PREPARATION

   1. Make sure that Java 6 or later is installed on your system.

   2. Visit http://www.it.uu.se/research/group/darts/uppaal/download to download
   the UPPAAL model checker. Unfortunately, a free registration is required to 
   use the tool in an academic context. However, the information entered is 
   used for registration purposes only and will not be available to us as the 
   authors of the submission under review.

   3. Unpack the downloaded ZIP archive and run "uppaal.jar" either by 
   double-clicking or by running "java -jar uppaal.jar" from the command-line 
   interface.

   4. To view failure traces in UPPAAL, you must enable diagnostic tracing. 
   In UPPAAL, click "Options -> Diagnostic Trace -> Some". 


DETECTION OF A TIMING CHANNEL

   5. IN UPPAAL, click "File -> Open System" and load the 
   "ManufacturingSystem.xml" file included in this archive. 
   The queries from file "ManufacturingSystem.q" will be loaded automatically.

   6. Switch to the "Verifier" tab and click "Check" to verify the 
   predefined query "A[] not Test.Err".

   7. In case you verified a failing query before, UPPAAL will open a dialog 
   telling you that "Storing the new trace in the simulator will destroy the 
   old one. Continue?". Please confirm.

   8. UPPAAL shows that the "Property is not satisfied", indicating that the 
   verified system is insecure. Switch to the "Simulator" tab to inspect the 
   failing execution trace that represents the timing channel described 
   in our paper.


MITIGATION OF THE TIMING CHANNEL

   9. Now load a secure version of the model that mitigates the detected timing 
   channel as described in our paper. Therefore, click "File -> Open System" 
   and load the "ManufacturingSystemMitigated.xml" file included in this 
   archive. The queries from file "ManufacturingSystemMitigated.q" will be 
   loaded automatically.

   10. Again, switch to the "Verifier" tab and click "Check" to verify the same 
   query again.

   11. Now UPPAAL will show that the "Property is satisfied", indicating 
   that the system is secure because the timing channel has been mitigated 
   correctly.
   