之前談到UML and Model Checking,卻沒談到如何實際應用及檢查方式,這篇Model Checking and Code Generation for UML State Machines and Collaborations是之前說到的Hugo/RT轉換工具的Paper,首先下載ArgoUML一套open source的UML工具;再下載Hugo/RT 0.42,個人是選UPPAAL的Model Checking tool。
1.先用ArgoUML將系統畫出,主要是class diagram跟state diagram。
如下圖:

2.透過Hugo/RT轉換成中間碼,Hugo/RT也提供直接轉換成Model Checking的語言,但因有些功能無法轉換,必須自行輸入,所以建議轉成中間碼UTE格式。

3.編輯UTE檔案,加入collaboration、interaction及assertion,其中assertion可以利用CTL(Computation tree logic)來檢查deadlock和是否會發生某些條件。例如此例就是ATM是否會有兩次密碼錯誤卻還能進入VerifyingCard的狀態。

EF的keyword如下圖所示。代表是否存在這個狀況。

4.編輯好存檔,再利用Hugo/RT轉成UPPAAL的檔案,且下所需要檢查的interaction和assertion,便會產生ta及q副檔名的兩個檔案。

5.再來就利用UPPAAL來驗證,開始剛產生的ta檔案,選verifier的tag就可以驗證是否會有不想要的情況。從結果可看出,並沒有輸入錯誤兩次還能在VerifyingCard狀態(紅燈),但卻可以輸入錯誤零次還能在VerifyingCard狀態(綠燈)。

本文只是介紹使用方法,詳細內容可以看Model Checking and Code Generation for UML State Machines and Collaborations及Hugo/RT網站。
雖然測試也可能找到相同的錯誤或不一致情況,但是Model Checking在OOA時就可以去驗證檢查,Testing則必須要到OOP之後有程式碼才能檢查,所以成本會比Model Checking還要高(越晚修改,cost越高),且Model Checking主要是檢查規格上的錯誤,無法去驗證效能和壓力,而這些主要是測試所要確認的。
2006-07-24 補充:本文的範例,蒸氣鍋爐,已刊登在IEICE TRANSACTIONS on Information and Systems,Constraint-Based Software Specifications and Verification Using UML。
Embedded.com - An introduction to model checking有詳細介紹Model Checking。
Posted by philipz at April 27, 2005 04:02 PMHello all
I am a new HUGO/RT user. I am having problems to retranslate UML runs from SPIN trails. Your support would be appreciated to solve this matter. Here are the details of my tests:
1.- I initially modelled a simple set of state charts with ArgoUML (prenoms.zargo)
2.- As suggested by hugo/rt documentation, I preferred to work with the UTE model representation (prenoms.ute) to which I added an "empty" collaboration and object definition so that HUGO/RT could generate useful PROMELA code (prenoms.pr)
3.- Making use of XSPIN, I generated a simple trail (renamed as prenoms.tl) with the PROMELA specification and a simple LTL formula
4.- I tried the following command to retranslate the spin trail into a dot spec, as you can see I had no success: java -jar hugort.jar -odot=prenoms.dot prenoms.tl prenoms.ute
This is the output I got:
Hugo/RT v0.42, 05/02/02
Parsing UML model from `prenoms.ute'...
Checking UML model `Tequila'...
Writing dot to `prenoms.dot'...
Translating collaboration `empty' in UML model `Tequila' into UPPAAL...
Parsing UPPAAL trail from `prenoms.tl'...
[ERROR] Trail parsing failed: Encountered "-" at line 1, column 1.
Was expecting:
"State:" ...
If more details are needed, please, do not hesitate to let me know.
Kind regards,
Javier
Javier,
I am very happy you find this page about Hugo/RT.
Actually, Hugo/RT still has some bugs when you translate to SPIN promela language.
I also had the same problem.
If you can email to me the UTE file or ArgoUML file, maybe I will clear understand where the problem is.
Below is Hugo/RT Author, Alexander, answered my question about this translator on SPIN.
Dear Philipz,
here is the detailed procedure using the atm.ute example of the
distribution:
1. Translate the model with an assertion (or interaction) into Promela:
./hugort -opromela=output/atm.spin -c -a=sanity models/atm.ute
This produces in particular a file
output/atm.spin.ltl
which contains a temporal logic formula, here:
> ((term) && (term_G5))
2. Translate the temporal logic formula of output/atm.spin.ltl into a SPIN
never claim:
spin -f "> ((term) && (term_G5))"
This produces the never claim on the console.
3. Copy the never claim into output/atm.spin.ltl in between the lines
starting with "#define" and the line starting with "#ifdef NOTES":
#define term_G5 (Bank[processIds[obj_bank-1]]:state4 == VerifyingCard)
#define term (Bank[processIds[obj_bank-1]]:numIncorrect == 2)
never { /* > ((term) && (term_G5)) */
T0_init:
if
:: ((term) && (term_G5)) -> goto accept_all
:: (1) -> goto T0_init
fi;
accept_all:
skip
}
#ifdef NOTES
> ((term) && (term_G5))
#endif
4. Translate the Promela code and the never claim into C:
spin -a -N output/atm.spin.ltl output/atm.spin
This produces a file named "pan.c".
5. Translate the C code for the model checker:
gcc -DNOREDUCE -o pan pan.c
The definition of NOREDUCE is necessary because of variable references in
the never claim.
6. Check the model:
./pan
This produces a trail file named "atm.spin.trail"
7. Translate the trail file into a readable format:
spin -l -g -w -v -t output/atm.spin > output/atm.tl
8. Retranslate the readable SPIN trail file into the notions of UML:
./hugort -otrail=output/atm.utl -c -a=sanity output/atm.tl models/atm.ute
Step 2-6 may be more easily done using XSPIN. And, yes, this calls for some
script...
Caveat: There is an error in the Hugo/RT 0.41 version: In order to
reconstruct UML from SPIN trails it is necessary to remove all lines after
the line "spin: trail ends after steps". I've put a corrected
version (Hugo/RT 0.42) on the web site.
Hope this helps,
Best regards,
Alexander.
Dear Philipz,
Thanks for your quick answer, I will follow Alexander's suggestions right away.
I will be happy to e-mail you my files, please give me your address, haven't found it in this page.
Regards,
Javier
Dear Javier
My Email address is philipzheng@gmail.com
Hope you solve this problem successfully.
Sincerely,
Philipz
Dear Philipz,
找Model Checking相關的資訊
發現貴Blog有這篇相當不錯的介紹
不過在轉換ute時發生了點問題
所以想請教一下您在使用ArgoUML時
State Diagram與Class的宣告之類都寫的很嚴謹嗎,
或是只寫個虛擬碼之類的就能轉
感謝您
Dear Kividy,
很高興看到您留言。
關於ArgoUML透過Hugo/RT轉換成Model Checking的語言
不建議直接轉換,的確先轉成中間格式UTE是比較好的
之後還是必須依照Hugo/RT的網站上說明再稍微修改UTE以便符合您所要轉換的語言。
Hugo/RT對於ArgoUML有版本支援的問題,那一版比較好,小弟已經忘記了。
希望這對您有幫助。
順道一提,剛好月初時,用到這Model Checking來驗證UML的論文
Constraint-Based Software Specifications and Verification Using UML
恰好剛刊登出來。
Dear Philipz,
感謝您的回答
我大概了解了
我想我得先解決ArgoUML太難用這個問題
因為在轉成ute時都無法成功了
感謝您
Dear Philipz,
我是您實驗室學弟 聖瑜,
最近因論文需要在做Model Checking,
參考了您的文章及論文,
發生了些問題想請教一下,
collaboration看例子上來說是atm及bank間的一些關係,
若我今天只有單一一個class的話能夠用collaboration
來描述assertion的關係嗎?
因為我要驗證的其中一個model剛好跟atm及bank的兩次錯誤的驗證相同,但是我只有單一個class,
且在用uppaal驗證時一直告訴我Syntax Error,
好像是什麼Declaration裡有個ID的Syntax Error,
不知道跟上面的問題有沒有關,
麻煩學長指教一下,thank you.
不好意思連發兩篇
不知道uppaal您有沒有當初您在用時的版本
因為我目前用最新版試著去驗証
Hugo/RT本身提供的例子也會發生錯誤
如果有的話不知道可不可以麻煩您寄給我或老師
謝謝您
聖瑜:
只有一個class應該沒法模擬出atm及bank間的關係,應該要兩個class才可以。
uppaal我當時使用的版本,已經忘記是那一個了,也沒有保留,所以可能沒法傳給你。
你可能要上Hugo/RT網站研究一下那語法,可能對你有幫助,轉成UTE檔後,再修改,應該就可以。
Dear Philipz,
看來也只能這樣子了,
我再研究研究看看好了,
謝謝您呀^^