppaal: The Chess gMAC WSN Protocol
    Table 1.3 Model checking experiments of a network with two communities
    Table 2: Specification, blocking and worst-case response-times of individual tasks. On a Linux server with Intel Xeon E5420 2.5GHz processor UPPAAL takes 2min 40s to verify that the system is schedulable, 6min 30s to find WCRTs with 0% BCET deviation. In case of 10% BCET deviation it took slightly over 6 days to establish schedulability and slightly over 7 days of 6 parallel runs to find all WCRTs. Table 3 shows the amount of verification resources UPPAAL requires to verify schedulability with different task execution time windows and model time limits. In this study we used compact data structure (CDS) to store the clock val- uations in contrast to difference bound matrices (DBM) in previous study, which explains why the verification is slower, but the memory usage is limited and varies very little across model time limits.
    Table 3: Verification statistics for different task execution time windows and explo- ration limits: the percentage denotes difference between WCET and BCET, limit is in terms of 250ms cycles ( stands for no limit, i.e. full exploration), memory in MB, time in seconds.
    Table 1.1 Main characteristics of the strategies synthesized with UPPAAL-TIGA. in the interval /;, the corresponding period of activation of the pump is represented. We have represented volumes which share the same strategy in the same color. For the 50 initial possible values of volume, we obtain 10 different strategies (first row of Table 1.1). The overall strategy we synthesize thus measures the volume just once at the beginning of each cycle and plays the corresponding “local strategy” until the beginning of next cycle.
    Table 1.2 Performance characteristics based on SIMULINK simulations. Now, the plots in Fig. 1.19 are the result of SIMULINK simulations of the con- trollers, illustrating the volume of the accumulator as well as the state of the pump (on or off) for a duration of 200 s, i.e. 10 cycles. Though the simulations do not reveal the known violation of the safety requirement R; in the HYDAC Smart con- troller case, the simulations yield useful information concerning the performance of the controllers. In particular, the simulations indicate that the accumulated oil vol- ume for all controllers grow linearly with time. Also, there is clear evidence that the strategies synthesized by UPPAAL-TIGA outperform the Smart controller of Hy- DAC — which is not robust — and also the Bang-Bang controller — which is robust but far from optimal.
    Armd Hartmanns, Holger Hermanns, and Joost- Pieter K atoen 3 Analysing MODEST Models
    descriptionView Paperarrow_downwardDownload
    Reo Based Interaction Model
    by Ernesto Pimentel

    2006, Electronic Notes in Theoretical …

    UNU-IIST is jointly funded by the Governor of Macau and the governments of the People's Republic of China and Portugal through a contribution to the UNU Endownment Fund. As well as providing two-thirds of the endownment fund, the Macau... more
    descriptionView Paperarrow_downwardDownload
    Fuzzy expert system for solving lost circulation problem
    by Leonid Sheremetov

    2008, Applied Soft …

    Lost circulation is the most common problem encountered while drilling oil wells. This paper describes a distributed fuzzy expert system, called Smart-Drill, aimed in helping petroleum engineers to diagnose and solve lost circulation... more
    descriptionView Paperarrow_downwardDownload
    Modeling information systems from the viewpoint of active documents Proposal for a modeling approach putting emphasis on the ubiquitous documents
    by Bálint Molnár
    The development of document handling by orga- nizations at the level of business processes and business information systems leads to the phenomenon that the major- ity of documents and their contents remain in semi-structured format and... more
    descriptionView Paperarrow_downwardDownload
    Document Centric Modeling of Information Systems
    by Bálint Molnár
    Most recently, the concept of business documents has started to play double role. On one side, a business document (word processing text or calculation sheet) can be used as specification tool, on the other side the business document is... more
    interactive documents and the emphasis on Web intertaces led to the concept of modern Information Systems. Beneath Information Systems there is a set of data that delivers the required information either to the business activities or to the information processes. During analysis, the question that is investigated is as to whether what information should be kept in the system. The data and their collections exist independently from business documents that may or may not related to decision processes. The modeling of Information Systems focused on document should adhere to established practices of data and information modeling. The model should be perceivable by users at high level. The approach for modeling and analysis should be semantically powerful in order to serve as a basic model and be understandable by users. The document-centric model is unlike to the data model but they are interdependent on each other. The document model tries to gather the transformations and the results of activities to extend information on documents with new facts. Figure 1: Levels of collections related to documents
    The artifact-centric business process model uses three basic concepts: artifact classes, tasks, and busines: tules*”’. The tasks handle the artifacts, the business rules govern which tasks should be triggered and which artifact will be manipulated'*"’. Figure 2: Class Diagram for Documents at “Document Conceptual Level” within a Case Study
    To combine the previously referred approaches to model modern Information Systems, there are various proposals'*”°”', Blokdijk’s assembly of Information System Models> offers structuring principles, moreover the axiomatic design approach” can be employed for the Information Systems provides clues for both theoretic and practical modeling point of view. The concept of generalized hypergraph® seems to be a proper mathematical formalism that fits to unifving all viewpoints. perspectives. artifacts and modeling elements. Figure 3: Class Diagram for Documents Class Diagram for Documents at “Data Model Conceptual Level” within a Case Study
    included in documents should be traced, i.e. creating, modifying data items, establishing new relationship; the precedence analyses is an available option for tracking the impacts”. The chain of events and processes can be monitored through roles/actors and their handling of identifiable datz tems within documents. The human roles stimulate data processing activities that effects documents, consequently he data items as well that are included in the documents. The document-subdocument structure (Figure 1, Figure 2. ‘igure 3) is able to represent both the organization and the information model at the same time. Whilst the datz nodel is not structured as set of swb-data models instead it displays rather uniform configuration’ (Figure 5) 3lokdijk’s model offers a structuring approach for perceiving Information Systems. The model’s major component: re: (1) organizational model (2) information model; (3) data model; (4) process model. The process mode! rovides the composition of business activities and it is strongly coupled to the control structure. However, the date nodel is not an exact representation of the organization structure. For the reason that patterns of data model reflec’ he relevant facts about the organization but it does not map the organization structures. The document and date nodel requires a common representational method in which the services, and functions of documents, the couplec yusiness activities can be depicted in a uniform manner. Furthermore, the interrelationships between the data anc locument model can be shown as much the same way as possible. There is logic of inheritance to identify data items vithin documents. Within the document chain, data elements are inherited from the previous element of documents. Towever, the responsibility for recognizing the proper data items relates to the currently valid system role (human o1 usiness process). The previously published figure’ (Figure 5) has been extended to designate the name space o1 Jocument’s DBMS, emphasize the mutual mapping between the information related to control and business rocesses, and to pinpoint to set of models that play a crucial role in integration of enterprises and informatior ystems.
    Figure 5: A Multi-dimensional model for interaction of Information Systems and Documents
    Figure 6: Information Systems’ model in a document-centric approach.
    A database-centric Information System model that is based on an information theory approach’ outlines a framework that describes the input, output and query processing. Figure 6 contains the Information System model indicated by the dashed red line; the previously published version’® is enhanced to express that the source code data outside of the system and the code generated by the information system towards destination are communicated through a crust consisting of documents. In computerized systems, interactive documents and Web services become visible on the source and the output side. Free documents appear at the interface/fagade level. The system roles (either human or automated system) perform variable valuation, or binding at each single variable through simple tasks. The business activities consist of tasks, a task can be composed of elementary tasks. An elementary task can be coupled to specific variables and its manipulation. The end-users who typically use information can retrieve data through documents, e.g. querying and fetching data from database and then processing the obtained responses.
    descriptionView Paperarrow_downwardDownload
    Performance by unified model analysis (PUMA
    by Dorina Petriu

    2005

    Evaluation of non-functional properties of a design (such as performance, dependability, security, etc.) can be enabled by design annotations specific to the property to be evaluated. Performance properties, for instance, can be annotated... more
    descriptionView Paperarrow_downwardDownload
    Evaluation of a business continuity plan using process algebra and modal logic
    by Wolfgang Boehmer and 
    1 more
    Jan Friso Groote

    2009, 2009 IEEE Toronto International Conference Science and Technology for Humanity (TIC-STH)

    Knight and Pretty published their study about the impact of catastrophes on shareholder value, the need for a business continuity management system (BCMS) became clear. Once a BCMS is in place, the corresponding risks can be insured... more
    descriptionView Paperarrow_downwardDownload
    A comparative reliability analysis of ETCS train radio communications
    by Yaroslav Usenko

    2005

    StoCharts have been proposed as a UML statechart extension for performance and dependability evaluation, and were applied in the context of train radio reliability assessment to show the principal tractability of realistic cases with this... more
    A trivial P-edge (where probability 1 is assigned to a unique action set and target nodes set) can be drawn like a transition in a statechart diagram: a single arrow labeled with event, guard and actions.
    Figure 2: Cumulative distribution function for the transmission delay
    Figure 4: The receiver model, including error models
    Figure 5: Model for the first experiment
    Figure 6: Model for the second experiment
    Figure 7: Comparison of two cumulative distribution functions for max At
    We used the tool chains to estimate the probability p that the communication succeeds fo: some values of t. Table 1 gives the estimates for the three combinations of tools we have used. We can see that the three tool combinations produce (approximately) the same results.
    the latter is based on information not older than At + 7.4 seconds. So, in addition to the minimal headway for instant communication (40 seconds), we allow for another 7.4 seconds headway based on the analysis method. Therefore, we have chosen to analyze the situation where the headway between two trains is 62.4 seconds. What is the probability that the following train has to brake during this trip? So, what is the probability p that the time At between two successive movement authorities received by the following train is more than 15 seconds at least once? Further, what is the probability that it has to stop? (At 300 km/h, a train needs about one minute to stop.) So, what is the probability p that At > 15 + 60 seconds at least once? PROVER and MODEST provide us with the results shown in table 2. Table 2: Experiment 2 results: Probability that At is > the indicated time at least once during a 1 hour trip We can see that according to both tools, about one train out of 9 or 10 would have to brake. The simulations did not produce a single run where a train would need to stop, so this probability is too small to be measured.
    descriptionView Paperarrow_downwardDownload
    Algebraic–coalgebraic specification in CoCasl
    by Horst Reichel

    2006, The Journal of Logic and Algebraic Programming

    We introduce CoCasl as a light-weight but expressive coalgebraic extension of the algebraic specification language Casl. CoCasl allows the nested combination of algebraic datatypes and coalgebraic process types. Moreover, it provides... more
    descriptionView Paperarrow_downwardDownload
    Business Processes Verification for e-Government Service Delivery
    by Alberto Polzonetti

    2010, Information Systems Management

    Domain experts knowledge represents a major source of information in the design and the development of user-centric and distributed service-based applications, such as those of e-government. Issues related both to the communication among... more
    descriptionView Paperarrow_downwardDownload
    Proving non-termination
    by Ashutosh Gupta

    2008

    The search for proof and the search for counterexamples (bugs) are complementary activities that need to be pursued concurrently in order to maximize the practical success rate of verification tools. While this is well-understood in... more
    Figure 1. Broken binary search implementation.
    Figure 6. Typical permissions table generated by mmpt_insert. Figure 5. Modriaan permissions table indexing.
    Figure 7. Table state after first call of mmpt_insert.
    Figure 11. Acceleration of the algorithm NONTERM for testing termination. Lines 18.1-18.9 replace line 18 in Figure 2. We unroll the loop part of a terminating lasso without intermediate checks for non-termination. Recall that the variable s holds the value of the current program state, whose successors are computed during loop unrolling.
    descriptionView Paperarrow_downwardDownload
    Verification of Hypertorus Communication Grids by Infinite Petri Nets and Process Algebra
    by IEEE/CAA J. Autom. Sinica

    2019, IEEE/CAA Journal of Automatica Sinica

    A model of a hypertorus communication grid has been constructed in the form of an infinite Petri net. A grid cell represents either a packet switching device or a bioplast cell. A parametric expression is obtained to allow a finite... more
    descriptionView Paperarrow_downwardDownload
    Trend of Scientific research: Analysis of Mega-data of discrete event systems described by mathematical tools
    by Mohamed Fri and 
    2 more
    Fouad Belmajdoub
    Omaima Benatia
    _In this article, we are interested in the discrete event systems modeled by the mathematical tools (Boolean algebra, state space, max-plus, algebra process, temporal logic) and we analyze the mega-data of more than 800 articles published... more
    descriptionView Paperarrow_downwardDownload
    Modeling information systems from the viewpoint of active documents
    by Benczúr András and 
    1 more
    Bálint Molnár

    2015, Vietnam Journal of Computer Science

    The development of document handling by organizations at the level of business processes and business information systems leads to the phenomenon that the majority of documents and their contents remain in semi-structured format and a... more
    Table 1. Mapping the Concepts of Web Information Systems onto the Notion of Hypergaph.
    mapping between the software architecture and the project structure of the software development team in a software development and engineering environment, (Herb- sleb 1999)). The document model should reflect the evolution of documents, the changes, the events, the stimulus-response patterns in line with business processes. The changes that affect the identifiable data contained in documents should be tracked, i.e. creating, modifying new data elements, setting up new relationship, as e.g. making use of precedence analyses (Blokdijk 1987). The chain of course can be monitored through the actors and their manipulation of identifiable data elements within documents. The effects on documents and data elements exercised either by physical transformation within organization or by data processing activities triggered by human. Fig. 1. Document model of Information Systems from an Enterprise Architecture perspective.
    Fig. 2. An Illustrative Example for Structure of Documents via Hypergraph representation
    Fig. 3. Information Systems’ model in a document-centric approach
    The accurate and valid handling of document is the responsibi ity of Web service management system. The semantic validity of documents as a property can be per- ceived as: the set of relationships among documents that are semantically correct, valid in the context of other documents, business processes, and activities, and the general operation of business units. The Web pages, the messages between Web ser- vices conveying data and / or documents are important component of WIS. Semi- structured data occur in the form of XML/HTML documents for t he users on the net- work (Intranet, Extranet, and Internet) and in WIS. Displaying information for the users and requests input from the users are the two facets of WIS considering the information exchange Fig. 4. Dependence Hypergraph for Document Concept and Structures
    The hypergaph approach for modeling WIS from a document-centric viewpoint provides an algebraic toolset for analyzing, conformance, compliance and consistency checking of the model. Thereby, the model can be exploited for design and opera- tional purposes as well [6]. Fig. 5. Dependence Hypergraph for Depicting the Structure of Ontological Concepts for Busi- ness Processes and Participants of Organization
    Fig. 6. A Part of a Directed Hypergraph for Story Board
    descriptionView Paperarrow_downwardDownload
    Split: a flexible and efficient algorithm to vector-descriptor product
    by Thais Webber

    2007

    Many Markovian stochastic structured modeling formalisms like Petri nets, automata networks and process algebra represent the infinitesimal generator of the underlying Markov chain as a descriptor instead of a traditional sparse matrix. A... more
    descriptionView Paperarrow_downwardDownload
    Metrics for labelled Markov processes
    by Josée Desharnais

    2004, Theoretical Computer Science

    The notion of process equivalence of probabilistic processes is sensitive to the exact probabilities of transitions. Thus, a slight change in the transition probabilities will result in two equivalent processes being deemed no longer... more
    descriptionView Paperarrow_downwardDownload
    Performance analysis of stochastic process algebra models using stochastic simulation
    by Jeremy T. Bradley

    2006, Proceedings 20th IEEE International Parallel & Distributed Processing Symposium

    We present a translation of a generic stochastic process algebra model into a form suitable for stochastic simulation. By systematically generating rate equations from a process description, we can use tools developed for chemical and... more
    descriptionView Paperarrow_downwardDownload
    Code generation for a family of executable modelling notations
    by Pourya Shaker

    2012, SoSyM

    We are investigating semantically configurable model-driven engineering (MDE). The goal of this work is a modelling environment that supports flexible, configurable modelling notations, in which specifiers can configure the semantics of... more
    descriptionView Paperarrow_downwardDownload
    Process algebra-based computational tools in ecological modelling
    by Ferenc Jordán

    2011, Ecological Complexity

    Individual-level variability (DeAngelis and Mooij, 2005), stochasticity and local interactions call for individual-based models (IBMs, Grimm et al.
    descriptionView Paperarrow_downwardDownload
    Metamodeling Mathematics: A Precise and Visual Framework for Describing Semantics Domains of UML Models
    by Daniel Varro

    2002

    As UML 2.0 is evolving into a family of languages with individually specified semantics, there is an increasing need for automated and provenly correct model transformations that (i) assure the integration of local views (different... more
    descriptionView Paperarrow_downwardDownload
    Specifying active databases in the situation calculus
    by Leopoldo Bertossi

    1998, Proceedings SCCC'98. 18th International Conference of the Chilean Society of Computer Science (Cat. No.98EX212)

    This paper provides a predicate logic based semantics for active rules in active databases [24, 10]. Previous work has been done to provide semantics of execution of active rules [21, 3, 9, 11]. In part, this work has been directed... more
    descriptionView Paperarrow_downwardDownload
    Prime Filters on Residuated Lattices
    by Esko Turunen

    2012, 2012 IEEE 42nd International Symposium on Multiple-Valued Logic

    In this short paper we give an affirmative answer to the problem left open in [3], that is, for any residuated lattice L, if prime filters and prime filters of the second kind coincide, then L must be an MTL-algebra.
    descriptionView Paperarrow_downwardDownload
    Semantic reengineering of business processes
    by Violeta Damjanovic

    2010, Information Systems

    This paper discusses transforming ontological models into non-ontological models of business processes, when the process of articulating different data models is known as reengineering domains. As a crucial factor in achieving... more
    Fig. 2. The semantic business process transformation scenario. Each model from the M1 layer conforms to an ippropriate metamodel from the M2 layer. At the same
    Fig. 4. Mapping from the OWL DDPO-based Elementary task into the BPEL Throw activity. Fig. 3. The “Semantic-Rule-Action” sense of the transformation scenario.
    Fig. 6. A graphical representation of the DDPO Component.
    Fig. 5. A graphical representation of the DDPO Elementary task. Syntax of the DDPO Elementary task (according to [6]). Table 5
    Finally, the syntax of the DDPO Task is given in the form of a graphical representation that involves both the sequence and the multi merge workflow patterns (shown in Fig. 7). Based on Fig. 7, the semantics of the DDPO Task is described by the definitions (9)-(14). The DDPO Task (that is defined by map relation in (9)) is a course (that is further defined by cur relation in (10)) in which a plan In the next step, the syntax of the DDPO Component relation is given in the form of a graphical representation that involves both the sequence and the parallel split workflow patterns (shown in Fig. 6) [7]. Starting from Fig. 6, the Pi-Calculus based semantics of the DDPO Component is defined and represented by the definitions (4)-(8). The DDPO Component relation (that is defined by map relation in (8)) is described as a proper part (defined by pp relation in (4)), which is further qualified by description (defined by dsc relation in (5)) in which the proper part z (defined by z relation in (6)) and the proper part w (defined by w relation in (7)) are involved.
    Table 1
    The syntax of the DDPO tasks (according to [6]). Table 2
    The metamodel-based transformation rules. Table 6 Fig. 7. A graphical representation of the DDPO Task.
    descriptionView Paperarrow_downwardDownload
    Integration of safety analysis in model-driven software development
    by Alejandro Alonso

    2008, Iet Software/iee Proceedings - Software

    Safety critical software requires integrating verification techniques in software development methods. Software architectures must guarantee that developed systems will meet safety requirements and safety analyses are frequently used in... more
    descriptionView Paperarrow_downwardDownload
    Merging frameworks for interaction
    by Eric Pacuit

    2009, Journal of Philosophical Logic

    descriptionView Paperarrow_downwardDownload
    Axiomatization of Bisimulation Based Relations
    by Pranav Singh

    2005

    The question of when two systems are behaviourally equal has occupied a large part of the literature on verification and has yielded various equivalences (and congruences). These equivalence relations are most useful in comparing systems... more
    descriptionView Paperarrow_downwardDownload
    FORMAL APPROACH TO A WEB INFORMATION SySTEM BASED ON STORy ALGEBRA
    by Bálint Molnár

    2012, Singidunum Journal

    Web Information Systems (WIS) are becoming more and more ubiquitous along with the changes in information technology. There have already been several studies on modeling various aspects of WIS. This paper attempts to investigate the... more
    descriptionView Paperarrow_downwardDownload
    Automated Verification of Executable UML Models
    by Mohammadreza Mousavi
    We present a fully automated approach to verifying safety properties of Executable UML models (xUML). Our tool chain consists of a model transformation program which translates xUML models to the process algebra mCRL2, followed by... more
    descriptionView Paperarrow_downwardDownload
    Analysing scientific workflows with Computational Tree Logic
    by Vasa Curcin

    2009, Cluster Computing

    Motivated by the widespread use of workflow systems in e-Science applications, this article introduces a formal analysis framework for the verification and profiling of the control flow aspects of scientific workflows. The framework... more
    descriptionView Paperarrow_downwardDownload
    EXTENDED PROCESS ALGEBRA FOR COST ANALYSIS
    by International Journal in Foundations of Computer Science & Technology ( IJFCST )
    Recently, the computational cost in execution of processes is considered to be one of the important factors in concurrent systems and is beginning to interest to us. For example, the denial-of-service attacks are related to it... more
    descriptionView Paperarrow_downwardDownload
    A balancing act: Analyzing a distributed lift system
    by Arno Wouters and 
    2 more
    Jun Pang
    Jan Friso Groote

    2001, Proc. 6th Workshop on Formal Methods …

    The process-algebraic language mcrl is used to analyze an existing distributed system for lifting trucks. Four errors were found in the original design. We propose solutions for these problems and show by means of model-checking that the... more
    Figure 1: State of the relays before (left) and after (right) initialization
    Table 1: Transition system dimensions
    descriptionView Paperarrow_downwardDownload
    Inheritance of behavior
    by Wil van der Aalst

    2001, Journal of Logic and Algebraic …

    descriptionView Paperarrow_downwardDownload
    Specification Based Software Product Line Testing: A case study
    by satish mishra

    2000, IEEE Concurrency

    In this paper, we describe an approach of software prod- uct line testing which is based on formal specifications of the desired properties. In a software product line, common behaviours are main- tained at subsequent levels of the... more
    descriptionView Paperarrow_downwardDownload
    Simulation and Verification for Computational Modelling of Signalling Pathways
    by Gethin Norman

    2006, Proceedings of the 2006 Winter Simulation Conference

    Modelling of the dynamics of biochemical reaction networks typically proceeds by solving ordinary differential equations or stochastic simulation via the Gillespie algorithm. More recently, computational methods such as process algebra... more
    Kwiatkowska, Norman, Parker, Tymchyshyn, Heath, and Gaffney Figure 1: Graphical Representation of FGF and FGFR Interaction and Their Effect on Sre and Grb2.
    Figure 7: Results of Analysis of the Example: Concentration/Quantity of Two Forms of FGFR over Time Figure 6: Fragment of the Automatically Generated ODEs
    bound to FGFR. In this case, the ODE result disagrees with averaged simulation runs from the z-calculus model. This is because the stochastic approach is more accurate when the number of molecules is small and the behaviour of the reaction system becomes non-continuous. The behaviour of the ODE model differs because Src cannot be totally degraded (the degradation is balanced by the formation of new Src), whereas in the stochastic model the random walk of Src, which starts at 10, can easily lead to 0. Figure 8: An Extended Example Demonstrating the Differ- ence between ODE and Stochastic Modelling Results
    Figure 9 presents further results obtained with PRISM: both the expected number of reactions of a certain type and the expected time a complex is present by time T.
    For illustration, the graph in Figure 10 shows the amount of Grb2 bound to FRS2 (not included in the running ex- ample). The plots show the result of our in silico genetics experimentation, that is, how the variation in quantity is affected by the removal of certain key components. Figure 10: The Variation in the Amount of Grb2 Bound to FRS2 in the Full FGF Pathway Model
    Figure 2: Summary of the Reactions
    Kwiatkowska, Norman, Parker, Tymchyshyn, Heath, and Gaffney A fragment of t of BioSPI) relating and Src is shown in as the parallel com each of which mod he z-calcu Figure 4. position oO us code (in the textual format to FGFR and its interactions with FGF We encode an FGFR protein f interacting subcomponents, els a characteristic of the protein, for example the connection to an FGF protein (bound/unbound) or the state of a residue (phosp Subcomponents serve as both protein internal states and its interfaces through which the interactions with other proteins occur. FGF, Sre and Grb2 are modelled as separate processes (omitted from Figure 4). Input, output, action prefix and choice are denoted by “?”, “!, “?’ and “;” respectively. For further details, see, e.g., (Regev and Shapiro 2004). horylated/unphosphorylated).
    Kwiatkowska, Norman, Parker, Tymchyshyn, Heath, and Gaffney
    Kwiatkowska, Norman, Parker, Tymchyshyn, Heath, and Gaffney
    descriptionView Paperarrow_downwardDownload
    Reo Based Interaction Model
    by Ana Roldan

    2006, Electronic Notes in Theoretical Computer Science

    UNU-IIST is jointly funded by the Governor of Macau and the governments of the People's Republic of China and Portugal through a contribution to the UNU Endownment Fund. As well as providing two-thirds of the endownment fund, the Macau... more
    descriptionView Paperarrow_downwardDownload
    Toposes are adhesive
    by Pawel Sobocinski

    2006, Graph transformations

    Adhesive categories have recently been proposed as a categorical foundation for facets of the theory of graph transformation, and have also been used to study techniques from process algebra for reasoning about concurrency. Here we... more
    descriptionView Paperarrow_downwardDownload
    Processes in Lingua Cosmica
    by Douglas Vakoch

    2012, Acta Astronautica

    In a sequence of papers on the topic of message construction for interstellar communication by means of a cosmic language, representations of various kinds of concepts of reality in a Lingua Cosmica system [1]. Those studied were logic... more
    descriptionView Paperarrow_downwardDownload
    Towards the modeling of cell communication and computation using the shape algebra of biopolymers
    by Sungchul Ji

    2002

    One of the critical components of the mechanisms of cell communication and cell computing has been postulated to be space-and time-organized teleonomic (or goaldirected) shape changes of biopolymers that are driven by exergonic chemical... more
    “Just as verbal sentences (as written) are strings of words arranged linearly in the geometric space, so the cell-linguistic (or molecular) sentences are visualized as strings of gene expressions arranged in the time space.
    The evolution of the interacting processes is described by a reduction relation over processes called reaction. This reaction relation contains those transitions which can be inferred from a set of rules. If we now consider @ as a prefix indicating the shape of an interaction, then we have the following definition for the reduction relation. the prefix x(y) binds the name y; we denote by fn (P) the set of the names with free occurrences in P. We denote by P{v/u} the result of simultaneous substitution in P of all free occurrences of the name u by the name v, using alpha- conversion wherever necessary to avoid name capture. A structural congruence relation is defined over the set of processes; this relation provides a static semantics of some formal constructions. We denote by =, the standard alpha- conversion of the lambda-calculus (a well- known term-algebra with the same computational power as the Turing machines).
    It is very useful to be able to compare the behaviour of two systems. We intro- duce two behavioural equivalences. These behavioural equivalence are based on the important notion of bisimulation origin- ating from process algebra in computer science. There are several versions of bisimilarity; one of them is called open bisimilarity. Its definition is given by using the labeled transition system defined by the reduction rules.
    strains of biopolymers that provide both the free energy to do work and the genetic information to control work.
    The modeling relation between cell and human languages.
    Table 2. A comparison between human and cell languages. Cell language is defined as “a self- organizing system of molecules, some of which encode, act as signs for, or trigger, gene-directed cell processes” (Ji, 1997). Both human and cell languages can be represented as 6-tuples, {L, W, S, G, P, M}, where L is the alphabet, W is the lexicon, S is an arbitrary set of sentences, G is a set of rules governing the formation of sentences from words (called the first articulation) and the formation of words from letters (the second articulation), P is a set of physical mechanisms necessary and sufficient to implement a language, and finally M is a set of objects or processes, both symbolic and material, referred to by words, sentences, and their higher-order structures (Ji, 1999a). In Table 2 cell and human languages are compared with respect to these linguistic elements.
    Table 3. Paradigmatic substitutions in sentences. MAP kinase pathway shown below (Marshall, 1994): The syntagmatic relation in signal trans- duction pathways can be identified with the temporal patterns of protein-protein interactions underlying, for example, the
    Table 4. Paradigmatic relations among signal transducing proteins in the MAP kinase cascade. Data from (Marshall, 1994).
    The hypothetical entity exhibiting the properties of information and energy as its complementary aspects is known as gnergy (Ji, 1991, 1995, 2000, 2002a,b). The discrete units of gnergy are called ‘gnergons’, the best studied example of which being conformons, defined as sequence-specific conformational strains of biopolymers that carry both free energy (to do work) and genetic information (to control work) (Ji, 1974, 1991, 2000). Available data indicate that the average conformon in proteins carries 8-16 Kceal/mole of free energy and 40-200 bits of information (Ji, 2000; Benham, 1996). The corresponding values for the average conformon in DNA have been estimated to be 500-2500 Keal/mole and 200-600 bits of information, respectively. According to the conformon theory of molecular machines, chemical reactions produce conformons, which then drive Table 5. A comparison between human logic and molecular (or cell) logic.
    Table 7. A comparison between physics and biology with a special attention given to the role of the microarray technique in the biology of the 21 century.
    descriptionView Paperarrow_downwardDownload
    Formal Modelling of PKI Based Authentication
    by Ali E. Abdallah

    2009, Electronic Notes in Theoretical Computer Science

    One of the main aims of certificate based Public Key Infrastructure (PKI) is to provide authentication in distributed systems. Through its functions, PKI authentication can be viewed as a re-usable component that can be integrated with... more
    descriptionView Paperarrow_downwardDownload
    Non-Well-Founded Probabilities and Coinductive Probability Logic
    by Andrew Schumann

    2008, 2008 10th International Symposium on Symbolic and Numeric Algorithms for Scientific Computing

    ABSTRACT
    descriptionView Paperarrow_downwardDownload
    Download research papers for free!
    580 California St., Suite 400
    San Francisco, CA, 94104