A Compositional Approach on Modal Specifications for Timed Systems

Transcription

1 A Compositionl Approch on Modl Specifictions for Timed Systems Nthlie Bertrnd 1, Axel Legy 1, Sophie Pinchint 2, nd Jen-Bptiste Rclet 3 1 INRIA Rennes, Frnce 2 IRISA & Université Rennes 1, Frnce 3 INRIA Rhône-Alpes, Frnce Abstrct. On the one hnd, modl specifictions re clssic, convenient, nd expressive mthemticl objects to represent interfces of component-bsed systems. On the other hnd, time is crucil spect of systems for prcticl pplictions, e.g. in the re of embedded systems. And yet, only few results exist on the design of timed component-bsed systems. In this pper, we propose timed extension of modl specifictions, together with fundmentl opertions (conjunction, product, nd quotient) tht enble to reson in compositionl wy bout timed system. The specifictions re given s modl event-clock utomt, where clock resets re esy to hndle. We develop n entire theory tht promotes efficient incrementl design techniques. 1 Introduction Nowdys, systems re tremendously big nd complex, resulting from the ssembling of severl components. These mny components re in generl designed by tems, working independently but with common greement on wht the interfce of ech component should be. As consequence, mthemticl foundtions tht llow to reson t the bstrct level of interfces, in order to infer properties of the globl implementtion, nd to design or to dvisedly (re)use components is very ctive reserch re, known s compositionl resoning [16]. In logicl interprettion, interfces re specifictions nd components tht implement n interfce re understood s models. Aiming t prcticl pplictions s the finl gol, the softwre engineering point of view nturlly leds to the following requirements for good theory of interfces. 1. Stisfibility/Consistency nd Stisfction. It should be decidble whether specifiction dmits model, nd whether given component implements given interfce. Moreover, for the synthesis of components to be effective, stisfible interfces should lwys hve finitely presentble models. This work ws funded by the Europen project COMBEST, IST-STREP

2 2. Refinement nd shred refinement. Refinement of specifictions [20, 23] expresses inclusion of sets of models, nd therefore llows to compre interfces. Relted to this impliction-like concept, the intersection, or gretest lower bound, is n optiml interfce refining two given interfces. 3. Compositionlity of the bstrction. The interfce theory should lso provide combintion opertor on interfces, reflecting the stndrd composition of models by, e.g. prllel product. 4. Quotient. Lst but not lest, quotienting opertion, dul to composition is crucil to perform incrementl design. Intuitively, the quotient enbles to describe prt of globl specifiction ssuming nother prt is lredy relized by some component. Together with the composition the quotient opertor enjoys the following fundmentl property t the component level: C 2 = S S 1 C 1 [C 1 = S 1 C 1 C 2 = S] ( ) where S, S i re interfces, C, C i components, nd = is the stisfction reltion. Building good interfce theories is the subject of intensive studies which hve led to theories bsed on models such s interfce utomt [12,14], modl utomt or specifictions [19,22 24,5], nd their respective timed extension [13, 9]. Modl specifictions re deterministic utomt equipped with trnsitions of the following two types: my nd must. The components tht implement such interfces re deterministic lbeled trnsition systems; n lterntive lngugebsed semntics cn therefore be considered, s presented in [22, 23]. Informlly, must trnsition is vilble in every component tht implements the modl specifiction, while my trnsition needs not to be. Modl specifictions re interpreted s logicl specifictions mtching the conjunctive nu-clculus frgment of the mu-clculus [15]. As corollry, but lso proved directly in [22], stisfction nd consistency of modl specifictions re decidble, nd the finite model property holds. Refinement between modl specifictions coincides with stndrd notion of lternting simultion. Since components cn be seen s specifictions where ll trnsitions re typed must (ll possible implementtion choices hve been mde), stisfction is lso expressed vi lternting simultion. Shred refinement is effectively computed vi product-like construction. Combintion of modl specifictions, hndling synchroniztion products à l Arnold nd Nivt [6], nd the dul quotient combintors cn be efficiently hndled in this setting [23]. Recently, timed extension of the theory of modl specifictions hs been introduced [9], motivted by the fct tht time cn be crucil prmeter in prctice, e.g. in embedded system pplictions. In this piece of work, components re timed utomt s defined in [1], nd nturlly, n effective nd expressive region-bsed semntics llows to combine modlities nd timing constrints. 2

3 In this pper, we build on this preliminry pper nd develop complete compositionl pproch for modl specifictions of timed systems. This frmework fvors methodologies for n incrementl design process: Assume globl system implementing specifiction S hs to be synthesized, nd ssume component implements interfce S 1. Computing S S 1 nd synthesizing model of S S 1 yields component tht, in -combintion with the component for S 1, will yield model for the globl interfce S, thnks to property ( ). As consequence, low complexity lgorithms re needed for computing product nd quotient, s well s for the stisfibility decision procedure. The synchronous product of timed objects requires tight control on clocks [1], nd so should its dul quotient. Actully, developing the theory in the generl frmework where components cn reset their clocks in n rbitrry mnner is difficult question. Indeed, computing the resets of clocks of product or of quotient depends on how the control of clocks is distributed mong the components. This informtion hs to be provided priori, which requires n extr formlism. We therefore restrict the presenttion to the clss of components definble by event-clock utomt [2]: in these timed utomt, resets re fully determined by the ctions. Interfces whose models re event-clock utomt re clled modl event-clock specifictions (mecs). Inheriting from the region-bsed semntics of timed modl specifictions [9], we study the stisfibility s well s the consistency problems for mecs. Stisfibility is PSPACE-complete, hence no hrder thn trditionl decision problems in the clss of timed utomt. Refinement serves s theoreticl bsis to develop the product nd the quotient of mecs. We propose two equivlent chrcteriztions of these opertions. Not surprisingly ccording to the semntics, inefficient EXPTIME constructions vi the region grphs of the mecs (seen s untimed specifictions) re provided. More interestingly, we present lterntive direct nd efficient PTIME constructions. The rest of the pper is orgnized s follows. In Section 2, we introduce the timed modl specifiction setting, with preliminries on untimed modl specifictions nd the definition of modl event-clock specifictions. Section 3 focuses on mecs nd exposes effective techniques to compute the binry opertions of gretest lower bound, product, nd quotient. In Section 4, we compre our frmework with the existing literture. Section 5 concludes the pper. A long version of the current pper, including proofs is vilble s reserch report [8]. 2 Timed modl specifictions In this section we recll the frmework of modl specifictions originly defined in [18] twenty yers go (see [5] for survey), nd its timed extension, recently proposed in [9]: We discuss the semntic, the preorder refinement nd the stisfibility problem for untimed nd timed modl specifictions. 3

4 2.1 Preliminries on untimed specifictions A modl specifiction is n utomton equipped with two types of trnsitions: must-trnsitions, tht re required nd my-trnsitions, tht re llowed. We fix Σ finite set of ctions. Definition 2.1 (Modl specifiction). A modl specifiction (ms) is tuple R = (P, λ 0, m, M ) where P = P is finite set of sttes with P =, λ 0 P is the unique initil stte, nd M m P Σ P. M nd m correspond respectively to must-trnsitions nd my-trnsitions. We dditionlly ssume tht m is deterministic (hence so is M ) nd complete, tht is, for every stte p P nd every ction Σ, there is exctly one stte λ P such tht (p,, λ) m. We use p (resp. λ) s typicl element of P (resp. P ). Note tht completeness is not restriction since from ny incomplete specifiction, one cn derive complete one by dding my-trnsitions to possibly new stte. Intuitively, in stte p P -my trnsition to some stte λ lbelled by ction mens tht ction is forbidden in p. This interprettion will become clerer when we define the set of models of modl specifiction. The condition M m nturlly imposes tht every required trnsition is lso llowed; it gurntees the locl consistency of the modl constrints. The set of sttes denotes the bd sttes which crry locl inconsistency. Elements of re sink sttes with no outgoing trnsition since both M nd m re subsets of P Σ P. Globl inconsistency cn be derived s follows: we let I be the set of inconsistent sttes tht must led (tht is vi sequence of musttrnsitions) to locl inconsistency; sttes in P \I re consistent. Formlly I = {λ 0 n 0, λ 1 λ n P 1 n Σ s.t. λ n nd (λ i, i+1, λ i+1 ) M }. Notice tht in prticulr I. We sy tht the modl specifiction R is consistent whenever its initil stte is consistent, i.e. λ 0 / I; otherwise R is inconsistent. In the following, we write or drw p λ (resp. p λ) to men (p,, λ) M (resp. (p,, λ) m \ M ); in other words, solid rrows denote required trnsition, wheres dshed rrow represent llowed but not required trnsitions. Exmple 2.2. Consider client for given resource vilble in system. The lphbet of ctions includes: get when the resource is requested; grnt in cse of ccess to the resource; nd, extr which occurs when privileged ccess with extended time is requested. In order to simplify the figures, sttes in re not represented (except if they re necessry) nd trnsitions of the form q re not depicted. Action nmes my be preceded by some! or? when the occurrence of the ctions respectively stems from the designed component or by its environment. 4

5 !extr!get!extr!get!get!extr 0 1?grnt () Client Cl!get b c?grnt?grnt (b) Automton M Fig.1. The modl specifiction Cl ccepts the utomton M The modl specifiction Cl for the client in Fig. 1() specifies tht get request my be sent gin. Moreover every get request must be grnted. Additionlly the client my request extended time t ny moment. Models of ms re deterministic utomt 4, with possibly infinitely mny sttes, which we shortly cll utomt in the sequel. An utomton is structure of the form M = (M, m 0, ) where M is (possibly infinite) set of sttes, m 0 M is unique initil stte, nd M Σ M is prtil trnsition function. The model reltion = defined below is prticulr cse of lternting simultion [4] between the model nd the consistent prt, if ny, of the specifiction. Definition 2.3 (Model Reltion). Let R = (P, λ 0, m, M ) be ms. An utomton M = (M, m 0, ) is model of R, written M = R, if there exists binry reltion ρ M (P \I) such tht (m 0, λ 0 ) ρ, nd for ll (m, p) ρ, the following hold: (1) for every (p,, λ) M there is trnsition (m,, m ) with (m, λ) ρ, nd (2) for every (m,, m ) there is trnsition (p,, λ) m with (m, λ) ρ. We denote by Mod(R), the set of models of n ms R = (P, λ 0, m, M ). Remrk in Definition 2.3 tht inconsistent sttes of the specifiction cnnot pper in the reltion ρ. Consequently, trnsition of the form (p,, λ) m where λ I is inconsistent interprets s: in ny model, no -trnsition from stte in reltion with p is llowed. Moreover, for λ 0 I no ρ cn exist nd ctully we hve: Lemm 2.4. Let R be ms. Mod(R) if, nd only if, R is consistent. Exmple 2.5. The utomton M in Fig. 1(b) is model of the ms Cl in Fig. 1() s the binry reltion ρ = {(, 0), (b, 1), (c, 1)} witnesses. The semntic preorder between ms relies on n extension of Definition lso clled deterministic lbeled trnsition systems. 5

6 Definition 2.6 (Modl Refinement Preorder). Given two ms, R 1 = (P 1, λ 0 1, m 1, M 1 ) nd R 2 = (P 2, λ 0 2, m 2, M 2 ), R 1 is refinement of R 2, written R 1 R 2, whenever there exists binry reltion ρ (I 1 I 2 ) (P 1 (P 2 \I 2 )) such tht (λ 0 1, λ0 2 ) ρ, nd for ll (λ 1, λ 2 ) ρ ((P 1 \ I 1 ) (P 2 \ I 2 )): (1) for every (λ 2,, λ 2 ) M 2 there exists (λ 1,, λ 1 ) M 1 with (λ 1, λ 2 ) ρ (2) for every (λ 1,, λ 1) m 1 there exists (λ 2,, λ 2) m 2 with (λ 1, λ 2) ρ. Definition 2.6 requires some explntions. First, by definition of the domin of ρ, n inconsistent stte of R 2 cn only be refined s n inconsistent stte in R 1 wheres consistent stte in R 2 cn either be linked to consistent or inconsistent stte in R 1. Moreover, for pirs of consistent sttes, Condition (1) ensures tht ll required trnsition in R 2 re lso required in R 1, nd Condition (2) gurntees tht ech possible trnsition in R 1 is lso llowed in R 2. Under our ssumption tht ms re deterministic, we cn show tht the preorder between ms mtches the model inclusion preorder. We estblish n intermedite result tht exploits the embedding of utomt into modl specifictions. Definition 2.7 (Embedding in ms). An utomton M = (M, m 0, ) cn be interpreted s modl specifiction M = (M { }, m 0, m, M ) where = M m, nd (m,, ) m \ M when (m, ) is undefined in M. Lemm 2.8. Given n utomton M nd ms R, M = R iff M R. Proposition 2.9. Let R 1 nd R 2 be two ms, then: R 1 R 2 if, nd only if, Mod(R 1 ) Mod(R 2 ). Note tht the determinism of modl specifictions is crucil for the Proposition 2.9. In the nondeterministic cse, modl refinement is not complete [20], tht is Mod(R 1 ) Mod(R 2 ) does not imply R 1 R 2 in generl. As consequence of Definition 2.6, inconsistent ms refine ny ms, nd consistent ms cn only refine consistent ms. In the following, we write R 1 R 2, nd sy tht R 1 nd R 2 re equivlent, whenever R 1 R 2 nd R 2 R 1. Remrk tht by merging ll sttes of I, every ms is equivlent to ms where the set of inconsistent sttes is singleton. 2.2 Modl event-clock specifictions Let X be finite set of clocks nd let IR 0 denote the set of non-negtive rels. A clock vlution over X is mpping ν : X IR 0. The set of clock vlutions over X is denoted V; in prticulr, 0 V is the clock vlution such tht 0(x) = 0 6

7 for ll x X. Given ν V nd t IR 0, we let (ν+t) V be the clock-vlution obtined by letting t time units elpse fter ν, formlly, (ν +t)(x) = ν(x)+t for every x X. A gurd over X is finite conjunction of expressions of the form x c where x X, c IN is constnt, nd {<,, =,, >}. We then denote by ξ[x] the set of ll gurds over X. For some fixed N IN, ξ N [X] represents the set of gurds involving only constnts equl to or smller thn N. The stisfction reltion = (V ξ[x]) between clock vlutions nd gurds is defined in nturl wy nd we write ν = g whenever ν stisfies g. In the following, we will often buse nottion nd write g to denote the gurd g s well s the set of vlutions which stisfy g. Event-clock utomt [2], form subclss of timed utomt where clock resets re not rbitrry: ech ction comes with clock x which is reset exctly when ction occurs. We consider event-clock utomt with possibly infinitely mny loctions. Definition 2.10 (Event-clock utomt). An event-clock utomton (ec) over Σ is tuple C = (C, c 0, δ) where C is set of sttes, c 0 C is the initil stte, nd δ C ξ N [X Σ ] Σ C is the trnsition reltion (for some N N). The pir (Σ, N) is the signture of C. The semntics of n ec is similr to the one of timed utomton [1], except tht the set of clocks tht re reset by trnsition is determined by the ction of tht trnsition: while firing trnsition lbeled by, precisely clock x is reset. Event-clock utomt do form strict subclss of timed utomt, but they enjoy nice properties: they re closed under union nd intersection, nd more interestingly they cn be determinized (s opposed to the clss of rbitrry timed utomt). The determinizbility of event-clock utomt comes from the wy clocks re reset nd this property significntly eses the definition of binry opertors (such s lower bound, product nd quotient) on modl vrints of event-clock utomt. For fixed signture (Σ, N), region is n equivlence clss θ of clockvlutions tht stisfy the sme gurds in ξ N [X Σ ]. We denote by Θ N, or simply Θ, the set of ll regions. Given region θ Θ, we write Succ(θ) for the union of ll regions tht cn be obtined from θ by letting time elpse: Succ(θ) = {θ ν θ ν θ t IR 0 s.t. ν = ν + t}. Definition 2.11 (Region utomton [1]). The region utomton ssocited to n ec C = (C, c 0, δ) is the utomton R(C) = (C Θ, (c 0, 0), ) over the lphbet Θ Σ, where the set of trnsitions is defined s follows: for ech c, c C, θ, θ, θ Θ, nd Σ, ((c, θ), θ,, (c, θ )) whenever there exists (c, g,, c ) δ with θ Succ(θ) g, nd θ = θ [x = 0] is the region obtined from θ by resetting clock x. 7

8 Note tht the region utomt we consider extend the ones introduced in [1] since their trnsition lbels keep trck of the intermedite region where the ction is fired. As consequence, ny utomton over the lphbet Θ Σ uniquely defines n ec whose signture is of the form (Σ, N Θ ), with N Θ determined by the set of regions Θ. We denote by T the nturl injection of region utomt into ec; this mpping enbles us to distinguish between the two interprettions of the sme syntctic object: R(C) is n utomton wheres T(R(C)) is n ec. Definition 2.12 (Modl event-clock specifiction). A modl event-clock specifiction (mecs) over the finite lphbet Σ is tuple S = (Q, λ 0, δ m, δ M ) where Q := Q is finite set of loctions, with Q =, nd the initil stte is λ 0 Q. δ M δ m Q ξ[x Σ ] Σ Q re finite sets of respectively must- nd my-trnsitions. Given my-trnsition (q, g,, λ) δ m, q is the source stte, λ is the destintion stte, g ξ[x Σ ] is the gurd tht specifies the vlutions for which the trnsition cn be tken, Σ is the ction lbeling the trnsition recll tht the only clock tht is then reset is x. Moreover we require tht δ m is deterministic (hence, so is δ M ) nd complete: for ny stte q Q, ny ction Σ, nd ny clock vlution ν V, there is exctly one trnsition (q, g,, λ) δ m such tht ν = g. Exmple As n exmple of mecs, we consider in Fig. 2() timed vrint of the client Cl introduced erlier. The clock corresponding to the ction get is x get. In this exmple gin, for simplifiction purposes, trnsitions of the form q g, re not depicted. As mecs re complete, these trnsitions cn esily be recovered by tking g = ( i g i) where the g i s re the gurds ppering in the trnsitions of the form q gi, λ or q gi, λ. When the gurd of trnsition is not indicted, it is implicitly true. The mecs Cl for the client in Fig. 2() specifies tht get request my be sent gin t most one time unit fter the lst request. In the sequel, we generlize the grphicl convention lredy used for untimed objects by writing q g, λ whenever (q, g,, λ ) (δ m \ δ M ) nd q g, λ whenever (q, g,, λ ) δ M. Remrk tht nturl untimed object ssocited to mecs S is its region modl utomton, obtined by generlizing Definition 2.11 from event-clock utomt to their modl extension. More precisely, R(S) reflects the modlities of S = (Q, λ 0, δ m, δ M ) s done in [9], the initil stte is (λ 0, 0) nd the set of loclly inconsistent sttes in R(S) is S Θ. A mecs S is sid to be inconsistent 8

9 !extr!get!extr 0 1?grnt!get x get 1?get 0?extr 1!grnt x get 2?get!grnt x get 4 () Client Cl (b) Access controller Acc Fig. 2. Client Cl nd ccess controller Acc if R(S) is inconsistent; otherwise, it is consistent. Given modl event-clock specifiction S over signture (Σ, N), R(S) is modl specifiction over the extended lphbet Σ Θ N ; similrly, given n event-clock utomton C, R(C) is n utomton over lphbet Σ Θ N. Hving this in mind, the model reltion in the timed cse is inherited from the one in the untimed cse vi the region construction: Definition 2.14 (Model reltion). Let S be mecs. An event-clock utomton C is model of S, written C = S, if R(C) = R(S). The set of models of mecs S, is defined by Mod(S) := {C C = S}. Observing tht given mecs S, R(T(R(S))) nd R(S) re isomorphic, we obtin the following: Lemm Let S be mecs. Then, Mod(T(R(S))) = Mod(S). In the spirit of Def.2.14 for the model reltion, the modl refinement preorder between mecs lso relies on region-bsed construction: Definition 2.16 (Modl refinement preorder). Given two mecs S 1 nd S 2, S 1 refines S 2, written S 1 S 2, whenever R(S 1 ) R(S 2 ). As corollry of the nlogous results in the untimed setting on ms, it is decidble whether mecs refines nother one. Moreover, refinement nd inclusion of models mtch: Corollry Let S, S 1 nd S 2 be mecs. Then, Mod(S) if, nd only if S is consistent; S 1 S 2 if, nd only if Mod(S 1 ) Mod(S 2 ). 9

10 About consistency We recll tht specifiction is consistent if, nd only if, it dmits model. According to Lemm 2.4, checking whether n untimed specifiction is consistent mounts to checking tht the set of sttes cnnot be reched from its initil stte by sequence of must-trnsitions. The consistency problem is thus NLOGSPACE-complete for modl specifictions nd PSPACEcomplete in the timed cse. 3 Opertions on specifictions In this section, we introduce opertions on modl event-clock specifictions, which enble compositionl resoning. More precisely, we define the gretest lower bound, the product, nd the quotient over mecs. For ech of these opertions, we estblish importnt theoreticl properties. 3.1 Gretest lower bound of mecs We study the concept of gretest lower bound, which corresponds to the conjunction of two modl specifictions nd equivlently to their best shred refinement. We first recll the definition of the gretest lower bound in the untimed cse. Let R 1 = (P 1, λ 0 1, m 1, M 1 ) nd R 2 = (P 2, λ 0 2, m 2, M 2 ) be two ms. The gretest lower bound of R 1 nd R 2 is R 1 R 2 = (P, (λ 0 1, λ 0 2), m, M ) with P := P 1 P 2, := ( 1 P 2 ) (P 1 2 ), nd whose trnsition reltions re derived from the following rules: λ 1 λ 1 λ 1 nd λ 2 λ 2 (λ 1, λ 2 ) (λ 1, λ 2 ) λ 1 nd λ 2 λ 2 (λ 1, λ 2 ) (λ 1, λ 2 ) (Glb1) (Glb3) λ 1 λ 1 λ 1 nd λ 2 λ 2 (λ 1, λ 2 ) (λ 1, λ 2 ) λ 1 nd λ 2 λ 2 (λ 1, λ 2 ) (λ 1, λ 2 ) (Glb2) (Glb4) Remrk in prticulr, tht if in stte λ = (λ 1, λ 2 ), we hve the contrdictory requirements tht is required (λ 1 λ 1 P 1 ) nd should not hppen (λ 2 λ 2 2 ), then λ is inconsistent. This is indeed gurnteed by the definition of R 1 R 2 which imposes P 1 2. Gretest lower bound of mecs. The notion of gretest lower bound esily extends to mecs. Let S 1, S 2 be two mecs. The modlities for the trnsitions in S 1 S 2 re derived from those induced in the untimed cse (Rules (Glb1) to (Glb4)), nd the lbels of the trnsitions re obtined by intersecting the gurds for common ctions. As n exmple, Rule (Glb1) becomes (tglb1) s follows. g 1, λ 1 λ g 2, 1 nd λ 2 λ 2 (λ 1, λ 2 ) g1 g2, (tglb1) (λ 1, λ 2 ) 10

11 Thnks to Lemm 2.15, the set of models of mecs S mtches the set of models of its region version T(R(S)). The following proposition chrcterizes the gretest lower bound of two mecs vi the region grphs. Proposition 3.1. For ny two mecs S 1 nd S 2, R(S 1 S 2 ) R(S 1 ) R(S 2 ). In Proposition 3.1, opertor is overloded: on the right hnd side, it corresponds to the gretest lower bound of ms wheres on the left hnd side, it corresponds to the gretest lower bound of mecs. Computing the conjunction of two ms vi rules (Gbl1) to (Gbl4) is polynomil in the size of the rguments. Due to the construction of the region grphs, strting from two mecs S 1 nd S 2 computing R(S 1 ) R(S 2 ) is exponentil. The direct construction of the gretest lower bound by using the timed vrints of (Gbl1) to (Gbl4) is polynomil nd therefore worth dopting for effective methods. Finlly, ccording to the bove, one cn estblish tht the gretest lower bound yields the intersection of the models. Theorem 3.2. For ny two mecs S 1 nd S 2, Mod(S 1 S 2 )=Mod(S 1 ) Mod(S 2 ). Appliction of the gretest lower bound is the following: in the design of component one gives severl specifictions, ech of them describing prticulr requirement. The gretest lower bound of these specifictions enbles to check the comptibility of these requirements, by deciding consistency. 3.2 Product of mecs The product of mecs reltes to the synchronous prllel composition of models. For ms, it generlizes the synchronized product of utomt M 1 M 2 tht denotes the intersection of their behviors (lnguges). We first recll the product of ms: Let R 1 = (P 1, λ 0 1, m 1, M 1 ) nd R 2 = (P 2, λ 0 2, m 2, M 2 ) be two ms over the sme lphbet Σ. The product of R 1 nd R 2, denoted by R 1 R 2, is the ms (P, (λ 0 1, λ 0 2), m, M ), with P := P 1 P 2, := ( 1 P 2 ) (P 1 2 ), nd whose trnsitions re derived from the following rules: λ 1 λ 1 λ 1 nd λ 2 λ 2 (λ 1, λ 2 ) (λ 1, λ 2 ) λ 1 nd λ 2 λ 2 (λ 1, λ 2 ) (λ 1, λ 2 ) (Prod1) (Prod3) λ 1 λ 1 λ 1 nd λ 2 λ 2 (λ 1, λ 2 ) (λ 1, λ 2 ) λ 1 nd λ 2 λ 2 (λ 1, λ 2 ) (λ 1, λ 2 ) (Prod2) (Prod4) Notice tht Rules (P rod1) to (P rod4) uniformly consider consistent nd inconsistent sttes. 11

12 Product of mecs. The product of mecs extends the synchronized product of ec which consists in synchronizing trnsitions on ction nmes nd in tking the conjunction of the gurds of the combined trnsitions. Let S 1, S 2 be two mecs. The modlities for the trnsitions in S 1 S 2 re derived from those proposed in the untimed cse, nd the lbels of the trnsitions re composed of the intersection of the gurds together with the common ction. For exmple, the timed version of (Prod1) becomes (tprod1) s follows. g 1, λ 1 λ g 2, 1 nd λ 2 λ 2 (λ 1, λ 2 ) g1 g2, (λ 1, λ 2) (tp rod1) Similrly to Proposition 3.1 for the gretest lower bound, the product of mecs cn be lterntively computed by building the product of the region grphs. This construction however cuses n exponentil blow-up wheres the direct construction is polynomil. Notice tht opertor is overloded to ese the presenttion. Proposition 3.3. R(S 1 S 2 ) R(S 1 ) R(S 2 ). In the untimed setting, it is known [23] tht the product is monotonic with respect to the refinement, nd tht product of models is model of the product. Those properties extend to the timed cse s stted in the following theorem. Theorem 3.4 (Properties of the product). For ny mecs S 1, S 1, S 2, S 2, nd ny ec C 1, C 2, (S 1 S 2 nd S 1 S 2) = S 1 S 1 S 2 S 2; nd (C 1 = S 1 nd C 2 = S 2 ) = C 1 C 2 = S 1 S 2. As consequence, the product opertion stisfies the property of independent implementbility, in the sense of [12]: n implementtion of specifiction of the form S 1 S 2 cn be obtined by composing ny two independent implementtions of S 1 nd S 2 respectively. Exmple 3.5. The mecs Acc in Fig. 2(b) pge 9 specifies the behvior of n ccess controller; the ccess to the resource will be grnted for 2 time units fter the reception of get request. In cse of privileged ccess with n extr time, this durtion will be extended to 4 time units. The product Cl Acc is depicted in Fig. 3(). In the resulting specifiction, extr cn now only occur fter get request. Timing constrints on the grnt ction issued from the ccess controller re lso propgted. 12

13 get 00 grnt 10 x get 2 get 01 grnt 11 x get 4 extr get x get 1 get x get 1 grnt x get < 5 get grnt x get < 2 c b extr () The product Cl Acc (b) A desired behvior G Fig.3. The globl model Cl Acc nd its specified behvior G 3.3 Quotient of mecs In this section, we define the quotient opertion. Intuitively, the quotient describes prt of globl specifiction ssuming nother prt will be relized by some component. We thus consider quotient of specifictions which is different from the constructions studied in [17] where t lest one of the opernd is system. We strt by reclling the quotient opertion on untimed modl specifictions, then extend it to mecs. In the untimed setting, we im t defining n opertion dul to the product of Section 3.2 in the following sense. Given two ms R = (P, λ 0, m, M ) nd R 1 = (P 1, λ 0 1, m 1, M 1 ), we wnt the quotient of R by R 1 to be the ms written R R 1 which stisfies the following properties. Proposition 3.6. For every utomton M 2, M 2 = R R 1 M 1. [M 1 = R 1 M 1 M 2 = R] (1) nd R R 1 is the gretest such one, nmely R 1 R 2 R R 2 R R 1 (2) The definition of the quotient follows [23], but it is here revisited with uniform wy to hndle both consistent nd inconsistent sttes, s opposed to the originl definition where so-clled pseudo-specifictions needed being considered. Formlly, the quotient of R = (P, λ 0, m, M ) by R 1 = (P 1, λ 0 1, m 1, M 1 ) is the ms R R 1 = (P, (λ 0, λ 0 1), m, M ), with P (P P 1 ) { }, where is fresh element, nd the set of loclly inconsistent sttes of R R 1 contins t lest n element but lso other elements: the rules below describe these elements s well s the set of trnsitions. Nottion λ I mens tht the - my-trnsition from λ leds to n inconsistent stte in I. We lso use nottions 13

14 λ P \ I, λ I, nd λ P \ I with the expected mening, nd λ whenever there is no -must-trnsition from stte λ. λ I nd λ 1 / I 1 (λ, λ 1 ) I λ nd λ 1 I 1 (λ, λ 1 ) (I I1) ( Imust I1) λ I nd λ 1 I 1 (λ, λ 1 ) I λ nd λ 1 I 1 (λ, λ 1 ) (I I1) ( Imy I1) (top) Assume now tht both λ nd λ 1 re consistent, i.e., λ / I nd λ 1 / I 1 : λ I nd (λ 1 λ λ λ / I nd (λ 1 P 1 \ I 1 or λ 1 (λ, λ 1 ) nd λ 1 I 1 (λ, λ 1 ) (λ, λ 1 ) λ 1 / I 1 or λ 1 (λ, λ 1 ) λ λ nd λ 1 λ 1 (λ, λ 1 ) λ nd λ 1 λ 1 (λ, λ 1 ) (λ, λ 1 ) λ P 1 \ I 1 ) (my1) λ 1 / I 1) (inconsistency) (must) (mynot) (my2) We now give intuitive explntions for the rules bove in prticulr with respect to the first requirement of Proposition 3.6. To do so, let R λ be the ms informlly defined s the sub-specifiction of R with initil stte λ. When explining rule involving trnsitions outgoing λ in R nd λ 1 in R 1 we will thus spek bout models in R λ, R λ1 1 nd R λ R λ1 1. Rλ nd R λ1 1 re just introduced in order to be ble to regrd locl models of R nd R 1 from sttes λ nd λ 1. When, sy λ I, we hve Mod(R λ ) =. Rule (I I 1 ) ensures tht since there re no models for R λ nd there re models for R λ1 1, there should not be models of Rλ R λ1 1, otherwise we would not hve the right to left impliction of Eqution (1) in Proposition 3.6. For Rules ( Imust I1) nd ( Imy I1) (together with Rule (top)), since Mod(R λ1 1 ) =, the right hnd side of Eqution (1) is trivilly stisfied. Therefore in ( Imust I1), the -trnsition required from λ cnnot be gurnteed; hence the quotient is not consistent. On the other hnd for Rule ( Imy I1), 14

15 since nothing prticulr is required from λ for the -trnsition, nothing either needs being required for models of the quotient; to gurntee Eqution (2) of Proposition 3.6 (which sttes the mximlity of the quotient) we set the quotient to be universl, i.e. it ccepts every model. Rule (I I 1 ) together with Rule (top), is the cse where both Mod(R λ ) = nd Mod(R λ1 1 ) =. In this cse, the universl ms tht ccepts every model cn be in the quotient, nd this is wht is chosen in order to get the gretest such ms, s required by Eqution (2). We now come to the set of rules where both λ nd λ 1 re consistent (λ / I nd λ 1 / I 1 ), which by Lemm 2.4 mounts to sy tht Mod(R λ ) nd Mod(R λ1 1 ). In Rule (my1), is not possible from λ 1, nd is not mndtory from λ, it cn therefore sfely be uthorized in the quotient. Rule (mynot) dels with the cse where is forbidden in R λ, but is uthorized or even mndtory in R λ1 1 : it should be forbidden in the quotient. Rule (my2) is very strightforwrd, s models of the quotient my hve n -trnsition irrespectively of wht is required in R λ1 1. Finlly, Rules (inconsistency) nd (must) consider the cse where we hve must trnsitions in R λ. Rule (inconsistency) corresponds to the inbility of gurnteeing the -trnsition required in R λ since it my not exist in some models of R λ1. Hence only n inconsistent ms cn be considered so tht Eqution (1) holds. Rule (must) is the simple cse of must requirements; notice tht we implicitly hve λ 1 / I 1, since by ssumption λ 1 / I 1. One cn esily verify tht the conditions of the premises of Rules from (I I 1 ) to (must) re exclusive, hence the quotient construction yields deterministic object. Also, the quotient ms is complete. Quotient of mecs. The quotient of mecs S = (Q, λ 0, δ m, δ M ) by mecs S 1 = (Q 1, λ 0 1, δ m 1, δ M 1 ) is the mecs S S 1 = (Q, (λ 0, λ 0 1), δ m, δ M ), where Q (Q Q 1 ) { } nd where the set of loclly inconsistent sttes nd the trnsition modlities follow the rules (I I 1 ) to (must) of the untimed cse; the gurd of trnsition is the conjunction of the locl gurds of S nd S 1. For exmple, the untimed rule (must) becomes (tmust) s follows. λ g, λ g 1, nd λ 1 λ 1 (λ, λ 1 ) g g1, (λ, λ 1) Besides, the rule (ttop) is the following: true, (ttop) (tmust) This quotient opertion for mecs cn be used on ec s the clss of deterministic ec cn be embedded into the one of mecs; it suffices to type with must every 15

16 existing trnsitions in the ec, nd to complete it by dding trnsitions typed by my to stte in. Assuming determincy of event-clock utomt is not restrictive, since they re known to be determinizble [2]. Observe tht then the quotient of two event-clock utomt is not n event-clock utomton since e.g. Rule ( Imy I 1 ) introduces my trnsition to the top stte. Finlly, the quotienting opertion yields deterministic nd complete specifiction. Hence: Lemm 3.7. Modl event-clock specifictions re closed under quotient. As for the product opertion, the quotient opertion in the timed nd untimed settings relte vi the region construction (for the extended lphbet) s follows. Proposition 3.8. R(S S 1 ) R(S) R(S 1 ). The correctness of the quotient construction is stted by the following. Theorem 3.9 (Properties of the quotient). For ny mecs S, S 1, S 2, nd ny ec C 2, C 2 = S S 1 C 1. [C 1 = S 1 C 1 C 2 = S]; nd (3) S 1 S 2 S S 2 S S 1. (4) From prcticl point of view, the quotient opertion enbles incrementl design: consider desired globl specifiction S, nd the specifiction S 1 of preexisting component. By computing S S 1 nd by checking its consistency, one cn test whether component implementing S 1 cn be reused in order to relize S, or not. Note tht by (4) the specifiction S S 1 is mximlly permissive in the sense tht it chrcterizes ll components C 2 such tht for ny C 1 implementing S 1, the composed system C 1 C 2 implements S. Exmple A desired globl behvior G is depicted in Fig. 3(b), pge 13. It specifies tht ny get request must be fulfilled; the ccess to the resource is grnted for 2 time units nd 5 time units in the privileged mode. A model of G/(Cl Acc) will ct s protocol converter between Cl nd the ccess controller Acc ; the overll obtined system will stisfy G. The mecs G/(Cl Acc) is represented in Fig. 4. Not surprisingly, the stte c/11 is inconsistent. This is becuse, in the stte 11 in Fig. 3(), the resource is grnted for 4 units of time wheres in the stte c of the desired behvior G in Fig. 3(b), it must be grnted for 5 units of time. To void this inconsistency, the trnsition extr from stte b/10 to c/11 will not be implemented in ny model of G/(Cl Acc). Thus, the protocol converter will disllow the privileged mode. 16

17 grnt 4 < x get < 5 get get /00 b/10 extr grnt grnt c/11 /01 b/11 x get 4 grnt x get < 2 x get < 4 grnt, extr get,x get > 1 grnt get,x get > 1 extr get, grnt, extr grnt extr extr grnt,x get>4 get,x get>1 Fig. 4. The quotient G/(Cl Acc) The quotient opertion we gve hs nice properties: its construction is in essence crtesin product, thus yielding polynomil time complexity, s opposed to the exponentil blow-up cused by the region grph construction of Proposition 3.8. Also the quotient, defined t the level of specifictions nd bstrcting from prticulr choice of implementtions, mounts to quotienting logicl sttements denoted by specifictions. In the untimed setting, the quotient opertion is prticulr cse of the exponentil construction introduced by [7] for rbitrry mu-clculus sttements. However, we tke here dvntge of the restricted logicl frgment covered by the modl specifictions, nmely the conjunction nu-clculus [15], to get n d-hoc polynomil-time complexity of this quotient construction. The present contribution suggests similr sitution for timed extension of the mu-clculus. 4 Relted work Regrding theory of interfces, we compre our pproch with the following settings: Interfce utomt of [12], timed interfces of [13], nd timed extensions of modl specifictions of [10]. Interfce utomt. In interfce utomt [13], n interfce is represented by n input/output utomton [21], i.e., n utomton whose trnsitions re typed with input nd output rther thn must nd my modlities. The semntics of such n utomton is given by two-plyer gme: the input plyer represents the environment, nd the output plyer represents the component itself. As explined [24], interfces nd modlities re in essence orthogonl to ech other. Moreover, interfce utomt do not encompss ny notion of model, nd thus neither the model reltion nor the consistency, becuse one cnnot distinguish between 17

18 interfces nd components. Alterntively, properties of interfces re described in gme-bsed logics, e.g., ATL [3], with high-cost complexity. Refinement between interfce utomt corresponds to the lternting refinement reltion between gmes [4], i.e., n interfce refines nother one if its environment is more permissive wheres its component is more restrictive. There is no notion of component reuse nd shred refinement is defined in n d-hoc mnner [14]. Composition of interfce utomt differs from the one over modl specifictions. Indeed, in interfce utomt, the gme-bsed pproch offers n optimistic tretment of composition: two interfces cn be composed if there exists t lest one environment in which they cn interct together in sfe wy. In [19], Lrsen et l. proposed modl interfces tht re modl specifictions composed in gme-bsed mnner. This work suggests tht modl specifictions subsume interfce utomt. Timed interfces. In [13], de Alfro et l. proposed timed interfces which extend timed utomt just s interfce utomt extend utomt. The composition of timed interfces hs only been prtilly studied, becuse of the underlying timed gmes semntics: in prticulr, n extr feture needs being incorported to prevent plyers from winning by using Zeno strtegies. Moreover, no refinement reltion is defined. Recently, Chtin et l. [11] proposed notion of lternting timed refinement between timed utomt, implemented in the UPPAAL toolset [25]. In ll cses, opertions between specifictions hve not been investigted in systemtic wy, nd to our knowledge, no quotient construction hs been ddressed. A timed extension of modl specifictions. A timed extension of modl specifictions ppered in [10] in process lgebr style. The formlism proposed is vrint of CCS whose semntics relies on the configurtion grph rther thn on the region grph, s done here. No logicl chrcteriztion is developed, neither ny notion of model reltion (stisfction) or consistency (stisfibility). Moreover, the quotient hs not been considered t ll. 5 Conclusion Modl specifictions offer well-dpted lgebric frmework for compositionl resoning on component-bsed systems, tht enbles incrementl design s well s reuse of component. In this pper, we hve presented timed extension of modl specifictions using event-clock timed utomt. All essentil fetures expected from theory of interfce (such s refinement, conjunction, stisfibility, product, nd quotient) re fully ddressed nd efficiently treted in this frmework. Severl reserch directions still need being investigted in the future. We im t studying timed modl specifictions in broder frmework thn the one 18

19 of mecs, since event-clock utomt re strictly less expressive thn timed utomt. However, generliztion to rbitrry timed modl specifictions rises complex issues on how different sets of clocks cn be combined in the quotient. Another topic concerns logicl chrcteriztion of modl event-clock specifictions (or even more generl timed modl specifictions), in the spirit of [15] who estblished the correspondence between simple modl specifictions nd conjunctive ν-clculus. Such chrcteriztion brings insight on the expressiveness of the specifiction formlism. Acknowledgment We re very thnkful to the reviewers for relevnt comments tht helped us improving the pper. References 1. Rjeev Alur nd Dvid L. Dill. A theory of timed utomt. Theoreticl Computer Science, 126(2): , Rjeev Alur, Limor Fix, nd Thoms A. Henzinger. Event-clock utomt: A determinizble clss of timed utomt. Theoreticl Computer Science, 211:1 13, Rjeev Alur, Thoms A. Henzinger, nd Orn Kupfermn. Alternting-time temporl logic. Journl of the ACM, 49(5): , Rjeev Alur, Thoms A. Henzinger, Orn Kupfermn, nd Moshe Y. Vrdi. Alternting refinement reltions. In Proceedings of the 9th Interntionl Conference on Concurrency Theory (CONCUR 98), volume 1466 of Lecture Notes in Computer Science, pges Springer, Adm Antonik, Michel Huth, Kim G. Lrsen, Ulrik Nymn, nd Andrzej Wsowski. 20 yers of modl nd mixed specifictions. Bulletin of Europen Assocition of Theoreticl Computer Science, 1(94), André Arnold nd Murice Nivt. Metric interprettions of infinite trees nd semntics of non deterministic recursive progrms. Theoreticl Computer Science, 11: , André Arnold, Aymeric Vincent, nd Igor Wlukiewicz. Gmes for synthesis of controllers with prtil observtion. Theoreticl Computer Science, 303(1):7 34, Nthlie Bertrnd, Axel Legy, Sophie Pinchint, nd Jen-Bptiste Rclet. A compositionl pproch on modl specifictions for timed systems. INRIA Reserch report. 9. Nthlie Bertrnd, Sophie Pinchint, nd Jen-Bptiste Rclet. Refinement nd consistency of timed modl specifictions. In Proceedings of the 3rd Interntionl Conference on Lnguge nd Automt Theory nd Applictions (LATA 09), volume 5457 of Lecture Notes in Computer Science, pges Springer, Kārlis Čerāns, Jens Chr. Godskesen, nd Kim G. Lrsen. Timed modl specifiction - theory nd tools. In Proceedings of the 5th Interntionl Conference on Computer Aided Verifiction (CAV 93), volume 697 of Lecture Notes in Computer Science, pges Springer, Thoms Chtin, Alexndre Dvid, nd Kim G. Lrsen. Plying gmes with timed gmes. In Proceedings of the 3rd IFAC Conference on Anlysis nd Design of Hybrid Systems (ADHS 09), To pper. 19

20 12. Luc de Alfro nd Thoms A. Henzinger. Interfce utomt. In Proceedings of the 9th ACM SIGSOFT Interntionl Symposium on Foundtions of Softwre Engineering (FSE 01), pges , Luc de Alfro, Thoms A. Henzinger, nd Mriëlle Stoeling. Timed interfces. In Proceedings of the 2nd Interntionl Workshop on Embedded Softwre (EM- SOFT 02), volume 2491 of Lecture Notes in Computer Science, pges Springer, Lurent Doyen, Thoms A. Henzinger, Brbr Jobstmnn, nd Ttjn Petrov. Interfce theories with component reuse. In Proceedings of the 8th Interntionl Conference on Embedded Softwre (EMSOFT 08), pges ACM Press, Guillume Feuillde nd Sophie Pinchint. Modl specifictions for the control theory of discrete-event systems. Discrete Event Dynmic Systems, 17(2): , Thoms A. Henzinger nd Joseph Sifkis. The embedded systems design chllenge. In Proceedings of the 14th Interntionl Symposium on Forml Methods (FM 06), volume 4085 of Lecture Notes in Computer Science, pges Springer, Bengt Jonsson nd Kim G. Lrsen. On the complexity of eqution solving in process lgebr. In Proceedings of the Interntionl Joint Conference on Theory nd Prctice of Softwre Development (TAPSOFT 91), pges Springer, Kim G. Lrsen. Modl specifictions. In Proceedings of the Interntionl Workshop on Automtic Verifiction Methods for Finite Stte Systems, volume 407 of Lecture Notes in Computer Science, pges Springer, Kim G. Lrsen, Ulrik Nymn, nd Andrzej Wsowski. Modl i/o utomt for interfce nd product line theories. In Proceedings of the 16th Europen Symposium on Progrmming (ESOP 07), volume 4421 of Lecture Notes in Computer Science, pges Springer, Kim G. Lrsen, Ulrik Nymn, nd Andrzej Wsowski. On modl refinement nd consistency. In Proceedings of the 18th Interntionl Conference on Concurrency Theory (CONCUR 07), volume 4703 of Lecture Notes in Computer Science, pges Springer, Nncy Lynch nd Mrk R. Tuttle. An introduction to Input/Output utomt. CWI-qurterly, 2(3), Jen-Bptiste Rclet. Quotient de spécifictions pour l réutilistion de composnts. PhD thesis, Université de Rennes I, december (In French). 23. Jen-Bptiste Rclet. Residul for component specifictions. In Proceedings of the 4th Interntionl Workshop on Forml Aspects of Component Softwre (FACS 07), Jen-Bptiste Rclet, Eric Bdouel, Albert Benveniste, Benoit Cillud, nd Roberto Psserone. Why re modlities good for interfce theories? In Proceedings of the 9th Interntionl Conference on Appliction of Concurrency to System Design (ACSD 09), pges IEEE Computer Society Press, The UPPAAL tool. Avilble t 20