Analyzing Real-Time Systems 1

Transcription

1 Anlyzing Rel-Time Systems 1 Jürgen Ruf nd Thoms Kropf Wilhelm-Schickrd-Institute University of Tübingen, Snd 13, 7076 Tübingen, Germny {ruf,kropf}@informtik.uni-tuebingen.de Abstrct Temporl logic model checking is technique for the utomtic verifiction of systems ginst specifictions. Besides the correctness of sfety nd liveness properties it is often importnt to determine criticl nswer nd dely times of systems, especilly if they re embedded in rel-time environment. In this pper we present n pproch which llows the verifiction s well s the timing nlysis of reltime systems. The systems re described s networks of communicting time-extended finite stte mchines (I/Ointervl structures). We use compct symbolic representtion to obtin efficient nlysis lgorithms This work is supported by the Germn Reserch Grnt (DFG project GRASP) 1. Introduction Forml verifiction hs become n importnt tsk in the design of softwre nd hrdwre. Especilly utomtic techniques like temporl logic model checking re used to support or even to replce stndrd test nd simultion methods. In the re of embedded rective systems, the verifiction of timing constrins plys n importnt role. E.g. miniml nd mximl rection times of controller hve to be gurnteed, setup nd hold times of flipflops hve to be kept or wit times of work pieces in puse sttions of production utomtion system should be minimized. One possibility to verify such timing properties is to use rel-time temporl logic model checker. In this cse, the designer hs to specify the timing properties with temporl logic formuls nd the system s stte trnsition grph. After the utomted verifiction process, the model checker nswers yes or no. This mens the system stisfies the specifiction or not, e.g. the rection time lies under certin time bound or not. But the designer obtins no sttement bout the ctul vlue of the rection time. Therefore Cmpos nd Clrke developed n nlysis tool (VERUS) which llows the verifiction of rel-time properties s well s the quntittive nlysis of rel-time systems [1]. This tool gets n description of system s synchronous progrm, the specifictions in temporl logic nd the nlysis queries. The system description is trnslted into ROBDDs [] representing the stte trnsition grph. The disdvntge of this pproch lies in the representtion of time. Since time progress is represented by counters, there exists for every time step seprte stte in the underlying grph. Especilly if mny counters with lrge vlues exist, the stte spce my explode. Other pproches for rel-time model checking use timed utomt [3, 4, 5]. Timed utomt llow very detiled description of rel-time systems through fixed number of clocks defined over dense time model. However, these pproches hve very complex model checking lgorithms (they re PSPACE-complete) nd there exist no nlysis lgorithms. In [10] we hve presented new formlism clled I/Ointervl structure. This formlism expnds finite stte mchines by timed stte trnsitions. We developed efficient model checking lgorithms bsed on representtion of these structures with extended chrcteristic functions [6]. These functions re implemented with MTBDDs [7,8]. In [9] we hve presented method for the composition of I/Ointervl structures completely working on the MTBDD representtion, including two minimiztion heuristics. This pproch llows the integrtion of untimed FSMs (e.g. controller) nd I/O-intervl structures (e.g. timed environment). In this pper we develop nlysis lgorithms working on the symbolic representtion of intervl structures nd which mke optiml use of this MTBDD-Bsed representtion. These lgorithms determine criticl times of specified systems, e.g. wit times of production systems, rection times of embedded systems or mximl dely times of communiction protocols. Together with the lredy developed verifiction lgorithms, we now hve powerful tool for the verifiction nd the nlysis of rel-time systems out of mny domins.

2 Section 1 introduces the rel-time model checking pproch which is the bsis of the nlysis lgorithms. First the modeling formlism (I/O-intervl structures) nd the specifiction logic (CCTL) re introduced. Afterwrds we present the symbolic representtion with extended chrcteristic functions. In Section 3 the different nlysis lgorithms re introduced. Section 4 describes some optimiztions ccelerting the nlysis lgorithms. Experimentl results re shown in Section 5. Section 6 concludes this pper.. Rel-time model checking.1. Intervl structures nd I/O-intervl structures Structures re stte-trnsition systems modeling HW- or SW-systems. The fundmentl structures re Kripke structures (unit-dely [1,3] structures, temporl structures) which my be derived from FSMs. The bsic models for reltime systems re intervl structures, i.e., stte trnsition systems with dditionl lbelled trnsitions. We ssume tht ech intervl structure hs exctly one time clock for mesuring time. The Fig..1. Exmple IS clock is reset to zero if stte is entered. A stte my be left if the ctul clock vlue corresponds to dely time lbelled t n outgoing trnsition. The stte must be left if the mximl dely time of ll outgoing trnsitions is reched (Fig..1). One clock tick is the lowest grnulrity for the time modeling. Definition.1. An intervl structure (IS) I is tuple I = ( PSTLI,,,, ) with set of tomic propositions P, set of sttes S (i-sttes), trnsition reltion between the sttes T S S such tht every stte in S hs successor stte, stte lbeling function L:S ( P) nd trnsition lbeling function I:T ( IN ) with IN = { 1, } nd is the potentil set opertor. Every stte of the IS must be left fter the mximl stte time. Definition.. The mximl stte time of stte s MxTime:S IN is the mximl dely time of ll outgoing trnsitions of s, i.e. MxTime()= s. mx{ t s'. ( ss', ) T t = mx( I( s, s' ))} (1) Besides the sttes, we lso hve to consider the currently elpsed time to determine the trnsition behvior of the system. Hence, the ctul stte of system, clled the generlized stte, is given by n i-stte s nd the ctul clock vlue v (the elpsed time). Definition.3. A generlized stte (g-stte) g = ( s, v) is n i-stte s S ssocited with clock vlue v IN 0 ( IN 0 = { 01,, }). The set of ll g-sttes in I = ( PSTLI,,,, ) is given by: G = {( s, v) s S 0 v < MxTime() s } () The semntics of ISs is represented by runs. Definition.4. Given the IS I = ( PSTLI,,,, ) nd strting g-stte g 0. A run is sequence of g-sttes r = ( g 0, g 1, ). For the g-sttes g j = ( s j, v j ) G of the sequence holds either g j + 1 = ( s j, v j + 1) with v j + 1 < MxTime( s j ) or g j + 1 = ( s j + 1, 0) with ( s j, s j + 1 ) T nd v j + 1 Is ( j, s j + 1 ). To expnd intervl structures by possibility for communiction, we extend them to I/O-intervl structures. These structures crry dditionl input lbels on ech trnsition. Such n input lbel is Boolen formul over the inputs. We interpret this formuls s input conditions which hve to hold during the corresponding trnsition times. Inputinsensitive edges crry the formul true. Definition.5. An I/O-intervl structure (I/O-IS) is tuple I I O = ( PP, I, S, T, L, I, I I ). The set of ll input vlutions is: Inp := ( P I ). The components PSL,, nd I re defined s in IS. P I is finite set of tomic input propositions. The trnsition reltion connects pirs of sttes nd the destintion inputs: T S S Inp. 1 I I : T ( Inp) is the trnsition input lbeling. The execution semntics of I/O-intervl structures re similr to intervl structures. The only difference lies in the input restrictions. A trnsition my only be tken if the corresponding input restriction holds until the dely time is reched nd the stte is left.. The logic CCTL CCTL [9] is temporl logic extending CTL with quntittive bounded temporl opertors. Two new temporl opertors re introduced to mke the specifiction of timed properties esier. The syntx of CCTL is shown in (3); where p P is n tomic proposition, IN nd b IN { } re time bounds. All intervl opertors cn lso be ccompnied by single time-bound only. In this cse the lower bound is set to zero by defult. If no intervl is specified, the lower bound is implicitly set to zero nd the upper bound is set to infinity. If the X-opertor hs no 1. In the most cses, the input vlutions of the trget sttes re irrelevnt [10].

3 time bound, it is implicitly set to one. The semntics of CCTL is given in [10]. p ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ EX [ ] ϕ EF [ b, ] ϕ EG [ b, ] ϕ E( ϕ U [ b, ] ϕ) ϕ := E( ϕ C [ ] ϕ) E( ϕ S [ ] ϕ) AX [ ] ϕ AF [ b, ] ϕ AG [ b, ] ϕ A( ϕ U [ b, ] ϕ) A( ϕ C [ ] ϕ) A( ϕ S [ ] ϕ).3 Symbolic representtion of intervl structures In contrst to n explicit representtion, the symbolic representtion of FSMs uses chrcteristic functions. These functions mp sttes or trnsitions to true if they belong to the represented set. This representtion voids the explicit enumertion of sttes or trnsitions nd is therefore ble to represent sets of sttes with more thn 10 0 elements [11]. The representtion of g-sttes in IS need to store the elpsed time besides the ctul stte. Therefore we use extended chrcteristic functions (ECF, [1]) for symbolic representtion of IS. The following definition of ECFs is dpted to the representtion of IS. Definition.6. Given set of elements U (the universe, e.g. the set of sttes S) nd subset A U, where every element in A is ssocited with set of nturl numbers (the clock vlues, lso clled the ttribute set). An extended chrcteristic function representing A is given by: Λ A : U ( IN) with α if s A nd α IN Λ A ( s) 0 ssoc. with s := (4) otherwise I.e. we ccumulte ll clock vlues of g-sttes in the clock set which hve the sme i-stte. The stndrd set opertions like union or intersection my be extended to this kind of chrcteristic functions. ECFs my lso be used to represent the trnsition reltion. In this cse we mp pirs of sttes (the trnsition) to the vlid dely times. Also I/O-IS my be represented with ECFs..4 Model checking nd composition The min ide for the model checking lgorithm in [6] is to ssocite ech subformul of the specifiction with the set of g-sttes holding it. E.g. the formul "true" is ssocited with the set of ll g-sttes. The tomic proposition p P will be ssocited with the following g-stte set: { g g G s S. v IN 0.g = ( s, v) p L( s) } (5) The formul EXϕ will be ssocited with the set of predecessor g-sttes of the g-sttes ssocited with ϕ. Other temporl opertors my be computed by specil fixed point itertions bsed on the predecessor computtion. This com- (3) puttion my be split in two min opertions: the locl nd the globl predecessor computtion. The locl predecessor computtion tkes n ECF representing the ctul g-stte set nd decrements ll ttribute sets by one. A zero vlue will be removed: s.locl_ pre( Λ) ( s) = { v 1 v 1 v Λ( s) } (6) For set A of nturl numbers, we identify the set where ech vlue is decremented with: A 1. The globl predecessor computtion computes the predecessor of zero clocked g-sttes. This opertion works similr to the predecessor computtion of symbolic FSM trversl techniques. This opertion selects the g-sttes with zero clock vlues nd computes together with the trnsition reltion the predecessor g-sttes in predecessor i- sttes. This opertion is more complex thn the locl predecessor computtion. More detils my be found in [9]. The function pre is the union of the locl nd the globl predecessors. The result of this function is exctly the set of predecessors of given g-stte set. The function succ works similr nd computes the successor g-sttes. Model checking s described bove works exctly on one IS, but rel-life systems re usully described in modulr wy by mny intercting components. In order to mke model checking pplicble to networks of communicting components, it is necessry to compute the product structure of ll submodules. This product-computtion is clled composition. The composition is described in detil in [9]. The composition lgorithms re lso pplicble to networks of I/O-IS if we work with closed systems, where every free vrible is bounded by structure. After composition, the efficient model checking lgorithms for IS my be used for verifiction. These lgorithms re described in detil in [6]. Composition s well s the model checking lgorithms use the symbolic representtion of g-stte sets nd trnsition reltions with ECFs. 3. The nlysis lgorithms The nlysis technique should help designer to extrct importnt time bounds from his forml system description. An often rising problem is to compute the mximl stbility of signl. E.g. if we wnt to exmine switch circuit with dely times, it my be very importnt to determine the number of time steps, the out put signl stys stble high. This stbility nlysis is lso useful to compute the mximl number of time steps, work piece wits on buffer until it will be processed. Other typicl problems re miniml nd mximl dely times between events, e.g. how long does it miniml/mximl tke until the first work piece leves the production cell. In the following two subsections we present the nlysis lgorithms.

4 3.1 The STABLE lgorithm The nlysis lgorithms do lso use the trversl techniques (predecessor computtion) of the model checking lgorithms. The progrm 1 shows the implementtion of the STABLE-lgorithms in n impertive (C- or Pscllike) progrmming lnguge. 1 int stble(ecf f) ct := f 5 while (ct old ct ) do 6 old := ct 7 ct := pre(ct) ct 8 res := res if ct = then return res 10 else return Progrm 1. The STABLE lgorithm The lgorithm gets set of g-sttes to exmine (f). This set my be specified s CCTL formul nd my be computed by the model checking lgorithm (see Section.4). The lgorithm determines the mximl number of steps (res) such tht there exist run in which the first res g- sttes re members of the set represented by f but the g- stte t position res+1 is not member of f. The computtion of the lgorithms initilizes set of ctul g-sttes (ct) with the set of the g-sttes to exmine (f). Then it strts shrinking this set successively by intersecting it with its predecessors. If the set ct is empty, the mximl stbility is computed. If the lgorithm reches fixed point, i.e. ct=old, then there exist cycle in f. The figure 3.1 illustrtes the computtion of the STA- BLE lgorithm. The intervl structure to exmine is shown t the top. The lower prt displys the g-sttes nd the predecessor reltion (dotted rrows). The nlysis set is given by the CCTL formul AF [ ] which mens, tht on ll pths the signl must be rechble within two time steps. The grey ovl includes the ctul g-sttes (ct). The numbers on the left shows the ctul itertion (equl to res). 3. The MIN/MAX lgorithms The following two lgorithms compute the miniml resp. mximl number of unit time-steps between strt nd n im set of g-sttes. Cmpos nd Clrke introduced lgorithms bsed on n ROBDD representtion [13]. The ide of the lgorithm in progrm is to initilize set of g-sttes (ct) with the set of strt sttes nd then to expnd this set successively by its successors. The lgorithm counts the number of predecessor computtions while iterting (the dely time between g-stte nd its successor is exctly one time step). This procedure will be repeted until t lest one im stte is reched or the set AF [ ] 4 Fig Illustrtion of the STABLE-computtion. will not chnge nymore. In the ltter cse, there exist no pth from the strt sttes to the im sttes. 1 int min(ecf strt, im) ct := strt 5 while (ct old ct im = ) do 6 old := ct 7 ct := ct succ(ct) 8 res := res if ct im then return res 10 else return Progrm. The MIN lgorithm The lgorithm computing the mximl dely time is shown in progrm 3. It initilizes set with ll g-sttes except the the im set (ct). Then it shrinks this set by intersectin ct with its predecessors until no strt g-stte is left or fixed point is reched. In the ltter cse, there exists either no connection between the strt set nd the im set or there exist loop such tht the mximl dely time is infinite. 1 int min(ecf strt, im) ct := im 5 while (ct old ct im = )do 6 old := ct 7 ct := ct pre(ct) 8 res := res if ct=old then return 10 else return res Progrm 3. The MAX lgorithm 4. Time prediction nd time jumps As lredy mentioned in Section.4, the globl predecessor computtion is more expensive thn the locl predeces- 1

5 sor computtion. But on the other hnd, the set of globl predecessor g-sttes my sty constnt during some itertion steps. Upon this observtion, we present n optimiztion technique which computes globl predecessors only if they chnge. This technique (clled time prediction) ccelertes the nlysis lgorithms enormously. The ide is to predict the number of computtions for which the globl predecessors sty constnt. For this number of steps, the itertion will be performed loclly on the ttribute sets of the ECFs. We show this technique exemplrily for the STABLE lgorithm. The prediction exmines ll ttribute sets of the ctul stte set ( Λ A ) nd the globl predecessors ( Λ G ), computes the number of steps nd returns the minimum: predict( Λ A, Λ G ) := min s S l_ pred( Λ A ( s), Λ G ( s) ) (7) After the prediction is computed, the itertion of line 5 to 9 in progrm 1 my be performed loclly on the ttribute sets. Therefore we introduce locl itertion function (l_iter) which preforms this itertion on the ctul clock vlues ( A) nd the ctul globl predecessors ( G) of one stte: 1 set l_iter(set A, G, int n) res := A 4 i := 0 5 while i n res old do 6 old := res 7 res := res (res-1 G) 8 return res Progrm 4. Locl itertion function As lredy defined, the decrementtion in line 7 ffects ll vlues in the set. To pply this ttribute oriented function to n ECF, we pply it to every ttribute set: s. itertion( Λ A, Λ G, n) = l_iter( Λ A ( s), Λ G ( s), n) (8) With the knowledge of the locl itertion, we my define the locl prediction function. The function l_ pred receives two sets of nturl numbers, the ctul clock vlues ( A) nd the ctul globl predecessors ( G) of the exmined stte. The locl prediction hs to distinguishe two cses: l_ pred( A, G) n. { 0,, n} A n + 1 A := n + 1 if c G.c 0,, n (9) otherwise The only reson to recompute the globl predecessor is when zero clock vlue disppers. A new zero clock vlue my never pper. The zero clock vlue disppers fter n + 1 steps, when the vlues 0 to n re in the ctul g-stte nd the vlue n + 1 is not n ctul clock vlue. Moreover there my not exist vlue in G smller thn 1 int stble_predict(ecf f) ct := f 5 while (ct old ct ) do 6 old := ct 7 g := globl_pre(ct) 8 n := predict(ct,g) 9 ct := itertion(ct,g,n) 10 res := res + n 11 if ct = then return res 1 else return Progrm 5. Stble computtion with prediction n + 1 becuse this vlue supports the zero vlue. In this sitution every itertion step removes one element in A. The first step removes the vlue n, the second step removes the vlue n 1 nd so on. This mens fter n + 1 steps the zero clock vlue will be removed. In progrm 5 the complete lgorithm with time prediction is shown. An dditionl technique to ccelerte the lgorithms is clled time jump. This technique tries to improve the locl itertion. If we regrd the set of clock vlues in different itertion steps in figure 4.1, we relize, tht the ctul clock vlue set shrinks until it will be supported by vlue in G. itertion A G clock vlue Fig The behvior of the g-stte sets Therefore it is not necessry to perform every itertion step explicitly, we exploit this regulr behvior to execute in one complex opertion n itertion steps. Formlly we my define the time jump for the stbility nlysis through: jump( A, G, n) := v { v,, v+ n} A w v.w G { v,, w} A (10) This opertion is very implementtion dependent, therefore we will not show further detils. Figure Fig. 4. shows the computtion of figure 3.1with time prediction nd time jumps. On the right side of this figure, the result of the prediction for the next jump is shown. Becuse of the time prediction technique only globl itertion steps re necessry. 5. Experimentl results All presented lgorithms re implemented in our rel-time verifiction tool RAVEN. The ECFs re implemented by

6 0 1 Fig. 4.. Optimized STABLE-computtion multi terminl binry decision digrms (MTBDDs). We compred our implementtion with VERUS [1]. We modeled timed trnsitions in VERUS by loops which wit one time unit nd decrement counter. We compred only the min/mx lgorithms becuse VERUS do not support the stble query but on the other hnd VERUS offers two queries mincount nd mxcount which re ctully not supported by RAVEN. We hve chosen the sme vrible ordering for the signls. The exmined cse studies re the single pulser circuit enriched by timed gtes (SP), production cell (PC) nd the rbitrtion mechnism of the J1850 bus protocol. The first two systems re widely used to compre forml methods. Detils of the exmined systems my be found in [10]. For the single pulser we computed the miniml nd the mximl length of the output impulse. In the production cell we were interested in the miniml nd the mximl time when the first work piece leves the cell. In the J1850 exmple we checked the miniml nd the mximl dely time when node will leve the sending mode. The following tble compres the runtimes of both tools. For the VERUS run-times we tried vrious options nd choose the best results. For RAVEN we compred the time prediction (+t) nd the prediction together with the time jumps (+tj). The run-times in the tbel with nd without optimiztions seems to show, tht these techniques cuse only tiny speedup. But the run-times shown in the tble contin besides the nlyse times lso the composition times of the structures. In ll three exmples the composition consumes the mjor prt of the times (11.73 sec. for the single pulser, 000 seconds for the production cell nd 5 sec. for the J1850). If there will be more thn two nlysis (s computed in the exmples), thn the frction of composition time to nlyse time will shrink nd the the optimiztions will cuse lrger speedup. SP PC J1850 VERUS b RAVEN RAVEN +t RAVEN +tj VERUS terminted with n error: string tble overflow b. VERUS ws terminted due to memory consumption over 600MB predict = 6. Conclusion In this pper we presented new pproch for the nlysis of rel-time systems. This pproch works on the sme representtion s rel-time model checking. This llows the verifiction s well s nlysis. The systems re described by networks of communicting I/O-intervl structures. These structures include timed trnsitions nd the lbeling of these trnsitions with input restrictions. After the composition of the substructures, RAVEN performs the model checking nd the nlysis on the resulting intervl structure. Due to the symbolic representtion of the structures nd g-stte sets with extended chrcteristic functions, this pproch works very compct in the memory consumption. Especilly if long dely times re specified, the dvntges of this technique re obvious. By exploiting the loclly stored timing informtion (in the ttribute sets), techniques like time prediction nd time jumps ccelerte the model checking nd nlysis lgorithms. Bibliogrphy [1] S. Cmpos, E. Clrke, nd M. Mine. The verus tool: A quntittive pproch to the forml verifiction of rel-time systems. In CAV, LNCS. Springer Verlg, June [] R. Brynt. Grph-Bsed Algorithms for Boolen Function Mnipultion. IEEE Trnsctions on Computers, August [3] R. Alur, C. Courcoubetics, nd D. Dill. Model Checking for Rel- Time Systems. In LICS, Wshington, D.C., June IEEE CSP. [4] T. Henzinger, X. Nicollin, J. Sifkis, nd S. Yovine. Symbolic Model Checking for Rel-Time Systems. In LICS, Snt-Cruz, June 199. IEEE Computer Society Press. [5] M. Bozg, O. Mler, A. Pnueli, nd S. Yovine. Some progress in the symbolic verifiction of timed utomt. In CAV 97. Springer Verlg, June [6] J. Ruf nd T. Kropf. Symbolic model checking for discrete clocked temporl logic with intervls. In CHARME 97, Montrel, Cnd, Oct Chpmn nd Hll. [7] E. Clrke, K. McMillin, X. Zho, M. Fujit, nd J.-Y. Yng. Spectrl Trnsforms for lrge Boolen Functions with Appliction to Technologie Mpping. In DAC 93, Dlls, TX, June [8] R. Bhr, E. Frohm, C. Gon, G. Hchtel, E. Mcii, A. Prdo, nd F. Somenzi. Algebric Decision Digrms nd Their Applictions. In ICCAD, Snt Clr, CA, Nov ACM/IEEE, IEEE CSP. [9] J. Ruf nd T. Kropf. Using MTBDDs for composition nd model checking of rel-time systems. In FMCAD 1998, Plo Alto.Springer. [10] J. Ruf nd T. Kropf. Modeling nd Checking Networks of Rel- Time Systems. In CHARME 99, Bd Herrenlb, Germny. Springer Verlg, Septemper [11] J. Burch, E. Clrke, K. McMilln nd D. Dill. Symbolic Model Checking: 10 0 Sttes nd Beyond. In LICS, IEEE Computer Society press, June [1] J. Ruf nd T. Kropf. Using MTBDDs for discrete timed symbolic model checking. Multiple-Vlued Logic An Interntionl Journl, Gordon nd Brech publisher. [13] S. Cmpos, E. Clrke, W. Mrrero, M. Mine, nd H. Hirishi. Computing quntitive chrkteristics of finite-stte rel-time systems. Technicl Report, Pittsburgh, My 1994.