Verification of UML State Diagrams using a Model Checker A Manuscript Submitted to the Department of Computer Science and the Faculty of the University of Wisconsin-La Crosse La Crosse, Wisconsin by Yiwei Zou in Partial Fulfillment of the Requirements for the Degree of Master of Software Engineering August, 2013 Verification of UML State Diagrams using a Model Checker By Yiwei Zou We recommend acceptance of this manuscript in partial fulfillment of this candidates re- quirements for the degree of Master of Software Engineering in Computer Science. The candidate has completed the oral examination requirement of the capstone project for the degree. Dr.Kasi Periyasamy Date Examination Committee Chairperson Dr.Mao Zheng Date Examination Committee Member Dr.Tom Gendreau Date Examination Committee Member ii Abstract Zou, Yiwei, Verification of UML State Diagrams using a Model Checker, Master of Software Engineering, August 2013. (Advisor: Kasi Periyasamy, Ph.D). This manuscript describes the process of verifying the UML state diagrams by using model checker. A UML state diagram describes the behavior of an object which includes a sequence of states that the object visits during its lifetime. Verification of UML state dia- gram is important because if one state diagram is incorrect, the object’s behavior will not be displayed correctly which leads to incorrect coding and eventually may lead to the possible failure of the system. However, it is hard to verify UML state diagram without the aid of other tools. Therefore, model checker is introduced to verify the UML state diagram. Since model checkers use different syntax, one needs to convert state diagrams from UML tools to the syntax used by the model checker. Moerover, model checkers also use temporal logic experssions for verification which need to be added to the information in the state diagram for verification purposes. This manuscript describes the design and implementation of a conversion tool that converts UML state diagrams drawn using Visual Paradigm to the syn- tax used by UPPAAL model checker. The tool was tested with several UML state diagrams. iii Acknowledgements I would like to express my sincere thanks to my project advisor Dr. Kasi Periyasamy for initiating this project and providing his valuable guidance. I would also like to express my appreciation to the Department of Computer Science at the University of Wisconsin-La Crosse for providing the learning materials and computing environment for my project. iv Contents 1 Introduction 1 1.1 UML State Diagram . 1 1.2 Model Checker . 3 2 Current Project 5 2.1 Overview . 5 2.2 UML Tool . 5 2.3 Model Checking Tool . 6 3 Converting Tool 7 3.1 Development Approach . 7 3.2 Convert Function . 9 3.3 User Interface . 12 3.3.1 Main Window . 12 3.3.2 Additional Information Window . 15 4 Verification 17 4.1 Simulator . 17 4.2 Verifier . 20 4.3 Verify Command . 22 4.3.1 Reachability Properties . 22 4.3.2 Safety Properties . 23 4.3.3 Liveness Properties . 24 4.3.4 Deadlock Properties . 26 5 Case Study 26 5.1 Coffee Machine . 26 5.1.1 Convert . 26 5.1.2 Verify . 28 6 Future Work 30 7 Conclusion 32 8 References 33 9 Appendix 34 9.1 CD Player . 34 9.2 Coffee Machine . 35 9.3 Cruise Controller . 36 9.4 ATM Machine . 37 9.5 Traffic Light . 38 v List of Figures 1 A template of a UML state diagram . 2 2 A finite-state system . 4 3 The simulator on a finite-state system . 4 4 The temporal logical formula to verify the finite-state system . 5 5 Overview of the project . 6 6 UPPAAL Sample . 7 7 Visual Paradigm XML file . 10 8 UPPAAL XML file . 10 9 Main Window . 14 10 Additional Information Window . 16 11 Simulator Example . 18 12 Simulator Trace Example . 19 13 Simulator Trace Example . 20 14 Exist Eventually . 23 15 Exist Globally . 24 16 Always Globally . 24 17 Always Eventually . 25 18 Always Leads To . 25 19 Coffee Machine State Machine Diagram . 27 20 Coffee Machine Convert . 28 21 Coffee Machine In UPPAAL . 29 22 Coffee Machine Verify Queries . 29 23 CD Player state diagram . 34 24 CD Player finite-state system . 34 25 Coffee Machine state diagram . 35 26 Coffee Machine finite-state system . 35 27 Cruise Controller state diagram . 36 28 Cruise Controller finite-state system . 36 29 ATM Machine state diagram . 37 30 ATM Machine finite-state system . 37 31 Traffic Light state diagram . 38 32 Traffic Light Left Lane state diagram . 38 33 Traffic Light finite-state system . 39 34 Traffic Light Left Lane finite-state system . 39 vi GLOSSARY UML Unified Modeling Language - A standardized, general-purpose modeling language in the field of software engineering. Temporal Logic Any system of rules and symbolism for representing, and reasoning about, propositions qualified in terms of time. DOM Document Object Model - A cross-platform and language-independent convention for representing and interacting with objects in HTML, XML and XHTML documents. Finite-state System A mathematical model of computation used to design both computer programs and sequential logic circuits. vii 1 Introduction 1.1 UML State Diagram The UML state diagram displays the behavior of an object which specifies the sequence of states the object visits during its lifetime in response to events, together with its responses to those events. [1] The elements a UML state diagram contains are listed below: • State: A state is a condition during the life of an object. When an object is in a particular state, it satisfies some condition, performs some activity, or waits for some external event. • Transition: A transition is a relationship between two states indicating that an object in the first state will, when a specified set of events and conditions are satisfied, perform certain actions and enter the second state. Mostly, a transition has a source state, an event trigger, an action and a target state as components. A UML state diagram is a mixture of graphical and textual representation that precisely captures both the state topology and its actions. It is strongly connected to other UML diagrams since it gives users a more specific view of the behavior of an instance of one particular class in the class digram. However, a UML state diagram is not completely descriptive. Any complex diagram requires a large amount of textual information like the specification of actions and guards. Moreover, the UML state diagram is meant for design purposes and the semantics of application is not easy to observe from the diagram. A sample UML state diagram is shown in figure 1. The diagram displays the behavior of a CD player. There is one vital error in the diagram. There is no transaction from the 1 Figure 1: A template of a UML state diagram state “CDStopped” to the state “CDPlaying” which indicates that there is no way for the CD player to move from stop to play.However, it takes time for users to verify the diagram just by looking at it. Moreover, there could still be hidden error even if the user checks the diagram carefully. This diagram includes only five simple states. The problem would be much more complex if the number of states increases or complex state diagrams are used. Embedding verification techniques in UML may solve the problems. However, UML is meant as a design notation that already has a vast number of design notations. Moreover, design and verification are usually performed separately. Therefore, it is preferable to take UML design diagram as an input to some verifier and then verify the design. 2 1.2 Model Checker In computer science, model checking refers to the following problem: Given a model of a system, exhaustively and automatically check whether this model meets a given spec- ification. Typically, the specification contains several requirements such as the absence of deadlocks and critical states that could cause the system to crash. Model checking, therefore, is a technique that can automatically verify correctness properties of finite-state systems. [2] Model checking technology arguably ranges among the foremost applications of logic to computer science and computer engineering. In the twenty-five years since its invention, model checking has achieved multiple breakthroughs, bridging the gap between theoretical computer science, hardware and software engineering. Today, model checking is exten- sively used in the hardware industry, and has become feasible for verifying many types of software as well. Model checking has been introduced into computer science curricula at universities worldwide, and virtually has become a universal tool for the analysis of sys- tems. [6] The finite-state system of the CD player in the previous section is shown in figure 2. The finite-state system is similar to the UML state diagram. However, it has some additional information for the guards and synchronizations to actually run the finite-state system. Model checkers have two ways to verify the finite-state system. One way is to use a simulator to track the behavior of the object, as shown in figure 3. The other is using a verifier. By typing in the specification as a temporal logical formula, the verifier will ex- hausively go into all reachable states to verify whether the system meets the specification. The example temporal logical formula is shown in figure 4. 3 Both the simulator and verifier will be discussed later in this manuscript. Figure 2: A finite-state system Figure 3: The simulator on a finite-state system 4 Figure 4: The temporal logical formula to verify the finite-state system 2 Current Project 2.1 Overview The UML state diagram is a great way to view the behavior of an object in a complex system.