Abstract
There is a general consensus on the importance of good requirements engineering for achieving high-quality software. Functional requirements capture the intended behavior of the system in terms of services, tasks, or functions the system is required to perform, while non-functional requirements capture required properties of the system, such as timing, performance, and security. These non-functional requirements play a crucial role during system development life cycle serving as selection criteria for choosing among myriads of design decisions. The ability to model and validate the system non-functional properties at the requirements level supports the detection of design errors during the early stages of a software development life cycle and helps reduce the cost of later redesign activities. The widespread interest in time modeling and analysis techniques at the requirements phase provides the major motivation for this research. This paper presents a novel and fully automated approach to describe and validate high-level timed requirements using the Timed Use Case Maps language. We extend the, ITU-T standard User Requirements Notation, Use Case Maps metamodel with time requirements. The resulting extensions are implemented within the jUCMNav tool and formalized using Abstract State Machines allowing for automated simulation and analysis. We illustrate the applicability of our approach using a business process model (conference review process model) and a real-time system model (IP multicast routing case study).


























Similar content being viewed by others
Notes
For a detailed description of IP multicast scenarios, the reader is invited to consult [40]
References
Alur R, Dill DL (1994) A theory of timed automata. Theor Comput Sci 126(2):183–235. doi:10.1016/0304-3975(94)90010-8
Amyot D (1994) Formalization of timethreads using LOTOS. Master’s thesis, University of Ottawa, Ottawa, Ontario, Canada
Amyot D, Andrade R (1999) Description of wireless intelligent network services with Use Case Maps. In: SBRC’99: 17th Brazilian Symposium on Computer Networks, Salvador, Brazil
Amyot D, Bordeleau F, Buhr RJA, Logrippo L (1995) Formal support for design techniques: a timethreads-LOTOS approach. In: FORTE, pp 57–72
Amyot D, Hart N, Logrippo L, Forhan P (1998) Formal specification and validation using a scenario-based approach: The GPRS group-call example. In: Selic B (eds) ObjecTime workshop on research in OO real-time modeling., Ottawa, Canada
Amyot D, Mussbacher G (2011) User Requirements Notation: the first ten years, the next ten years (invited paper). JSW 6(5):747–768
Amyot D, Roy JF, Weiss M (2005) Ucm-driven testing of web applications. In: Proceedings of the 12th international conference on Model Driven, SDL’05. Springer, Berlin, pp 247–264
Andrade R (2000) Applying Use Case Maps and formal methods to the development of wireless mobile ATM networks
Apvrille L, Courtiat JP, Lohr C, de Saqui-Sannes P (2004) TURTLE: a real-time UML profile supported by a formal validation toolkit. IEEE Trans Softw Eng 30(7):473–487. doi:10.1109/TSE.2004.34
AsmL (2009) Microsoft research: the abstract state machine language. http://research.microsoft.com/en-us/projects/asml/. Last accessed, Dec 2013
Ball T (1999) The concept of dynamic analysis. In: Proceedings of the 7th European software engineering conference held jointly with the 7th ACM SIGSOFT international symposium on Foundations of software engineering, ESEC/FSE-7. Springer, London, pp 216–234
Blass A, Gurevich Y (2008) Abstract state machines capture parallel algorithms: correction and extension. ACM Trans Comput Logic 9(3):19–11932. doi:10.1145/1352582.1352587
Börger E, Stark RF (2003) Abstract state machines: a method for high-level system design and analysis. Springer-Verlag New York, Inc., Secaucus
Bornot S, Sifakis J (2000) An algebraic framework for urgency. Inf Comput 163(1):172–202. doi:10.1006/inco.2000.2999
Bornot S, Sifakis J, Tripakis S (1998) Modeling urgency in timed systems. In: Revised lectures from the international symposium on compositionality: the significant difference, COMPOS’97. Springer, London, UK, pp 103–129
Bowman H, Gomez R (2006) Concurrency theory—calculi and automata for modelling untimed and timed concurrent systems. Springer, Berlin
Braberman VA, Kicillof N, Olivero A (2005) A scenario-matching approach to the description and model checking of real-time properties. IEEE Trans Softw Eng 31(12):1028–1041
de Bruin H, van Vliet H (2003) Quality-driven software architecture composition. J Syst Softw 66(3):269–284. doi:10.1016/S0164-1212(02)00079-1
Buhr RJA, Elammari M, Gray T, Mankovski S (1998) Applying Use Case Maps to multi-agent systems: a feature interaction example. In: HICSS (6), pp 171–179
Cerone A, Maggiolio-Schettini A (1999) Time-based expressivity of timed petri nets for system specification. Theor Comput Sci 216(1–2):1–53. doi:10.1016/S0304-3975(98)00008-5
Chaochen Z, Hoare CAR, Ravn AP (1991) A calculus of durations. Inf Process Lett 40(5):269–276
Corradini F (2000) Absolute versus relative time in process algebras. Inf Comput 156(1-2):122–172. doi:10.1006/inco.1999.2821
Corradini F, Ferrari GL, Pistore M (2001) On the semantics of durational actions. Theor Comput Sci 269(1-2):47–82
Dietz C (1996) Graphical formalization of real-time requirements. In: FTRTFT ’96: Proceedings of the 4th International symposium on formal techniques in real-time and fault-tolerant systems. Springer, London, pp 366–384
Dwyer MB, Avrunin GS, Corbett JC (1999) Patterns in property specifications for finite-state verification. In: Proceedings of the 21st international conference on Software engineering, ICSE’99. IEEE Comput Soc Press, Los Alamitos, pp 411–420
Eshuis H (2002) Semantics and verification of UML activity diagrams for workflow modelling. Ph.D. thesis, University of Twente, Enschede, The Netherlands
Eshuis R, Wieringa R (2001) A formal semantics for UML activity diagrams—formalising workflow models. Technical report, University of Twente, Department of Computer Science, University of Twente
Farzan A, Madhusudan P (2008) Monitoring atomicity in concurrent programs. In: Proceedings of the 20th international conference on computer aided verification, CAV ’08. Springer, Berlin, pp 52–65 doi:10.1007/978-3-540-70545-1_8
Fenner W (1997) RFC 2236: Internet Group Management Protocol, version 2. URL ftp://ftp.internic.net/rfc/rfc2236.txt
Flake S (2003) Temporal OCL extensions for specification of real-time constraints. In: Workshop specification and validation of UML models for Real Time and Embedded Systems (SVERTS’03) at UML’03. San Francisco
Flake S, Mueller W (2002) A UML profile for real-time constraints with the OCL. In: UML ’02: Proceedings of the 5th International Conference on the unified modeling language. Springer, London, pp 179–195
Folmer E, van Gurp J, Bosch J (2003) Scenario-based assessment of software architecture usability. In: Proceedings of ICSE 2003 workshop on bridging the gaps between software engineering and human-computer interaction, pp 61–68. IFIP
Gorrieri R, Roccetti M, Stancampiano E (1995) A theory of processes with durational Actions. Theor Comput Sci 140(1):73–94
Grabowski V, Dietz C, Olderog ER (1998) Semantics for timed message sequence charts via constraint diagrams. In: Lahav Y, Wolisz A, Fischer J, Holz E (eds.) Proceedings of the 1st Workshop of the SDL Forum Society on SDL and MSC, Informatik-Bericht Nr. 104. Humbold-Universitaet zu Berlin/Germany, pp 251–260 (Juli 1998)
Guelfi N, Mammar A (2005) A formal semantics of timed activity diagrams and its promela translation. In: APSEC’05: Proceedings of the 12th Asia-Pacific Software Engineering Conference, pp 283–290. IEEE Comput Soc, Washington. doi:10.1109/APSEC.2005.7
Gurevich Y (1991) Evolving algebras. A tutorial introduction. Bull Eur Assoc Theor Comput Sci 43:264–284
Gurevich Y (1995) Evolving algebras 1993: Lipari guide. Oxford University Press Inc., New York, pp 9–36
Gurevich Y (2000) Sequential abstract-state machines capture sequential algorithms. ACM Trans Comput Logic 1(1):77–111. doi:10.1145/343369.343384
Harel D, Marelly R (2002) Playing with time: On the specification and execution of time-enriched lscs. In: MASCOTS ’02: Proceedings of the 10th IEEE International Symposium on modeling, analysis, and simulation of computer and telecommunications systems (MASCOTS’02). IEEE Computer Society, Washington, p 193
Hassine J (2008) Formal semantics and verification of Use Case Maps. Ph.D. thesis, Concordia University, Montreal, Canada
Hassine J (2009) Early Schedulability Analysis with Timed Use Case Maps. In: SDL’09: Proceedings of the 14th international SDL conference on design for motes and mobiles, pp. 98–114
Hassine J (2010) AsmL-based concurrency semantic variations for Timed Use Case Maps. In: Frappier M, Glässer U, Khurshid S, Laleau R, Reeves S (eds) ASM, Lecture Notes in Computer Science, vol 5977, Springer, Berlin, pp 34–46
Hassine J, Rilling J, Dssouli R (2005) Abstract operational semantics for Use Case Maps. In: Formal techniques for networked and distributed systems—FORTE 2005, 25th IFIP WG 6.1 International Conference, Taipei, Taiwan, Oct 2–5, pp 366–380
Hassine J, Rilling J, Dssouli R (2005) An ASM operational semantics for Use Case Maps. In: RE ’05: Proceedings of the 13th IEEE International Conference on requirements engineering (RE’05), Paris. IEEE Comput Soc, pp 467–468
Hassine J, Rilling J, Dssouli R (2006) Timed Use Case Maps. In: System analysis and modeling: language profiles, 5th International Workshop, SAM 2006, Kaiserslautern, Germany, May 31–June 2, 2006, revised selected papers, pp 99–114
Hassine J, Rilling J, Dssouli R (2007) Formal verification of use case maps with real time extensions. In: SDL 2007: design for dependable systems, 13th International SDL Forum, Paris, France, Sept 18–21, 2007, Proceedings, pp 225–241
Hassine J, Rilling J, Dssouli R (2009) Use Case Maps as a property specification language. Softw Syst Model 8(2):205–220. doi:10.1007/s10270-007-0076-6
Hassine J, Rilling J, Dssouli R (2010) An evaluation of timed scenario notations. J Syst Softw 83:326–350. doi:10.1016/j.jss.2009.09.014
Hennessy M, Regan T (1995) A process algebra for timed systems. Inf Comput 117(2):221–239. doi:10.1006/inco.1995.1041
ISO (1989) Information processing systems, osi: Lotos—a formal description technique based on the temporal ordering of observational behaviour
ITU-T (1996) Recommendation Z.120. Message sequence charts (MSC). Geneva, Switzerland
ITU-T (2010) Recommendation Z.151, User Requirements Notation (URN). URL http://www.itu.int/rec/T-REC-Z.151/en
Kim TH, Cha SD (2006) Timed high-level message sequence charts for real-time system design. In: System analysis and modeling: language profiles, 5th International Workshop, SAM 2006, Kaiserslautern, Germany, May 31–June 2, 2006, revised selected papers, pp. 82–98
Klose J, Wittke H (2001) An automata based interpretation of live sequence charts. In: TACAS 2001: Proceedings of the 7th International conference on tools and algorithms for the construction and analysis of systems. Springer, London, pp 512–527
Konrad S, Cheng BHC (2005) Real-time specification patterns. In: ICSE ’05: Proceedings of the 27th international conference on Software engineering, pp 372–381 doi:10.1145/1062455.1062526
Larsen KG, Pettersson P, Yi W (1997) UPPAAL in a nutshell. Int J Softw Tools Technol Transf 1(1–2):134–152
Lavazza L, Morasca S, Morzenti A (2005) A dual language approach to the development of time-critical systems. Electr Notes Theor Comput Sci 116:227–239
Le Maigat P, Hélouët L (2000) A (max,+) approach for time in message sequence charts. In: Boel R, Stremersch G (eds) Proceedings of the 5th workshop on discrete event systems., Kluwer Academic Publishers, Ghent, pp 83–92
Manna Z, Pnueli A (1996) Clocked transition systems. Technical report. Stanford University, Stanford
Meng-Siew N (1993) Reasoning with timing constraints in message sequence charts. Master’s thesis, University of Stirling, Scotland, U.K. (Aug 1993)
Merlin PM (1974) A study of the recoverability of computing systems. Ph.D. thesis, University of California, Irvine
Mussbacher G, Amyot D (2008) Assessing the applicability of use case maps for business process and workflow description. In: Proceedings of the 2008 International MCETECH Conference on e-Technologies, MCETECH ’08, pp. 219–222. IEEE Computer Society, Washington. doi:10.1109/MCETECH.2008.18
Nagappan M, Wu K, Vouk MA (2009) Efficiently extracting operational profiles from execution logs using suffix arrays. In: Proceedings of the 2009 20th International Symposium on Software Reliability Engineering, ISSRE ’09. IEEE Comput Soc, Washington, pp 41–50 doi:10.1109/ISSRE.2009.23
Nicollin X, Sifakis J (1992) An overview and synthesis on timed process algebras. In: Proceedings of the real-time: theory in practice, REX Workshop. Springer, London, pp 526–548
Ober I, Graf S, Ober I (2006) Validating timed UML models by simulation and verification. Int J Softw Tools Technol Transf 8(2):128–145. doi:10.1007/s10009-005-0205-x
OMEGA (2007) OMEGA consortium. webpage of the omega ist project. http://www-omega.imag.fr/. Last accessed, Dec 2013
OMG (2002) Response to the OMG RFP for schedulability, performance and time, v. 2.0. OMG document ad/2002-03-04
OMG (2007) MARTE OMG specification. A UML Profile for MARTE. Beta 1. OMG Adopted specification ptc/07-08-04
Ouimet M, Lundqvist K (2008) The timed abstract state machine language: abstract state machines for real-time system engineering. J Univ Comput Sci 14(12):2007–2033
Peiris M, Hill JH (2013) Adapting system execution traces to support analysis of software system performance properties. J Syst Softw 86(11):2849–2862. doi:10.1016/j.jss.2013.06.060
Petriu D, Amyot D, Woodside M (2003) Scenario-based performance engineering with ucmnav. In: Proceedings of the 11th international conference on System design, SDL’03. Springer, Berlin, pp 18–35
Petriu DC, Woodside CM (2002) Software performance models from system scenarios in Use Case Maps. In: TOOLS ’02: Proceedings of the 12th International Conference on computer performance evaluation, modelling techniques and tools. Springer, London, pp 141–158
Ramamritham K, Stankovic J (1994) Scheduling algorithms and operating systems support for real-time systems. Proc IEEE 82(1):55–67. doi:10.1109/5.259426
Ramchandani C (1974) Analysis of asynchronous concurrent systems by timed petri nets. Technical reports, Massachusetts Institute of Technology, Cambridge
Sinnott RO (2004) The formal, tool supported development of real time systems. In: SEFM ’04: Proceedings of the software engineering and formal methods, second international conference on (SEFM’04). IEEE Comput Soc, Washington, pp 388–395 doi:10.1109/SEFM.2004.43
SpecExplorer: microsoft research: Spec explorer tool. http://research.microsoft.com/en-us/downloads/b33add8c-6172-444d-b1b1-6a91323ad7cc/default.aspx(2006)
jUCMNav v5.4.0: jUCMNav Project (tool, documentation, and meta-model). http://jucmnav.softwareengineering.ca/jucmnav (2013), Last accessed, Dec 2013
Veanes M (2002) Modeling software: From theory to practice. In: FST TCS ’02: Proceedings of the 22nd Conference Kanpur on foundations of software technology and theoretical computer science. Springer, London, pp 37–46
Wilhelm R, Engblom J, Ermedahl A, Holsti N, Thesing S, Whalley D, Bernat G, Ferdinand C, Heckmann R, Mitra T, Mueller F, Puaut I, Puschner P, Staschulat J, Stenström P (2008) The worst-case execution-time problem: overview of methods and survey of tools. ACM Trans Embed Comput Syst 7:36:1–36:53. doi:10.1145/1347375.1347389
Wolf F, Mohr B (2003) Automatic performance analysis of hybrid mpi/openmp applications. J Syst Architect 49(10–11):421–439. doi:10.1016/S1383-7621(03)00102-4
Xu W, Huang L, Fox A, Patterson D, Jordan M (2008) Mining console logs for large-scale system problem detection. In: 3rd Workshop on tackling system problems with machine learning techniques (SysML08), pp. 1–6
Xuandong L, Meng C, Yu P, Jianhua Z, Guoliang Z (2001) Timing analysis of UML activity diagrams. In: UML 2001—The Unified modeling language, modeling languages, concepts, and tools, 4th International Conference, Toronto, Canada, Oct 1–5, 2001, Proceedings. Springer, London, pp. 62–75
Yi Z (2000) CNAP specification and validation: A design methodology using lotos and UCM. Master’s thesis, SITE, University of Ottawa, Canada
Zheng T, Khendek F (2002) An extension for MSC-2000 and its application. In: Telecommunications and beyond: the broader applicability of SDL and MSC, Third International Workshop, SAM 2002, Aberystwyth, June 24–26. Revised papers, pp. 221–232
Zheng T, Khendek F, Hélouët L (2002) A semantics for timed msc. Electr Notes Theor Comput Sci 65(7):85–99
Author information
Authors and Affiliations
Corresponding author
Appendices
Appendix: 1 ASM-based TUCM semantics
1.1 Timed OR-fork interleaving ASM rule
If the control is on the incoming connection of a timed OR-fork, the conditions are evaluated and the control passes to the connection associated with the true condition. If more than one condition evaluates to true (i.e., non-deterministic choice), the control passes randomly to one of the outgoing connections associated with the true conditions. Note that, in such a case, the selected outgoing edge might not lead to the successor construct with the least delay. Indeed, the branching decision is made based on the local evaluation of the timed OR-Fork conditions and no prior knowledge of successor nodes incurred delays is assumed. The set active is updated by removing the incoming connection in (with its associated delay) and by adding out k (with its corresponding delay) that corresponds to the true condition Cond k . Lock situations (i.e., none of the conditions evaluate to true) are reported to the user. Figure 27 illustrates the OR-fork ASM rule.
1.2 Timed OR-join interleaving ASM rule
When one or many flows reach an OR-join (i.e., \(\exists\,in_{i}\,\in\) active), the master clock is incremented by the value of the actual delay and by the value of the actual execution time, then the control passes to the outgoing connection out. Figure 28 illustrates the OR-join ASM rule.
1.3 Timed AND-join interleaving ASM rule
When all incoming connections of an AND-join are active (i.e., \([in_{i}]_{i \leq n}\,\subseteq\) in(active)), the master clock is incremented by the value of the actual delay then by the value of the actual execution time. The incoming parallel flows are joined and the control passes to the outgoing connection out. The set active is updated by removing the connections out i (along with their associated delays) and by adding the incoming connection in with its associated delay. Figure 29 illustrates the AND-join ASM rule.
1.3.1 Timer interleaving ASM rule
If the control flow reaches a Timer, the continuation of the scenario on the regular path (i.e., out_rp) depends on the arrival of a trigger event (i.e., trigger = true) before the timer period expiry (i.e., tocc < timerPeriod), otherwise the timeout path (i.e., out_top) is taken. Figure 30 illustrates the timer ASM rule.
1.4 Stub interleaving ASM rule
The stub concept allows for hierarchical decomposition of complex TUCM maps. The TUCM path details can be hidden in separate sub-diagrams called plug-ins, contained in stubs (diamonds) on a path. No time constraints are defined for stubs since a stub is a simple container for plug-ins and the execution of a stub is simply the execution of one of its plug-ins. Once the control reaches a stub, the control passes to the selected plug-in and the execution continues following the TUCM semantics. The set of active connections is updated by adding the incoming connection of the selected plug-in map and by removing the connection entry k from which the control reached the stub. Figure 31 illustrates the stub ASM rule.
1.5 Timed end point interleaving ASM rule
When the control reaches an end point, post-conditions (a list of conditions that must be satisfied once the scenario is completed) are evaluated and if satisfied, the master clock is incremented by the computed delay. Four cases have to be considered, depending on whether the end point is connected to a start point (called a waiting place) and whether it is inside a plug-in map or part of the root map (i.e., the main TUCM map):
-
1.
If the end point is part of the root map (i.e., inRootMap = true) and it is not connected to a start point (i.e., out = undefConn), then the incoming connection is removed from the set of active connections and the master clock is incremented by the computed duration.
-
2.
If the end point is part of the root map and it is connected to a start point (i.e., a waiting place), then the incoming connection is removed from the set of active connections, the master clock is incremented by the computed duration, and the control passes to the outgoing connection by adding out to the set of active connections.
-
3.
If the end point is part of a plug-in and it is bound to a stub exit point (i.e., StubBinding(out) < > undefConn), then out is added to the set of active connections.
-
4.
If the end point is part of a plug-in but it is not bound to a stub exit point, then the incoming connection is removed from the set of active connections and the master clock is incremented by the computed duration.
Figure 33 illustrates the ASM interleaving semantics rule of timed end points.
Appendix 2: TUCM-AsmL simulation engine utility methods
Figure 32 illustrates an excerpt of the AsmL implementation of some utility methods that are common to three concurrency variants.
Appendix 3: AsmL implementation of the simulation engine
Since our focus is on time and concurrency variations, we only illustrate the AsmL rules of responsibilities (durative and involving delay) and AND-forks (used to split a single flow into many concurrent flows).
3.1 AsmL implementation of the interleaving semantics
Figures 33 and 34 illustrates an excerpt of the AsmL implementation of the interleaving semantics.
3.2 AsmL implementation of the true concurrency semantics
The activ data structure, presented in Fig. 34, is slightly modified to include responsibility’s remaining execution time (i.e., remExecTime). At each step, the master clock MClock is incremented by 1, all active delays greater than 0 are decremented by 1, and constructs reaching a delay equal to zero are selected for execution (Fig. 35).
3.3 AsmL Implementation of the run-to-completion semantics
Figure 36 illustrates an excerpt of the AsmL implementation of the run-to-completion multi-agent variant. When the control reaches an AND-fork, the currently running agent creates new subagents (e.g., let ag = new Agent("Agent-" + z.edge, z.edge, running, me.level, me.current_Stub)) and sets their mode to running, then sets its own mode to inactive. Each new subagent inherits the program for executing timed UCMs (e.g., ag.Program()), and its control starts at the associated outgoing edge of the AND-fork. The order of activation of subagents depends on the delay associated with the subsequent timed UCM constructs of each subagent (i.e., the subagent with the minimal delay is activated first). Each agent runs to completion (i.e., till it reached an end point or an AND-join) before the next agent starts executing.
Rights and permissions
About this article
Cite this article
Hassine, J. Early modeling and validation of timed system requirements using Timed Use Case Maps. Requirements Eng 20, 181–211 (2015). https://doi.org/10.1007/s00766-013-0200-9
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s00766-013-0200-9