A safety pragma expresses a property that is expected to be verified by the internal model checker or by UPPAAL.
A safety pragma is as follows, with p and q being properties:
Example: T A<> Block1.x > 0 means that the attribute “x” of block “Block1” is always strictly positive.
“A” means on All paths and “[]” means in all states. “A[] p” therefore means that “p” is expected to be satisfied in all states of all paths.
“A” means on All paths and “<>” means in at least one state. “A<> p” therefore means that “p” is expected to be satisfied in at least one state of all paths.
“E” means on one paths and “[]” means in all states. “E[] p” therefore means that “p” is expected to be satisfied in all states of at least one path.
“p –> q” means that whenever p is encoutred in a state s, all paths starting from state s must have a state in which q is satisfied.
A pragma may start with “T” or “F”. “T” stands for True and “F” for False. T or F precise if the pragma is expected to be true or false during verification. - If a pragma starts with a “T” and is satisfied, then a green check is added on its left side. - if a pragma starts with a “T” and is not satisfied, then a red cross is added on its left side. - If a pragma starts with a “F” and is satisfied, then a red cross is added on its left side. - if a pragma starts with a “F” and is not satisfied, then a green check is added on its left side.
Adding “T” or “F” before at the beginning of a pragma is optional. A pragma with no “T” or “F” is assumed to start with a “T”.
A pragma termines with a property. A property is a boolean expression. The following operators can be used between sub-boolean expressions: - “&&”, “||”
A boolean expression can: - State that a given state s of a block b has been reached: b.s - Use boolean or integer attributes of blocks, comparing them with operators such as : “==”, “<”, “>”, “>=”, “<=”
The following figures gives the pragmas that are given in the CoffeeMachine use case available on the model repository of TTool.
A[] CoffeeMachine.nbOfCoins<=2
T E<> CoffeeMachine.nbOfCoins>0
E<> CoffeeMachine.nbOfCoins>1
E[] CoffeeMachine.nbOfCoins<2
A[] Wallet.nbOfCoins<3
A[] Wallet.nbOfCoins>=0
E[] Wallet.nbOfCoins>=1
F CoffeeMachine.Beverage –> CoffeeMachine.CoffeeDelivered
CoffeeMachine.Beverage –> CoffeeMachine.CoffeeDelivered && CoffeeMachine.TeaDelivered
CoffeeMachine.Beverage –> CoffeeMachine.CoffeeDelivered || CoffeeMachine.TeaDelivered
CoffeeMachine.Beverage –> CoffeeMachine.WaitingForFirstCoin
F CoffeeMachine.WaitingForFirstCoin –> CoffeeMachine.EjectState
CoffeeMachine.WaitingForFirstCoin –> CoffeeMachine.EjectState || CoffeeMachine.WaitingForSecondCoin
CoffeeMachine.CoffeeDelivered –> CoffeeMachine.nbOfCoins<2
After verifying them with TTool’s internal model checker, we obtain the following: