We present interface models that describe both the input assumptions of a component, and its output behavior. By enabling us to check that the input assumptions of a component are met in a design, interface models provide a compatibility check for component-based design. When refining a design into an implementation, interface models require that the output behavior of a component satisfies the design specification only when the input assumptions of the specification are satisfied, yielding greater flexibility in the choice of implementations. Technically, our interface models are games between two players, Input and Output; the duality of the players accounts for the dual roles of inputs and outputs in composition and refinement. We present two interface models in detail, one for a simple synchronous form of interaction between components typical in hardware, and the other for more complex synchronous interactions on bidirectional connections. As an example, we specify the interface of a bidirectional bus, with the input assumption that at any time at most one component has write access to the bus. For these interface models, we present algorithms for compatibility and refinement checking, and we describe efficient symbolic implementations.

Synchronous and bidirectional component interfaces

This paper proposes a method for compositional verification of the standard and generalized nonblocking properties of large discrete event systems. The method is efficient as it avoids the explicit construction of the complete state space by considering and simplifying individual subsystems before they are composed further. Simplification is done using a set of abstraction rules preserving generalized nonblocking equivalence, which are shown to be correct and computationally feasible. Experimental results demonstrate the suitability of the method to verify several large-scale discrete event systems models both for standard and generalized nonblocking.

/pdf/compositional-nonblocking-verification-using-generalized-3gntab279p.pdf

Compositional Nonblocking Verification Using Generalized Nonblocking Abstractions

This paper proposes a compositional approach to verify the generalised nonblocking property of discrete-event systems. Generalised nonblocking is introduced in [1] to overcome weaknesses of the standard nonblocking check in discrete-event systems and increase the scope of liveness properties that can be handled. This paper addresses the question of how generalised nonblocking can be verified efficiently. The explicit construction of the complete state space is avoided by first composing and simplifying individual components in ways that preserve generalised nonblocking. The paper extends and generalises previous results about compositional verification of standard nonblocking and lists a new set of computationally feasible abstraction rules for standard and generalised nonblocking.

/pdf/a-compositional-approach-for-verifying-generalised-4hqkkbpkc8.pdf

A compositional approach for verifying generalised nonblocking

Vývoj bezchybných komponentových systemů je velice obtižný ukol z důvodu vysoke pravděpodobnosti konfliktů ve vzajemne interakci komponent, ktere jsou z principu komponentoveho vývoje vytvořeny nezavisle na sobě. Vzhledem k rostoucim možnostem výpocetni techniky se pro řeseni tohoto ukolu nabizi využiti automatizovaných formalnich metod. Před samotnou aplikaci formalnich metod je vsak třeba vytvořit model studovaneho systemu, pro který je třeba nalezt vhodný modelovaci formalismus. Ten by měl být dostatecně přesný, aby zachytil vsechny podstatne informace pro formalni analýzu. Na druhou stranu ale musi abstrahovat od těch aspektů, ktere nejsou pro analýzu nezbytne a mohly by vest k nepřiměřenemu narůstu velikosti modelu. Cilem teto prace je přispět k vývoji v oblasti formalni analýzy komponentových systemů ve dvou směrech. Prvnim je navrženi formalniho přistupu k modelovani interakci mezi komponentami. Pro tyto ucely navrhujeme nový modelovaci jazyk, nazvaný Component-Interaction automaty. Kromě definice jazyka a diskuze jeho možných kompozicnich operatorů, je velka cast prace věnovana jeho aplikaci na modelovani interakci mezi komponentami. Prace provadi celým modelovacim procesem a pote se věnuje zachyceni nejrůznějsich aspektů realných systemů, jakými jsou interni stavy komponent, prace s výjimkami, modelovani asynchronni komunikace, nebo konstrukce a destrukce instanci komponent. Druhým směrem studovaným v teto praci je formalni analýza vytvořených modelů. Na zakladě formalismu Component-Interaction automatů a definovane ekvivalenci mezi jednotlivými modely, prace navrhuje přistup k vývoji komponentových systemů garantujici spravnost z podstaty použitých kroků vývoje. Konkretně studujeme takove situace v procesu vývoje, kdy může ověřeni vzajemneho vztahu artefaktů na různých urovnich předejit vzniku chyb v systemu. Takovými situacemi jsou napřiklad integrace nezavisle vytvořených komponent, nebo výměna existujicich komponent za nove.

Modelling and Formal Analysis of Component-Based Systems in View of Component Interaction

Interface automata are one of the prominent formalisms for specifying interface behaviors of component-based systems. However, only one-to-one communication is allowed in the composition of interface automata. This paper presents multicast interface automata which generalize the classic interface automata and accommodate multicast communication mechanism. The multicast interface automata endorse both bottom-up and top-down design methodologies. Theoretical results on compatibility and refinement are established for incremental design and independent implementability.

Generalized interface automata with multicast synchronization

Interface automata is a formal model to be used for describing the temporal interface behaviors of software components. It adopts an alternating approach to design refinement, which is significantly different with the traditional use of automata. In this paper, it is proven that an interface automaton refines another if and only if there exists a special kind of forward simulation between their corresponding I/O automata, which shows the essential relation between interface automata and I/O automata on refinements.

Bridging refinement of interface automata to forward simulation of I/O automata

Labelled state transition system (LSTS) is a formalism intended to combine the benefits of both state-based and action-based models. However, its existent equivalence preserves many properties with the cost of poor reduction effects. A new equivalence is presented, namely called reverse observation equivalence which is defined in the opposite direction to observation equivalence and orients the invariant checking of LSTS. Experiments show that the new semantics is efficient in the context of compositional reachability analysis.

Reverse observation equivalence between labelled state transition systems

Labelled state transition system (LSTS) is a formalism intended to combine the benefits of both state-based and action-based models However, its existent equivalence preserves many properties with the cost of poor reduction effects A new equivalence is presented, namely called reverse observation equivalence which is defined in the opposite direction to observation equivalence and orients the invariant checking of LSTS Experiments show that the new semantics is efficient in the context of compositional reachability analysis

Interface automata is a light-weight formalism to be used for describing the temporal interface behaviors of software components. This paper investigates the refinement of interface automatons and shows its application to serve as a semantic foundation for software architectural description languages. Firstly, inspired by 2/3 simulation, the 2/3alternating simulation between interface automaton is presented, and the corresponding refinement relation is also derived between interface automaton. The distinguished feature is that it can preserve deadlock-freedom. Then, a concise formal semantics is provided for the architectural description language Wright, based on interface automaton, where the checking of compatibility and deadlock-freedom becomes simpler.

Ji Wang

Papers

Bridging refinement of interface automata to forward simulation of I/O automata

Reverse observation equivalence between labelled state transition systems

Reverse observation equivalence between labelled state transition systems

2/3 alternating simulation between interface automata