Modeling and Verifying Asynchronous Communication Mechanisms using Coloured Petri Nets

Transcription

1 School of Elctrical, Elctronic & Computr Enginring Modling and Vrifying Asynchronous Communication Mchanisms using Colourd Ptri Nts Kyllr Gorgônio and Fi Xia Tchnical Rport Sris NCL-EECE-MSD-TR March 2008

2 Contact: Supportd by: EPSRC grant EP/C512812; CICYT TIN , a Distinction for Rsarch from th Gnralitat d Catalunya; Nokia Institut of Tchnology/Nokia do Brasil through coopration projct with Fdral Univrsity of Campina Grand NCL-EECE-MSD-TR Copyright c 2008 Univrsity of Nwcastl upon Tyn School of Elctrical, Elctronic & Computr Enginring, Mrz Court, Univrsity of Nwcastl upon Tyn, Nwcastl upon Tyn, NE1 7RU, UK

3 Modling and Vrifying Asynchronous Communication Mchanisms using Kyllr Gorgônio and Fi Xia March 2008 Abstract Asynchronous data communication mchanisms (ACMs) hav bn xtnsivly studid as data connctors btwn indpndntly timd concurrnt procsss. In prvious work, two automatic ACM synthsis mthods hav bn proposd. Howvr, problms rmain unrsolvd with th most asynchronous typ of ACMs, th ovrwriting and r-rading boundd buffr (OWRRBB), spcially with buffr sizs gratr than on. In this work, a mthod of systmatic modling and vrification of multi-cll OWRRBBs is prsntd. This mthod supports th study of ths kinds of ACMs with rgard to vital data and tmporal charactristics. 1 Introduction Allowing as much asynchrony as possibl is on of th most important goals whn dsigning communication schms btwn asynchronous procsss. And this task bcoms mor important whn th siz of computation ntworks bcoms larg and th traffic btwn th procssing lmnts incrass. On of th most important motivations for allowing maximal asynchrony in data communications is ral tim applications. Hard ral tim computational nods nd to hav indpndnt tmporal motiv powrs (clocks) and th timing of thrad xcutions should not b influncd by xtrnal data communications. An Asynchronous Communication Mchanism (ACM) is a schm dsignd to manag th transfr of data btwn a producr and a consumr procsss that ar not ncssarily synchronizd for data transfr. In th ACM modl thr is a shard mmory to hold th data bing transfrrd and som control variabls. This schm is shown in Figur 1. In this work th data consists of a stram of itms of th sam typ, th writr and radr procsss ar singl-thradd loops, and at ach itration a singl data itm is transfrrd to or from th ACM. Figur 1: ACM with shard mmory and control variabls ACMs may b of arbitrary siz and th shard mmory is organizd as a ring of mmory clls, as illustratd by Figur 2, ach on bing abl to hold on data itm. Each procss attmpting to accss a spcific cll has th accss to it grantd or dnid according to th valus of th control variabls and th rquirmnts th ACM should satisfy. NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 1

4 Figur 2: Multi-cll ACM schm Classical smaphors can b configurd to prsrv th cohrnc of writ and rad oprations. Howvr, this approach is not satisfactory whn data itms ar larg and a minimum locking btwn th writr and th radr is xpctd [Lam86]. By using singl-bit unidirctional variabls, th synchronization control can b rducd to atomic actions consisting of rading and writing thm [Sim03], providing th safst solution for a maximum asynchrony btwn th procsss. Variabls ar said to b unidirctional whn thy can only b modifid by on of th procsss. ACMs ar classifid according to whthr ovrwriting and r-rading ar allowd or not [Sim03, XHC + 04]. Ovrwriting occurs whn th ACM is full of non-rad data, and in this cas th producr may ovrwrit th data itm in a cll causing th ovrwrittn itm to b lost. R-rading occurs whn all data in th ACM has bn rad bfor, and in this cas th consumr is allowd to r-rad an xisting itm. Tabl 1 shows such a classification. BB stands for a boundd buffr that dos not allow nithr ovrwriting nor r-rading. RRBB stands for an ACM that only allows r-rading. On th othr hand, th OWBB schm allows only ovrwriting. Finally, th OWRRBB schm allows both r-rading and ovrwriting. No r-rading R-rading No ovrwriting BB RRBB Ovrwriting OWBB OWRRBB Tabl 1: Classification of ACMs For th r-rading ACM class, it is mor convnint to r-rad th itm from th prvious cycl rathr than an itm from svral cycls bfor. For ovrwriting, th typical cass consist of ovrwriting ithr th nwst or th oldst itm [Fas01, GCX07, Sim03, YKXK98]. Ovrwriting th nwst itm [YKXK98] attmpts to provid th bst continuity of data itms. Continuity is on of th primary rasons for having a buffr of significant siz. Ovrwriting th oldst itm is basd on th assumption that nwr data is always mor rlvant than oldr. Th choic of a particular class of ACM for a crtain job gnrally dpnds on data rquirmnts and systm timing rstrictions [Lam86, Sim03]. This is gnrally tru for ral-tim systms. An introductory xampl Now considr a simpl ACM with thr data clls. Th singl-bit (boolan) control variabls r i and w i, with i {1, 2, 3}, ar usd to indicat which cll ach procss must accss. Initially th radr is pointing at cll 0, r 0 = 1 and r 1 = r 2 = 0, and th writr at cll 1, w 1 = 1 and w 0 = w 2 = 0. Th shard mmory is initializd with som data. This schm is shown in Figur 3. Th writr always stors som data into th ACM and thn attmpts to advanc to th nxt cll rlasing th nw data. A possibl trac for th writr is wr 1 wr 2 wr 0 wr 1, whr wr i dnots writ data on cll i, and a possibl trac for th radr is rd 0 rd 1 rd 1 rd 2. Dpnding on how ths tracs intrlav, cohrnc and frshnss proprtis must b satisfid. Cohrnc is rlatd to mutual xclusion btwn th writr and th radr. For xampl, a possibl NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 2

5 Figur 3: Excution of RRBB ACM with 3 clls intrlaving is wr 1 wr 2 rd 0. Aftr th writr xcuting twic, th nxt possibl action for both procsss is to accss cll 0. This potntially introducs a data cohrnc problm. Frshnss is rlatd to th fact that th last data producd by th writr must b availabl for th radr. Th radr always attmpts to rtriv th oldst non-rad data. This mans that frshnss imposs a spcific data squncing, i.. th data is rad in th sam ordr that it is writtn. Data can b lost or rad mor than onc, but th ordr is maintaind. For th xampl abov, on possibl trac is wr 1 rd 0 wr 2 rd 1 rd 1. At th momnt th radr xcuts th first rd 1 action, th writr has alrady xcutd a wr 2. This mans that thr is som nw data on cll 2. But th radr is ngagd to xcut rd 1 again, violating frshnss. For diffrnt ACM typs thr may b diffrnt notions of frshnss. For instanc, frshnss may imply that th nwst non-rad data nds to b rtrivd. In this papr w concntrat on th oldst availabl data paradigm. For th xampl abov, a corrct trac is wr 1 rd 0 rd 1 wr 2 rd 1 wr 0 rd 2 wr 1. Th sub-trac rd 1 wr 2 rd 1 dos not contradict th fact that th radr only r-rads any data if thr is no nw on availabl. This is bcaus aftr th first rd 1 thr is no nw data, thn th radr prpars to r-rad and from this point it will ngag in a r-rading rgardlss th actions of th writr. Obsrv that in th xampl abov ach procss consists of an infinit loop, and at ach ACM opration: Th writr first writs to th shard mmory and thn tris to advanc to th nxt cll by modifying its control variabl w, if this is contradictory to th currnt valus of th radr s control variabl r, th writr waits. Whil th writr waits, th data itm just writtn into th ACM is not availabl for th radr to rad bcaus th writr has not yt compltd its mov to th nxt cll. Th radr first tris to advanc to th nxt cll by modifying its control variabl r, if this is contradictory to th currnt valus of th writr s control variabl w, no modification to r occurs. In ithr cas th radr thn rads (or r-rads) from cll r. Cll r cannot b accssd by th writr, vn if its contnt has alrady bn rad by th radr. In othr words, at any tim, ach of th writr and radr procsss owns a cll, and for data cohrnc purposs any cll can only blong to on of ths procsss at any tim. Furthrmor, sinc only binary control variabls ar usd, th siz of this dscription grows with th siz of th ACM. This mans that mor variabls ar ndd, and for ovrwriting ACM classs it is mor difficult to corrctly dal with all of thm. Ovrwriting ACMs ar also mor rlvant to ral tim applications bcaus ovrwriting braks any timing dpndncy of th radr on th writr. In [GCXY07] an automatic mthod for th synthsis of ACMs is proposd. It rquirs th gnration of th complt stat spac of th ACM by xploring all possibl intrlavings btwn th radr and th writr actions. Th stat spac of th ACM was gnratd from its functional spcification thn a Ptri nt [Mur89] modl was obtaind using th concpt of ACM rgions, a rfind vrsion of th convntional rgions. Anothr approach for gnrating ACMs is introducd in [GCX07]. It is basd on th synthsis of a Ptri nt modl using a modular NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 3

6 approach that dos not rquir th xplicit numration of th stat spac. Th Ptri nt modl is build by conncting a st of Ptri nt moduls. Finally th modl is translatd to C++ sourc cod. Ths synthsis mthods, howvr, hav shortcomings. For instanc, th low-lvl stat spac can bcom vry larg whn both ovrwriting and r-rading ar allowd, spcially if th numbr of clls in th ACM is also larg. This may rndr th ACM rgion basd mthod vry difficult or vn impossibl to us. Th modular approach, on th othr hand, is havily basd on huristics and human xprinc, lacking a formal proof of its corrctnss. This mthod rquirs th knowldg of xpctd bhaviors of an ACM or its parts to construct th moduls usd in th assmbly. Qustions might b raisd on th validity and rigorousnss of th rsults obtaind if vrification cannot b satisfactorily carrid out. For instanc, valid qustions may b raisd on whthr somthing blivd to b an xpctd bhavior at som low lvl dtail might actually b in conflict with som spcifid ovrall ACM proprty such as data cohrnc or frshnss. In this papr, w try to study th xpctd bhaviors of OWRRBBs of finit, but arbitrary, siz. Such xpctd bhaviors ar at a dtaild lvl drawn from prvious xprincs obtaind from th succssful synthsis of OWRRBBs of siz on and othr typs of ACMs of arbitrary sizs. If such bhaviors do indd satisfy th important ovrall proprtis rquird of this kind of OWRRBBs, attmpts at synthsizing using th modular mthod can thn b carrid out with high confidnc, avoiding travrsing th whol lowlvl stat spac. In ffct, w will attmpt to dvis a mthod with which modls can b obtaind and vrifications can b carrid out at a much highr lvl of abstraction which will nvrthlss provid for th sam dgr of confidnc in futur synthsis as complt low-lvl stat spac analysis may provid. And th mthod will includ progrssivly mor algorithmic modls which hopfully will lad to bttr synthsis. In th rst of th papr th st of bhaviors xpctd from OWRRBBs of arbitrary sizs is formally dscribd thn vrifid for data cohrnc and data frshnss. An ACM with this bhavior st is thn modld using [Jn92, Jn97]. Simulating th CPN modls producd Mssag Squnc Charts (MSC) [HT03] furthr clarifying th data and tmporal charactristics of th st of bhaviors, confirming that th CPN modls ar corrctly drivd. Finally, by spcifying data cohrnc and data frshnss using CTL, w ar abl to vrify for ths rquird OWRRBB proprtis on th CPN modls. This is don with th ASKCTL modl chckr. Th us of CPN to modl th bhavior of ACMs introducs th advantag of not rquiring th dsignr to spcify all dtails about th targt policy. In this way, it is possibl to introduc nw policis without th nd to construct its complt stat spac or to provid a low-lvl algorithmic dscription. This is don at a highr lvl of abstraction, allowing for simulation and vrification with lss ffort during dsign. In this sns, th us of MSCs allows th validation of th modl with rspct to th xpctd tracs of th ACM, which should b spcifid by a transition rul systm. 2 Ovrwriting ACMs Th xpctd bhavior of an ovrwriting ACM is dscribd as a transition systm. Each σ = a 0 a 1 a j 1 a j, whr j < n and n is siz of th ACM, dfins th stat of th ACM basd on th data itms availabl for rading. a j is th last writtn data, and a 0 is th nxt data to b rtrivd by th radr. Th siz of th ACM is givn by its numbr of clls, i.. th maximum numbr of data itms th ACM can stor at a crtain tim. σ also xprss if th procsss ar accssing th ACM or not. This is dnotd by flags in th a 0 and a j itms. a w j indicats that th writr is producing data a j, and this data is not yt availabl for rading. Similarly, a r 0 is usd to indicat that th radr is consuming data a 0. Thr ar four vnts that chang th stat of th ACM: rd b (a): rading data itm a bgins. NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 4

7 rd (a): rading data itm a nds. wr b (a): writing data itm a bgins. wr (a): writing data itm a nds. Th notation σ i σ j dnots th occurrnc of vnt from stat σ i to stat σ j. Th writr can add data in th ACM until it is full. In such cas, th oldst data itm is rplacd and th writr procds its normal opration. Th radr always tris to rtriv th oldst non-rad data and, if all data in th ACM has bn rad bfor, thn it attmpts to r-rad th last rtrivd data itm. Not that both procsss ar rquird not to wait whn starting an accss to th ACM. Th abov bhavior st is formally introducd by Dfinition 1. Ruls 1-4 modl th bhavior st of th writr. Ruls 5-8 modl th bhavior st of th radr. Dfinition 1 (OWRRBB transition ruls) Th bhavior st of an OWRRBB ACM is dfind by th following st of transitions (n is th numbr of clls of th ACM and th clls ar numbrd from 0 to n 1): 1. σ wr b(a) σa w 2. aσ wr b(b) σb w if σ < n if aσ = n 3. a r bσ wr b(c) a r σc w if abσ = n 4. σa w wr(a) σa 5. aσ rd b(a) a r σ 6. a r σ rd(a) σ if σ > 0 σ b w 7. a r rd(a) a 8. a r b w rd(a) ab w Obsrv that in stat a r b w th nxt lmnt to b rtrivd dpnds on th ordr that vnts wr (b) and rd (a) occur. If th writr dlivrs b bfor th radr finishs rtriving a, thn b will b th nxt data to b rad. Othrwis, th radr will prpar to r-rad a. It is also important to not that whn th ACM is full of data and writr is starting a nw accss action, som data is lost. If th radr is accssing th ACM, with a rd bσ in th data quu, thn th scond itm in quu is ovrwrittn. Othrwis, if th radr is idl, th quu contains aσ and first itm is rplacd. Dfinition 1 was modld using th Cadnc SMV modl chckr and frshnss and cohrnc proprtis wr vrifid. Each procss was modld as an SMV modul. In th SMV languag, a modul is a st of dfinitions, such as typ dclarations and assignmnts, that can b rusd. Spcifically, ach procss consists of a cas statmnt in which ach condition corrsponds to a rul in Dfinition 1. Th SMV modl obtaind from Dfinition 1 will b usd in Sction 3 to vrify a lowr lvl spcification of th ACM. Nxt, th spcification of th cohrnc and frshnss proprtis is discussd. Prviously [GCX07] th RRBB policy was modld in SMV and vrifid. Cohrnc Vrifying cohrnc rquirs to show that thr is no rachabl stat in th systm in which both procsss ar addrssing th sam sgmnt of th shard mmory. According to Dfinition 1, th radr always addrsss th data stord in th had of σ, whil th writr always addrsss th nd of th tail of σ. Vrifying cohrnc in this modl only rquirs to prov that vry tim th radr is accssing th ACM: NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 5

8 1. It is addrssing th first data itm, and 2. If th writr is also accssing th ACM, thn it is not writing in th first location. In othr words, if at a crtain tim th shard mmory contains a squnc of data σ = a 0 a 1 a j 1 a j, with j < n, whr n is th siz of th ACM. Thn, th following CTL formula should b satisfid: AG (a r σ (a r = a 0 (a w σ a w = a j j > 0))) Frshnss As discussd bfor, frshnss is rlatd to squncing of data. Lt us assum that at a crtain tim th shard mmory contains σ = a 0 a 1 a j 1 a j. At th nxt cycl th ACM will contain a squnc of data σ such that on of th following is tru: 1. σ = σ: nithr th radr has rmovd or th writr has stord any data itm in σ; 2. σ = a 0 a 1 a j 1 a j a j+1 : th radr has not rmovd any itm from σ, but th writr has addd a nw itm; 3. σ = a 1 a j 1 a j : th radr or th writr has rmovd a data itm from th had of σ. 4. σ = a 0 a 2 a j 1 a j : th writr has rmovd a data itm from th had of σ. Th abov can b spcifid by th following CTL formula: AG( σ = x AX(( σ >= x σ = σ + ) ( σ = x 1 σ = σ ))) whr σ + is usd to dnot a 0 a j or a 0 a j a j+1 and σ is usd to dnot a 1 a j 1 a j or a 0 a 2 a j 1 a j. Obsrv that 1 and 2 ar capturd by th sam sam CTL sub-formula, which is givn by th lft sid of th insid th AX oprator. 3 Modling ACMs with CPN In this sction w will dscrib an ACM fitting th bhavior st introducd in Sction 2 with a Hirarchical Colord Ptri Nt (HCPN) [Jn92, Jn97] modl. W will thn dscrib th proprtis of data cohrnc and data frshnss using ASKCTL and vrify th HCPN modl of th ACM for ths proprtis. An HCPN is a st of non-hirarchical CPN modls in which ach modl is calld a pag. Two mchanisms ar introducd to allow hirarchical lvls: substitution transition and fusion placs. A substitution transition is a transition that rprsnts a CPN pag. Th fusion placs ar physically diffrnt but logically th ar th sam, dfind by mans of a fusion st. All placs blonging to a fusion st hav th sam marking. As in othr typs of Ptri nts modls, a marking of a plac is th st of tokns in that plac at a givn momnt. And th marking of a nt is th st of markings of all placs. Whn a marking of a plac blonging to a fusion st changs, th marking of all placs blonging to that st also changs. In ordr to manipulat tokns in a CPN, it is dfind th concpt of multi-st. A multi-st is a st whr it is possibl to hav svral occurrncs of th sam lmnt. This concpt allows similar parts of th modl to b modld as tokn information instad of structur rplication. Figurs 4 and 5 shows th HCPN modls for th writr and radr procsss as introducd by Dfinition 1, rspctivly. Each procss has two transitions, on modling th bginning of a buffr accss NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 6

9 Idl 1 1` E Start Writing E input (q); output (nq); action (start_writing q); q nq ACM Fusion 1 [(0,non)] 1 1`[(0,non)] QUEUE Finish q nq input (q); output (nq); action (finish_writing q); Figur 4: CPN modl for th writr action and othr modling th nd of th action. In th initial stat both procsss ar rady to initiat an accss action and th buffr is initializd with som data. Placs labld ACM in th pag of th writr and in th pag of th radr modl th quu of data σ. Ths placs blong to th sam fusion st, maning that thy ar th sam plac. For this rason w will not distinguish thm from now. Th typ of th tokns in ACM is a list of data itms. A data itm is a pair (data,status) whr data is th data bing transmittd and status is on of wr, rd or non. Indicating if th data is bing writtn or rad in a givn marking. To avoid th stat spac xplosion, w usd data as a Boolan, but it can b st as an intgr, string or any othr data typ. Whn th writr bgins writing som data into th ACM, modld by transition Start in Figur 4, it adds a pair (data valu, wr) to th nd of th tokn alrady stord in plac ACM. For instanc, if th currnt marking of ACM is [(fals, non)] and th valu to b transmittd is tru, thn aftr th occurrnc of Start th marking of ACM will b [(fals,non),(tru,wr)]. In th notation of th prvious Sction w hav that fals wr b(tru) fals tru wr. In a similar way, whn th writr finishs accssing th ACM, modld by transition Finish, it updats th valu of th tokn in plac ACM to indicat that th nw valu is availabl for rading. In th xampl abov, th nw marking of ACM will b [(fals,non),(tru,non)]. A similar rasoning applis to th radr procss. Whn it starts rading from th ACM th valu of th first lmnt of th tokn on plac ACM is modifid to indicat th bginning of th accss. Mor spcifically, if th valu of th tokn is [(fals,non),(tru,non)], aftr th occurrnc of transition Start of th radr procss, th nw marking of ACM will b [(fals,rd),(tru,non)]. If th buffr is full, som data should b rplacd to procd writing a nw on. This is don by th function NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 7

10 start writing() calld in th cod rgion of transition Start. Whn th radr finishs th data rad action, dpnding on th status of th quu th first lmnt of th list of data itms is rmovd. Again, if th list of data itms contains [(fals,rd),(tru,non)], th had of th list can b rmovd and th nw data quu will contain [(tru,non)]. Howvr, if th ACM contains [(fals,rd)] or [(fals,rd), (tru,wr)], thn th had cannot b rmovd without th risk of both procsss addrssing th sam mmory sgmnt. In this cas th radr will prpar to r-rad th had of th quu, and th marking of plac ACM will not chang. In any cas, th radr is not rquird to wait for som vnt from th writr. Obsrv that nithr procss is rquird to wait for th othr in any situation Idl 1 1` E Start Rading E input (q); output (nq); action (start_rading q); q nq ACM Fusion 1 [(0,non)] 1 1`[(0,non)] QUEUE Finish q nq input (q); output (nq); action (finish_rading q); Figur 5: CPN modl for th radr Obsrv that for both procsss th modifications of th valu of a data itm ar xcutd by th SML functions associatd to ach transition of th procsss. Ths functions ar: 1. start writing(q:queue) 2. finish writing(q:queue) 3. start rading(q:queue) 4. finish rading(q:queue) Th function start writing(q:queue) is rsponsibl for adding an itm of th typ (DATA, wr) to th tokn rprsnting th status of th buffr. Th sourc cod bllow shows such a function. 1 fun start_writing data: QUEUE = NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 8

11 2 ( 3 lt 4 val wdata = discrt(min, max); 5 val msg = "start writing "^Int.toString(wdata); 6 in 7 msc.addevnt("writr", "radr", msg); 8 if (lngth data = n andalso 9 (#2 (hd data) = rd)) thn ( 10 [hd data]^^(tl (tl data))^^[(wdata, wr)] 11 ) ls if (lngth data = n andalso 12 (#2 (hd data) = non)) thn 13 tl(data)^^[(wdata, wr)] 14 ls 15 data^^[(wdata, wr)] 16 nd 17 ); Two constants ar dclard: on rprsnting th nw data to b transmittd, givn by wdata; othr to dfin th mssag that appars on th MSC. Th function first gnrats th mssag that appars on th MSC (lin 7), thn it chcks if th siz of th availabl data quu (i.. th data that has not bn rad) is qual to th siz of th ACM or not (lin 8). If this is tru and th radr is accssing th ACM (lin 9) thn th scond data itm on th quu is rmovd and th writr starts putting a nw data on th nd of th quu (lin 10). This cod implmnts th bhavior dfind by rul 3 on Dfinition 1. On th othr hand, if th quu is full but th radr is not accssing th ACM (lins 11 and 12), thn th first itm is discardd and writr starts storing a nw data on th nd of th quu (lin 13). And this implmnts th bhavior of rul 2 of Dfinition 1. Finally, if th quu is not full, th writr simply starts storing a nw data in th nd of th quu (lins 14 and 15), which implmnts rul 1 of Dfinition 1. Th function finish writing(q:queue) is rsponsibl for changing th last itm in th buffr from (DATA, wr) to (DATA, non) indicating that th nw data was rlasd for rading. Its sourc cod is shown bllow. 1 fun finish_writing data:queue = 2 ( 3 lt 4 val msg = "finish writing"; 5 in 6 if (lngth (tl data) > 0) thn 7 [hd data]^^finish_writing(tl data) 8 ls ( 9 msc.addevnt("writr", "radr", msg); 10 [(#1 (hd data), non)] 11 ) 12 nd 13 ); Th writr is always allowd to rlas th nw itm. finish writing simply signals on th last data itm that it has finishd writing by rplacing th pair (data, wr) by (data, non). Not that this is a rcursiv function, thn it nds to chck for th siz of th quu until it is mpty (i.. th data quu has only its had). finish writing implmnts th bhavior dfind by rul 4 of Dfinition 1. NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 9

12 Th function start rading(q:queue) is rsponsibl for changing th first itm in th buffr from (DATA, non) to (DATA, rd) to indicat that th radr startd accssing it. 1 fun start_rading data: QUEUE = 2 ( 3 lt 4 val msg = "start rading "^Int.toString(#1 (hd data)); 5 in 6 msc.addevnt("radr", "writr", msg); 7 [(#1 (hd data), rd)]^^tl data 8 nd 9 ); Th function finish rading(q:queue) is rsponsibl for dtrmining if th radr will nxt r-rad th currnt data itm or gt a nw on. If r-rad is triggrd, it changs th first itm in th buffr from (DATA, rd) to (DATA, non), othrwis it rmovs that itm from th buffr. 1 fun finish_rading data: QUEUE = 2 ( 3 lt 4 val msg = "finish rading"; 5 in 6 msc.addevnt("radr", "writr", msg); 7 if (lngth data = 1) thn 8 [(#1 (hd data), non)] 9 ls if (#2 (hd (tl data)) = wr) thn 10 [(#1 (hd data), non)]^^tl data 11 ls 12 tl data 13 nd 14 ); Th bhavior of start rading and finish rading can b infrrd from th dscription of th bhavior of th writr rlatd functions. start rading implmnts th bhavior dfind by rul 5 whil finish rading implmnts th bhavior of rul 6 to 8 of Dfinition 1. Not that th writr can also rmov itms from th quu whn ovrwriting it. This is don by th function start writing() whn th buffr is full of non rad data and th oldst non rad data itm is ovrwrittn. In such cass, th scond or th first itm in th buffr is rplacd according to ithr th radr is accssing th buffr or not. It is also intrsting to notic that in th writing functions th focus is on th act of start writing, whil in th rading functions th focus is on finishing rading. This is du to th fact that th writr has no rstrictions about rlasing a nw itm, whil th radr has no rstriction about gtting th itm it is prpard to gt. 4 Validation and vrification In ordr to illustrat th bhavior of th CPN modl introducd abov a numbr of Mssag Squnc Charts (MSC) [HT03] has bn automatically gnratd from th simulation of th modl. For instanc, in Figur 6 th MSC gnratd whn th radr and writr procsss ar about th sam spd is showd. In this cas r-rading and ovrwriting do not occur. In such MSC th mssag labld start writing 100 is gnratd by th transition Start of th writr procss and it indicats that it is starting to writ th valu 100 in th buffr. On th sam way, th NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 10

13 Figur 6: MSC for no r-rading and no ovrwriting cas mssag finish writing indicats that th writr is rlasing th nw data for rading opration. Th sam rasoning applis for mssags gnratd by th radr. An important obsrvation that should b don is that th labls of th mssags in th chart do not rflct th information xchangd by th procsss. Such labls ar abstractions of th changs in th tokn containing th data bing communicatd, i.. th tokn in plac ACM. In th ral implmntation ths mssags ar rplacd by changs in valus of th control variabls. In th initial stat th buffr is initializd with th data valu 0 and non of th procsss ar accssing it. According to th MSC th following squnc of stats, as introducd in Dfinition 1, is gnratd: NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 11

14 σ 0 = 0 σ 1 = w σ 2 = σ 3 = 0 r 100 σ 4 = 100 σ 5 = 100 r σ 6 = 100 r 78 w σ 7 = 100 r 78 σ 8 = 78 σ 9 = w σ 10 = 78 r 11 w Obsrv that th squnc of data rcivd by th radr (0, 100, 78...) is th sam that was snt by th writr (0, 100, 78, 11...), xcpt for th last data that has not bn rcivd yt. Also, not that any σ i can b asily mappd into a tokn containd in th plac ACM. For instanc, w is mappd into th tokn [(0, non), (100, wr)] In Figur 7 th MSC gnratd whn r-rading occurs is illustratd. In this cas radr accss th buffr twic, rcovring th data valu 0 on both, bfor th writr accss it for th first tim. Obsrv that th writr accsss th buffr bfor th radr finishs its scond opration. For this rason, on th nxt tim th radr rcovrs th nw valu 100, othrwis it should ngag in anothr r-rading opration. Figur 7: MSC for th r-rading cas For this squnc of mssags, th squnc of stats according to Dfinition 1 is as follows: NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 12

15 σ 0 = 0 σ 1 = 0 r σ 2 = 0 σ 3 = 0 r σ 4 = 0 r 100 w σ 5 = 0 r 100 σ 6 = 100 σ 7 = 100 r Finally, in Figur 8 th MSCs obtaind whn ovrwriting occurs is introducd. In this cas th writr attmpts to snd anothr data itm whn th buffr is alrady full of itms. Th writr first snds th valu 100 and just aftr that it snds th valu 78. On its scond opration, th valu 100 is rplacd du to th fact that th radr is alrady accssing th mmory position containing 0. This is ndd in ordr to prsrv data cohrnc. Not that in this cas th ACM can hold at most two at a tim. In this cas th squnc of stats is as follows: σ 0 = 0 σ 1 = 0 r σ 2 = 0 r 100 w σ 3 = 0 r 100 σ 4 = 0 r 78 w σ 5 = 0 r 78 σ 6 = 78 σ 7 = 78 r As can b obsrvd th MSCs gnratd by th modl discussd abov rflct th bhavior st dfind by th transition systm introducd by Dfinition 1. Th MSCs ar not a proof of corrctnss of th modl. Howvr thy giv a good intuition that th modl is corrct with rspct to Dfinition 1. Bsids that, thy promot an intuitiv way of undrstanding how th ACM policis work. Nvrthlss, in ordr to giv formal argumnts of th corrctnss of th modl, cohrnc and frshnss proprtis introducd in Sction 2 wr modld using th ASKCTL modl chckr. ASKCTL is a modl chckr originally dsignd to run insid th Dsign/CPN tools that is also mbddd into CPN- Tools [JKW07, RWL + 03]. In ASKCTL, modl chcking rquirs th gnration of th occurrnc graph of th CPN modl and thn th gnration of its strongly connctd componnts graph. Tmporal logic formula ar dscribd as a CTL lik languag and th atomic propositions ar dscribd by SML functions. Each of ths functions should rciv as input a nod of th occurrnc graph and valuat it to tru or fals. Dscribing th formula is a qustion of using th corrct syntax. In ASKCTL, th oprator is not availabl, so it is ncssary to rwrit th part of th CTL formula for cohrnc (s Sction 2) that is in th form A B, to its quivalnt A B. Also, it is ncssary to us th ASKCTL oprator quivalnt to AG. Finally, th atomic propositions ar writtn as SML functions rciving a nod from th stat spac as paramtr and rturning a Boolan. Th following ASKCTL formula is thn obtaind: 1 INV(OR(NOT(NF("rading", has_rd)), 2 AND(NF("rading had", rd_first), NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 13

16 Figur 8: MSC for th ovrwriting cas 3 OR(NOT(NF("writing", has_wr)), 4 NF("writing last", wr_last))))); In th abov, INV is th ASKCTL quivalnt of AG and has rd, rd first, has wr and wr last ar th SML functions for th atomic propositions. has rd and has wr chck if th radr and th writr ar accssing th ACM at a givn stat, rspctivly. Whil rd first and wr last chcks if th radr is accssing th first position of th quu and if th writr is accssing th last, in th cas that som of thm is accssing it. NF is usd to tll ASKCTL that th proposition rfrs to nod of th stat and not to an arc. Th formula abov is nough to vrify ACMs of any siz. Frshnss is much mor complicatd. And it rquirs on formula for ach possibl siz th data quu may hav, i.. from 1 to n assuming that n is th siz of th ACM. For instanc, th formula dscribing frshnss for th quu holding 2 itms is givn by: 1 INV(OR(NOT(NF("lnght of sigma is 2", chck_lngth 2)), 2 FORALL_NEXT(OR(AND(OR(NF(" sigma = 2", chck_lngth 2), 3 NF(" sigma = 2+1", chck_lngth 3)), 4 NF("sigma = sigma+", chck_sigma_plus)), 5 AND(NF(" sigma = 2-1", chck_lngth 1), 6 NF("sigma = sigma-", chck_sigma_lss)))))); Again, it is ncssary to r-writ th A B and rplac th oprator AG and AX by its ASKCTL quivalnts. Which ar INV and FORALL NEXT rspctivly. chck lngth chcks if th siz of th data quu quals to som intgr, chck sigma plus chcks if th nw quu is on th form dfind by σ + and chck sigma lss if it is of th form σ as dfind in Sction 2. On important obsrvation that should b mad hr is that it is not possibl to vrify cohrnc without th information about th prvious stat of th data quu. So, to chck for cohrnc a small modification is mad to th modl. A nw plac is addd to th CPN to stor th prvious valu of th data quu. Evry tim a transitions firs, it backs up th tokn on plac ACM. On Figur 9 this modification is showd. NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 14

17 Idl E q q2 [(0,non)] OLD Fusion 2 QUEUE Start Writing E input (q); output (nq); action (start_writing q); q nq ACM Fusion 1 [(0,non)] QUEUE q2 q Finish q nq input (q); output (nq); action (finish_writing q); Figur 9: CPN modl for th writr saving quu stat Both proprtis wr vrifid and provd to b corrct for a numbr of OWRRBB ACMs of diffrnt sizs. Obsrv that th modl introducd hr is not gnric in th sns of a modl for OWRRBB ACMs of any siz. Howvr, it is paramtrizd and modifying th siz of th ACM is a vry simpl opration. Bsids cohrnc and frshnss w hav also vrifid that th initial marking of th CPN modl is a hom marking, maning that th systm can always rturn to its initial stat if th st of allowd data valus is finit. 5 Conclusions and futur work Rlatd work has introducd automatic mthods for th synthsis of ACMs. Th synthsis procss starts from a functional spcification and concluds with an implmntation of th ACM. At th momnt it is possibl to gnrat C++ sourc cod to communicat two procsss asynchronously. In this work, on class of ACMs is formally dfind and modld as an HCPN. Thn it is vrifid against a st of proprtis dscribd in tmporal logic. Although OWRRBB ACMs hav bn dsignd, synthsizd and vrifid bfor, thy all concntratd in singl-cll solutions. This is th first attmpt at dsigning and vrifying a multi-cll OWRRBB. Firstly, th bhavior of OWRRBB ACMs was formally dfind and modld as an HCPN using th CPNTools. Th proprtis that such ACM should satisfy wr also discussd and dscribd by CTL formula. Th spcifid proprtis includ: cohrnc, frshnss, rvrsibility and absnc of dadlocks. All proprtis wr provd to b satisfid. Howvr, whn th siz of th ACM grows, it is mor difficult to prform modl chcking du to th stat xplosion problm. Our attmpts at vrifying at a high lvl only dlays this problm. Additionally, th OWRRBB CPN modl was usd to gnratd a numbr of MSCs that wr usd to validat th modl with rspct to th bhavior st introducd by Dfinition 1. This validation was prformd manually. Howvr, th mthodology introducd can b usd to incras th confidnc of th dsignr whn spcifying a nw protocol, and it is don at a highr lvl of abstraction, NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 15

18 without th nd of gnrating a low-lvl algorithmic dscription. Finally, th MSCs ar gnratd automatically through th simulation of th CPN modl. Plans for futur work includ providing a formal proof that all ACMs with a bhavior compatibl with th formal bhavior w hav dfind satisfis cohrnc and frshnss. This stp is ndd du to th fact that our modls ar not modls of ACMs of any siz. Modl chcking is prformd for som siz n and nothing can b assurd for siz n + 1 unlss modl chcking is prformd again. With such proof, no modl chcking is ndd at all. Also, w intnd to us th CPN modls to gnrat an implmntation that cannot b trustd unlss w hav formally vrifid th modl. Sinc th stat xplosion problm cannot b avoidd, only minimizd, a proof is of grat importanc. At th prsnt tim th gnration of C++ cod from low-lvl Ptri nts has bn introducd. Anothr futur work is to xtnd that mthod to gnrat cod from high-lvl Ptri nt such as CPNs. Finally, it is a primary goal to b abl to gnrat th ACMs in th form of a Vrilog cod that can b usd to synthsiz a pic of hardwar. Acknowldgmnts This work is supportd by th EPSRC through projcts NEGUS (EP/C512812/1) and STEP (EP/E044662/1) at Nwcastl Univrsity, by Nokia Institut of Tchnology/Nokia do Brasil through coopration projct with Fdral Univrsity of Campina Grand and by CICYT TIN , a Distinction for Rsarch from th Gnralitat d Catalunya. Rfrncs [Fas01] [GCX07] Jan-Philipp Fassino. THINK: vrs un architctur d systèms flxibls. PhD thsis, Écol National Supériur ds Télécommunications, Dcmbr Kyllr Gorgônio, Jordi Cortadlla, and Fi Xia. A compositional mthod for th synthsis of asynchronous communication mchanisms. In Jtty Klijn an Alx Yakovlv, ditor, ICATPN, numbr 4546 in LNCS, pags Springr-Vrlag Brlin Hidlbrg, [GCXY07] Kyllr Gorgônio, Jordi Cortadlla, Fi Xia, and Alx Yakovlv. Automating synthsis of asynchronous communication mchanisms. Fundamnta Informatica, 78(1):75 100, Jun [HT03] David Harl and P. S. Thiagarajan. Mssag squnc charts. pags , [Jn92] [Jn97] [JKW07] [Lam86] [Mur89] Kurt Jnsn. : Basic Concpts, Analysis Mthods and Practical Us, volum 1 of EACTS Monographs on Thortical Computr Scinc. Springr-Vrlag, Kurt Jnsn. : Basic Concpts, Analysis Mthods and Practical Us, volum 2 of EACTS Monographs on Thortical Computr Scinc. Springr-Vrlag, Kurt Jnsn, Lars Michal Kristnsn, and Lisa Wlls. Colourd ptri nts and cpn tools for modlling and validation of concurrnt systms. Int. J. Softw. Tools Tchnol. Transf., 9(3): , Lsli Lamport. On intrprocss communication parts I and II. Distributd Computing, 1(2):77 101, Tadao Murata. Ptri nts: Proprtis, analysis and applications. Procdings of th IEEE, 77(4): , April NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 16

19 [RWL + 03] Ann V. Ratzr, Lisa Wlls, Hnry Michal Lassn, Mads Laursn, Jacob Frank Qvortrup, Martin Stig Stissing, Michal Wstrgaard, Sørn Christnsn, and Kurt Jnsn. Cpn tools for diting, simulating, and analysing colourd ptri nts. In ICATPN, pags , [Sim03] Hugo R. Simpson. Protocols for procss intraction. IEE Procdings on Computrs and Digital Tchniqus, 150(3): , May [XHC + 04] Fi Xia, Fi Hao, Ian Clark, Alx Yakovlv, and Gram Chstr. Buffrd asynchronous communication mchanisms. In Procdings of th Fourth Intrnational Confrnc on Application of Concurrncy to Systm Dsign (ACSD 04), pags IEEE Computr Socity, [YKXK98] Alx Yakovlv, David J. Kinnimnt, Fi Xia, and Albrt M. Kolmans. A fifo buffr with non-blocking intrfac. TCVLSI Tchnical Bulltin, pags 11 14, Fall NCL-EECE-MSD-TR , Univrsity of Nwcastl upon Tyn 17