Verificação de modelos é uma das mais eficientes técnicas de verificação automática de sistemas. No entanto, apesar de poder lidar com verificações complexas, as ferramentas de verificação de modelos usualmente não fornecem informação alguma sobre como reparar inconsistências nestes modelos. Nesta dissertação, mostramos que abordagens desenvolvidas para a atualização de modelos CTL inconsistentes não são capazes de lidar com todos os tipos de alterações em modelos. Introduzimos então o conceito de revisão de modelos: uma abordagem baseada em revisão de crenças para o reparo de modelos inconsistentes em um contexto estático. Relacionamos nossa proposta com trabalhos clássicos em revisão de crenças. Definimos um operador de revisão de modelos e mostramos que este obedece postulados de racionalidade clássico de revisão de crenças. Propomos um algoritmo de revisão com base no algoritmo utilizado pela abordagem de atualização de modelos. Discutimos sobre problemas e limites do algoritmo proposto, e mostramos que essa estratégia de adaptação não é uma solução apropriada. / Model checking is one of the most robust techniques in automated system verification. But, although this technique can handle complex verifications, model checking tools usually do not give any information on how to repair inconsistent system models. In this dissertation, we show that approaches developed for CTL model update cannot deal with all kinds of model changes. We introduce the concept of CTL model revision: an approach based on belief revision to handle system inconsistency in a static context. We relate our proposal to classical works on belief revision. We define an operator for model revision and we show that it obeys the classical rationality postulates of belief revision. We propose an algorithm for model revision based on the algorithm used by the model update approach. We discuss problems and limitations of our proposed algorithm and show that this strategy of adaptation is not an appropriate solution.

Verificação de modelos é uma das mais eficientes técnicas de verificação automática de sistemas. No entanto, apesar de poder lidar com verificações complexas, as ferramentas de verificação de modelos usualmente não fornecem informação alguma sobre como reparar inconsistências nestes modelos. Nesta dissertação, mostramos que abordagens desenvolvidas para a atualização de modelos CTL inconsistentes não são capazes de lidar com todos os tipos de alterações em modelos. Introduzimos então o conceito de revisão de modelos: uma abordagem baseada em revisão de crenças para o reparo de modelos inconsistentes em um contexto estático. Relacionamos nossa proposta com trabalhos clássicos em revisão de crenças. Definimos um operador de revisão de modelos e mostramos que este obedece postulados de racionalidade clássico de revisão de crenças. Propomos um algoritmo de revisão com base no algoritmo utilizado pela abordagem de atualização de modelos. Discutimos sobre problemas e limites do algoritmo proposto, e mostramos que essa estratégia de adaptação não é uma solução apropriada. / Model checking is one of the most robust techniques in automated system verification. But, although this technique can handle complex verifications, model checking tools usually do not give any information on how to repair inconsistent system models. In this dissertation, we show that approaches developed for CTL model update cannot deal with all kinds of model changes. We introduce the concept of CTL model revision: an approach based on belief revision to handle system inconsistency in a static context. We relate our proposal to classical works on belief revision. We define an operator for model revision and we show that it obeys the classical rationality postulates of belief revision. We propose an algorithm for model revision based on the algorithm used by the model update approach. We discuss problems and limitations of our proposed algorithm and show that this strategy of adaptation is not an appropriate solution.

Die steigende Nachfrage an immer komplexeren Systemen in verschiedensten wirtschaftlichen Bereichen, erfordert Strategien, die Wartbarkeit und Wiederverwendbarkeit unterstützen. An diesem Punkt setzen service-orientierte Architekturen (SOAn) an. Dieses Paradigma fordert die Aufspaltung von Funktionalität in Services, die komponiert werden können, um eine gewünschte, komplexe Funktionalität zu erreichen. Besonders in sicherheitskritischen Bereichen, kann eine fehlerbehaftete Komposition jedoch zu hohen finanziellen Einbußen oder sogar zu lebensbedrohlichen Situationen führen. Um die Korrektheit sicherzustellen, müssen Kompositionsmethoden im Vorfeld definierte Eigenschaften garantieren und die, durch die unabhängige Entwicklung auftretenden, Interface-Inkompatibilitäten behandeln. Existierende Ansätze zur automatisierten Service-Komposition durch Controller-Synthese beinhalten jedoch keine formale Datenbehandlung und können daher nicht mit datenabhängigem Verhalten umgehen. In der vorliegenden Arbeit, löse ich dieses Problem durch die Bereitstellung eines Ansatzes zur automatisierten Synthese datenabhängiger, korrekter Service-Controller. Dabei wird ein Controller direkt aus den spezifizierten Anforderungen und dem Verhalten der Services erzeugt. Basierend auf den Annahmen, dass die Anforderungen in RCTL, einer Untermenge der Computational Tree Logic (CTL), spezifiziert und die Services als Algebraische Petrinetze (APNe) gegeben sind, vereinigt mein neuartiger Ansatz die beiden Formalismen und unterstützt eine zuverlässige Extraktion des Controller-Verhaltens. Durch die Nutzung der APNe, erlaubt der Ansatz eine formale Datenbehandlung und somit eine Betrachtung datenabhängigen Verhaltens. Die Anwendbarkeit meines Ansatzes habe ich an drei Fallstudien aus dem medizinischen Bereich gezeigt, wo Geräte sicher miteinander kommunizieren müssen. / The continuously increasing demand for more complex systems in various economical domains requires a strategy that supports maintainability and reusability. This is addressed by the service-oriented architecture (SOA)}-paradigm that encourages the encapsulation of functionality into services. To achieve a specific functionality, services can be composed. Especially in safety-critical systems, an incorrect composition of various components can lead to high financial losses or even life threatening situations. To ensure the correctness, composition methods must particularly be able to guarantee pre-specified requirements and to overcome interface incompatibilities, which result from the independent development of the single services. However, current approaches for automated service composition via controller synthesis do not support a formal data-treatment and do not cope with data-dependent behavior. In this thesis, we overcome this problem by providing an approach for the automated synthesis of data-dependent service controllers that are correct-by-construction. The core idea is to synthesize such a controller directly from given requirements and the behavior of the services. Based on the assumptions that the requirements are specified using a subset of Computational Tree Logic (CTL), called RCTL, and that the services are given as algebraic Petri Nets (APNs), our novel synthesis process unifies the two formalisms and enables a reliable extraction of the controller behavior. Especially due to the use of APNs, our approach supports a formal data-treatment and enables a consideration of data-dependent behavior. With our synthesis process, which is based on a successive combination of requirements and services, we provide a practical applicable approach that works fully automatically. We show the applicability of our approach using three case studies in which medical devices interact with each other.

Model checking is a powerful technique for analyzing reach ability and temporal properties of finite state systems. Model-checking finite state systems has been well-studied and there are well known efficient algorithms for this problem. However these algorithms may not terminate when applied directly to in finite state systems. Counter systems are a class of in fininite state systems where the domain of counter values is possibly in finite. Many practical systems like cache coherence protocols, broadcast protocols etc, can naturally be modeled as counter systems. In this thesis we identify a class of counter systems, and propose a new technique to check whether a system from this class satires’ a given CTL formula. The key novelty of our approach is a way to use existing reach ability analysis techniques to answer both \until" and \global" properties; also our technique for \global" properties is different from previous techniques that work on other classes of counter systems, as well as other classes of in finite state systems. We also provide some results by applying our approach to several natural examples, which illustrates the scope of our approach.