UPPAAL: Status & Developments

Uppaal is a tool box for validation (via graphical simulation) and veri cation (via automatic model-checking) of real-time systems, based on constraint solving and onthey techniques. It consists of three main parts: a description language, a simulator and a model-checker. It is appropriate for systems that can be modelled as networks of timed automata [3, 2], i.e. a collection of non-deterministic processes with nite control structure and real-valued clocks, communicating through channels and shared variables. The description language ofUppaal is a non-deterministic guarded command language with data types (currently, only integer and clock, with restricted forms of operations implemented). The semantics of the language is given in terms of labelled transition systems in the tradition of timed process algebras. The simulator enables examination of possible dynamic executions in early design stages and thus provides an inexpensive mean of fault detection prior to veri cation by the model-checker which covers the exhaustive dynamic behaviour. The two main design criteria for Uppaal have been e ciency and ease of usage. An important key to the e ciency of the current model-checking engine of Uppaal is the application of on-they veri cation combined with a symbolic technique reducing the veri cation problem to that of solving simple constraint systems [3, 2]. In contrast to the previous version of Uppaal which was based on backwards reachability analysis, the current version implements forwards on-they reachability analysis. In addition, it o ers both breadthrst and depthrst search of the state-space of a system description. Another important key to e ciency is the restriction to model checking of simple invariant and reachability properties. Other properties such as bounded liveness properties may be checked by reasoning about the system in the context of a testing automata or the decorated system with debugging information. In order to facilitate debugging, Uppaal automatically generates a diagnostic trace that explains why a property is (or is not) satis ed by a system description. Our current research results promises even more e cient veri cation engines in near future (see Section 3). To ease the usage of Uppaal particular e ort has been made in developing graphical user interfaces. Thus, system descriptions may be de ned graphically using an