Patent Publication Number: US-2023153216-A1

Title: Method and system for testing operation of target computer system

Description:
TECHNICAL FIELD 
     This disclosure relates to requirement engineering for computer systems and relates more specifically to a method and system for testing the operation of a target computer system by using timed requirements. 
     BACKGROUND ART 
     In the process of developing computer systems, requirement engineering consists in defining, documenting and maintaining the requirements that a computer system needs to comply with. Requirements can be of different nature but, in computer systems, timed requirements are of importance. Basically, a timed requirement corresponds to constraints, including timing constraints, between outputs of the computer system and inputs to said computer system. In practice, timed requirements will be the basis of the design and development of the computer system. Also, timed requirements will partly drive the testing campaign in order to check that they are indeed complied by the actual computer system, once developed. 
     Of course, it is of primary importance to design timed requirements that are consistent, i.e. that are not contradictory such that implementations conforming with said timed requirements are indeed possible and may be designed and developed. 
     In the scientific literature, there exist different consistency notions defined for real-time systems&#39; timed requirements. 
     For instance, real-time consistency (a.k.a. rt-consistency) [PHP11] requires that all finite execution sequences that do not already violate some timed requirement have an extension that satisfies all of them. Put differently, this means that if an implementation produces a finite execution sequence whose all continuations necessarily lead to the violation of some timed requirement, then there must be a timed requirement that is already violated by the finite execution sequence. Thus, rt-consistency ensures that the set of timed requirements is well designed and sane. This notion of consistency is interesting in that it may catch subtle problems in the set of timed requirements, but it is rather computationally expensive to check. 
     Another example corresponds to partial consistency [Bec19], which is a weaker notion of consistency that only considers conflicts between pairs of timed requirements. In practice, partial consistency checking is usually restricted to execution sequences of bounded length, but it may still detect important flaws in the specifications of the timed requirements. The general motivation is to gain in efficiency by restricting to pairs of timed requirements, but also by focusing on situations where inconsistencies may arise. The computational complexity for checking partial consistency is lower than for checking rt-consistency, even if it can remain computationally expensive in some cases. However, one should be aware that focusing on pairs might introduce false negatives (considering that the set is not inconsistent while it is inconsistent), since consistency of pairs of requirements does not imply consistency of the whole set timed requirements, since inconsistencies can be introduced by adding a new timed requirement. Conversely, focusing on pairs might also produce false positives (considering the set is inconsistent while it is consistent), since an inconsistency of a pair of requirements can be removed by adding a new timed requirement of the set which prevents the execution sequence revealing the inconsistency to occur. 
     SUMMARY OF INVENTION 
     The present disclosure aims at proposing a solution for checking the consistency of a set of timed requirements describing the operation of a target computer system which is computationally less expensive than rt-consistency checking and provides a more accurate assessment of the consistency of the set of timed requirements than (bounded) partial consistency checking. 
     According to a first aspect, the present disclosure relates to a computer implemented method for testing the operation of a target computer system, said operation of the target computer system being constrained by a set of timed requirements, wherein said method comprises defining subsets of timed requirements of the set, and for each subset of a plurality of subsets, iterating steps of:
         searching for an execution sequence of the target computer system, referred to as witness trace, satisfying a criterion for detecting a conflict between timed requirements of the subset;   when a witness trace is found: searching for a contradicting timed requirement among the timed requirements of the set which are not present in the subset, which prevents the witness trace to occur when considered with the subset;   when a contradicting timed requirement is found: augmenting the subset by including the contradicting timed requirement in the subset;
 
wherein an inconsistency of the operation of the target computer system constrained by the set of timed requirements is detected when a witness trace is found for at least one subset and no contradicting timed requirement is found for said witness trace.
       

     Hence, the testing method aims at evaluating the operation of a target computer system. The target computer system may be any computer system for which timed requirements may be defined, such as an embedded electronic system and/or mechatronic system and/or a mechanical control system, etc. 
     The operation of the target computer system is constrained by a set of timed requirements. Testing the operation of the target computer system corresponds to simulating the behavior of the target computer system at the timed requirement level, in order to detect inconsistencies among the timed requirements. Hence, it is emphasized that the testing method does not interact with the actual target computer system, which may not be designed or developed yet, but evaluates the operation of the target computer system by simulating its behavior at the timed requirement level. Accordingly, the testing method is carried out by a testing computer system that is different from the target computer system. 
     As discussed above, a timed requirement may be viewed as constraints, including timing constraints, between outputs of the target computer system and inputs to said target computer system. A timed requirement may be modeled by a set of possible states of the target computer system, with at least one error state, together with possible transitions between states and the associated timing constraints. 
     The testing method searches for execution sequences of the target computer system, referred to as “witness trace”, that may lead to conflicts between timed requirements, i.e. that may lead to at least one timed requirement being violated. An execution sequence basically corresponds a sequence of inputs to the target computer system and resulting outputs from said target computer system at successive time steps. At least one timed requirement is violated when the constraints it defines cannot be satisfied at some point during an execution sequence. It should be noted that the witness trace itself does not violate a timed requirement yet. However, the witness trace is not prevented to occur by the considered timed requirements and yet it reaches a configuration of the target computer system from which at least one timed requirement will be violated at some point. 
     The testing method searches for witness traces satisfying a criterion for detecting a conflict between timed requirements. Basically, the conflict detection criterion may use different notions of inconsistency checking, such as rt-inconsistency checking or partial inconsistency checking. Detailed examples of conflict detection criteria are provided hereinbelow. 
     The testing method searches for witness traces in an iterative manner, by searching for witness traces in subsets of the original set. Basically, a witness trace is searched for in a subset of the set of timed requirements, i.e. the witness trace complies with the timed requirements of the subset in that it is not prevented to occur by said timed requirements, but it reaches a configuration of the target computer system from which at least one timed requirement of the subset will be violated at some point. 
     If a witness trace for a subset is found (i.e. an inconsistency of the subset is detected), then a further check on the witness trace is performed by searching for a contradicting timed requirement in the remaining timed requirements of the set, i.e. in the timed requirements of the set that are not present in the considered subset. Basically, a contradicting timed requirement corresponds to a timed requirement which prevents the witness trace to occur when considered with the considered subset. Hence the contradicting timed requirement is a timed requirement that is violated by the witness trace before the end of the witness trace. In other words, if a contradicting timed requirement is found for the witness trace, this means that the inconsistency detected in the considered subset by the witness trace is in fact a false positive, that is therefore discarded. 
     When such a contradicting timed requirement is found, then it is added to the considered subset, and the testing method resumes to searching for a witness trace in the augmented subset. When no contradicting timed requirement is found, then the inconsistency detected is confirmed. 
     An inconsistency of the set of timed requirements is detected when a witness trace is found for at least one subset and no contradicting timed requirement is found for said witness trace. It should be noted that, if the subset has augmented up to a size N TR , then the subset is identical to the original set and all the timed requirements are included in the subset, such that if a witness trace is found, it is not possible to find a contradicting timed requirement. 
     It is possible to consider that no inconsistency is detected when no witness traces are found for the subsets. 
     When augmenting the subsets, it is possible to set a higher bound on the size of the subset. Enhanced accuracy may be achieved if the higher bound is set to the number N TR  of timed requirements of the set. However, it is also possible to consider a higher bound K TRmax , lower than N TR  in order to control the computational complexity required for searching for witness traces in a subset. 
     This iterative process allows to quickly find inconsistencies after a few iterations. Inconsistencies often depend on several timed requirements but not on all of them. While previous approaches required considering all timed requirements at once (which does not scale), or they would only consider pairs of timed requirements (which might lead to false positives or false negatives). 
     The present solution checks several subsets of timed requirements of growing size, which proves more efficient from a computational standpoint, and enables detecting more inconsistencies while discarding false positives. Indeed, increasing the size of a subset is not systematic and is only required when a witness trace is found for the subset and a false positive is detected. 
     In specific embodiments, the testing method can further comprise one or more of the following features, considered either alone or in any technically possible combination. 
     In specific embodiments, the conflict detection criterion is expressed using Computation Tree Logic, CTL, and searching for a witness trace uses a model checking tool. The advantage of CTL model checking is to be able to check a complex conflict detection criterion (expressed in CTL) rather than designing a specific algorithm for the task in hand. Moreover, this check can be done efficiently for timed automata with Boolean variables, by using e.g. Binary Decision Diagrams, BDD, based model checking. 
     In specific embodiments, searching for a witness trace uses a Satisfiability Modulo Theories, SMT, solver. Such SMT solvers are efficient in finding variable assignments satisfying given constraints. They prove very efficient in bounded model checking, which consists in checking traces of bounded length, and thus searching for witness traces of bounded length. 
     In specific embodiments, each timed requirement is modeled as a timed automaton. Timed automata can model complex timed requirements and can be checked efficiently using state-of-the-art model checkers. 
     In specific embodiments, each timed requirement is modeled as a Simplified Universal Pattern, SUP. SUPs are a restricted class of timed requirements, for which computationally efficient specific consistency checking tools exist. 
     According to a second aspect, the present disclosure relates to a computer program product comprising instructions which, when executed by at least one processor, configure said at least one processor to carry out a testing method according to any one of the embodiments of the present disclosure. 
     According to a third aspect, the present disclosure relates to a computer-readable storage medium comprising instructions which, when executed by at least one processor, configure said at least one processor to carry out a testing method according to any one of the embodiments of the present disclosure. 
     According to a fourth aspect, the present disclosure relates to a testing computer system for testing the operation of a target computer system, said testing computer system comprising at least one processor configured to carry out a testing method according to any one of the embodiments of the present disclosure. 
     The invention will be better understood upon reading the following description, given as an example that is in no way limiting, and made in reference to the figures. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         FIG.  1    shows a schematic representation of a timed requirement modeled as a Simplified Universal Pattern, SUP. 
         FIG.  2    shows a schematic representation of an exemplary timed requirement modeled as a timed automaton. 
         FIG.  3    shows a schematic representation of two exemplary timed requirements modeled as timed automata. 
         FIG.  4    shows a schematic representation illustrating the interference between action phases of two different SUP timed requirements after their trigger phases. 
         FIG.  5    shows a diagram representing the main steps of an exemplary embodiment of a testing method. 
     
    
    
     DESCRIPTION OF EMBODIMENTS 
     In these figures, references identical from one figure to another designate identical or analogous elements. For reasons of clarity, the elements shown are not to scale, unless explicitly stated otherwise. 
     As discussed above, the present disclosure relates to a method  50  and system for testing the operation of a target computer system by searching for inconsistencies between timed requirements of a set of timed requirements the target computer system must comply with. 
     We first introduce some definitions and conventions used in the following non-limitative description, and then we present the main steps of the testing method and different preferred embodiments of the testing method  50 . 
     A. Definitions 
     We consider target computer systems (such as Programmable Logic Controllers or PLCs) whose behaviors are driven by the observation of Boolean variables and are subject to discrete timing constraints. Intuitively, a run of the target computer system can be understood as a sequence of time steps at which the value of Boolean variables is observed, the evolution of the target computer system being governed by both timing constraints and the Boolean value of these Boolean variables. 
     For this kind of target computer systems, timed requirements can for example be represented by timed automata such as those described in [AD90], with specific restrictions, but extended with Boolean variables. In subsection A.1, we introduce a formal definition of deterministic discrete timed automata with Boolean variables. In subsection A.2, we discuss execution sequences of a set of timed requirements. In subsection A.3, we introduce the notion of Simplified Universal Patterns (SUP) [Bec19] and show how timed requirements can be represented by this form of timed automata. 
     A.1. Timed Automata 
     Timed automata (TA) [AD90] extend finite-state automata with variables, called clocks, that can be used to measure (and impose constraints on) delays between various events along executions. More precisely, given a set  ={c i |1≤i≤k} of clocks, the set of allowed constraints is defined using the following grammar: 
         ( )   g::=c˜n|g∧g    
     where c ranges over  , n ranges over  , ˜ranges over {&lt;, ≤, =, ≥, &gt;}, and the operator A corresponds to the logical “AND”. We consider integer-valued clocks. The semantics of such clock constraints may be defined as follows: given a clock valuation v:  → , that a constraint g∈ ( ) holds true at v, denoted v|=g, is defined inductively as follows: 
         v|=g˜n  if, and only if,  v ( c )˜ n  
 
         v|=g   1   ∧g   2  if, and only if,  v|=g   1  and  v|=g   2 . 
     For a valuation v:  → , an integer d∈ , and a subset R⊆ , we let: 
         v+d:      →     v [ R← 0]:  → 
 
         c     v ( c )+ d c∈R   0 
         c∉R     v ( c ) 
     Finally, we let 0 be the valuation mapping all variables to 0. 
     In our timed automata, we also consider the observation of the evolution of the target computer system through the values of Boolean variables. We thus consider a set AP={b i |1≤i≤n} of atomic propositions, and we define the set of Boolean constraints  (AP) as the set of all propositional formulas built on AP. Notice that those Boolean variables cannot be modified, but are only observed, since they belong to the target computer system itself, contrary to clocks that can be reset since they are owned by the timed requirement only and used by it to check timing constraints. 
     A timed automaton is a tuple  = S, S 0 , AP,  , T, E  where S is a finite set of states, S 0 ⊆S is a set of initial states, AP is a finite set of atomic propositions,   is a finite set of clocks, T⊆S× (AP)× ( )× ×S is a finite set of transitions, and E⊆S is a subset of error states from which one cannot escape, i.e. for any t=(s, c, g, r, s′) E T, if s∈E then also s′∈E. 
     For a transition t=(s, c, g, r, s′)∈T of a timed automaton, we define src(t)=s, tgt(t)=s′, bool(t)=c, guard(t)=g, and reset(t)=r. Basically, t=(s, c, g, r, s′) denotes a transition from src(t)=s to tgt(t)=s′ that is available if the valuation of Boolean variables satisfies the boolean guard bool(t)=c and the valuation of clock variables satisfies the clock guard guard(t)=g. After the transition t, the value of each clock contained in the subset of clock variables reset(t)=r is reset to 0. Note that guards are pairs of Boolean and timed guards that can be interpreted (and will be noted) as conjunctions since the two types of guard do not interfere. Intuitively, error states are entered when the timed requirement is violated, and this is definitive. All other states can be considered accepting, meaning that no violation has been detected yet. This will be formalized later. 
     A configuration of a timed automaton is a pair (s, v) where s∈S and v∈ . With a timed automaton  , we associate the infinite-state automaton  ( )= Q, Q 0 , Σ, D, Ω  where:
         the set of states Q contains all configurations (s, v)∈S× ;   the initial states are obtained by adjoining the null valuation (all clocks are mapped to zero) to initial states S 0 , i.e. Q 0 =S 0 ×0;   Σ=2 AP  is the alphabet of actions, i.e. valuations of all Boolean variables;   transitions in D are combinations of a transition of the timed automaton and a 1-time-unit delay. Formally, given a letter σ∈Σ and two configurations (s, v) and (s′, v′), there is a transition ((s, v), σ, (s′, v′)) in D if, and only if, there is a transition (s, c, g, r, s′) in T such that:   σ|=c and v|=g;   v′=(v[r←0]+1);   Ω=E×  is the set of error configurations.       

     A run of   is a run of its associated infinite-state automaton  ( ). It can be represented as a sequence along which configurations and actions alternate: 
       ( s   0   ,v   0 )·σ 1 ·( s   1   ,v   1 )·σ 2  . . . ( s   n   ,v   n ) . . . .
 
     An execution sequence (or trace) of this sequence is its projection on the set of actions. In other terms, it is a finite or infinite sequence σ={σ i } 0≤i≤l  of actions where l∈ ∪{+∞} is the length of σ, denoted with |σ|. Finite traces belong to Σ* and infinite ones to Σ ∞ . A trace is accepted by   if there is a run on that trace that never enters any error state. 
     It should be noted that the transition system  ( ) is infinite because we impose no bound on the values of the clocks during executions. However, as is classical in the setting of timed automata [AD90], we may notice that the exact value of a clock is irrelevant as soon as it exceeds the largest integer constant with which it is compared. We could thus easily modify the definition of  ( ) in such a way that it only contains finitely many states. 
     In the sequel, we consider in a non-limitative manner that the timed automata are complete, meaning that from any (reachable) configuration (s, v), and for any subset σ of AP, there is a transition t=(s, c, g, r, s′) in T such that of σ|=c and v|=g. This is no loss of generality since we may have self-loops if we want to let more time elapse, and we may add the missing transitions to the error states. Also, the timed automaton are considered to be deterministic, i.e. for any two configurations (a, c, g, r, s) and (a, c′, g′, r′, s′) (hence starting from the same state a) such that both c∧c′ and g∧g′ are satisfiable, then s=s′ and r=r′. 
     In the sequel, we will need to consider several timed requirements, each of them specified by a timed automaton. To this aim, we define the product of timed automata. Formally, given two timed automata    1 = S 1 , S 1,0 , AP 1 ,    1 , T 1 , E 1    and T 2 = S 2 , S 2,0 , AP 2 ,    2 , T 2 , E 2    with disjoint clock sets (i.e.,    1 ∩   2 =Ø), their product    1 ⊗   2  is a timed automaton  = S, S 0 , AP,  , T, E  where S=S 1 ×S 2 , S 0 =S 1,0 ×S 2,0 , AP=AP 1 ∪AP 2 ,  =   1 ∪   2 , E=E 1 ×S 2 ∪S 1 ×E 2 , and the set of transitions is defined as follows: there is a transition ((s 1 , s 2 ), c, g, r, (s′ 1 , s′ 2 )) in T if there are transitions (s 1 , c 1 , g 1 , r 1 , s′ 1 ) in T 1  and (s 2 , c 2 , g 2 , r 2 , s′ 2 ) in T 2  with c=c 1 ∧c 2 , g=g 1 ∧g 2 , and r=r 1 ∪r 2 . 
     Note that in this definition, clocks of factor timed automata are disjoint, while atomic propositions are not, which may create interferences in guards of the product, and possibly inconsistencies. Also note that the product falls in an error state of E as soon as one of its factors does in E 1  or E 2 , and if, as assumed above, no transition is leaving E 1  and E 2 , this assumption is preserved on E. This product of timed automata can be easily generalized to an arbitrary number of timed automata, and timed requirements that they specify. For a set  ={R i } i∈I  of timed requirements, each specified by a timed automaton    i (R i ), we note ⊗  the timed requirement specified by the timed automaton ⊗ i∈I T i (R i ). 
     A.2. Execution Sequences 
     In the remainder of the present description, we consider, in a non-limitative manner, complete deterministic timed automata with error states that cannot be escaped. Notice that those properties are preserved when composing several timed automata. We use timed automata to encode timed requirements. Intuitively, entering an error state of a timed automaton corresponds to violating the corresponding timed requirement. 
     In the sequel, for any timed automaton   and any finite or infinite execution sequence (also referred to as “trace”) σ, we write σ|=(“σ satisfies  ”) if, and only if, σ does not violate  , i.e. running σ on   does not visit E. 
     It should be noticed that for a finite trace σ, σ|=  simply means that the timed requirement has not been violated, but it could be the case that all infinite continuations of the trace σ inevitably lead to E. To distinguish this case, we define the notation for |≈ finite traces, which is stronger than |=. Hence, for a finite trace σ, and a timed automaton  , we write σ|≈  if there exists an infinite trace σ′ such that σ·σ′|= . 
     Those configurations that are not yet erroneous but inevitably lead to an error state (i.e. those configurations reached by some finite traces σ such that σ|=  but σ|   ) are all configurations InevE that satisfy the Computation Tree Logic, CTL, formula ¬err∧AFerr where err is the proposition that is true in E and false otherwise. Configurations in InevE witness the inconsistency of the timed automaton. In fact, the timed automaton should already have detected that there is no possible continuation satisfying the timed requirement and it should already be in an error state. 
     For a given trace σ, and set of timed automata  ={   i } i∈I , we write σ|=  (resp. σ|≈ ) to mean that σ|=⊗  (resp. σ|≈⊗ ). It should be noted that, given  ′⊆ , then for any finite trace σ, if σ|= , then σ|= ′ and if σ|≈  then σ|≈ ′. 
     A.3. Simplified Universal Patterns (SUP) 
     In this subsection, we describe a pattern language called Simplified Universal Pattern (SUP) [Bec19] that can be used to define timed requirements. Compared to timed automata, SUPs offer a more intuitive though less expressive way of writing timed requirements. All SUPs can be written as timed automata, but not all timed automata can be written using SUPs. We consider both timed automata and SUP requirements since SUPs have been used previously, and we propose some specific embodiments that hold only for SUPs, and some specific embodiments that hold more generally for timed automata, etc. 
     SUP instances can be denoted by: 
     
       
         
           
             
               
                 ( 
                 
                   TSE 
                   , 
                   TC 
                   , 
                   TEE 
                 
                 ) 
               
               [ 
               
                 
                   T 
                   ⁢ 
                   min 
                 
                 , 
                 
                   T 
                   ⁢ 
                   max 
                 
               
               ] 
             
             
               → 
               
                 [ 
                 
                   Lmin 
                   , 
                   Lmax 
                 
                 ] 
               
             
             
               
                 
                   ( 
                   
                     ASE 
                     , 
                     
                       A 
                       ⁢ 
                       C 
                     
                     , 
                     AEE 
                   
                   ) 
                 
                 [ 
                 
                   
                     A 
                     ⁢ 
                     min 
                   
                   , 
                   
                     A 
                     ⁢ 
                     max 
                   
                 
                 ] 
               
               . 
             
           
         
       
     
     A SUP instance is thus defined by the choice of the Boolean formulas TSE, TC, TEE, ASE, AC, AEE, and durations Tmin, Tmax, Lmin, Lmax, Amin, Amax. The Boolean formulas are propositional formulas built from system Boolean variables in a set AP of atomic propositions. For simplicity, when talking about an individual SUP, we gather the values of these parameters in a vector P, and refer to its elements using the names of the parameters (e.g. P TSE  is the value of the first parameter TSE). But we should remember that they are valuations of formulas, and when several SUPs are considered, since they may refer to some common Boolean variables, their valuations may interfere on those variables. 
       FIG.  1    illustrates the intuitive semantics of SUP. Intuitively, the left part of a SUP defines a trigger phase, while the right part is the action phase. For a trigger phase to be realized, TSE (“Trigger Start Event”) has to be true, and then confirmed within a duration in [Tmin, Tmax]. Confirmation means that TC (“Trigger Condition”) holds until TEE (“Trigger End Event”) occurs. Otherwise the trigger is aborted. 
     If the trigger phase is realized, for the SUP to be satisfied, its action phase should be started by ASE (“Action Start Event”) within [Lmin, Lmax] time units, and then confirmed. That an action phase is realized is defined as for triggers, with a confirmation duration within [Amin, Amax], during which both AC (“Action Condition”) holds until AEE (“Action End Event”) occurs. Otherwise, the SUP is violated. 
       FIG.  2    represents schematically an example of deterministic timed automaton that can be used to encode a SUP timed requirements, since a SUP timed requirement is a special case of a timed automata as defined above. 
     As can be seen in  FIG.  2   , the timed automaton encoding the SUP timed requirement has five states idle, trig, delay, act and err (wherein err is the only error state), and an associated clock c. Also, in  FIG.  2   , the operator v corresponds to the logical “OR” and the operator ¬ corresponds to the logical operator “NOT”. 
     This timed automaton clearly exhibits the successive phases of a SUP. However, the real timed automaton we use to encode a SUP is the transitive closure of the timed automaton depicted on  FIG.  2   . For instance, if both TSE and TEE hold true at the same time and Tmin=0, then the transitions from idle to trig and from trig to delay have to be taken at the same time. All maximal simple (i.e. where no transitions may appear twice) sequences of transitions have to be merged this way, provided that the conjunctions of their Boolean constraints and clock guards (taking intermediary clock resets into account) can be satisfied. 
     Example 1 
     
       
         
           
             
               Consider 
               ⁢ 
                   
               the 
               ⁢ 
                   
               SUP 
               ⁢ 
                  
               
                 
                   ( 
                   
                     p 
                     , 
                     p 
                     , 
                     p 
                   
                   ) 
                 
                 [ 
                 
                   0 
                   , 
                   0 
                 
                 ] 
               
             
             
               → 
               
                 [ 
                 
                   0 
                   , 
                   1 
                 
                 ] 
               
             
             
               
                 
                   ( 
                   
                     q 
                     , 
                     q 
                     , 
                     q 
                   
                   ) 
                 
                 [ 
                 
                   0 
                   , 
                   0 
                 
                 ] 
               
               . 
             
           
         
       
     
     In words, this SUP is triggered by a single occurrence of p, and it is satisfied if each such occurrence of p is followed, within one time unit, by an occurrence of q. For such a SUP (where P TSE =P TC =P TEE , and/or where E ASE =P AC =P AEE ), we simplify the notations and write: 
     
       
         
           
             
               p 
               [ 
               
                 
                   T 
                   ⁢ 
                   min 
                 
                 , 
                 
                   T 
                   ⁢ 
                   max 
                 
               
               ] 
             
             
               → 
               
                 [ 
                 
                   Lmin 
                   , 
                   Lmax 
                 
                 ] 
               
             
             
               
                 q 
                 [ 
                 
                   
                     A 
                     ⁢ 
                     min 
                   
                   , 
                   
                     A 
                     ⁢ 
                     max 
                   
                 
                 ] 
               
               . 
             
           
         
       
     
     We also omit to mention the intervals if they are [0, 0], such that the SUP above can be written 
     
       
         
           
             
               p 
               
                 → 
                 
                   [ 
                   
                     0 
                     , 
                     1 
                   
                   ] 
                 
               
                 
               q 
             
             , 
           
         
       
     
     and it is satisfied e.g. along a trace where p holds true at each step and q is fulfilled at every other step. 
     Given a SUP requirement R, and a trace σ, we write σ|=R (resp. σ|≈R) to mean that a timed automaton   encoding R satisfies σ|=  (resp. σ|≈ ). In the rest of the present description, a timed requirement refers either to a timed automaton or to a SUP. 
     A.4. Several Notions of Consistency 
     {A.4.1. Rt-Consistency} 
     We consider the rt-consistency notion introduced in [PHP11]. As we already mentioned, consistency for a single timed automaton   amounts to requiring that InevE=E. This asks that errors be detected as soon as they cannot be avoided. In simple terms, rt-consistency ensures that this property is true for a set of timed requirements, that is, in the product of the timed automata that encode it. 
     Let   be a set of requirements. Then   is rt-consistent if, and only if, for all finite traces σ satisfying σ|= , we have σ|≈ . 
     Thus, the set   is rt-consistent if all finite traces satisfying all timed requirements in   (i.e. not yet violating one of the timed requirements) can be extended to an infinite trace satisfying all requirements in  . In other words, for all finite traces σ: 
       σ|= ⇒σ|≈ 
 
     In fact, even if individual timed requirements are consistent alone (∀σ, α|=R⇒σ|≈R for each R∈ ), this may not be the case for their conjunction. Thus, checking rt-consistency means checking the consistency of the conjunction of given timed requirements. Note also that the notion of rt-consistency is simply a generalization of consistency to a set of requirements. 
     Example 2 
     Consider the following two timed requirements: 
     
       
         
           
             
               
                 P 
                 ⁢ 
                 1 
                 : 
                     
                 request 
               
                   
               
                 → 
                 
                   [ 
                   
                     3 
                     , 
                     4 
                   
                   ] 
                 
               
               response 
             
             ⁢ 
             
 
             
               
                 P 
                 ⁢ 
                 2 
                 : 
                     
                 repair 
               
               
                 → 
                 
                   [ 
                   
                     5 
                     , 
                     5 
                   
                   ] 
                 
               
               
                 ! 
                 
                   
                     response 
                         
                     [ 
                     
                       3 
                       , 
                       3 
                     
                     ] 
                   
                   . 
                 
               
             
           
         
       
     
     The first timed requirement models a target computer system that has to respond to any request within 3 to 4 time units. The second timed requirement states that if the target computer system enters a maintenance phase, then it will be off (and cannot respond) after 5 time units, and for a duration of 3 time units. 
       FIG.  3    represents the timed automata encoding those two SUPs. 
     As can be seen in  FIG.  3   , the timed automaton encoding the timed requirement P 1  has three states I 1 , D 1  and E 1  (wherein E 1  is the only error state), and an associated clock c 1 . The timed automaton encoding the timed requirement P 2  has four states I 2 , D 2 , A 2  and E 2  (wherein E 2  is the only error state), and an associated clock c 2 . These timed requirements are not rt-consistent. Indeed, consider a finite trace σ where the repair signal is received, followed 3 time units later with a request. Then σ|=SUP(P 1 )∧SUP(P 2 ). The joint runs of the automata are as follows: 
     
       
         
           
             
               ( 
               
                 
                   
                     
                       I 
                       1 
                     
                   
                 
                 
                   
                     
                       
                         c 
                         1 
                       
                       = 
                       0 
                     
                   
                 
                 
                   
                     
                       I 
                       2 
                     
                   
                 
                 
                   
                     
                       
                         c 
                         2 
                       
                       = 
                       0 
                     
                   
                 
               
               ) 
             
             
               → 
               
                 
                   
                     repair 
                   
                 
                 
                   
                     
                       ( 
                       
                         + 
                         delay 
                       
                       ) 
                     
                   
                 
               
             
             
               ( 
               
                 
                   
                     
                       I 
                       1 
                     
                   
                 
                 
                   
                     
                       
                         c 
                         1 
                       
                       = 
                       1 
                     
                   
                 
                 
                   
                     
                       D 
                       2 
                     
                   
                 
                 
                   
                     
                       
                         c 
                         2 
                       
                       = 
                       1 
                     
                   
                 
               
               ) 
             
             
               → 
               
                 
                   
                     * 
                   
                 
                 
                   
                     
                       ( 
                       
                         + 
                         delay 
                       
                       ) 
                     
                   
                 
               
             
             
               ( 
               
                 
                   
                     
                       I 
                       1 
                     
                   
                 
                 
                   
                     
                       
                         c 
                         1 
                       
                       = 
                       2 
                     
                   
                 
                 
                   
                     
                       D 
                       2 
                     
                   
                 
                 
                   
                     
                       
                         c 
                         2 
                       
                       = 
                       2 
                     
                   
                 
               
               ) 
             
             
               → 
               
                 
                   
                     * 
                   
                 
                 
                   
                     
                       ( 
                       
                         + 
                         delay 
                       
                       ) 
                     
                   
                 
               
             
             
               ( 
               
                 
                   
                     
                       I 
                       1 
                     
                   
                 
                 
                   
                     
                       
                         c 
                         1 
                       
                       = 
                       3 
                     
                   
                 
                 
                   
                     
                       D 
                       2 
                     
                   
                 
                 
                   
                     
                       
                         c 
                         2 
                       
                       = 
                       3 
                     
                   
                 
               
               ) 
             
             
               → 
               
                 
                   
                     
                       request 
                       ) 
                     
                   
                 
                 
                   
                     
                       ( 
                       
                         + 
                         delay 
                       
                       ) 
                     
                   
                 
               
             
             
               
                 ( 
                 
                   
                     
                       
                         D 
                         1 
                       
                     
                   
                   
                     
                       
                         
                           c 
                           1 
                         
                         = 
                         1 
                       
                     
                   
                   
                     
                       
                         D 
                         2 
                       
                     
                   
                   
                     
                       
                         
                           c 
                           2 
                         
                         = 
                         4 
                       
                     
                   
                 
                 ) 
               
               . 
             
           
         
       
     
     From this last configuration, it can be checked that no continuations of this trace will avoid reaching E 1  or E 2 . Indeed, from the last configuration above, both timed automata will first loop in their current states D 1  and D 2 , reaching configuration (D 1 , c 1 =2, D 2 , c 2 =5). In order to avoid visiting E 2 , the next two steps must satisfy ¬ response, thereby reaching configuration (D 1 , c 1 =4, A 2 , c 2 =2). From that configuration, we have a conflict: if response is true at the next step, the run will reach E 2  in the second timed automaton, while if response is false (i.e. ¬ response is true), E 1  will be reached in the first timed automaton. 
     Now, assume we add the following timed requirement, which expresses that no request can be received during maintenance: 
     P 3 : repair→!request[5,5]. 
     This timed requirement P 3  rules out the above trace, i.e. it prevents the above trace to occur, and it can be checked that the resulting set of requirements is rt-consistent. 
     As will be seen in section B below, checking rt-consistency is in general computationally expensive. Several possibilities can be investigated to fight against this complexity:
         First, one can restrict the considered class of timed requirements, while still having enough expressive power for targeted applications, and this is the idea of focusing on SUP requirements for which computationally efficient tools exist;   Second, one can restrict consistency checking to subsets of requirements. However, one should be aware that this might introduce false negatives: consistency of a subset does not imply consistency of the whole set, since inconsistencies can be introduced by adding a new requirement. Conversely, adding requirements may also introduce false positives: an inconsistency of a subset can be removed by adding a new requirement which prohibits some behaviors revealing an inconsistency (as for requirement P 3  in the example above). We will however explore this idea, and see that some additional checks are necessary to avoid these situations;   Third, inconsistencies typically arise in some particular risky situations where Boolean valuations conflict. Some of these situations may in particular be identified for the restricted class of SUPs, where they correspond to conflicts between action parts of SUPs. This check can also be restricted to subsets or even pairs of timed requirements. Again, one should be aware that false negatives may arise (absence of particular risky situations on pairs does not imply consistency), as well as false positives (risky situations are not necessarily rt-inconsistencies). Again, additional conditions must be checked to get conclusions.       

     The present disclosure relates inter alia to these developments. 
     {A.4.2. Partial Consistency} 
     Partial consistency was introduced in [Bec19] as a partial but more efficient check to detect inconsistencies in SUP requirements. Indeed, partial consistency checking simply identifies risky situations for pairs of SUPs that could be rt-inconsistent. We will however later show (see Lemma 3) that additional checks allow to lift witnesses of partial inconsistencies to witnesses of rt-inconsistencies. 
     For a SUP requirement R=SUP(P), a finite trace σ∈Σ*, and j∈ , we define the predicate TriggerAt R  (σ, j) which holds if a trigger phase was just ended at step j. Formally, let    R  denote a deterministic timed automaton representing R. In addition, for    R  and σ, let (s i , v i ) i∈[0,|σ|]  denote the corresponding run. Then, TriggerAt R  (σ, j) holds if, and only if, one of the following conditions holds:
         Either s j-1 =trig, σ j |=P TEE , and v j-i (c)≥P Tmin ;   Or s j-1 =idle, σ j |=P TSE ∧P TEE  and P Tmin = 0 ;   Or S j-1 =act, σ j |=P AEE ∧P TSE ∧P TEE , v j-1 (c)≥P Amin  and P Tmin =0;   Or S j-1 =delay, σ j |=P ASE ∧P AEE  ∧P TSE ∧P TEE , v j-1 (c)≥P Lmin  and P Amin =P Tmin =0.       

     Note that the first case is the main one and the easiest one to understand: TriggerAt R  (σ, j) holds if the timed automaton was in the state trig and P TEE  just occurred while P Tmin  time was spent during the trigger phase. Thus, the trigger phase has successfully ended. The other items treat the cases where the trigger phase ends within one step in the initial state, or simultaneously as the previous action phase is ending, and the case where both the previous action phase and the present trigger phase are done within the same step. 
     For SUP requirements R 1 =SUP(P 1 ), R 2 =SUP(P 2 ), R=SUP(P), indices j 1 , j 2 , k∈ , we define: 
       Interfere (R     1     ,R     2     ) ( j   1   ,j   2 )= j   1 +( P   1 ) L min+( P   1 ) Amin   ≥j   2 +( P   2 ) Lmax   ∧j   2 +( P   2 ) Lmin +( P   2 ) Amin   ≥j   1 +( P   1 ) Lmax    
       Trig (R     1     ,R     2     ),k (σ)∃ j   1   ,j   2   ∈     : j   1   ≤k∧j   2   ≤k ∧TriggerAt R     1   (σ, j   1 )∧TriggerAt R     2   (σ, j   2 )∧Interfere (R     1     ,R     2     ) ( j   1   ,j   2 )
 
     Interfere (R1,R2) (j 1 , j 2 ) expresses the fact that if trigger phases of R 1  and R 2  are completed at steps j 1  and j 2  respectively, then their respective potential action phases necessarily overlap. Trig (R     1     ,R     2     )k (σ) means that the trigger phases of R 1  and R 2  are completed by step k and their potential action phases overlap.  FIG.  4    illustrates the interferences of the action phases (action 1  and action 2  in  FIG.  4   ) of two timed requirements after their trigger phases (trigger 1  and trigger 2  in  FIG.  4   ). Remark that if a is a prefix of p, then Trig (R     1     ,R     2     ),k  (σ) implies Trig (R     1     ,R     2     ),k (ρ). 
     Consider SUP timed requirements R 1 , R 2  and a set    inv , of SUP timed requirements. We say that R 1  and R 2  are partially consistent with respect to    inv  if: 
       ∀ k ∈ ,(∀ i∈{ 1,2},∃σ∈Σ ∞ ,σ|=   inv   ∪{R   i }∧Trig (R     1     ,R     2     ),k (σ))⇒(∃σ∈Σ ∞ ,σ|=   inv   ∪{R   1   ,R   2 }∧Trig (R     1     ,R     2     ),k (σ))  (1)
 
     Partial consistency requires that for all k≥1, if traces for both timed requirements can be found in which the trigger is completed within k steps, and the timed requirement satisfied, then a single trace must exist that triggers and satisfies both timed requirements. Observe that, given set    inv , timed requirements R 1 , R 2 , a witness trace of partial inconsistency is a number k≥0 and two sequences σ 1  and σ 2  of length k, such that each σ i  triggers both R 1  and R 2  and satisfies R i , but there are no infinite traces that trigger both R 1  and R 2  within k steps and satisfy both. 
     As in [Bec19], to efficiently find witnesses of partial inconsistency, we may consider the following approximation. Given bounds α, β&gt;0, timed requirements R 1 , R 2  are (α, β)-bounded partial consistent if: 
       ∀ k ≤α,(∀ i∈{ 1,2},∃σ∈Σ α ,σ|=   inv   ∪{R   i }∧Trig (R     1     ,R     2     ),k (σ))⇒(∃σ∈Σ α+β ,σ|=   inv   ∪{R   1   ,R   2 }∧Trig (R     1     ,R     2     ),k (σ))  (2)
 
     Thus, the approximation consists in looking for witness traces of bounded length for the failure of Equation (2), but remark that witness traces for the failure of Equation (2) are not witness traces of the failure of Equation (1) which require infinite traces. 
     Example 3 
     We consider again the timed requirements of Example 2. Timed requirements P 1  and P 2  are not partially consistent under empty    inv , since there are traces that trigger both timed requirements, but as soon as their action phases overlap, both cannot be fulfilled. Under timed requirement P 3 , timed requirements P 1  and P 2  cannot interfere, so that with    inv =SUP(P 3 ), those two timed requirements are partially consistent. 
     There are a few differences with the original definition of partial consistency of [Bec19]. First, partial consistency of [Bec19] only checks the very first trigger of the traces, that is, the TriggerAt formula is used to define the position of the trigger of the first phase only. In our case, we consider also the triggers of later phases. In fact, TriggerAt(σ, j) is true whenever j is the end of the trigger of some phase of σ. Thus, we can detect more subtle inconsistencies. 
     The second difference is that the bounded approximation in [Bec19] checks for the existence of a lasso-shaped execution in the timed automata that recognize the SUP timed requirements. The advantage of this is that such a lasso describes an infinite execution, so if partial consistency holds, so does the bounded approximation; while the converse is not true. In our case, we do not look for a lasso in the left part of Equation (2), so this implication does not hold. We do prove, on the other hand, that rt-consistency implies Equation (2) (see Lemma 3 below). 
     Third, in [Bec19],    inv  contains only a specific type of timed requirements called invariants. In our case,    inv  is an arbitrary subset of the set of timed requirements. 
     B. Detailed Description of the Testing Method 
       FIG.  5    represents the main steps of a method  50  for testing the operation of a target computer system (not represented in the figures), the operation of said target computer system being constrained by a set   of N TR  timed requirements, | |=N TR ≥3. 
     The testing method  50  is carried out by a testing computer system (not represented in the figures). In preferred embodiments, the testing computer system comprises one or more processors (which may belong to a same computer or to different computers) and storage means (magnetic hard disk, optical disk, electronic memory, or any computer readable storage medium) in which a computer program product is stored, in the form of a set of program-code instructions to be executed in order to implement all or part of the steps of the testing method  50 . Alternatively, or in combination thereof, the testing computer system can comprise one or more programmable logic circuits (FPGA, PLD, etc.), and/or one or more specialized integrated circuits (ASIC), etc., adapted for implementing all or part of said steps of the testing method  50 . In other words, the testing computer system comprises a set of means configured by software (specific computer program product) and/or by hardware (processor, FPGA, PLD, ASIC, etc.) to implement the steps of the testing method  50 . 
     As illustrated by  FIG.  5   , the testing method  50  comprises a step S 51  of defining subsets of K TR  timed requirements of the set  , 2≤K TR &lt;N TR . Preferably, all subsets have initially the same number of timed requirements but, in some embodiments, the initial number of timed requirements may vary from one subset to another. The subsets are all different, none of the subsets defined is included or identical to another subset. However, a given timed requirement may be included in a plurality of subsets. Preferably, the union of all the subsets defined corresponds to the set  . 
     Then, as illustrated in  FIG.  5   , the testing method  50  comprises additional steps which may be iterated for each subset of a plurality of subsets. Preferably, said steps are executed for all the subsets defined, however it is also possible to execute these steps only on some of the subsets. 
     As illustrated by  FIG.  5   , for each subset of the plurality of subsets, the following steps are iterated:
         a step S 52  of searching for an execution sequence of the target computer system, referred to as “witness trace”, satisfying a criterion for detecting a conflict between timed requirements of the subset;   when a witness trace is found (reference S 52   a  in  FIG.  5   ): a step S 53  of searching for a contradicting timed requirement among the timed requirements of the set   which are not present in the subset, which prevents the witness trace to occur when considered with the subset;   when a contradicting timed requirement is found (reference S 53   a  in  FIG.  5   ): a step S 54  of augmenting the subset by including the contradicting timed requirement in the subset.       

     The step S 52  of searching for a witness trace satisfying the conflict detection criterion between timed requirements of the subset corresponds to performing an inconsistency check on the subset. The conflict detection criterion may use different notions of inconsistency checking, such as rt-inconsistency checking or partial inconsistency checking, and the witness trace is an execution sequence which demonstrates the inconsistency. Also, in some cases (see e.g. subsection B.2), more than one witness trace may be found, depending e.g. on the conflict detection criterion considered. 
     If no witness trace is found for the considered subset (reference S 52   b  in  FIG.  5   ), then no inconsistency of the subset is detected, and the execution of the different steps S 52 , S 53  and S 54  stops for this subset. 
     In turn, if a witness trace is found for the considered subset (reference S 52   a  in  FIG.  5   ), then the testing method  50  continues with step S 53  of searching for a contradicting timed requirement in the timed requirements of the set   which are not present in the subset. 
     Basically, a contradicting timed requirement corresponds to a timed requirement which prevents the witness trace to occur when considered with the considered subset. Hence the contradicting timed requirement is a timed requirement that is violated by the witness trace before any timed requirement of the considered subset is violated. 
     If no contradicting timed requirement is found for the witness trace (reference S 53   b  in  FIG.  5   ), then an inconsistency of the subset is detected, and the execution of the different steps S 52 , S 53  and S 54  stops for this subset. 
     In turn, if a contradicting timed requirement is found for this witness trace (reference S 53   a  in  FIG.  5   ), then the testing method  50  continues with step S 54  of augmenting the subset with the contradicting timed requirement, which consists in including the contradicting timed requirement in the considered subset, such that the number of timed requirements of this subset is incremented. 
     After step S 54  of augmenting the considered subset, step S 52  of searching a witness is executed again on the augmented subset, and so on. 
     As can be seen in  FIG.  5   , the execution of the different steps S 52 , S 53  and S 54  may stop e.g. when no witness trace is found or when no contradicting timed requirement is found for a given witness trace. It should be noted that no contradicting timed requirement can be found if the considered subset has been augmented up to the size of the set  , i.e. when the number of timed requirements of this subset is equal to N TR  and there are no timed requirements of the set which are not present in this subset. 
     An inconsistency of the set   (which defines the operation of target computer system) is detected when a witness trace is found for at least one subset and no contradicting timed requirement is found for said witness trace. The testing method  50  may stop once at least one inconsistency is detected for at least one subset, or it may continue until e.g. all the subsets are processed. 
     In some embodiments, and as illustrated in  FIG.  5   , the testing method  50  may also comprise a step S 55  of evaluating whether a stop criterion is satisfied. For instance, it is possible to consider a higher bound K TRmax  (K TRmax &lt;N TR ) on the size of the subset, such that the stop criterion is satisfied when the size of the subset reaches K TRmax  Other stop conditions, or a combination thereof, may be considered in the stop criterion. In  FIG.  5   , the step S 55  of evaluating the stop criterion is executed after step S 52  of searching for a witness trace. If the stop criterion is not satisfied (reference S 55   b  in  FIG.  5   ), then the testing method  50  proceeds with step S 53 . In turn, if the stop criterion is satisfied (reference S 55   a  in  FIG.  5   ), then the iterations stop for this subset. However, other positions are possible, and the testing method  50  may also include more than one step S 55  of evaluating a stop criterion, evaluating different respective stop conditions. 
     In the sequel, we describe specific preferred embodiments of testing method  50 . It is emphasized that the present invention is not limited to the below exemplary embodiments. Variants of these embodiments are also within the scope of the present invention. 
     B.1. Embodiment 1: Incremental RT-Consistency Checking 
     In this subsection, we present an embodiment of the testing method  50  for rt-consistency checking. This embodiment uses computation tree logic, CTL, model checking. 
     Consider a set  ={R i } i∈I  given as timed automata. As discussed above, in the product of R i , the set of error states is the set of states in which at least one timed automaton is in its error state. Thus, given trace σ∈Σ*, the predicate err is false in the state reached by reading σ in ⊗  if, and only if, σ|= . Rt-inconsistency checking then reduces to checking whether a finite trace satisfying ¬err can be found such that err is inevitable from the last state. Accordingly, the conflict detection criterion can be expressed by the following CTL formula to be checked in ⊗ : 
         E [¬ err U (♭ err ∧AFerr)].
 
     We do not formally define CTL and its semantics but only explain this specific formula. This formula says that there exists a finite execution p in which ¬err holds (that is, ∀0≤i≤|ρ|, ρ i |=¬err), such that all continuations from state ρ |ρ|-1  eventually lead to err, that is, err is inevitable from the last state of ρ. 
     If the formula is true, then there exists a finite trace σ such that σ|=  (since err is false), but for all infinite traces σ′∈Σ ∞ , σσ′ sets err to true eventually. In other terms, σσ′|≠  for all σ′∈Σ ∞ , or equivalently σ′|   , witnessing that   is rt-inconsistent. Such a finite trace σ, if it exists, corresponds to a witness trace for the rt-inconsistency of the set  , searched for in step S 52  of the testing method  50 . Basically, the witness trace σ satisfies all the timed requirements of the subset, but the witness trace has no extension that satisfies all said timed requirements of the subset. 
     The advantage of defining the conflict detection criterion using a CTL formula is that there exist efficient model checking tools (such as NuSMV) for checking if a finite state target computer system satisfies such a CTL formula. Additionally, if the formula holds, such model checking tools will also return a run witnessing this CTL formula, i.e. the witness trace searched for in step S 52  of the testing method  50 . 
     It should be noted that this CTL formula, together with model checking tools, can be used directly on the whole set  , without considering subsets as discussed in reference to  FIG.  5   , if the size of the set   is not too large. 
     When the size of the set   is too large, then we can consider subsets of the set  , as discussed above in reference to  FIG.  5   . The resulting check can only provide partial guarantee on rt-inconsistency. Indeed if  ′⊆ , consistency of   does not imply consistency of  ′, nor the opposite. Nevertheless, rt-inconsistencies can be detected, as shown in the next lemma. 
     {Lemma 1} 
     Let σ∈Σ* be a witness trace for the rt-inconsistency of  ′⊆ . If σ|= , then a is also a witness trace for the rt-inconsistency of  . 
     {Proof} 
     In fact, if σ is a witness trace of rt-inconsistency in  ′ i.e. σ|= ′ but σ|   ′, it also implies σ|   . If additionally σ|= , then we can conclude that σ is a witness trace of rt-inconsistency of  . 
     Given the set   and a bound K TRmax ≤| |, we consider subsets  ′ of the set   of size up to K TRmax , starting for instance with subsets of size 2 (K TR =2). If a subset  ′⊆  is found to be rt-inconsistent with a witness trace σ, then we check whether σ|= \ ′. If this is the case (which implies that no contradicting timed requirement can be found), we can conclude using Lemma 1 that the set   is rt-inconsistent and that σ is a witness trace of this rt-inconsistency. 
     Otherwise (if σ|≠ \ ′), we select a contradicting timed requirement R∈ \ ′ such that σ|≠R, and restart the analysis with  ′∪{R} (i.e. the subset  ′ is augmented with the contradicting timed requirement R). It should be noted that if  ′⊆{R} is inconsistent, then the trace σ identified during the previous iteration cannot be a witness trace for  ′∪{R} since it violates R. This ensures that a new timed requirement will be added to the subset at each iteration. If no confirmed witness traces are found (i.e. either no further witness trace is found or there always exists a contradicting timed requirement), then the iterations may stop, and no rt-inconsistency is found for this subset. If K TRmax =| |, then one can conclude that the set R is rt-consistent. Otherwise (K TRmax &lt;| |), the check is only partial. In order to increase the precision (to have a better chance to detect rt-inconsistencies), one can increase the bound K TRmax . In order to reduce the number of cases to check, thus giving up on completeness, one might restrict only to some subsets, for instance making sure that each timed requirement is covered by at least one subset. 
     An exemplary pseudo-code implementation for the present embodiment is given below, in the case where K TR =2. In the example below, we write  ′|=E[¬err U(¬err∧AFerr)] for a subset  ′ of timed automata and the CTL formula to mean that the product of these timed automata satisfies the CTL formula (i.e. there exists a witness trace satisfying the conflict detection criterion). It should be noted that, in order to avoid checking the same subsets of the set   several times (e.g. when augmenting the subsets), one can store the subsets seen so far and break the while loop when a subset   has already been processed. 
     
       
         
           
               
               
             
               
                   
                   
               
             
            
               
                   
                 for all pairs {R 1 , R 2 } ⊆    do 
               
               
                   
                      ′ ← {R 1 , R 2 } // subset 
               
               
                   
                  while |    ′| ≤ K TRmax  and    ′|=E[¬err U(¬err∧AFerr)] do 
               
               
                   
                   σ ← witness trace for E[¬err U(¬err∧AFerr)] 
               
               
                   
                   if ∃R ∈    , σ|≠R then 
               
               
                   
                        ′ ←    ′ ∪ R // subset is augmented 
               
               
                   
                   else 
               
               
                   
                    return σ // rt-inconsistency of    detected 
               
               
                   
                   end 
               
               
                   
                  end 
               
               
                   
                 end 
               
               
                   
                 return ∅ // no witness trace found 
               
               
                   
                   
               
            
           
         
       
     
     B.2. Embodiment 2: Incremental Partial-Consistency Checking 
     In this subsection, we present an embodiment of the testing method  50  for partial consistency checking. This embodiment uses timed requirements modeled as a Simplified Universal Patterns, SUPs. 
     Ideally, we would like to check Equation (2) for all pairs {R 1 , R 2 } of requirements with respect to R inv = \{R 1 , R 2 }. In fact, considering such a subset    inv  makes sure that traces do not trivially violate timed requirements. 
     This is costly in general, and the present embodiment starts with an empty    inv  and let it grow incrementally by adding timed requirements as needed. Hence, in the present embodiment, the subset (as defined in reference to  FIG.  5   ) corresponds to    inv ∪{R 1 , R 2 } (which is initially equal to {R 1 , R 2 } since    inv  is initially empty, such that K TR =2). For the present embodiment, the conflict detection criterion is satisfied when Equation (2) above fails and searching for witness traces may use e.g. a Satisfiability Modulo Theories, SMT, solver. 
     Given the set  , a pair {R 1 , R 2 }, a subset    inv ⊆ \{R 1 , R 2 }, integer parameters α, β&gt;0, the (α, β)-bounded partial-consistency checking consists in verifying Equation (2). If the check is negative (i.e. Equation (2) fails), then the conflict detection criterion is satisfied and there exists k&lt;α and a pair of traces σ 1 , σ 2  satisfying the left part of Equation (2) (σ i  is a witness trace for the case i∈{1,2}), while the right part of Equation (2) is not satisfiable. Hence, in the present case, there are two witness traces σ 1 , σ 2  found during step S 52  of the testing method  50 . We check whether σ i |=  for some i∈[1,2] in which case the witness trace is returned, and a partial inconsistency is detected. Otherwise, we select a timed requirement  ′∈ \{   inv  ∪{R 1 , R 2 }} such that and we add it to    inv  (i.e. the subset    inv ∪{R 1 , R 2 } is augmented with the contradicting timed requirement R′), and we restart the analysis with {R 1 , R 2 } and    inv . Subsequent iterations may discard the witness trace σ i  and look for other traces. 
     An exemplary pseudo-code implementation for the present embodiment is given below. 
     
       
         
           
               
               
             
               
                   
                   
               
             
            
               
                   
                 for all pairs [R 1 , R 2 ] ⊆    do 
               
               
                   
                       inv  ← ∅ // subset corresponds to     inv  ∪ {R 1 , R 2 } 
               
               
                   
                  while Equation (2)fails do 
               
               
                   
                   (σ 1 , σ 2 ) ← witness trace for the premise of (2) for some k 
               
               
                   
                      ≤ α 
               
               
                   
                   if ∃i ∈ {1,2}, σ i |=    then 
               
               
                   
                    return σ i  // rt-inconsistency of    detected 
               
               
                   
                   else 
               
               
                   
                    if    =     inv  ∪ {R 1 , R 2 } then 
               
               
                   
                     break 
               
               
                   
                    else 
               
               
                   
                     Choose R′ ∈    such that σ i |≠R′ for some i ∈ {1,2} 
               
               
                   
                          inv  ←     inv  ∪ R′ // subset     inv  ∪ {R 1  R 2 ] is 
               
               
                   
                     augmented 
               
               
                   
                    end 
               
               
                   
                   end 
               
               
                   
                  end 
               
               
                   
                 end 
               
               
                   
                 return ∅ // no witness trace found 
               
               
                   
                   
               
            
           
         
       
     
     Before proving the absence of false positives as output to the present embodiment, we prove an intermediate lemma relating to some witness of bounded-partial inconsistency and rt-inconsistency. 
     {Lemma 2} 
     Let σ 1 , σ 2  and k be witnesses of bounded partial inconsistency for    inv  ⊆ , i.e. counterexamples of Equation (2). For any i, if additionally σ i |= , then σ i  is also a witness trace for the rt-inconsistency of  . 
     {Proof} 
     Suppose σ 1 , σ 2 ∈Σ α  and k≤α witness (α, β)-bounded partial inconsistency, thus ∀i∈[1,2], σ i  ∈Σ α , Σα, σ i |=   inv  ∪{R i }∧Trig (R     1     ,R     2     ),k (σ i ) but there is no σ∈Σ α+β  such that σ|=   inv  ∪{R 1 , R 2 }∧Trig (R     1     , R     2     ),k (σ). Suppose by contradiction that σ i  is not a witness trace of rt-inconsistency, i.e. σ i |= . By definition, there is an infinite continuation σ′∈Σ ∞  such that σσ′|= . Let ρ be the prefix of σσ′ of length α+β. Since σ is a prefix of ρ and Trig (R     1     ,R     2     ),k (σ)′ we also get Trig (R     1     ,R     2     ),k  (ρ) Now the right part of Equation (2) is false, while ρ∈Σ α+β  and ρ|= ⊇   inv  ∪{R 1 , R 2 } and this is a contradiction, such that we can conclude that σ i |   . 
     The following lemma then shows that witness traces returned by the present embodiment are witnesses to rt-inconsistency. 
     {Lemma 3} 
     Let   be a set of SUP requirements, and σ be a finite trace returned by the present embodiment (at line 6 of the pseudo-code), then σ is a witness trace for rt-inconsistency for  . 
     {Proof} 
     Assume that the present embodiment returned a witness trace σ∈Σ* for the outer iteration with R 1 , R 2 ∈ , and inner iteration    inv ⊆ . The present embodiment ensures that σ|=  (line 5 of the pseudo-code above). We then use Lemma 2 to conclude that σ is a witness trace for rt-inconsistency for the set  . 
     B.3. Embodiment 3: Partial RT-Consistency Checking 
     In this subsection, we present an embodiment of the testing method  50  for partial consistency checking. Basically, we divide the rt-consistency checking problem into several smaller problems. Intuitively, for all (or part of) subsets of a given set   of requirements, we check an absence of conflict involving all the timed requirements in the subset. Notice that a divided problem for a large subset (possibly the original set itself) would be still simpler than the original problem, since each divided problem considers only the case where all the timed requirements in the subset conflict simultaneously. 
     For a timed requirement represented by a deterministic timed automaton  = S, S 0 , AP,  , T, E  and a trace σ∈Σ*, let (s i , v i ) i∈[0,|σ|]  denote a corresponding run. Then, for a transition t E T and a natural number k∈ , we define: 
       ErrAt( , t,σ,k )=( tgt ( t )∈ E )∧( src ( t )= S   k )∧( v   k |=guard( t )).
 
     Intuitively, ErrAt( , t, σ, k) holds if transition t, leading to an error state, is available after step k along a trace σ (for some valuation of the atomic propositions). 
     For a set of timed automata  ={   i = S i , S i,0 , AP i ,    i , T i , E i   } i∈    that represents a set of timed requirements, we define: 
       conflict( ,σ, k )=∃( t   i ) ∈(× T   i ) ,(|= bool i ( t   i ))∧∀ ′⊂ , ′≠└→¬(|= bool i ( t   i ))∧∀   i ∈ ,ErrAt(   t   i   ,σ,k ).
 
     Intuitively, conflict( , σ, k) holds if for all σ′∈Σ, σ . . . k σ′ takes some transition into an error state at step k+1. In other words, after an execution represented by σ . . . k , all the timed requirements in R conflict each other, and any execution at step k+1 will violate at least one of the time requirements in  . Moreover, in conflict( , σ, k), we only consider conflicts among all of the timed requirements in  , by specifying the condition ¬(|= bool i (t i )). That enables incremental checking of conflict for each subset of  . 
     Now we define a notion of partial rt-consistency. For a set   of timed automata and a subset  ′⊆ ,  ′ is α-bounded partially rt-inconsistent with    inv ⊆ \ ′ if, and only if 
       ∃ k≤α,∃σ∈Σ   k ,σ|={ ′∪   inv }∧conflict( ′,σ, k ).  (3)
 
     Furthermore, for K TRmax ∈[1,| |], we define K TRmax -partial rt-consistency as follows: 
       ∀ ′⊆ ,| ′|≤ K   TRmax  →(∀ k≤α,∀σ∈Σ   k ,σ|= →¬conflict( ′,σ, k )).
 
     K TRmax -partial rt-consistency ensures that there is no conflict among a subset of R of size 1 to K TRmax  up to step α. Thus, | |-partial rt-consistency implies rt-consistency up to step α, and | |-partial rt-inconsistency implies rt-inconsistency. 
     In the present embodiment, the conflict detection criterion is satisfied when Equation (3) above fails and searching for witness traces may use e.g. a SMT solver. Basically, the witness trace σ is such that it satisfies all the timed requirements of the subset and, for all extensions of the witness trace, at least one timed requirement of the subset will always be violated at next step. 
     The subset (as defined in reference to  FIG.  5   ) corresponds to    inv  ∪ ′ (which is initially equal to ′ since    inv  is initially empty). 
     An exemplary pseudo-code implementation for the present embodiment is given below. A witness trace σ returned by the present embodiment is clearly a witness of rt-inconsistencies of bounded size for a subset  . Since the present embodiment ensures that a satisfies   (line 5 in the pseudo-code below), again using Lemma 1 we can conclude that σ is a witness trace of rt-inconsistency. 
     
       
         
           
               
               
             
               
                   
                   
               
             
            
               
                   
                 for all    ′ ⊆    such that |    ′| ≤ K TR  do 
               
               
                   
                       inv  ← ∅ // subset corresponds to     inv  ∪    ′ 
               
               
                   
                  while Equation (3)fails do 
               
               
                   
                   (k, σ) ← k ≤ α and σ witness trace for Equation (3) 
               
               
                   
                   if σ|=    then 
               
               
                   
                    return σ // inconsistency detected 
               
               
                   
                   else 
               
               
                   
                    if    =     inv  ∪    ′ then 
               
               
                   
                     break 
               
               
                   
                    else 
               
               
                   
                     Choose R ∈    such that σ|≠R 
               
               
                   
                          inv  ←     inv  ∪ R // subset     inv  ∪    ′ is augmented 
               
               
                   
                     end 
               
               
                   
                    end 
               
               
                   
                   end 
               
               
                   
                  end 
               
               
                   
                 return ∅ // no witness trace found 
               
               
                   
                   
               
            
           
         
       
     
     To illustrate how partial rt-consistency checking works, consider the following SUP requirements: 
     
       
         
           
             
               
                 
                   
                     R 
                     1 
                   
                   : 
                       
                   
                     
                       ( 
                       
                         p 
                         , 
                         true 
                         , 
                         true 
                       
                       ) 
                     
                     [ 
                     
                       0 
                       ; 
                       0 
                     
                     ] 
                   
                 
                 
                   → 
                   
                     [ 
                     
                       1 
                       ; 
                       1 
                     
                     ] 
                   
                 
                 
                   
                     ( 
                     
                       q 
                       , 
                       true 
                       , 
                       r 
                     
                     ) 
                   
                   [ 
                   
                     1 
                     ; 
                     1 
                   
                   ] 
                 
               
               ; 
             
             ⁢ 
             
 
             
               
                 
                   
                     R 
                     2 
                   
                   : 
                       
                   
                     
                       ( 
                       
                         p 
                         , 
                         true 
                         , 
                         true 
                       
                       ) 
                     
                     [ 
                     
                       0 
                       ; 
                       0 
                     
                     ] 
                   
                 
                 
                   → 
                   
                     [ 
                     
                       2 
                       ; 
                       2 
                     
                     ] 
                   
                 
                 
                   
                     ( 
                     
                       
                         ¬ 
                         q 
                       
                       , 
                       true 
                       , 
                       true 
                     
                     ) 
                   
                   [ 
                   
                     0 
                     ; 
                     0 
                   
                   ] 
                 
               
               ; 
             
             ⁢ 
             
 
             
               
                 
                   R 
                   3 
                 
                 : 
                     
                 
                   
                     ( 
                     
                       p 
                       , 
                       true 
                       , 
                       true 
                     
                     ) 
                   
                   [ 
                   
                     0 
                     ; 
                     0 
                   
                   ] 
                 
               
               
                 → 
                 
                   [ 
                   
                     4 
                     ; 
                     4 
                   
                   ] 
                 
               
               
                 
                   
                     ( 
                     
                       r 
                       , 
                       true 
                       , 
                       true 
                     
                     ) 
                   
                   [ 
                   
                     0 
                     ; 
                     0 
                   
                   ] 
                 
                 . 
               
             
           
         
       
     
     Let    1 ,    2  and    3  denote timed automata representing R 1 , R 2  and R 3  respectively. For each timed automaton, there exists the following transitions into error state:
             1 : (delay 1 , c 1 =1, ¬q, err 1 ), (act 1 , c 1 =1, ¬r, err 1 );       2 : (delay 2 , c 2 =2, q, err 2 );       3 : (delay 3 , c 3 =4, ¬r, err 3 ).       

     A tuple t=(s, clock, bool, s′) denotes a transition from state s to state s′ with time condition clock and Boolean condition bool. In other words, src(t)=s, tgt(t)=s′, guard(t)=clock and bool(t)=bool. For example, (delay 1 , c 1 =1, ¬q, err 1 ) denotes that if    1  is in the state delay 1  and the value of its clock is 1 at some step i, and the condition q does not hold at step i+1 then,    1  transitions to the error state err 1  at step i+1. 
     In 2-partial rt-consistency checking, the subsets {R 1 , R 2 }, {R 2 , R 3 }, {R 1 , R 3 } are checked. Let t 1   1 ,t 2   1 ,t 1   2 ,t 1   3  denote (delay 1 , c 1 =1, ¬q, err 1 ), (act 1 , c 1 =1, ¬r, err 1 ), (delay 2 , c 2 =2, q, err 2 ), (delay 3 , c 3 =4, ¬r, err 3 ) respectively. For the subset {R 1 , R 2 }, there exists a pair of transitions (t 1   1 ,t 2   1 ) which satisfies the condition |=bool(t 1   1 )∨bool(t 2   1 ) since |=¬q∨q holds. Thus, if there exists a trace σ and k∈  that satisfies ErrAt(   1 , t 1   1 , σ, k)∧ErrAt(   2 , t 1   2 , σ, k) then, conflict({R 1 , R 2 }, σ, k) holds. In that case, if σ satisfies R 1 , R 2  and R 3  until step k, the timed requirements are rt-inconsistent. 
     However, by definition of ErrAt,    1  must be in the state delay 1  and c 1 =1, and    2  must be in the state delay 2  and c 2 =2, at step k. It will never occur since    1  and    2  transition to delay 1  (resp. delay 2 ) simultaneously and the value of their clock are always same. In practice, that may be automatically checked by an SMT solver until step α. Thus, R 1  and R 2  are partially rt-consistent. For {R 2 , R 3 } and {R 1 , R 3 }, there is no pair (t, t′) that satisfies |=bool(t)∨bool(t′). Therefore, the timed requirements R 1 , R 2  and R 3  are 2-partially rt-consistent. 
     In 3-partial rt-consistency checking, the original set {R 1 , R 2 , R 3 } is checked. In this case, there exists a triplet of transitions (t 1   1 , t 1   2 , t 1   3 ) that satisfies|=bool(t 1   1 )∨bool(t 1   2 )∨bool(t 1   3 ). However, the triplet does not satisfy the condition |≈bool(t 1   1 )∨bool(t 1   2 ) since|=¬q∧q holds. Then, we can conclude that t 1   1 , t 1   2  and t 1   3  do not become available at the same time, since it is already confirmed in 2-partial rt-consistency checking that there is no trace σ and k∈  that satisfies ErrAt(   1 , t 1   1 , σ, k)∨ErrAt(   2 , t 1   2 , σ, k). Thus obviously, there is no a and k that satisfies ErrAt(   1 , t 1   1 , σ, k)∧ErrAt(   2 , t 1   2 , σ, k)∧ErrAt(   3 , t 1   3 , σ, k). Therefore, R 1 , R 2  and R 3  are 3-partially rt-consistent. As a result, the timed requirements R 1 , R 2  and R 3  are rt-consistent. 
     REFERENCES 
     
         
         [AD90] Rajeev Alur and David L. Dill. “ Automata for modeling real - time systems ”. In Mike Paterson, editor, Proceedings of the 17th International Colloquium on Automata, Languages and Programming (ICALP&#39;90), volume 443 of LNCS, pages 322-335. Springer, 1990. 
         [Bec19] Jan Steffen Becker. “ Analyzing consistency of formal requirements ”. In Proceedings of the 18th International Workshop on Automated Verification of Critical Systems (AVOCS&#39;18). EASST, 2019. 
         [PHP11] Amalinda Post, Jochen Hoenicke, and Andreas Podelski. “ Rt - inconsistency: a new property for real - time requirements ”. In Proceedings of the 14th International Conference on Fundamental Approaches to Software Engineering (FASE&#39;11), volume 6603 of LNCS. Springer, 2011.