Abstract. We present Ecdar a new tool for compositional design and verification of real time systems. In Ecdar, a component interface describes both the behavior of the component and the component's assumptions about the environment. The tool supports the important operations of a good compositional reasoning theory: composition, conjunction, quotient, consistency/satisfaction checking, and refinement. The operators can be used to combine basic models into larger specifications to construct comprehensive system descriptions from basic requirements. Algorithms to perform these operations have been based on a game theoretical setting that permits, for example, to capture the real-time constraints on communication events between components. The compositional approach allows for scalability in the verification.
OverviewThe context. Contemporary IT systems are assembled out of multiple independently developed components. Component providers operate under a contract on what the interface of each component is. Interfaces are typically described using textual documents or models in languages such as UML or WSDL. Unfortunately, such specifications are subject to interpretation. To avoid the risk of ambiguity, we recommend mathematically sound formalisms, such as interface theories, whenever possible. A good interface theory supports refinement checking (whether an interface can be replaced by another one), satisfaction checking (whether an implementation satisfies the requirements expressed with the interface), consistency checking (whether the interface can be implemented), a composition operator (structurally combining interfaces), a conjunction operator (computing a specification whose implementations are satisfying both operands), and a quotient operation that is the adjoint for composition. It should also guarantee important properties such as independent implementability [10].It has been argued [7,10] that games constitute a natural model for interface theories: each component is represented by an automaton whose transitions are typed with input and output modalities. The semantics of such an automaton is given by a two-player game: the input player represents the environment, and the output player represents the component. Contrary to the input/output