1. SS 2018 Software Verification ML, state machines
Prof. Dr. Holger Schlingloff 1,2
Dr. Esteban Pavese 1
(1) Institut für Informatik der Humboldt Universität
(2) Fraunhofer Institut für offene Kommunikationssysteme FOKUS

2. Short Recapitulation What is modal correspondence theory?
What is the standard translation from ML to FOL?
What is the standard translation of an axiom?
What is multi-modal logic, what is it good for?
What is a FSM, what is an NFA, what is a LTS?
What is its semantics?

3. FSM: Variants Labelled transition system LTS
Kripke structure / Kripke model
Nondeterministic finite automaton NFA / FSM
Deterministic finite automaton DFA
Parallel FSM
Finite-state program (variables on finite domains)
UML state machine
What is a “state”?

4. What is a „State“ Wikipedia:
State (computer science), a unique configuration of information in a program or machine
Program state, in computer science, a snapshot of the measure of various conditions in the system
a program is described as stateful if it is designed to remember preceding events or user interactions; the remembered information is called the state of the system
Propositional viewpoint: A state is a complete description of the current value of variable properties of a system
properties might be physical measurables such as weight, temperature, shape, …
or they might be the current value of the bits in memory (variable value assignment)
properties may change over time (thus they are variable)
properties may be observable or unobservable / only indirectly observable

5. UML State Machines – States
UML states are really modes (sets of states)
A UML state models a situation during which (usually implicit) invariant conditions hold
e.g. waiting for an event to occur
e.g. performing some behavior
Associated with each state may be
entry, do and exit actions
constraints (=state invariants)
Pseudostates
initial, history, fork, join, junction, choice, entry, exit, terminate, (final)

6. UML State Machines – Transitions
A transition is a directed relationship between a source vertex and a target vertex
Labels consist of
Trigger [Guard] / Action
where
trigger is a transition label (i/o-event)
guard is a logical formula on internal variables
action is an update of the variables
“Run-to-completion” semantics
if an action is also a trigger, it will be processed before the next external trigger is taken into consideration
maintaining an “event pool” during execution

7. State Machine Meta Model

8. Exercises We will revisit those pesky modelling questions
We will start modelling software with UML-SMs!
We will focus on concurrent system modelling
(after all, that’s where the fun is)

9. Parallelism

10. Parallelism vs. Nondeterminism
Why is nondeterminism in modeling useful?
Nondeterminism arises from hiding „unnecessary details“
e.g., „irrelevant“ variables
e.g., external choices
Which information was hidden in TicTac?

11. Do we „need“ Nondeterminism?
Are the following two LTS equivalent?
What is process equivalence, anyway? a a a c b b c

12. Simulations and Bisimulations
When are two FSMs equivalent?
(consider their purpose for accepting words)
When are two Kripke structures equivalent?
(consider their purpose for interpreting formulas)
When are two LTSs equivalent?
(what is their purpose in modelling?)

13. What is equivalence anyway?
What about graph isomorfism?
Even considering only the reachable portion, it seems too strict

14. What is equivalence anyway?
Recall how we could not distinguish between some Kripke structures using modal logic.
This will be the core idea of model equivalence
The model equivalence notion should
Actually be an equivalence relation (reflexive, symmetric, transitive)
Abstract away from graph structure or trace sets
Be decidable
Be invariant w.r.t. both modal logics and parallel composition

15. Simulation
In other words, a model simulates another one if it can always imitate its behavior

16. Bisimulation
The idea is similar to mutual simulation, but where the simulation relation is the same in both cases