OCRA: A tool for checking the refinement of temporal contracts

Abstract

Contract-based design enriches a component model with properties structured in pairs of assumptions and guarantees. These properties are expressed in term of the variables at the interface of the components, and specify how a component interacts with its environment: the assumption is a property that must be satisfied by the environment of the component, while the guarantee is a property that the component must satisfy in response. Contract-based design has been recently proposed in many methodologies for taming the complexity of embedded systems. In fact, contract-based design enables stepwise refinement, compositional verification, and reuse of components. However, only few tools exist to support the formal verification underlying these methods.OCRA (Othello Contracts Refinement Analysis) is a new tool that provides means for checking the refinement of contracts specified in a linear-time temporal logic. The specification language allows to express discrete as well as metric real-time constraints. The underlying reasoning engine allows checking if the contract refinement is correct. OCRA has been used in different projects and integrated in CASE tools.

Providing tool support for specifying safety-critical systems by enforcing syntactic contract conditions

“…However, while the approach in the present paper is applicable for any type design flow, i.e., top-down, bottom-up, or anything in between, the approach in [3] requires using model transformations for driving development and is therefore only applicable for a top-down design flow. In contrast to the present paper, but similar to the previously mentioned contract-based approaches [13,14,16], the support in [3,28] relies on formal representations of architectures and requirements. The work in [2] describes a formal modelbased development methodology using requirements refinement.…”

“…Even more similar to the present paper, the work [16] describes tool support for verifying a hierarchical organization of contracts related to a system architecture model. Despite the similarities between [13,14,16] and the present paper, as previously mentioned in Sect. 1, while the tool support in [13,14,16] requires that contracts must be formally represented in the language linear-time temporal logic (LTL) [59], the tool support described in the present paper does not require that contracts are specified in formal representation; in fact, the present paper describes how explicit support can be provided when requirements are specified in semiformal representation.…”

“…For example, contracts theory is used to provide tool support for safety analyzes in [19], safety certification in [69], modelbased design in [5], and failure propagation modeling in [56,57]. More similar to the present paper, the work [13,14] presents tool support for verifying contracts refinement, which in essence corresponds to verifying completeness. Even more similar to the present paper, the work [16] describes tool support for verifying a hierarchical organization of contracts related to a system architecture model.…”

“…The present paper capitalizes on this fact by considering the support that can be provided for tasks (I)-(IV) by having a tool that evaluates these formal contract conditions. Notably, there already exist approaches such as [13,14,16] where formal contract conditions are evaluated in tools. However, the tool support in these approaches is dependent on that contracts must be formally represented in the language linear-time temporal logic (LTL) [59].…”

Tightening the contract refinements of a system architecture

“…These proof obligations are temporal formulas obtained from assumptions and guarantees, which are valid if and only if the refinement is correct. The approach is implemented in the OCRA tool [11,27] and is parametrized by a linear-time temporal logic, either propositional LTL [28], or LTL with SMT predicates [14], or HRELTL [13,14], a variant of LTL where formulas represent sets of hybrid traces, mixing discrete-and continuous-time steps, and therefore amenable to model properties of hybrid systems. The approach has been used in several contexts and domains.…”