Real-time Concepts for a Formal Specification Language for Software / Hardware Systems

Transcription

1 1 Rel-time Concepts for Forml Specifiction Lnguge for Softwre / Hrdwre Systems M.C.W. Geilen nd J.P.M. Voeten Abstrct Incresingly complex systems re being designed tht consist of concurrently operting nd communicting processes, often combining both hrdwre nd softwre. A methodology for high level specifiction nd design of softwre/ hrdwre systems (SHE [1]) hs been designed to cope with this incresing complexity. SHE incorportes forml specifiction lnguge nmed POOSL. Mny systems tody cn be chrcterised s rel-time. The timing properties of such reltime system determine the correctness of n implementtion. This pper describes the extension of the lnguge POOSL with notion of time nd with rel-time primitives, which enble it to specify nd model timing properties. Concepts nd spects relted to timing nd concurrency re discussed nd options for introducing time nd dding temporl mening to existing elements of the lnguge re investigted. The lnguge POOSL nd its forml semntics hve been extended with notion of time nd new primitive hs been dded. It is shown tht this extension enbles the expression of typicl forms of temporl behviour such s execution time, time-out behviour, etceter. POOSL cn thus be used s forml bsis for specifying nd designing rel-time systems within the SHE methodology. Keywords Rel-time systems, concurrency, forml specifiction, process lgebrs. I. Introduction Tody, mny complex informtion-processing systems need to be designed. These systems often consist of distributed concurrently operting processes, implemented in mix of hrdwre nd softwre. The incresing complexity mkes these systems very hrd to design using existing methods. An object-oriented specifiction nd design methodology SHE (Softwre Hrdwre Engineering [1]) hs been developed for concurrent rective softwre/ hrdwre systems. This methodology contins both informl grphicl meth- Section of Informtion nd Communiction Systems, Fculty of Electricl Engineering, Eindhoven University of Technology, P.O.Box 513, 5600 MB Eindhoven, The Netherlnds. E-mil: geilen@ics.ele.tue.nl ods nd n executble forml high-level specifiction lnguge POOSL (Prllel Object Oriented Specifiction Lnguge). Using this methodology, system s specifiction is grdully refined from informl grphicl representtions to rigorous forml model, expressed in POOSL. POOSL hs forml opertionl semntics. Its rigorous model enbles the use of forml methods nd utomted tools. Mny rective softwre/ hrdwre systems cn be chrcterised s rel-time systems. The timing of such system s response is eqully importnt to its correctness s its functionl behviour. Typicl properties of rel-time systems include timeliness, relibility, sfety, etceter [2]. To llow the specifiction of timing behviour in POOSL, the lnguge nd its semntics hve been extended with notion of time nd with new opertor for expressing temporl behviour. This opertor in combintion with existing primitives llows the expression of typicl forms of timing behviour, such s delys, time-outs etceter. In section II, the requirements for rel-time specifiction lnguge re discussed. Section III describes the semntics of process lgebrs, upon which the definition of the semntics of POOSL is bsed. Section IV discusses some concepts of time, which determine the implementtion of the lnguge extension. This extension is shown in section V. Some exmples of the expressiveness of the extended lnguge re given in section VI. II. Requirements for rel-time lnguge In this section, the requirements re discussed for n extension of the lnguge with concept of time. In [3] the following requirements re given for n extension, with respect to mintining the vlidity of non rel-time specifictions inside the extended model: Extension. The originl lnguge of untimed specifictions should form subset of the extended lnguge. All existing specifictions in the originl lnguge should still be vlid specifictions in the extended one.

2 2 Semntics conservtion. Untimed specifictions should lso mintin their mening in the new lnguge. Isomorphism. Specifictions should be equivlent in the originl lnguge if nd only if they re equivlent under the new interprettion. This ensures tht ll existing results nd tools remin vlid s long s they re pplied to untimed specifictions. Since the lnguge is lso used to communicte with non-experts, redbility nd understndbility of the new concepts re very importnt. It should furthermore be expressive enough to model typicl time relted behviour of the system. For instnce: Performnce nlysis. The lnguge should be ble to model time relted performnce spects, such s modelling execution time nd stochstic timing behviour. Time-outs. A time-out limits the mount of time system will wit for some event to occur. For exmple to specify mximum witing time for receiving messge. Wtchdogs. A wtchdog limits the mount of time vilble for performing some ctivity, offering the possibility for lterntive behviour if this dedline is not met. More requirements cn be deduced from the context in which the lnguge will be used. It should for instnce be executble or nlysble in resonbly efficient mnner, in order to be ble to build useful tools. III. Semntics In order to discuss n extension of the lnguge nd its semntics, some insight in process lgebrs nd their semntics is required. POOSL combines model of communiction nd concurrency, which is bsed on the process lgebr CCS [4], with impertive sequentil dt objects, bsed on object-oriented lnguges like C++ or Smlltlk-80 [5]. The semntics of the process prt of POOSL re defined in mnner similr to the definitions of mny process lgebrs. However, POOSL is more thn process lgebr, it lso contins vribles, dt objects, nd mny more concepts which re not present in simple process lgebrs. This complictes the definition of the semntics of POOSL. This complexity however is not required to understnd the principles behind the extension with time. We will therefore use simplified process lgebr-like nottions, which re esier to red. In this pper only very brief introduction to process lgebrs cn be given. For more informtion on (timed) process lgebrs, the reder is referred to [6] nd [7]. A process lgebr is usully defined lbelled trnsition system, triple (P roc, Act, { Act}) where P roc is set of syntcticlly vlid process descriptions defined by grmmr such s P = SKIP P P +P P P P \L P [f] is n element of the set of ctions Act, L is subset of Act nd f is function Act Act. { Act} is set of reltions P roc P roc tht indicte possible ctions of processes. P Q mens tht process P my perform ction nd will further behve s process Q. The set of processes is defined by some primitive processes such s SKIP, which does nothing, or which could indicte the behviour of successfully terminted process, nd by opertors to construct new processes. Possible opertors re: Prefixing. A process tht cn perform n ction cn be written s P. This ctivity could be communiction, synchronous or synchronous, or some internl ctivity. After performing, it will behve s P. Alterntive. Process lgebrs usully contin some form of choice opertor, the exct semntics of which my vry. P + Q cn behve s P or s Q, depending on the environment or on some internl decision. Prllel composition. It is possible to crete new processes by considering the concurrent ctivities of two processes nd by llowing them to communicte. The usul nottion is P Q. Other opertors cn include hiding (P \L is not llowed to perform ctions from the set L), relbelling of chnnel nmes (P [f]), sequentil composition, recursion, etceter. The trnsition reltions, which determine the mening of the opertors, re defined s the smllest reltions tht comply with set of xioms nd rules. An xiom could for instnce be P P for ny Act nd P P roc. It defines the mening of the prefix opertor. Rules re usully written in

3 3 the form condition result mening tht if the condition holds thn the result is lso vlid. The choice opertor cn be defined by the rules: P P P + Q P Q Q P + Q Q The first rule sttes tht P + Q cn behve like P, nd the lst one tht it cn behve like Q. There is one element of Act, denoted s τ, which represents specil kind of ction. It denotes the silent ction. It is n internl ction nd cnnot be observed by the environment. Prllel composition cn be defined by the rules: P P P Q P Q Q Q P Q P Q P P Q Q ā P Q P τ Q The first two rules define tht both concurrent processes cn operte independently. The third sttes tht concurrent processes cn communicte (synchronously) if they cn perform comptible ctivities (indicted by nd ā). The result is silent ction nd is externlly not observble. P P L P \L P \L defines the semntics of the hiding opertor. In P \{} communiction cn only tke plce inside P nd not with the environment of P. Relbelling of ctions is possible using the relbelling opertor nd function f : Act Act which modifies the lbels of the ctions tht P cn perform: P P f() P [f] P [f]\l A process description cn perform certin sequences of ctions. The behviour of process consists of ll possible interctions it cn hve with the environment. In this wy it is defined wht ctions process my perform. This description however, does not tell us nything bout when these ctions re being performed. In order to dd such timing informtion, some existing process lgebrs hve been extended with notion of time, such s TeCCS [8], TCSP [9], ATP [10] nd ACP ρ [11]. IV. Timing concepts In this section, concepts of time nd their impct on the implementtion of the rel-time semntics re discussed. Abstrction nd non-determinism. Models re bstrctions of relity. With the informtion lost in the bstrction, non-determinism is introduced. In model without time, this results in rbitrry interleving of ctions: b c cn result in ny of the following sequences of ctions b c, c b, b c, b c, c b nd c b If, b nd c re executed by three concurrent processes, then ny order of execution will be possible. As the number of concurrent ctions increses, the number of possibilities grows exponentilly. Adding notion of time to model removes prt of the bstrction of time nd yields model with less non-determinism nd thus less possible execution trces. It llows correltion of speeds of different components nd ssigning time to n execution step or sequence of ctions. Asynchronous vs. synchronous. Models for concurrent systems should not mke ny ssumptions bout the reltive speeds of concurrently operting processes. Therefore, model in which processes perform their ctions synchronously is most pproprite. In most synchronous lnguges concurrent ctivities re interleved: b = b + b If nd b re executed concurrently then they cn tke plce in ny order, but never t the sme time. Regrdless of speed however, ny notion of time is the sme for ll concurrent processes nd hs the nturl property to dvnce synchronously. Atomicity of ctions. Since the lnguge should be n extension of POOSL in which concurrency is modelled with interleving, concurrent ctions cnnot overlp in time. Therefore time cnnot dvnce during the execution of single tomic ction nd execution of tomic ctions cnnot tke time in the model. Drwbck of this bstrction is tht in relity, execution does tke time nd ctions cn overlp. This my cuse behviour, which is not cptured by the model. By modelling ctions tomiclly, it is still possible for two ctions to tke plce t the sme instnt (infinitesimlly close), but not concurrently. This is shown in figure 1, which shows sequence of ctions occurring sequentilly t the sme instnt in time. Two phse execution. The stte of system cn chnge either by synchronously executing some

4 A 4 t' t t'' forced to mke mximl progress. If they cn perform some ctivity, they will not be llowed to let time pss before doing so. t-δ t Fig. 1 Asynchronous ctions t the sme instnt tomic ction (tking no time) or by letting time pss (synchronously). This results in n lterntion of synchronous nd synchronous phses in which processes perform ctivity (without time dvncing), respectively let time pss together (see figure 2 [3]). t+δ V. Implementtion In this section, the implementtion of the lnguge extension is discussed. In this pper, it is not possible to show the complete implementtion. Detils re given in [12]. A new reltion is dded indicting whether process is llowed to let certin mount of time pss: d P Q holds if process P cn wit for d units of time nd then behve s Q. A process cn thus perform observble ctions, silent ctions or it cn wit. A new primitive is needed for quntittive timing specifiction: the dely sttement llows process to inctively wit specified mount of time. Its semntics re defined by the xioms (d < d): dely d dely d d d dely d d F D = I A =? J E I F D = I A J E F D = I A =? J E I Fig. 2 Two-phse execution model Time domin. The syntx or semntics of some lgebrs explicitly require discrete time domin (for exmple N). Other lgebrs cn use ny time domin (dense or discrete) with the properties tht it hs n ddition opertor (+) nd totl pre-order ( ) s well s lest element (0). For instnce Q +, R +, or non-archimeden domins (like δ-times in VHDL) re dense time models. The opertionl semntics llows ny time-domin to be used which hs the mentioned properties. Some cre hs be tken tht the lnguge remins executble, e.g. tht the instnce of the next event cn be efficiently computed. Progress nd urgency. In the extended lnguge some processes cn perform ctivity nd some processes cn let time pss. In order to gurntee tht possible ctions ctully do occur, processes must be The dely d sttement cn wit for totl of d units of time, fter which it termintes. It is further necessry to define the mening of existing primitives in the context of time. A few exmples will be given here. The choice opertor cn wit (nd postpone decision) if nd only if both lterntives cn wit. P P d Q Q d P or Q P d or Q Note tht in this wy mximl progress is mintined. If the lterntives cnnot wit unnecessry, then neither cn the choice sttement. If one lterntive cn terminte by witing, the choice opertor cn terminte s well, disbling the other lterntive. P d Q Q d P or Q d P d P Q d P or Q d The semntics should ensure mximl progress, but progress cnnot be enforced on the environment. In POOSL, communiction is synchronous rendezvous. If process wnts to communicte, the environment cnnot be forced to produce n opportunity for communiction. Therefore the communiction sttements

5 5 should be llowed to wit for prtner (ch?m denotes receive sttement, nd ch?m send sttement). ch?m d ch?m ch!m d ch!m As stted in the previous section, time should dvnce synchronously in ll concurrent processes. The semntics of the prllel composition opertor ensures this: P P d Q Q d P Q P d Q The prllel composition opertor furthermore introduces communiction. Since the individul send nd receive sttements re not forced to mke progress, the opertor should mke communiction urgent. Therefore, n extr condition is necessry for the rule bove: P P d Q Q d Urgent (P, Q, d) P Q P d Q P Q my only wit if P nd Q my both wit nd if P nd Q will not be ble to communicte within d time-units. The lst condition is expressed by Urgent (P, Q, d), the definition of which will not be given here). The interrupt nd bort sttements of POOSL re semnticlly relted to the choice opertor. Their temporl behviour is therefore lso modelled fter the choice opertor. For instnce the semntics of the bort. P P d Q Q d P bort Q P d bort Q P d Q Q d P bort Q d P d P Q d P bort Q d There re more rules to define time in the context of sequentil composition, gurded commnds nd the interrupt sttement. The following section will show tht the dely sttement gives in combintion with existing POOSL primitives, the desired expressive power. The clim tht this extension stisfies the requirements expressed in section II is further discussed in [12]. VI. Exmples We will now show some exmples of how the extended lnguge cn be used to express typicl reltime properties/ requirements of systems. A. Performnce nlysis The extended lnguge cn be used for time-relted performnce nlysis. Exmple 1 (from [13]) shows the behviour of chnnel tht ccepts messges nd delivers them fter some rndom dely, with distribution defined by the vrible trnsitiontimedistr. Exmple 1: Performnce nlysis trnsfer()() dt: DtPcket in?pcket(dt); pr dely trnsitiontimedistr next; out!pcket(dt) nd trnsfer()() rp. In this so-clled process method, trnsfer()() is the nme of n instnce method of the clss of the chnnel object. dt: DtPcket defines dt s locl vrible of type DtPcket. in?pcket(dt) is executed when DtPcket is received on chnnel in nd the pcket is stored in locl vrible dt. Subsequently, the behviour is strted gin (trnsfer()()), concurrently with rndom dely (dely trnsitiontimedistribution next) followed by the sending of the pcket on chnnel out. B. Time-outs Another populr timing construct is time-out. A process my wnt to wit only limited mount of time for some event to occur, e.g. the reception of messge. This kind of behviour cn be expressed by combining the dely with the or sttement. Exmple 2: Time-out FetchInput()(Sttus, Vlue) chnnel!inputrequest; sel chnnel?getinput(vlue); Sttus := OK or dely 20; Sttus := TimeOut les.

6 6 The process of exmple 2 will send messge inputrequest nd will subsequently wit for response getinput. If this messge does not rrive within 20 time-units, the other lterntive is chosen nd Sttus will be set to the vlue TimeOut, which indictes tht time-out hs occurred on the reception of getinput. C. Dedlines A dely sttement cn be combined with n bort sttement to crete so-clled wtchdog construction. With wtchdog, piece of behviour cn be executed with limit on its durtion. If the behviour hs not finished within the specified time, it is borted nd lterntive behviour (for exmple some error hndling) is strted. Exmple 3: Wtchdog TimeCriticlComputtion()() docomputtion()() bort (dely Dedline; ErrorHndling()()). Exmple 3 shows procedure in which the execution of the procedure docomputtion()() is not llowed to tke more thn Dedline units of time. If it does not terminte before tht, the procedure ErrorHndling()() is clled. VII. Conclusion The high-level specifiction lnguge POOSL hs been extended with notion of time. Aspects of time tht hve guided the extension hve been discussed. The implementtion of the rel-time semntics is explined. It hs been shown tht the extension of the lnguge with timing nd with new primitive opertor dely llows the expression of typicl forms of temporl behviour. This mkes POOSL suitble lnguge for specifiction nd design of rel-time rective systems. VIII. Future Reserch The new POOSL lnguge llows the designer to specify rel-time system in n impertive style. The POOSL description is executble nd the behviour of POOSL specifiction cn be vlidted by executing the specifiction using simultion tool. This vlidtion needs to be done mnully by inspecting the simultion results. A simultion tool is vilble. More tools should become vilble however, to support the process of verifying the correctness of specifiction. A lnguge is to be creted in which desired properties of the system cn be formlly expressed. This lnguge could then be used to utomticlly verify these properties during simultion, or s bsis for other verifiction tools. A tool to support performnce nlysis is useful during the design spce explortion, to estimte performnce of suggested implementtions. References [1] P.H.A. vn der Putten nd J.P.M. Voeten, Specifiction of Rective Hrdwre / Softwre Systems, Ph.D. thesis, Eindhoven University of Technology, Deprtment of Electricl Engineering, [2] A. Burns nd A. Wellings, Rel-Time Systems nd their Progrmming Lnguges, Addison Wesley, [3] X. Nicollin nd J. Sifkis, An overview nd synthesis on timed process lgebrs, in Proc. CAV 91 3rd Interntionl Workshop Computer Aided Verifiction, Ålborg, Denmrk, July 1991 (LNCS 575), K. Lrsen nd A. Skou, Eds., Berlin, 1992, pp , Springer Verlg. [4] R. Milner, A clculus of communicting systems, in Lecture Notes in Computer Science Vol.92. Springer Verlg, Berlin, [5] J.P.M. Voeten, Semntics of POOSL: n Object-Oriented specifiction lnguge for the nlysis nd design of hrdwre / softwre systems, Tech. Rep. EUT Report 95-E- 293, Eindhoven University of Technology, Deprtement of Electricl Engineering, october [6] R. Milner, Communiction nd Concurrency, Prentice Hll, Englewood Cliffs, New Jersey, [7] M. Hennessy, Timed process lgebrs: A tutoril, in Progrm Design Clculi. Proceedings of the NATO Advnced Study Institute. Mrktoberdorf, Germny 28 July-9 Aug 1992, M. Broy, Ed., Berlin, 1993, pp , Springer Verlg. [8] F. Moller nd C. Tofts, A temporl clculus of communicting systems, in CONCUR 90 Theories of Concurrency: Unifiction nd Extension Proc. Amsterdm, The Netherlnds Aug. 1990, Lecture Notes in Computer Science V.458, J.C.M. Beten nd J.W. Klop, Eds., Berlin, 1990, pp , Springer Verlg. [9] J. Dvies, D.M. Jckson, G.M. Reed, J.N Reed, A.W. Roscoe, nd S.A. Schneider, Timed CSP: theory nd prctice, in Rel-Time Theory in Prctice. REX Workshop Proceedings Mook, the Netherlnds 3-7 June 1991, J.W. de Bkker, C. Huizing C, W.P. de Roever, nd G. Rozenberg, Eds., Berlin, 1992, pp , Springer Verlg. [10] X. Nicollin nd J. Sifkis, The lgebr of timed processes, ATP: theory nd ppliction, Informtion nd Computtion, vol. 144, no. 1, pp , [11] J.C.M. Beten nd J.A. Bergstr, Discrete time process lgebr, Tech. Rep. P9208b, University of Amsterdm, progrmming reserch group, december [12] M.C.W. Geilen, Rel-Time concepts for Softwre/Hrdwre engineering, M.S. thesis, Fculty of Elec-

7 tricl Engineering, Eindhoven University of Technology, Eindhoven, The Netherlnds, [13] J.P.M. Voeten, P.H.A. vn der Putten, M.P.J. Stevens, nd M.C.W. Geilen, Forml modelling of rective hrdwre / softwre systems, in Proceedings of ProRISC 1997,