Reduction of automated test generation for Simulink/Stateflow to reachability and its novel resolution

Abstract

Simulink/Stateflow is a popular commercial model-based development tool for many industrial domains. For safety and security concerns, verification and testing must be performed on the Simulink/Stateflow designs and the generated code. In this paper, we present a test generation approach for Simulink/Stateflow by reduction to reachability in a Hybrid Automaton, with its locations representing the computations of the Simulink/Stateflow model, and edges representing the computation-succession. A novel reachability resolution method is presented based on the refinement of the hybrid automaton such that the reachability is reduced to the reachability in the underlying graph (without the dynamics), whenever the refinement step terminates. The approach yields a technique that is effective in terms of achieving test coverage and efficient in terms of test generation time.

Fault Detection of Discrete-Time Stochastic Systems Subject to Temporal Logic Correctness Requirements

“…Remark 3: In Definition 2, and , where , capture the probabilities that an I/O-SHA stays in current location or executes a transition , and so it satisfies the following stochasticity constraint: (4) Note that, in a special setting, the range space of and can simply be the binary set [33], i.e., given any , an I/O-SHA will either stay at current location or execute one transition, with probability 1. Then, the guard/invariant can be equivalently written as logical predicates and .…”

“…To model the refinement of the continuous physical system against the Büchi requirement model, we introduce the notion of input-output stochastic hybrid automaton (I/O-SHA), extending the logical input-output hybrid automaton (I/O-HA) introduced in [33], by allowing randomness in invariants, guards, data updates, and output assignments. Next we propose an algorithm that performs the refinement to yield an I/O-SHA such that the violation of the LTL formula is captured as a reachability property to a certain fault-location.…”

“…1) The notion of I/O-SHA is introduced, extending its logical counterpart in [33]. 2) Stochastic filtering equations are provided to recursively update the distributions for both continuous states and discrete locations of I/O-SHA.…”

Failure diagnosis and prognosis in stochastic discrete-event and cyber-physical systems

“…We introduce the notion of an input-output stochastic hybrid automaton (I/O-SHA), generalizing its logical counterpart presented in [72] by allowing randomness in invariants, guards, data updates, and output assignments. Then we show that I/O-SHA model can be used to model the refinement of a given discrete-time stochastic system against its LTL specification so as to identify the system behaviors that satisfy the nonfault specification versus the ones that violate it in form of reachability of a fault location.…”

“…In Chapter 4, we study fault diagnosis of cyber physical systems, where the physical dynamics over discrete sample instances are described by stochastic difference equations and the nonfault behaviors are specified by linear-time temporal logic (LTL) formulas over sequences of requirement variables that are functions of inputs and states (just as the outputs). Firstly, we propose the notion of input-output stochastic hybrid automaton (I/O-SHA), extending the logical input-output hybrid automaton (I/O-HA) introduced in [72], by allowing randomness in invariants, guards, data updates, and output assignments. Secondly, we present a method to refine a given discrete-time stochastic system against a deterministic (LTL) specification (one that can be accepted by a deterministic Büchi automaton), where the refinement is an I/O-SHA with the property that the violation of the LTL specification can be captured as a reachability property, and the probability of specification violation versus no violation can be estimated via a state estimation computation in the I/O-SHA model.…”