Modular refinement of hierarchic reactive machines

Foundations of Aspect-Oriented Languages, 2004

In order to provide better alignment between conceptual requirements and aspect-oriented implementations, formal specification methods should enable the encapsulation of logical abstractions of systems. In this paper we argue that horizontal architectures, consisting of such logical abstrac- tions, can provide better separation of concerns over con- ventional ones while supporting incremental development for more common units of modularity such as

Faraday Discuss, 2003

2013 Proceedings of the International Conference on Embedded Software (EMSOFT), 2013

We present a method and a tool for composing a reactive system and for accompanying the development and documentation process with a proof of its correctness. The approach is based on behavioral programming (BP) and the Z3 SMT solver. We show how program verification can be automated and streamlined by combining properties of individual modules, specified and verified separately, with application-independent specifications both of the BP semantics and of general theories. The method may yield an exponential acceleration of the verification process when compared with model-checking the composite application. We show that formalization of properties of independent modules in preparation for the correctness proofs can be useful as documentation for future development. We view this work as a further step towards making formal correctness proofs standard practice in the development of reactive systems, and carried out by programmers at large.

ACM Transactions on Cyber-Physical Systems, 2022

Modularity is a central principle throughout the design process for cyber-physical systems. Modularity reduces complexity and increases reuse of behavior. In this article we pose and answer the following question: how can we identify independent “modules” within the structure of reactive control architectures? To this end, we propose a graph-structured control architecture we call a decision structure and show how it generalizes some reactive control architectures that are popular in Artificial Intelligence (AI) and robotics, specifically Teleo-Reactive programs (TRs), Decision Trees (DTs), Behavior Trees (BTs), and Generalised Behavior Trees ( k -BTs). Inspired by the definition of a module in graph theory [ 16 ] we define modules in decision structures and show how each decision structure possesses a canonical decomposition into its modules, which can be found in polynomial time. We establish intuitive connections between our proposed modularity and modularity in structured progra...

Lecture Notes in Computer Science, 2014

Typical reactive system languages are programmed by means of rules of the form if antecedent then consequent. However, despite their seemingly logical character, hardly any reactive system languages give such rules a logical interpretation. In this paper, we investigate a simplified reactive system language KELPS, in which rules are universally quantified material implications, and computation attempts to generate a model that makes the rules true. The operational semantics of KELPS is similar to that of other reactive system languages, and is similarly incomplete. It cannot make a rule true by making its antecedent false, or by making its consequent true whether or not its antecedent becomes true. In this paper, we characterize the reactive models computed by the operational semantics. Informally speaking, a model is reactive if every action in the model is an instance of an action in the consequent of a rule whose earlier conditions are true.

cse.wustl.edu

We defend the need of a dual approach for representing reactive systems and reasoning about their timing properties; this dual approach uses a notation for the specification of behaviour (preferably a graphical one), and a temporal logic to express formally, and reason about, this behaviour. The combination of two representation schemes forms the basis of a generic framework that can be instantiated for different choices of notations. Two instantiations of the framework, illustrating its use, are discussed. To describe in detail one of the instantiations (ArchSM method) we use design patterns.

2023

Developing reliable reactive software is notoriously di cult -particularly when that software reacts by changing its behavior. Some of this di culty is inherent; software that must respond to external events as they arrive tends to end up in states that are dependent on the value of that input and its order of arrival. This results in complicated corner cases that can be challenging to recognize. However, we nd that some of the complexity is an accident of the features of the programming languages widely used in industry. The loops and subroutines of structured programming are well-suited to data transformation, but poorly capture -and sometimes obscure -the ow of data through reactive programs developed using the inversion-of-control paradigm; an event handler that modi es the data ow tends to be declared closer to the de nition of the event that activates it than to the initial denition of the data ow that it modi es. This paper approaches both challenges with a language inspired by the declarative modules of languages SIGNAL and Lustre and the semantics of the SodiumFRP Functional Reactive Programming library with a declarative mechanism for self modi cation through module substitution. These language features lead to software with a code structure that closely matches the ow of data through the running program and thus makes software easier to understand. Further, we demonstrate how those language features enable a bounded model checking approach that can verify that a reactor meets its requirements or present a counterexample trace, a series of states and inputs that lead to a violation. We analyze the runtime performance of the veri er as a function of model size and trace length. CCS Concepts: • Software and its engineering → Data ow languages.

2000

Object-oriented systems are able to treat objects indirectly by message passing. This allows them to manipulate objects without knowing their exact runtime type. Behavioral subtyping helps one reason in a modular fashion about such programs. That is, one can reason based on the static types of expressions in a program, provided that static types are upper bounds of the runtime types in a subtyping preorder, and that subtypes satisfy the conditions of behavioral subtyping. We survey various notions of behavioral subtyping proposed in the literature for objectoriented programming. We also sketch a notion of behavioral subtyping for objects in component-based systems, where reasoning about the events that a component can raise is important.

2005

When using a component framework, developers need to respect the behavior implemented by the components. Static information about the component interface is not sufficient. Dynamic information such as the description of valid sequences of operations is required. In this paper we propose a mathematical model obeying the Synchronous hypothesis and a formal language to describe the knowledge about behavior. We focus on extension of components, owing to the notion of behavioral substitutability. A formal semantics for the language is defined and a compositionality result allows us to get modular model-checking facilities. From the language and the model, we can draw practical design rules that are sufficient to preserve behavioral substitutability. Associated tools may ensure correct (re)use of components, as well as automatic simulation and verification, code generation, and runtime checks.

Lecture Notes in Computer Science, 2005

We describe a method for the specification and verification of the dynamic behaviour of component systems. Building applications using a component framework allows the developers to specify the architecture, the deployment, the life-cycle of the system with well-defined formalisms, and to gain productivity by reusing existing components. But then one wants to make sure that the application built from existing components is safe, in the sense that its parts fit together appropriately and behave together smoothly. Each component must be adequate to its assigned role within the system, and the update or replacement of a component should not cause deadlock or failure of the rest of the system. The usual notion of type compatibility of interfaces is not sufficient; we need to capture the dynamic interaction between components, and typically to avoid deadlocks or unexpected behaviours in the system. In this work, we focus on hierarchical component systems. We describe both the functional behaviour and the non-functional features (life-cycle management) of components in terms of synchronised transition systems; we define a notion of correct component composition; then we show how we can prove, using (compositional) model-checking techniques, temporal properties of a component system. Transformations of a system, for example replacement of a sub-component, are expressed as transformations of its behavioural semantics, allowing to prove preservation of some properties, or the validity of new properties after transformation.