Author index

This paper describes the automated translation of timed automata to tock-CSP. This translation has been implemented in a translator. The tock-CSP output of the translator can be input to FDR for the automated verification of properties of the input timed automata. It has been shown, by the use of the digitization technique, that there are relationships between Timed Automata and tock-CSP. Preliminary experiments indicate that this technique is promising for the automated verification of real-time systems and should be further developed. Real-time systems are commonly used in safety-critical systems. Hence, their correctness has to be guaranteed. Such systems can be analyzed by the application of testing or formal verification methods. The use of formal verification methods can show that errors are absent in the system and therefore can give the desired guarantee. Usually formal verification requires a specification, an implementation and a technique to determine that the implementation meets the specification. In explicit state model checking every reachable state of the model is explored and shown to meet the requirements. Techniques such as partial-order reduction, symmetry reduction, etc., help avoid the exploration of the whole state space. A prominent method to analyse real-time systems is by means of timed automata (Alur, Courcoubetis and Dill) and UppAal is a tool for model checking such timed automata. CSP stands for Communicating Sequential Processes [Ros97]. The behavior of CSP processes can be verified using the model checker FDR (failures, divergence, refinement). Timed CSP [RR86] is an extension of CSP and is one of the prominent methods to analyse real-time systems. Timed CSP is a timed process algebra, with a continuous model of time. As timed CSP has a continuous model of time there is no direct way to apply the model checker FDR to such models. Hence a discrete timed model was presented in [Ros97] Chapter 14 which had a special event tock, which modeled the passage of one unit of time. The digitization technique was introduced in [HMP92]. It shows the conditions under which the analysis of a timed automaton with dense time can be performed using only the integral observations. Specifically, for some implementations, which are closed under digitization, and specifications, which are closed under inverse digitization, the check for correctness using the dense time observations is equivalent to the check for correctness using the integral observations. It has been shown that closed timed automata are closed under digitization and we can show that reachability properties are closed under inverse digitization. Hence we can apply the following translation from timed automata to tock CSP and use FDR to verify properties of timed automata. Initially we thought that in the translation each clock variable in the timed automaton would be translated to a clock process. Each clock process had a parameter which varied from 0 to the maximum value to which that clock was compared. The value of the clock process could be read, reset to 0 and the clock process engaged in the tock event. A parallel composition of all the clock processes was made with synchronisation on the tock event. Later, an efficiency consideration was to have what we call Guard Analyser Processes. Instead