Formal Validation of Hierarchical State Machines against Expectations

This paper explains some analyses that can be performed on a hierarchical finite state machine to validate that it performs as intended. Such a hierarchical state machine has transitions between states, triggered by conditions over inputs, with outputs determined per state in terms of inputs. Intentions are captured per state as expectations on input values. These expectations are expressed using the same condition language as transition triggers, extended to constrain rates of change as well as ranges. The analyses determine whether the expectations are consistent and whether the state machine conforms to the expectations. For the analyses to find no problems, the explicit expectations on the root state would be at least as strong as the implicit expectations of the state machine. One way of using the analyses is to reveal these implicit expectations. The analyses have been automated for statecharts built with the MathWorks' Stateflow tool.