A new notion of realization of reactive systems is defined. Realization is defined as a relation between the states of two transition systems, the specification and the implementation, in which events are
classified as input, output or internal. This new definition attempts to model the correct interaction between a system and its environment. The differences with other definitions of refinement and
realization are discussed.Postprint (published version

Carmona Vargas, Josep

Cortadella, Jordi

English

A new notion of realization of reactive systems is defined. Realization is defined as a relation between the states of two transition systems, the specification and the implementation, in which events are

classified as input, output or internal. This new definition attempts to model the correct interaction between a system and its environment. The differences with other definitions of refinement and

realization are discussed

UPCommons

On the realization of reactive systems

UPCommons. Portal del coneixement obert de la UPC

On the realization of reactive systems Josep Carmona Jordi CortadellaSoftware DepartmentUniversitat Polite`cnica de CatalunyaBarcelona, Spainfjcarmona,jordicg@lsi.upc.esAbstractA new notion of realization of reactive systems is defined. Realization is defined as a relation be-tween the states of two transition systems, the specification and the implementation, in which events areclassified as input, output or internal. This new definition attempts to model the correct interaction be-tween a system and its environment. The differences with other definitions of refinement and realizationare discussed.1 IntroductionThe concept of realization between a specification and an object implementing the specification’s be-havior has been approached by some authors [LT87, Jos88, BS95, Neg98, YG01]. A new definition ofrealization is defined here, in order to take into account the following facts:1. The new realization notion must deal with Reactive systems, i.e., systems which react to changesof the environment. The environment where such systems operate can not be modified.2. It is not necessary to maintain the overall concurrency between the events of the specification.Reducing the concurrency leads sometimes to simpler representations which are still correct real-izations.Basic definitions are given in Section 2. Section 3 summarizes some of the existing notions of realizationand refinement. Section 4 is devoted to explain in detail the new notion of realization. An example isshown in Section 5.2 Basic definitionsA Transition System (TS) [Arn94] is defined as a quadruple A   SE T sin where S is a nonemptyset of states, E is a set of events, T   SES is the transition relation, and sin S is the initial state.The elements of T are called the transitions of TS and are denoted by s e s  or s e s . A transitioncan also be denoted by s e if there is a state s   S such that s e s .The reachability relation between states is the transitive closure of the transition relationT . A feasiblesequence is a (possibly empty) sequence of transitions  between states s and s  (denoted by s  s ). Afeasible trace is obtained from a feasible sequence by removing states. This work has been partially funded by CICYT (TIC 98-0410 and TIC 98-0949), ACiD-WG (ESPRIT 21949), a grant by IntelCorporation, and CIRIT (1999SGR-150 and 2000FI-00472).1The set of events in E is partitioned into input events (EI), output events (EO) and internal events(EINT). The events in the sets EIand EOare called observable events.A TS can be viewed as an automaton with alphabet E where every state is an accepting state. Fora TS A, let LA be the corresponding language. We denote w nH the projection of w to the alphabetE H. Correspondingly, given a set of words R, the set R nH   fw nH jw  Rg.3 Previous workA summary of the existing relations between systems is done in this section. First, a well-known equiv-alence between systems is defined: the Observational Equivalence, defined in Milner’s book [Mil89].Afterwards two refinement notions are shown: vJ, defined in [Jos88] and vN, defined in [Neg98].Finally, two realization notions are shown: j B, defined in [BS95] and j Y, defined in [YG01].3.1 Observational EquivalenceSeveral notions of equivalence have been defined in the literature. In Milner’s work on theory of concur-rent systems [Mil89], a notion of equivalence between two agents P and Q is defined.Observational Equivalence (): Let A   SE T sin and B   S  E  T   s in be two TSs. Aand B are observational equivalent (A  B) iff there exists a relation R   S  S   satisfying1. sin s in  R.2. (a) s  S, s   S  s.t. s s   R.(b) s   S , s  S s.t. s s   R.3. (a) If s  s    R, e  EI	EO and s e sthen    E INT such that s   e s ,and s s   R.(b) If s  s    R, e  EI	EO and s  e s then    EINT such that s  e s,and s s   R.The equivalence notion defined above is symmetric: the specification (implementation) can be eitherA or B. According to our notion of realization, this is a rather strict relation because the same set ofobservable traces must be maintained in the implementation.3.2 [Jos88]’s RefinementIn [Jos88] a set of simple rules was presented for the purpose of proving that a process B can be shownto be a refinement of process A. In order to deal with internal events, the refinement with the hidingoperator1 will be defined here. It allows to have internal events in B:[Jos88]’s Refinement with hiding (vJ): Let A   SE T sin, B   S  E  T s in be twoTSs, where E I  EI, E O  EOand EINT  . A vJB if there is a relation D   S  S  satisfying:1. s  S s   S  e  E  s e  s  s    D   s  S    E INT s  e s 2. (a) s  S s s  S  e  E INT se s  s  s  D   s  s   D(b) s  S s s  S  e  E  se s s  s  D   s   S  s e s  s   s   D3. sin s in  DRefinementvJdoes not distinguish the scope of the events (only events inC are considered internal).Moreover, A and B must have the same set of observable events.1This notion appears in the original paper as P v Pn C , whereC is a set of internal events in P.23.3 [Neg98]’s RefinementNegulescu defines in [Neg98] the Process Space Formalism, a generic theory which includes, amongothers, the notion of process refinement. It regards the refinement as a relative notion of correctness: Brefines A means that A can be replaced by B without bad effects. The notion of refinement is used therefor verification purposes.The theory of Process Spaces is briefly described here. Let E be an arbitrary set; the elements of Eare called executions. A process over E is a pair XY  of subsets of E such that X 	Y   E . The set ofall processes over E is called the process space of E and is denote by SE.The main intuition is the following: a process can describe a device by means of an agreementbetween the device and its environment, regarding executions. The agreement stipulates that only exe-cutions from X  Y are allowed to occur in presence of the device. Set X contains executions wherethe device violates the agreement, while set Y contains the executions in which the environment violatesthe agreement. Accordingly, X contains executions where the device respects the agreement (but theenvironment may or may not violate it), while Y contains executions in which the environment respectsthe agreement (but the device may or may not violate it). For a process p   XY , set X is called theaccessible set of p and set Y is called the acceptable set of p.The only parameter of a process space is the execution set; different models of processes can bechoosed depending on what the executions represent. The notion of refinement in the Process Spaceformalism is quite simple:[Neg98]’s Refinement (vN): Let p q  SEtwo processes. Process q   X Y refines processp   X  Y  (p vNq) iff X  Xand Y   Y.Loosely speaking, when p vNq, q accesses fewer (accepts more) executions than p. Therefore,depending on what is an execution, the refinement can be instantiated to several refinement notionsbetween real systems. For instance, in the scope of reactive systems, an execution set can be EI	EOor EI	EO	EINT. According to the definition of vN, no internal events can be inserted in q.3.4 [BS95]’s RealizationBrzozowski and Seger [BS95] define a notion of realization between two behaviors: one denoting thespecification’s behavior and the other denoting the implementation’s behavior.Brzozowski and Seger’s realization’s notion is defined over the languages of the two TSs denotingspecification’s and the implementation’s behavior. A   SE T sin and B   S  E  T   s in denotespecification’s and implementation’s TS, respectively.Let    PEI	 EO and x   be a observable word in LA. A set Y of input variables,Y   EI, is applicable in A after x if Y    or if there exists a    such that x  LA n EINTand   EI  Y. Word w  LB n E INTis relevant to A if w  LA n EINT, or w   x, wherex  LA nEINT,    and  EIis applicable to A after x. Let LBA be the set of all the wordsof B that are relevant to A. Loosely speaking, LBA contains those words in B that matter whenrealizing A: suppose x is input and y is output and word xy x yis in LB, but no word in LAallows xto precede x . Then the word xy x yis not relevant to A.Definitions of “deadlock” and livelock relative to the specification are also defined: let w  LB LA be a observable word. B has deadlock with respect to A if w leads to a terminal state in B, but to anonterminal state in A. Respectively, B has a livelock with respect to A if w leads to a nonterminal statein A, and to a state in B that has a cycle of internal events around it.A TS is input-proper if, whenever q w  q, q w   q , x  EI, qx qand w  n EINT w  n EINT  w, then there also exists q such that q x q . In other words, whether or not an inputchange is permitted in a given state should depend only on the observable trace leading to that state.[BS95]’s Realization (j B): Let A   SE T sin and B   S  E  T   s in be two TSs, withE   EI	EO	EINT, E   E I	E O	E INT, EI  E Iand EO  E O. B realizes A (A j BB) if31. A and B are deterministic, and B is input-proper.2. LBA nEINT  LA nE INT.3. B is deadlock-free with respect to A.4. B is livelock-free with respect to A.Restriction 2 requires that the set of relevant observable traces of the implementation must be equalto the set of observable traces of the specification. According to our intuition of realization, this is ratherrestrict for real life examples.3.5 [YG01]’s RealizationRecently Yoeli and Ginzburg defined in [YG01] a new notion of realization over “Circuit Transitionsystems”, which are TSs where a partition exists in the set of events, separating input, internal andoutput events. Let A   SE T sin and B   S  E  T   s in be two TSs, with E   EI	 EOandE   E I	E O	E INT.[YG01]’s Realization (j Y): B realizes A (A j YB) iff1. EI  E I, EO  E O.2. LA   LB nE INT3. Assume w  LA, z  EO, w z  LB and w  nE INT  w. Then wz  LA.4. Assume w w LA, and there exists w   LB, such that w  nE INT  w . Then there existsw  , such that w   nE INT  wand w w    LB.5. Let w  LA, w   LB, and w  nE INT  w. Then there exists a positive integer k such thatfor any word w    E INT, w w   LB implies length(w  )  k.Two comments must be done in this definition: firstly, the input-proper restriction can be violated inthe implementation. Secondly, Restriction 2 is rather restrict according to the notion of realization thatwe want to represent.4 I/O preserving realizationIn this section the I/O preserving realization over reactive systems will be defined formally. It is inspiredon the realization relation of Brzozowski and Seger, together with the refinement idea of Negulescu.We are interested in the combination of both approaches because the two relevant ideas presented inthe introduction are represented: j Bexpress the input-proper restriction on the implementation, whichcontributes to preserve safely the dialog between the system and its environment. Secondly, Negulescu’sidea of accessing the same or fewer executions represent the possibility of reducing the concurrency onlybetween non-input events.Definition 4.1 (I/O preserving realization)Let A   SE T sin and B   S  E  T   s in be two TSs, with E   EI	 EO	 EINT, E  E I	E O	E INT, EI  E Iand EO  E O. B realizes A (A j  B) iff there exists a relationR  S S such that:1. sin s in  R.2. If s  s    R then:(a) i  EIs.t. s i s: s  i s ,  s s   R.(b) o  EOs.t. s  o s : s o s,  s s   R.3. B is deadlock-free with respect to A.4. B is livelock-free with respect to A.Condition 1 imposes that initial states must be related by R. Conditions 2(a)-(b) concern about theenabledness of the observable events both in the specification and the implementation.4    Aabcxzyw(a)ac bwxzzzzybyycxxxy(b)Figure 1: (a) Interface of system A, (b) Transition System model.5 An exampleThe concepts will be presented with an example. Consider the system A, specified in Figure 1. It receivesmessages x, y, z and w, and generates messages a, b and c (Figure 1(a)). The behavior of such systemis specified with the TS of Figure 1(b). Figure 2 depicts the TSs of four possible implementations ofsystem A.The notions, vJ, vN, j B, j Yand the new realization notion j  will be used for restricting theset of implementations of system A. The following table depicts the restricted search spaces. An “x” incell (i,j) means that the element j belongs to the restricted state space when using relation i.2 (a) 2 (b) 2(c) 2(d) x xvNxvJx xj Bxj Yx xj  x xTable 1: Restrictions of the implementation space.According to the input-proper property, TS 2(a) can not be considered as a correct realization, dueto the insertion of the internal event  before of the input messages x, y and z. The input-properrestriction can be explained with this example: imagine that the realization of  takes three days: 2(a) isimposing that after message a has been generated, the environment must wait for three days before ofgenerating the messages x, y and z. Therefore, if implementation 2(a) was selected, the system(s) in theenvironment responsible of generating messages x, y and z must be resynthesized. The equivalence ,the realization j Yand the refinement vJinclude TS 2(a) in the restricted search space.5yyzzwxxxyyazcbzxcbλ(a)wxzbc bczzzyyyaxxxyλ(b)axxcbwxxzyyyyzzz(c)wyax zz xcbcb(d)Figure 2: TS of different implementations of system A.However, the insertion of the event  in 2(b) leads to an input-proper TS. Sometimes the specificationmust be modified in order to fulfill some implementability conditions. The transformations usuallyrequire the insertion of new internal events. The refinementvNdoes not include TS 2(b) in the restrictedsearch space.According to our notion of realization, TS 2(c) is a correct implementation of system A, because itrepresents a modification of the specification 1(b), where the concurrency of the output events b and cis reduced: the environment will receive 2(c)’s messages in a more restricted (but still expected) order.Realization j Bdoes not include TS 2(c) in its restricted search space.6 ConclusionsA new realization notion over reactive systems have been defined. It is based on the idea that a reactivesystem must operate in a distributed environment, where a fixed dialog exists between the system andthe external systems (the environment). Comparison with respect to other definitions of equivalence,refinement and realization show the suitability of the new notion.References[Arn94] A. Arnold. Finite Transition Systems. Prentice Hall, 1994.[BS95] Janusz A. Brzozowski and Carl-Johan H. Seger. Asynchronous Circuits. Springer-Verlag, 1995.[Jos88] Mark B. Josephs. A state-based approach to communicating processes. Distributed Computing,3:9–18, 1988.6[LT87] Nancy A. Lynch and Mark R. Tuttle. Hierarchical correctness proofs for distributed algorithms.In Sixth Annual ACM Symposium on Principles of Distributed Computing, pages 137–151,Vancouver, British Columbia, Canada, August 1987.[Mil89] Robin Milner. Communication and Concurrency. Prentice-Hall, 1989.[Neg98] Radu Negulescu. Process Spaces and Formal Verification of Asynchronous Circuits. PhDthesis, Department of Computer Science, University of Waterloo, Waterloo, Ontario, Canada,August 1998.[YG01] M. Yoeli and A. Ginzburg. Lotos/cadp-based verification of asynchronous circuits. ReportCS-2001-09-2001, Technion - Computer Science Department, September 2001.7

On the realization of reactive systems

Abstract

Similar works

Full text

Available Versions

UPCommons

UPCommons. Portal del coneixement obert de la UPC