On the Formal Verification of Systems of Synchronous Software Components

  • Henning Günther
  • Stefan Milius
  • Oliver Möller
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7612)


Large asynchronous systems composed from synchronous components (so called GALS—globally asynchronous, locally synchronous—systems) pose a challenge to formal verification. We present an approach which abstracts components with contracts capturing the behavior by a mixture of temporal logic formulas and non-deterministic state machines. Formal verification of global system properties is then done transforming a network of contracts to model checking tools such as Promela/SPIN or UPPAAL. Synchronous components are implemented in Scade, and contract validation is done using the Scade Design Verifier for formal verification. We also discuss first experiences from an ongoing industrial case study applying our approach.


formal verification GALS systems rely-guarantee Scade SPIN UPPAAL 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    de Alfaro, L., Alur, R., Grosu, R., Henzinger, T., Kang, M., Majumdar, R., Mang, F., Meyer-Kirsch, C., Wang, B.: Mocha: Exploiting modularity in model checking (2000),
  2. 2.
    Alur, R., Courcoubetis, C., Dill, D.L.: Model-checking in dense real-time. Information and Computation 104(1), 2–34 (1993)MathSciNetzbMATHCrossRefGoogle Scholar
  3. 3.
    Alur, R., Henzinger, T.: Reactive modules. FMSD 15, 7–48 (1999)Google Scholar
  4. 4.
    André, C.: Semantics of S.S.M (safe state machine). Tech. Rep. UMR 6070, I3S Laboratory, University of Nice-Sophia Antipolis (2003)Google Scholar
  5. 5.
    Baufreton, P.: SACRES: A Step Ahead in the Development of Critical Avionics Applications. In: Vaandrager, F.W., van Schuppen, J.H. (eds.) HSCC 1999. LNCS, vol. 1569, p. 1. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  6. 6.
    Baufreton, P.: Visual notations based on synchronous languages for dynamic validation of GALS systems. In: CCCT 2004 Computing, Communications and Control Technologies, Austin, Texas (August 2004)Google Scholar
  7. 7.
    Bouhadiba, T., Maraninchi, F.: Contract-Based Coordination of Hardware Components for the Development of Embedded Software. In: Field, J., Vasconcelos, V.T. (eds.) COORDINATION 2009. LNCS, vol. 5521, pp. 204–224. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  8. 8.
    Chapiro, D.M.: Globally-asynchronous locally-synchronous systems. Ph.D. thesis. Stanford University (1984)Google Scholar
  9. 9.
    Clarke, E., Grumberg, O., Jha, S., Lu, Y., Veith, H.: Counterexample-Guided Abstraction Refinement. In: Emerson, E.A., Sistla, A.P. (eds.) CAV 2000. LNCS, vol. 1855, pp. 154–169. Springer, Heidelberg (2000)CrossRefGoogle Scholar
  10. 10.
    Dajani-Brown, S., Cofer, D., Bouali, A.: Formal Verification of an Avionics Sensor Voter Using SCADE. In: Lakhnech, Y., Yovine, S. (eds.) FORMATS 2004 and FTRTFT 2004. LNCS, vol. 3253, pp. 5–20. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  11. 11.
    Doucet, F., Menarini, M., Krüger, I.H., Gupta, R., Talpin, J.P.: A verification approach for GALS integration of synchronous components. ENTCS 146, 105–131 (2006)Google Scholar
  12. 12.
    Garavel, H., Thivolle, D.: Verification of GALS Systems by Combining Synchronous Languages and Process Calculi. In: Păsăreanu, C.S. (ed.) SPIN 2009. LNCS, vol. 5578, pp. 241–260. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  13. 13.
    Gastin, P., Oddoux, D.: Fast LTL to Büchi Automata Translation. In: Berry, G., Comon, H., Finkel, A. (eds.) CAV 2001. LNCS, vol. 2102, pp. 53–65. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  14. 14.
    Giese, H., Tichy, M., Burmester, S., Schäfer, W., Flake, S.: Towards the compositional verification of real-time uml designs. SIGSOFT Softw. Eng. Notes 28, 38–47 (2003)CrossRefGoogle Scholar
  15. 15.
    Giese, H., Vilbig, A.: Separation of non-orthogonal concerns in software architecture and design. Software and System Modeling 5(2), 136–169 (2006)CrossRefGoogle Scholar
  16. 16.
    Günther, H.: Bahnübergangsfallstudie: Verifikationsbericht. Tech. rep. Institut für Theoretische Informatik, Technische Universität Braunschweig (February 2012),
  17. 17.
    Günther, H., Hedayati, R., Löding, H., Milius, S., Möller, O., Peleska, J., Sulzmann, M., Zechner, A.: A framework for formal verification of systems of synchronous components. In: Proc. MBEES 2012 (2012),
  18. 18.
    Günther, H., Milius, S., Möller, O.: On the formal verification of systems of synchronous software components (extended version) (May 2012),
  19. 19.
    Halbwachs, N., Lagnier, F., Raymond, P.: Synchronous observers and the verification of reactive systems. In: Proc. of AMAST 1993. Workshops in Computing, pp. 83–96. Springer, London (1994)Google Scholar
  20. 20.
    Halbwachs, N., Mandel, L.: Simulation and verification of asynchronous systems by means of a synchronous model. In: Proc. of IFIP, pp. 3–14. IEEE Computer Society, Washington, DC (2006)Google Scholar
  21. 21.
    Halbwachs, N., Raymond, P.: Validation of Synchronous Reactive Systems: From Formal Verification to Automatic Testing. In: Thiagarajan, P.S., Yap, R.H.C. (eds.) ASIAN 1999. LNCS, vol. 1742, pp. 1–12. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  22. 22.
    Jahier, E., Halbwachs, N., Raymond, P., Nicollin, X., Lesens, D.: Virtual execution of AADL models via a translation into synchronous programs. In: Proc. of EMSOFT 2007, pp. 134–143. ACM, New York (2007)CrossRefGoogle Scholar
  23. 23.
    Jones, C.B.: Specification and design of (parallel) programs. In: Proc. IFIP Congress, pp. 321–332 (1983)Google Scholar
  24. 24.
    Kahsai, T., Tinelli, C.: PKind: A parallel k-induction based model checker. In: Barnat, J., Heljanko, K. (eds.) PDMC. EPTCS, vol. 72, pp. 55–62 (2011)Google Scholar
  25. 25.
    Le Guernic, P., Talpin, J.P., Le Lann, J.L.: Polychrony for system design. Journal of Circuits, Systems and Computers (2002); special issue on Application-Specific Hardware Design. World ScientificGoogle Scholar
  26. 26.
    Milner, R.: Calculi for synchrony and asynchrony. Theoret. Comput. Sci. 25(3) (July 1983)Google Scholar
  27. 27.
    Möller, M.O.: Benchmark Analysis of GTL-Backends using Client-Server Mutex, vol. 1(2). Verified Systems International GmbH (2012) Doc.Id.: Verified-WHITEPAPER-001-2012,
  28. 28.
    Mousavi, M.R., Le Guernic, P., Talpin, J., Shukla, S.K., Basten, T.: Modeling and validating globally asynchronous design in synchronous frameworks. In: Proc. of DATE 2004, p. 10384. IEEE Computer Society, Washington, DC (2004)Google Scholar
  29. 29.
    Rajan, B., Shyamasundar, R.: Multiclock Esterel: a reactive framework for asynchronous design. In: Proc. of IPDPS, pp. 201–209 (2000)Google Scholar
  30. 30.
    Ramesh, S.: Communicating reactive state machines: Design, model and implementation. In: Proc. IFAC Workshop on Distributed Computer Control Systems. Pergamon Press (September 1998)Google Scholar
  31. 31.
    Ramesh, S., Sonalkar, S., D’silva, V., Chandra, N., Vijayalakshmi, B.: A Toolset for Modelling and Verification of GALS Systems. In: Alur, R., Peled, D.A. (eds.) CAV 2004. LNCS, vol. 3114, pp. 506–509. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  32. 32.
    Sulzmann, M., Zechner, A., Hedayati, R.: Anforderungsdokument für die Fallstudie Bahnübergangssicherungsanlage. Tech. rep., ICS AG (2011)Google Scholar
  33. 33.
    Contract specification and domain specific modelling language for GALS systems, an approach to system validation. Tech. rep., ICS AG, Verified Systems International GmbH, TU Braunschweig (2011),

Copyright information

© Springer-Verlag Berlin Heidelberg 2012

Authors and Affiliations

  • Henning Günther
    • 1
  • Stefan Milius
    • 1
  • Oliver Möller
    • 2
  1. 1.Institut für Theoretische InformatikTechnische Universität BraunschweigGermany
  2. 2.Verified Systems International GmbHBremenGermany

Personalised recommendations