Timed CTL Model Checking in Real-Time Maude⋆ - IfI

34 D. Lepri, E. Ábrahám, and P. Cs. Ölveczky
Fig. 5: A Ptolemy II DE model of the railroad crossing benchmark.
6.2 Ptolemy II Discrete Event Models
As mentioned, Real-Time Maude provides a formal analysis tool for a set of modeling
languages for embedded systems, including Ptolemy II discrete-event (DE)
models. Ptolemy II [16] is a well-established modeling and simulation tool used
in industry that provides a powerful yet intuitive graphical modeling language.
Our model checker has been integrated into Ptolemy II by Kyungmin Bae, so
that we can now model check TCTL properties of Ptolemy II DE models from
within Ptolemy 12 . We show the TCTL analysis of the railroad crossing and the
hierarchical traffic light existing Ptolemy II models. In this second case study,
our model checking has uncovered a previously unknown flaw in the model.
Railroad Crossing Model Figure 5 shows the Ptolemy II model of the well
known railroad crossing benchmark. In this model, a train approaches a railroad
crossing, and a gate should be lowered when a train is in the intersection. The
12 Real-Time Maude verification commands can be entered into the dialog box that
pops up when the button “Double click to generate code” in Fig. 6 is clicked.