Constructing operational profiles for synchronous critical software

We describe a uniform approach to specify operational profiles for synchronous reactive software and to automatically generate random software inputs according to these profiles. The approach is general enough to allow realistic description of the operating environment: as the environment behavior is often characterized by properties expressing causal temporal dependencies, the operational profile specification technique gives a means to assign to the next event issued by the environment with a probability depending on any sequence of previous events. Two examples of reactive software controlling respectively a temperature control system and an elevator are used to illustrate the technique.