AVATAR Safety pragmas

A safety pragma expresses a property that is expected to be verified by the internal model checker or by UPPAAL.

A safety pragma is as follows, with p and q being properties:

Example: T A<> Block1.x > 0 means that the attribute “x” of block “Block1” is always strictly positive.

A[] p

“A” means on All paths and “[]” means in all states. “A[] p” therefore means that “p” is expected to be satisfied in all states of all paths.

A<>p

“A” means on All paths and “<>” means in at least one state. “A<> p” therefore means that “p” is expected to be satisfied in at least one state of all paths.

E[] properties

“E” means on one paths and “[]” means in all states. “E[] p” therefore means that “p” is expected to be satisfied in all states of at least one path.

E<> properties

“Leads to” properties

“p –> q” means that whenever p is encoutred in a state s, all paths starting from state s must have a state in which q is satisfied.

True / False

A pragma may start with “T” or “F”. “T” stands for True and “F” for False. T or F precise if the pragma is expected to be true or false during verification. - If a pragma starts with a “T” and is satisfied, then a green check is added on its left side. - if a pragma starts with a “T” and is not satisfied, then a red cross is added on its left side. - If a pragma starts with a “F” and is satisfied, then a red cross is added on its left side. - if a pragma starts with a “F” and is not satisfied, then a green check is added on its left side.

Adding “T” or “F” before at the beginning of a pragma is optional. A pragma with no “T” or “F” is assumed to start with a “T”.

“p” properties

A pragma termines with a property. A property is a boolean expression. The following operators can be used between sub-boolean expressions: - “&&”, “||”

A boolean expression can: - State that a given state s of a block b has been reached: b.s - Use boolean or integer attributes of blocks, comparing them with operators such as : “==”, “<”, “>”, “>=”, “<=”

Examples

The following figures gives the pragmas that are given in the CoffeeMachine use case available on the model repository of TTool.

After verifying them with TTool’s internal model checker, we obtain the following: