Verification of Real-Time Embedded Systems using Petri Net Models and Timed Automata

Transcription

1 in Proc. RTCSA Conference, 2002, pp Verificaion of Real-Time Embedded Sysems using Peri Ne Models and Timed Auomaa Luis Alejandro Corés, Peru Eles, and Zebo Peng Dep. of Compuer and Informaion Science Linköping Universiy, Linköping, Sweden Absrac There is a lack of new verificaion mehods ha overcome he limiaions of radiional validaion echniques and are, a he same ime, suiable for real-ime embedded sysems. This paper presens an approach o formal verificaion of real-ime embedded sysems modeled in a imed Peri ne represenaion. We ranslae he Peri ne model ino imed auomaa and use model checking o prove wheher cerain properies hold wih respec o he sysem model. We propose wo sraegies o improve he efficiency of verificaion. Firs, we apply correcness-preserving ransformaions o he sysem model in order o obain a simpler, ye semanically equivalen, one. Second, we exploi he srucure of he sysem model by exracing is he sequenial behavior. Experimenal resuls demonsrae significan improvemens in he efficiency of verificaion.. Inroducion Embedded sysems are ypically consiued by heerogeneous componens including boh hardware and sofware elemens. Besides heir heerogeneiy, embedded sysems are characerized by dedicaed funcion, real-ime behavior, and high requiremens on reliabiliy and correcness [3]. For he levels of complexiy ypical o modern elecronic sysems, radiional validaion echniques, like simulaion and esing, are no sufficien o verify heir correcness. Formal mehods are becoming a pracical alernaive o ensure he correcness of designs. In his paper we propose a verificaion mehod suiable for real-ime embedded sysems. Our approach allows he formal verificaion of sysems represened in PRES+ [5] by using model checking. PRES+ is a Peri ne based model exended o capure relevan characerisics of real-ime embedded sysems. We ranslae PRES+ models ino imed auomaa in order o make use of available model checking ools. The approach proposed in [5] ranslaes PRES+ models ino a collecion of imed auomaa. One auomaon wih one clock variable is obained for each ransiion. The main This research has been sponsored by he Swedish Agency for Innovaion Sysems (VINNOVA) in he frame of he SAVE projec. drawback of such an approach is ha he complexiy of model checking of imed auomaa is exponenial in he number of clocks and hus verificaion is no feasible for medium or large-size sysems. We address in his paper wo sraegies o alleviae he complexiy of verificaion. Firs, we presen a ransformaional approach aimed a reducing he verificaion cos of sysems modeled in PRES+. I makes use of correcnesspreserving ransformaions in order o reduce he sysem model, so ha he resuling one is simpler (sill semanically equivalen o he original model) and herefore cheaper o verify. Thus if he simplified model is correc, he iniial one is guaraneed o be correc. Second, we propose a clusering algorihm ha exracs he sequenial behavior of he Peri ne and hus he number of auomaa/clocks resuling afer ranslaing he PRES+ model can be reduced. In his manner we improve significanly he procedure o ranslae PRES+ models ino imed auomaa presened in [5] and consequenly he efficiency of he verificaion process. We also show how he efficiency of verificaion can be furher improved by combining he ransformaional and clusering approaches. Several analysis echniques based on ime-exensions of Peri nes have been proposed [5], [3], [6], [0]. These approaches, hough implemening efficien verificaion algorihms, are no oally suiable for real-ime embedded sysems since heir modeling formalisms do no capure imporan feaures of such sysems, for insance daa dependencies as expressed by guards in PRES+. The res of his paper is organized as follows. A descripion of he design represenaion ha we use o model realime embedded sysems is presened in Secion 2. Our approach o he verificaion of sysems described in PRES+ is inroduced in Secion 3, as well as he wo sraegies we propose in order o improve he efficiency of verificaion. Experimenal resuls are presened in Secion 4. Finally, some conclusions are drawn in Secion Model The noaion we have defined for modeling embedded sysems is PRES+ (Peri ne based Represenaion for Embedded Sysems). PRES+ overcomes some of he drawbacks of he classical Peri nes model: i capures explicily

2 iming informaion; i is more expressive as okens migh carry informaion; sysems may be represened a differen levels of granulariy; boh conrol and daa informaion may be capured by a unified design represenaion. PRES+ has been also exended by inroducing he concep of hierarchy [7]. In his secion we informally presen he main characerisics of PRES+. The reader is referred o [5] for a formal definiion of he model. A PRES+ model is a five-uple N = ( P, T, I, O, M 0 ) where P is a se of places, T is a se of ransiions, I is a se of inpu (place-ransiion) arcs, O is a se of oupu (ransiion-place) arcs, and M 0 is he iniial marking of he ne. A marking is an assignmen of okens o he places of he ne. A oken is a pair k= vr, where v is he oken value (may be of any ype) and r is he oken ime (a non-negaive real number). Thus okens carry daa and ime informaion aached o hem as samps. The oken ype associaed o a place p, denoed τ(p), is he ype of value ha a oken may bear in p. For he iniial marking M 0 in he model shown in Figure, p a is he only marked place and is oken k a = v a, r a has oken value v a =2 and oken ime r a =0. d [2.2,4] 7 d [a>0] p b a [,.7] p d b a b 3 -b 6 -d Figure. A PRES+ model Every ransiion T has one ransiion funcion associaed o i. Such a funcion akes as argumens he oken values of okens in he pre-se of he ransiion. The pre-se of a ransiion T is he se of inpu places of. The pos-se is he se of oupu places of. Correspondingly, he pre-se p and he pos-se p of a place p P are he ses of ransiions for which p is oupu and inpu place respecively. In Figure we inscribe ransiion funcions inside ransiion boxes: he funcion associaed o 8, for example, is given by f 8 ( e)=e+2 where e is he oken value of he oken in p e when marked. We use inscripions on he inpu arcs of a ransiion in order o denoe he argumens of is ransiion funcion and/or hose of is guard. A ransiion T may have a guard G, a condiion ha mus be saisfied in order o enable he ransiion when all p a [3,4] -a 2 [a<0] p e p c b 4 c 5 [,4] 5 d <2,0> [.8,3] a [2,3] c e+2 [0,] e 8 is inpu places hold okens. The guard of a ransiion is a funcion of he values of okens in he places of is pre-se. For insance, a < 0 is he guard of 2 in he example of Figure. Noe ha, for he iniial marking, 2 is no enabled even hough is only inpu place is marked. For every ransiion T, here exis a minimum ransiion delay d - and a maximum ransiion delay d +. The non-negaive real numbers d - d + represen he lower and upper bounds for he execuion ime (delay) of he funcion associaed o he ransiion. Transiion delays give he limis in ime for he firing of a ransiion since i becomes enabled, unless i is disabled by he firing of anoher ransiion. Assuming in Figure, for insance, ha fires a ime unis and accordingly he oken in p a is removed and a new oken k b = 2, is deposied in p b, hen 3 and 4 become enabled a ime unis. Thus 3 may no fire before 4 ime unis and mus fire before or a 5 ime unis, unless i becomes disabled by he firing of 4. When a ransiion fires, all okens in is oupu places ge he same oken value and oken ime. 3. Verificaion of Real-Time Embedded Sysems Model checking is an approach o formal verificaion used o deermine wheher he model of a sysem saisfies is specificaion, ha is, cerain required properies. The wo inpus o he model checking problem are he sysem model and he properies ha such a sysem mus saisfy, usually expressed as emporal logic formulas. For verificaion purposes, we resric ourselves o safe PRES+ nes, ha is, a place p P may hold a mos one oken for a cerain marking M. Oherwise, he formal analysis would become more cumbersome. This is a rade-off beween expressiveness and analysis power. Our approach allows o deermine he ruh of CTL (Compuaion Tree Logic) [4] and TCTL (Timed CTL) [] formulas wih respec o a (safe) PRES+ model. Formulas in CTL are composed of aomic proposiions, boolean connecors, and emporal operaors. Temporal operaors consis of forward-ime operaors (G globally, F in he fuure, X nex ime, and U unil) preceded by a pah quanifier (A all compuaion pahs, and E some compuaion pah). TCTL is a real-ime exension of CTL ha allows o inscribe subscrips on he emporal operaors o limi heir scope in ime. For insance, AF <n P expresses ha, along all compuaion pahs, he propery P becomes rue wihin n ime unis. In our approach he aomic proposiions of CTL/TCTL correspond o he marking of places in he ne. Thus he aomic proposiion p holds iff p P is marked. There are several ypes of analysis ha can be performed on PRES+ models: he absence/presence of okens in places of he ne, ime samps of such okens, and heir oken values. These analyses have been called reachabiliy, ime, and funcional analysis respecively. Our approach o verifica-

3 ion focuses on he firs wo, ha is, reachabiliy and ime analyses. If he sysem model does no bear guards, we can ignore ransiion funcions as reachabiliy and ime analyses will no be affeced by oken values. In order o verify he correcness of a real-ime embedded sysem, a sysemaic procedure o ranslae PRES+ ino imed auomaa was proposed in [5] (in he sequel, his procedure is referred o as naive ranslaion), so ha i is possible o make use of exising model checking ools, namely HyTech [], KRONOS [2], and UPPAAL [4]. In such an approach he resuling represenaion consiss of a collecion of imed auomaa which operae and coordinae wih each oher hrough shared variables and synchronizaion labels. One auomaon wih one clock is obained for each ransiion. Since he complexiy of model checking of imed auomaa is exponenial in he number of clocks, ha approach is no pracical for large sysems. In his paper we improve he verificaion approach inroduced in [5] in wo differen ways: applying a ransformaion-based concep in order o simplify he sysem model; exploiing he srucure of he ne by clusering ransiions. These reduce considerably he complexiy of he verificaion process. 3.. Reducion of Verificaion Complexiy by using Transformaions For he sake of reducing he verificaion effor, we firs ransform he sysem model ino a simpler one, sill semanically equivalen, and hen verify he simplified model. If a given model is modified using correcness-preserving ransformaions and hen he resuling one is proved correc wih respec o is specificaion, he iniial model is guaraneed o be correc, and no inermediae seps need o be verified. This simple observaion allows us o reduce significanly he complexiy of verificaion. We can define a se of ransformaion rules ha make i possible o ransform only a par of he sysem model. A simple bu useful ransformaion is shown in Figure 2. We do no inend o provide here a comprehensive se of ransformaions bu raher illusrae he ransformaion of jus a porion of he model (such a se of ransformaion rules has been defined in [8]). Assume ha wo subnes N' and N'' are oal-equivalen in he sense defined in [6]. The inuiive idea behind oal-equivalence is as follows (he reader is referred o [6] for a formal definiion): (a) here exis bijecions ha define one-o-one correspondence beween in(ou)-pors of N' and N'' ; (b) having iniially okens wih he same oken value and ime in corresponding inpors of N' and N'', here exiss a firing sequence which leads o a marking wih he very same oken value and ime in corresponding ou-pors. I is no difficul o prove ha A place p P is an in-por of he subne N = ( P, T, I, O, M 0 ) iff (, p) O for all T. A place p P is an ou-por of N iff ( p, ) I for all T. N' and N'' are oal-equivalen, provided he condiions given in Figure 2 are saisfied and ha neiher nor are in conflic wih any oher ransiion. An ineresing aspec for his ransformaion is ha if he par of he sysem model represened by he subne N' is replaced by N'', he overall behavior is he same in boh cases. Such a ransformaion rule could be used, herefore, o simplify PRES+ models and accordingly reduce he complexiy of he verificaion process. N p p n [G] f f 2 [a,b ] p 2 [a,b ] q q m 2 2 Toal-equivalence f = f o 2 f a = a + a 2 b = b + b 2 M ( p) = 0 Figure 2. A simple ransformaion rule We may ake advanage of ransformaions o reduce he complexiy of verificaion. The idea is o simplify he sysem model using ransformaions from a library. In he case of oal-equivalence ransformaions, since an exernal observer could no disinguish beween wo oal-equivalen nes (for he same okens in corresponding in-pors, he observer would ge in boh cases he very same okens in corresponding ou-pors), he global sysem properies are preserved in erms of reachabiliy, ime, and funcionaliy. Therefore such ransformaions are correcness-preserving: if a propery P holds in a ne ha conains a subne N'' (ino which a oal-equivalen subne N' has been ransformed), i does in anoher ha conains N' ; if P does no hold in he firs ne, i does no in he second eiher Reducion of Verificaion Complexiy by Clusering Transiions 0 In order o reduce he number of auomaa/clocks resuled from he ranslaion of PRES+ models ino imed auomaa, we propose an algorihm ha exracs he sequenial behavior of he Peri ne by clusering ransiions. Inuiively, each cluser consiss of a sequence of ransiions where he firing of one of hem enables he nex one. The inpu of he algorihm is a safe Peri ne and is oupu is a se of clusers, each represening a sequenial par of he ne. Then we obain he imed auomaa, wih one auomaon and one clock per cluser (insead of one auomaon and one clock per ransiion). A cluser is an ordered uple of disinc ransiions deno- N p [G] q f p n [a,b] q m

4 ed C= (,, n ), such ha i+ becomes enabled iff i fires, for i < n. We say ha and n are, respecively, he head and he ail of C. In Figure 3, a possible cluser is C= (, 3, 5 ) wih head and ail 5. p a l p l l a b b p b 2 [2,5] 2 a- [3,4] p j j+k [,2] Figure 3. PRES+ model o be clusered The cluser se S C of a cluser C= (,, n ) is he se of ransiions ha are componens of C, ha is S C = {,, n }. We explicily make a disincion beween cluser and cluser se because in he former case he order of he componens is relevan whereas he order of elemens in a se is immaerial. The objecive of our clusering algorihm is o find a se of clusers such ha heir cluser ses form a pariion of T (he se of ransiions of he Peri ne). In oher words, we aim a finding a number of clusers such ha each ransiion T is in one and only one cluser. We define he anerior se of a ransiion T, denoed an(), as he se of hose ransiions ha when fired will deposi a oken in some place in he pre-se, ha is, an()= p i. p i Similarly, he poserior se pos() of a ransiion T is he se of ransiions ha will ge a oken in some place of o heir pre-se when is fired, ha is, pos() = p i. p i o We define he anerior se an( C) of a cluser C= (,, n ) as he anerior se of is head, ha is, an( C)=an( ). The poserior se pos( C) of a cluser C= (,, n ) is he poserior se of is ail n, ha is, pos( C)=pos( n ). Consider, for example, he cluser C= ( 0,, 3 ) in he ne shown in Figure 3. Is anerior and poserior ses are an( C)= { 9 } and pos( C)= { 5, 6 } respecively. The clusering algorihm we propose ries o add a new head or ail o an exising cluser C. We keep a lis of free ransiions freet, i.e. ransiions no allocaed ye o any cluser. Le C= ( h,, ) be a cluser wih head h and ail and le freet be he se of free ransiions. We may add a j 9 c+ k c p c 3 [2,4] p k [,4] p d p e p f [,3] d e f 0 d 4 e 5 f 6 5 [2,3] [0,] p g p h p i h g i [h<2] h-2 7 g 8 new ail n o he cluser C if an( n )-{ n }={ } and n freet. We may add a new head nh o C if nh freet and an( C)-{ h }={ nh }. Consider again he example given in Figure 3. Assume his ime C= ( 9, 0, ) and freet=t -S C = { 2, 3, 4, 5, 6, 7, 8 }. Given ha 2, 3 freet and an( 2 )=an( 3 )={ }, boh 2 and 3 fulfill he requiremens for new ail saed above, bu only one of hem can be added as new ail o he cluser. In our algorihm his choice is made arbirarily. If, for insance, 3 is added o he cluser we obain C= ( 9, 0,, 3 ) and freet= { 2, 4, 5, 6, 7, 8 }. Noe ha 3 was removed from freet. I is no hard o see ha here is no ransiion o be added as new head of he cluser. Our clusering algorihm sars by selecing arbirarily a ransiion from he free lis. A new cluser C is formed so ha is iniially boh head and ail of C, and is removed from freet. The nex sep is o examine only hose ransiions in pos( C) ha are also in freet and check wheher hey may be a new ail of C. If so, he cluser is enhanced by adding a new ail. We repea he process unil no new ail may be added o he cluser. Then, in a similar fashion, we ry o enhance he cluser by adding a new head and repea unil here is no new head candidae in he free lis. When he cluser can no longer be enhanced, we selec anoher ransiion from freet, form a new cluser, and repea he process unil all ransiions have been allocaed o a cluser. The clusering algorihm is shown in Figure 4. clusering(safepn N) se freet := T while freet do wih an arbirary freet do new cluser C = () se se freet := freet {} newhead := rue se newail := rue // ry o add a new ail while newail do n se newail := false wih an arbirary n pos( C) freet such ha an( n ) { n } = { } do add n o C se freet := freet { n } se newail := rue endwih endwhile // ry o add a new head while newhead do nh se newhead := false wih nh an( C) freet such ha an( C) { h } = { nh } do add nh o C se freet := freet { nh } se newhead := rue endwih endwhile endwih endwhile endclusering Figure 4. Clusering algorihm By applying our clusering algorihm on he sysem of Figure 3, we obain he clusers C = ( 9, 0,, 2, 4 ), C 2 = ( 3, 5, 7 ), C 3 = ( 6 ), C 4 = ( 8 ). Noe ha he oupu of

5 he algorihm is no unique since here migh be new-ail ransiions chosen arbirarily. We could also have go, for insance, C '=( 9, 0,, 3, 6), C 2 '=( 2, 4 ), C 3 '=( 5, 7 ), C 4 '=( 8 ). However, in eiher case, he number of clusers is he same. A simple analysis shows ha he proposed algorihm has a (wors-case) ime complexiy O(n 2 ), where n is he number of ransiions in he ne. We have applied he clusering algorihm o hree differen examples ha can be scaled up. I is no our inenion o discuss hem here bu raher use hese examples in order o illusrae he performance of he algorihm in erms of execuion ime. Figure 5 shows he execuion imes of he clusering algorihm for he hree cases sudied. Clusering Time [s] Parallel Serial Comm Number of Transiions Figure 5. Performance of he clusering algorihm 3.3. Translaing PRES+ ino Timed Auomaa A imed auomaon is a finie auomaon augmened wih a finie se of real-valued clocks [2]. Timed auomaa can be hough as a collecion of auomaa which operae and coordinae wih each oher hrough shared variables and synchronizaion labels. There is a se of real-valued variables, named clocks, all of which change along he ime wih he same consan rae. There migh be condiions over clocks ha express iming consrains. An exended Timed Auomaa model (TA) can be expressed as M = ( L, L 0, E, ΣσX,,, V, ΦυR,,, A, I), where L is a finie se of locaions; L 0 L is a se of iniial locaions; E L L is a se of edges; Σ is a finie se of labels; σ : E Σ is a mapping ha labels each edge in E wih some label in Σ ; X is a finie se of real-valued clocks; V is a finie se of variables; Φ is a mapping ha assigns o each edge e= ( l, l' ) a clock condiion Φ( e) over X ha mus be saisfied in order o allow he auomaon o change is locaion from l o l' ; υ is a mapping ha assigns o each edge e= ( l, l' ) a variable condiion υ( e) over V ha mus be saisfied in order o allow he auomaon o change is locaion from l o l' ; R : E 2 X is a rese funcion ha gives he clocks o be rese on each edge; A is he aciviy mapping ha assigns o each edge e a se of aciviies Ae ( ); I is a mapping ha assigns o each locaion l an invarian I() l which allows he auomaon o say a locaion l as long as is invarian is saisfied. In order o verify he correcness of sysem represened in PRES+, we ranslae he sysem model ino imed auomaa so ha model checking ools can be used. In wha follows we describe he sysemaic procedure o ranslae PRES+ models ino TA afer clusering has been performed. The resuling model will consis of one auomaon and one clock per cluser. The ranslaion procedure ha we propose here is correc as long as he underlying unimed Peri ne is safe. We use he example of Figure 3 in order o illusrae he ranslaion procedure, consising of he following seps. Sep. Define one clock in X for each cluser. Define one variable in V for each place p x of he Peri ne, corresponding o he oken value v x when p x is marked. Sep 2. Define he se Σ of synchronizaion labels as he se of ransiions in he Peri ne. Seps 3 hrough 9 mus be performed for each one of he clusers obained by using he clusering algorihm. Consider a cluser C= (,, n ) wih head and ail n. For i S C ( i denoes he i-h ransiion in cluser C), le f + i be he ransiion funcion associaed o i, and le d ī and d i be he minimum and maximum ransiion delays associaed o i. Le G i v be he guard associaed o he ransiion i. Le p be he value of he oken in he place when marked. x x The imed auomaon corresponding o he cluser C is denoed C. The clock corresponding o C is denoed c. For he sake of clariy, we firs presen he ranslaion seps for he simples case: we iniially assume ha i is no in conflic wih any oher ransiion, for all i S C, and ha ( pos( C)-{ n }) S C =. Laer we will discuss he general case where hese assumpions do no hold. Sep 3. Define m+n locaions a,, a m, b,, b n, where m= an( C)-{ } and n= S C. These are he locaions of C. Define m edges ( a j, a j+ ), for j=,, m-, wih synchronizaion labels corresponding o he ransiions in an( C)-{ }. Define also m edges ( a m, b ) wih synchronizaion labels corresponding o he ransiions in an( C)-{ }. Then define one edge ( b i, b i+ ), for i=,, n-, wih synchronizaion label i. Define one edge ( b n, a ) wih synchronizaion label n. Consider he cluser C = ( 9, 0,, 2, 4 ) for he model given in Figure 3. We have n=5 for his cluser. Since an( C )={ 7, 8 } we have m=2. Therefore, he auomaon C corresponding o he cluser C has 7 locaions a, a 2, b 9, b 0, b, b 2, b 4 and is edges are as shown in Figure 6. Noe ha corresponds o he locaion in which ran- b k

6 C c<=5 c==5 b4 c:=0, d:=b g:=d 4 a 2 c>=2,c<=5 b2 c<=5 7 8 c:=0, b:=a-, c:=a- a2 c>=,c<=2 8 c:=0 c<=2 c:=0 7 b9 c==2 b c<=2 0 c:=0, a:=l 9 b0 c:=0, l:=j+k c<=3 c>=,c<=3 j:=h-2 h<2 c2>=3,c2<=4 c2<=4 c2:=0 h>=2 a 7 b7 c2:=0, h:=e c2:=0 b3 3 b5 5 c2>=2,c2<=3 c2<=4 c2>=,c2<=4 c2:=0, e:=c+, f:=c+ c2<=3 C 2 C 3 a k:=g 4 6 a c3:=0 c3<=4 c3:=0 b8 c3>=2,c3<=4 a i:=f 3 6 c4:=0 b6 c4<= C 4 Figure 6. Equivalen imed auomaa siion is enabled (if has no guard). The change of k k locaion, for example, from b o b 2 corresponds o he firing of ransiion. Sep 4. For every edge e j = ( a m, b ) and every edge e i = ( b i, b i+ ), i < n, define Re ( j )=R( e i )={ c}. For any oher edge e in C, define Re ( )=. This means ha on all edges bu ( a j, a j+ ), j < m, and ( b n, a ) he clock c will be rese. In Figure 6, he assignmen c k := 0 represens he rese of clock c k. Sep 5. For every locaion b i, i n, define is locaion + invarian as c d i. This enforces he firing of i before or a is laes rigger ime. Sep 6. To every edge wih synchronizaion label, where + i i S C, assign he clock condiion d ī c d i. In Figure 6, for example, he edge ( b 2, b 4 ) (wih synchronizaion label 2 ) of he auomaon C has a clock condiion 2 c 5 where 2 and 5 are he minimum and maximum ransiion delays of 2. Sep 7. For every edge wih synchronizaion label i, where i S C, and for every p j i assign o such an edge he v := f aciviies. j i For insance, he aciviies assigned o he edge ( b, b 2 ) wih synchronizaion label in he auomaon C are b := a- and c := a-, where a- is he ransiion funcion of. Sep 8. If he ransiion i S C has a guard G i, assign he variable condiion G i o he edge wih synchronizaion label i. Then add an edge e= ( b i, b i ) wih no synchronizaion label, variable condiion G i (he complemen of G i ), and Re ( )={ c}. Noe he variable condiion h < 2 on ( b 7, a ) and he edge ( b 7, b 7 ) in he auomaon C 2. This is due o he guard h < 2 of ransiion 7. Sep 9. If he ransiion i S C is enabled in he iniial marking, make he locaion b i he iniial locaion of C. Oherwise, if here are k places iniially marked in he prese of he head ( 0 k < m so ha is no enabled), make a k + he iniial locaion of C. In our example, b is he iniial locaion of C because he ransiion S C is enabled in he iniial marking of he ne. The auomaon C 2 has a as iniial locaion because none of he ransiions of he cluser C 2 is iniially enabled. Observe ha one and only one of he ransiions of a given cluser will be enabled a a ime. If wo ransiions in a cluser were enabled simulaneously, ha would imply ha he (underlying unimed) Peri ne is no safe. We have assumed ha i is no in conflic wih any ransiion, for all i S C, and ha ( pos( C)-{ n }) S C =. Now we discuss he cases in which hese assumpions do no hold: a) In case ha pos( C)-{ n } = { } (he poserior se of he cluser ail is he singleon conaining he cluser head) he auomaon C will have n locaions b,, b n, where n= S C, bu no a i locaions. There will be addiionally one edge ( b n, b ) wih synchronizaion label n and clock condiion, variable condiion, clock rese, and aciviies similar o he oher edges ( b i, b i+ ); b) If one of he ransiions i S C is in conflic wih anoher ransiion c, jus add o he auomaon C one edge ( b i, a ) wih synchronizaion label c. 4. Experimenal Resuls This secion presens wo examples which we use in order o illusrae our verificaion approach and he proposed improvemen echniques.

7 4.. Ring-Configuraion Processes We illusrae our verificaion approach on a scalable example, comparing he echnique based on a naive ranslaion from PRES+ ino auomaa inroduced in [5], he ransformaional approach presened in Secion 3., and he one formulaed in Secion 3.2 where he srucure of he ne is exploied. p i q i Figure 7. Model for one ring-configuraion process The example ha we use represens a number n of processes arranged in a ring configuraion. The model for one such process is illusraed in Figure 7. Each one of he n processes in he sysem has a bounded response requiremen, namely whenever he process sars i mus sricly finish wihin a ime limi, in his case 25 ime unis. Referring o Figure 7, he sar of one such process is denoed by he marking of p sar while he marking of p end denoes he end of he process. This requiremen is expressed by he TCTL formula AG( p sar AF <25 p end ). We have used UPPAAL [4], running on a Sun Ulra 0 worksaion, in order o model-check he iming requiremens of he processes in he ring-configuraion example. The resuls are summarized in Table. Table. Verificaion of he ring-configuraion example Number of processes (n) Naive [5] Verificaion Time [s] Transformaions Clusering Transf. + Clusering 2 < < < NA * NA * NA * NA * 6200 * No available: ou of ime Specificaion does no hold [,2] [0,] p sar 0 p end [,2] 5 p i+ q i+ The second column of Table corresponds o he verificaion ime using he approach of [5] (naive ranslaion of PRES+ ino imed auomaa). Noe ha only sysems up o 5 processes can be handled wih such an approach. The hird column in Table gives he resuls of verificaion when using he approach presened in Secion 3.: ransformaion of he model ino a semanically equivalen and simpler one in order o reduce complexiy, followed by naive ranslaion ino imed auomaa. The verificaion ime for he example of processes in a ring configuraion using he clusering approach of Secion 3.2 is shown in he fourh column of Table. These resuls include he execuion ime of he clusering algorihm. By combining he clusering echnique and he ransformaion-based one, i is possible o furher improve he efficiency of he verificaion process as shown in he las column of Table. We have ploed all hese experimenal resuls in Figure 8. Verificaion Time [s] Naive Transf. Clusering Transf. + Clusering Number of Processes Figure 8. Verificaion of ring-configuraion processes Observe ha for n=7 he bounded response requiremen expressed by he formula AG( p sar AF <25 p end ) is no saisfied, a fac which, a firs glance, is no obvious a all. An informal explanaion is ha since ransiion delays are given in erms of inervals, one process may ake longer o execue han anoher; hus differen processes can execue ou of phase and his phase difference may be accumulaed depending on he number of processes, causing one such process o ake evenually longer han 25 ime unis (for n=7 ). I is also worh menioning ha, alhough he model has relaively few ransiions and places, his example is raher complex because of is large (unimed) sae space which is due o he high degree of parallelism Verificaion of a GMDFα In his secion we model and verify a realisic sysem: a GMDFα (Generalized Muli-Delay frequency-domain Filer) [9]. GMDFα has been used in acousic echo cancellaion for improving he qualiy of hand-free phone and eleconference applicaions. The GMDFα algorihm is a

8 X µ F. GMDFα SendX s X [0.3,0.4] Norm 2 [0.8,.2] FFT X F. µ F.2 µ F.K a. Mul [0.7,0.9] E F. E F.2 E F.K FFT 8 [0.8,.2] FFT - b. [0.8,.] Coef 2 Coef Updae c. [0.4,0.5] d. FFT [0.8,.2] Y F. Echo [0.0,0.05] e Sender 8 p RecE r E Delay X F.2 Delay 4.K- 0. X F.K Mul a.k Mul a.2 [0.7,0.9] [0.7,0.9] FFT - b.2 [0.8,.] FFT - b.k [0.8,.] Coef K Updae c.k Updae c.2 [0.4,0.5] [0.4,0.5] d.k FFT d.2 [0.8,.2] FFT [0.8,.2] Y F.2 Y F.K Conv 5 [0.7,] - FFT 6 [0.8,.] Diff 7 [0.,0.2] E Figure 9. GMDFα modeled using PRES+ frequency-domain block adapive algorihm: a block of inpu daa is processed a a ime, producing a block of oupu daa. The impulse response of lengh L is segmened ino K smaller blocks of size N (K=L/N), hus leading o beer performance. R new samples are processed a each ieraion and he filer is adaped α imes per block (R=N/α). The filer inpus are he signal X and is echo E, and he oupu is he reduced or cancelled echo E'. In Figure 9 we show he PRES+ model of he GMDFα. The ransiion ransforms he inpu signal X ino he frequency domain by a FFT (Fas Fourier Transform). 2 corresponds o he normalizaion block. Transiions a.i, b.i, c.i, and d.i consiue a basic cell, where a filer coefficien is updaed and hus he filer is adaped by using FFT - and FFT operaions. There are K insances of such a basic cell. Transiions 4.i serve as delay blocks. 5 compues he esimaed echo in he frequency domain by a convoluion produc and hen i is convered ino he ime domain by 6. The difference beween he esimaed echo and he acual one (signal E) is calculaed by 7 and oupu as E'. Such a cancelled echo is also ransformed ino he frequency domain by 8 o be used in he nex ieraion when updaing he filer coefficiens. In Figure 9 we also model he environmen wih which he GMDFα ineracs: e models he echoing of signal X, s and r represen, respecively, he sending of he signal and he recepion of he cancelled echo, and p is he eniy ha emis X. Transiion delays in Figure 9 are given in ms. We consider wo cases of a GMDFα of lengh 024: a) wih an overlapping facor α=4, we have he following parameers: L=024, K=4, N=256, and R=64; b) wih an overlapping facor α=2, we have he following parameers: L=024, K=8, N=28, and R=64. As seen in Figure 9, K affecs direcly he dimension of he model and, herefore, he complexiy of verificaion. Having a sampling rae of 8 khz, he maximum execuion ime for one ieraion is in boh cases 8 ms (64 new samples mus be processed a each ieraion). The compleion of one ieraion is deermined by he marking of he place E'. We wan o prove ha he sysem will evenually complee is funcionaliy. According o he ime consrain of he sysem, i is no sufficien o finish he filering ieraion bu also o do so wih a bound on ime (8 ms). This aspec of he specificaion is capured by he TCTL formula AF <8 E'. GMDFα L=024 Table 2. Verificaion of he GMDFα Naive [5] Verificaion Time [s] Transformaions Clusering Transf. + Clusering α=4, K= < α=2, K=8 NA * * No available: ou of ime By running UPPAAL on a Sun Ulra 0 worksaion, we have verified ha in boh cases he specificaion formula AF <8 E' indeed holds. Table 2 shows he verificaion ime

9 for boh cases (K=4 and K=8) comparing he echniques proposed in his paper wih previous work. Observe how significan is he improvemen, especially when he ransformaional and clusering approaches are combined. 5. Conclusions We have presened an approach o formal verificaion of real-ime embedded sysems represened in PRES+. We make use of model checking o prove he correcness of such sysems wih respec o reachabiliy and ime, specifying design properies as emporal logic formulas. In order o use available model checking ools he Peri ne model is ranslaed ino imed auomaa. We have proposed wo echniques aimed a improving he efficiency of verificaion. The firs is an approach ha makes use of correcness-preserving ransformaions in order o simplify he sysem model and, herefore, faciliae verificaion. The second one improves he ranslaion procedure from PRES+ ino ime auomaa: we have proposed an algorihm of complexiy O(n 2 ) ha exracs he sequenial behavior of he ne by clusering ransiions; hus we obain one auomaon wih one clock per cluser, insead of one auomaon wih one clock per ransiion. Experimenal resuls have demonsraed he worhiness of such improvemen echniques, and ha by combining he clusering sraegy and he ransformaional approach he efficiency of verificaion is improved considerably. References [] R. Alur, C. Courcoubeis and D. L. Dill, Model Checking for Real-Time Sysems, in Proc. Symposium on Logic in Compuer Science, 990, pp [2] R. Alur, Timed Auomaa, in Compuer-Aided Verificaion, D. Peled and N. Halbwachs, Eds. LNCS 633, Berlin: Springer- Verlag, 999, pp [3] R. Camposano and J. Wilberg, Embedded Sysem Design, in Design Auomaion for Embedded Sysems, vol., pp. 5-50, Jan [4] E. M. Clarke, E. A. Emerson, and A. P. Sisla, Auomaic Verificaion of Finie-Sae Concurren Sysems Using Temporal Logic Specificaions, in ACM Trans. on Programming Languages and Sysems, vol. 8, pp , April 986. [5] L. A. Corés, P. Eles, and Z. Peng, Verificaion of Embedded Sysems using a Peri Ne based Represenaion, in Proc. ISSS, 2000, pp [6] L. A. Corés, P. Eles, and Z. Peng, Definiions of Equivalence for Transformaional Synhesis of Embedded Sysems, in Proc. ICECCS, [7] L. A. Corés, P. Eles, and Z. Peng, Hierarchical Modeling and Verificaion of Embedded Sysems, in Proc. Euromicro Symposium on Digial Sysem Design, 200. [8] L. A. Corés, A Peri Ne based Modeling and Verificaion Technique for Real-Time Embedded Sysems, Liceniae Thesis, Dep. of Compuer and Informaion Science, Linköping Universiy, Linköping, Sweden, 200. [9] L. Freund, M. Israel, F. Rousseau, J. M. Bergé, M. Auguin, C. Belleudy, and G. Gognia, A Codesign Experimen in Acousic Echo Cancellaion: GMDFα, in ACM Trans. on Design Auomaion of Elecronic Sysems, vol. 4, pp , Oc [0] H. Hulgaard and S. M. Burns, Efficien Timing Analysis of a Class of Peri Nes, in Compuer-Aided Verificaion, P. Wolper, Ed. LNCS 939, Berlin: Springer-Verlag, 995. [] HyTech: The HYbrid TECHnology Tool, hp://wwwcad.eecs.berkeley.edu/~ah/hytech/ [2] KRONOS, hp://www-verimag.imag.fr/temporise/ kronos/ [3] T. G. Rokicki and C. J. Myers, Auomaic Verificaion of Timed Circuis, in Compuer-Aided Verificaion, D. L. Dill, Ed. LNCS 88, Berlin: Springer-Verlag, 994, pp [4] UPPAAL, hp:// [5] E. Verlind, G. de Jong, and B. Lin, Efficien Enumeraion for Timing Analysis of Asynchronous Sysems, in Proc. DAC, 996, pp [6] T. Yoneda and B.-H. Schlingloff, Efficien Verificaion of Parallel Real-Time Sysems, in Formal Mehods in Sysem Design, vol., pp , Aug. 997.