Development of quality assured software-intensive systems, such as automotive embedded systems, is an increasing challenge as the complexity of these systems significantly increases. EAST-ADL is an architecture description language developed to specify automotive embedded system architectures at multiple abstraction levels in the development of safety-critical automotive products. In this paper, we propose an architecture-based verification technique which enhances the model-based development process supported by EAST-ADL by adapting model-checking to EAST-ADL specifications. We employ UPPAAL as a verification tool to ensure that predicted function behaviors of the models in EAST-ADL satisfy functional and real-time requirements. The criteria for this architecture-based verification is presented and the transformation rules which comply with this criteria are derived. This enables us to extract the relevant information from EAST-ADL specifications and to generate analyzable UPPAAL models. The formal semantics of EAST-ADL is defined which is essential to automate the verification of EAST-ADL specifications. Our approach is demonstrated by verifying the safety of the steering truck system units.
Our earlier work @cite_16 verifies EAST-ADL models using UPPAAL-PORT [1] http: www.uppaal.org port . The work uses mainly structural information of EAST-ADL and its requirement, where models are manually translated into SAVE-CCM @cite_9 , which is the required input format for UPPAAL-PORT. In contrast to that work @cite_16 , we consider recent additions to EAST-ADL, including both the timing and behavior extensions by analyzing application internal behaviors specified in behavioral annex as well as using artifact packages. Furthermore, we eliminate the need for intermediate formalisms like SAVE-CCM and target direct transformation of EAST-ADL specifications to UPPAAL TAs.
@cite_9 @cite_16
169129071 2345573725 2962764817 1994157580
We study the use of formal modeling and verification techniques at an early stage in the development of safety-critical automotive products which are originally described in the domain specific architectural language EAST-ADL2. This architectural language only focuses on the structural definition of functional blocks. However, the behavior inside each functional block is not specified and that limits formal modeling and analysis of systems behaviors as well as efficient verification of safety properties. In this paper, we tackle this problem by proposing one modeling approach, which formally captures the behavioral execution inside each functional block and their interactions, and helps to improve the formal modeling and verification capability of EAST-ADL2: the behavior of each elementary function of EAST-ADL2 is specified in UPPAAL Timed Automata. The formal syntax and semantics are defined in order to specify the behavior model inside EAST-ADL2 and their interactions. A composition of the functional behaviors is considered a network of Timed Automata that enables us to verify behaviors of the entire system using the UPPAAL model checker. The method has been demonstrated by verifying the safety of the Brake-by-wire system design. This paper compares the tools SPIN and UPPAAL by modelling and verifying a Collision Avoidance Protocol for an Ethernet-like medium. We find that SPIN is well suited for modelling the untimed aspects of the protocol processes and for expressing the relevant (untimed) properties. However, the modelling of the media becomes awkward due to the lack of broadcast communication in the PROMELA language. On the other hand we find it easy to model the timed aspects using the UPPAAL tool. Especially, the notion of committed locations supports the modelling of broadcast communication. However, the property language of UPPAAL lacks some expressivity for verification of bounded liveness properties, and we indicate how timed testing automata may be constructed for such properties, inspired by the (untimed) checking automata of SPIN. We focus on grounding (i.e., localizing or linking) referring expressions in images, e.g., "largest elephant standing behind baby elephant". This is a general yet challenging vision-language task since it does not only require the localization of objects, but also the multimodal comprehension of context - visual attributes (e.g., "largest", "baby") and relationships (e.g., "behind") that help to distinguish the referent from other objects, especially those of the same category. Due to the exponential complexity involved in modeling the context associated with multiple image regions, existing work oversimplifies this task to pairwise region modeling by multiple instance learning. In this paper, we propose a variational Bayesian method, called Variational Context, to solve the problem of complex context modeling in referring expression grounding. Our model exploits the reciprocal relation between the referent and context, i.e., either of them influences estimation of the posterior distribution of the other, and thereby the search space of context can be greatly reduced. We also extend the model to unsupervised setting where no annotation for the referent is available. Extensive experiments on various benchmarks show consistent improvement over state-of-the-art methods in both supervised and unsupervised settings. The code is available at https: github.com yuleiniu vc . Abstract Synchronous programming (Berry, 1989) is a powerful approach to programming reactive systems. Following the idea that “processes are relations extended over time” (Abramsky, 1993), we propose a simple but powerful model for timed, determinate computation, extending the closure-operator model for untimed concurrent constraint programming (CCP). In . (1994a) we had proposed a model for this called tcc—here we extend the model of tcc to express strong time-outs: if an event A does not happen through time t , cause event B to happen at time t . Such constructs arise naturally in practice (e.g. in modeling transistors) and are supported in synchronous programming languages. The fundamental conceptual difficulty posed by these operations is that they are non-monotonic. We provide compositional semantics to the non-monotonic version of concurrent constraint programming (Default cc) obtained by changing the underlying logic from intuitionistic logic to Reiter's default logic. This allows us to use the same construction (uniform extension through time) to develop Default cc as we had used to develop tcc from cc. Indeed the smooth embedding of cc processes into Default cc processes lifts to a smooth embedding of tcc processes into Default cc processes. We identify a basic set of combinators (that constitute the Default cc programming framework), and provide constructive operational semantics (implemented by us as an interpreter) for which the model is fully abstract. We show that the model is expressive by defining combinators from the synchronous languages. We show that Default cc is compositional and supports the properties of multiform time, orthogonal pre-emption and executable specifications. In addition, Default cc programs can be read as logical formulae (in an intuitionistic temporal logic)—we show that this logic is sound and complete for reasoning about (in)equivalence of Default cc programs. Like the synchronous languages, Default cc programs can be compiled into finite state automata. In addition, the translation can be specified compositionally. This enables separate compilation of Default cc programs and run-time tradeoffs between partial compilation and interpretation. A preliminary version of this paper was published as . (1995). Here we present a complete treatment of hiding, along with a detailed treatment of the model.