1. Modular Refinement of Hierarchic Reactive Machines Rajeev Alur Radu Grosu University of Pennsylvania www.cis.upenn.edu/~alur,grosu/

2. Results 1.Visual language for hierarchic reactive machines hierarchic modes, mode sharing, group transitions, history, mixed and/or hierarchies. 2. Observational trace semantics mode refinement, compositional and assume/guarantee reasoning.

3. Motivation Scalable analysis demands modular reasoning: modeling language has to support syntactically and semantically modular constructs, model checking has to exploit modular design. Close the gap between: software design languages (UML, Statecharts, Rsml), model checking languages (Spin, SMV, Mocha).

4. Characteristics Description is hierarchic. Well defined interfaces. Supports black-box view. Model checking Compositional reasoning. Assume/guarantee reasoning. E.g. in SMV, Mocha. Telephone Exchange: Architecture TelI = tk | onH | offH | dig(int) TelO = tk | dtB | dtE | rtB | rtE ti 1,…,ti n : TelI; to 1,…,to n : TelO; TelExchange ti 1 to 1 ti n to n TelSw 1 TelExchange Bus TelSw n bo 1 bi 1 bo n bi n ti 1 to 1 ti n to n …

5. TelSw 1 TelExchange Bus TelSw n bo 1 bi 1 bo n bi n ti 1 to 1 ti n to n … onHookoffHook onH call answ rtB Telephone Exchange: Behavior tel?onH onH connecting talking ok call rtB gettingNo ok rtB answ onH idle ringing rtB rtE rtB call offH answ read ti : TelI; write to : TelO; local nr : (0..n)

6. Hierarchic Behavior Diagrams Formalism Introduced: 1987 by David Harel as Statecharts, Related notations: Rsml, Modecharts, Roomcharts, Key component in OO Methods: UML, ROOM, OMT, etc. Software ILogix, ObjecTime, Rational, etc. Application Area Automotive industry, avionics, etc. Semantics Many attempts (more than 24 semantics), All operational: no trace semantics, no refinement rules.

7. rtB onH connecting talking ok gettingNo ok idle ringing rtB rtE rtB offH onHookoffHook From Statecharts to Modes Obstacles in achieving modularity State reference -> Scoping of variables (data interface) Group transitions implicitly connect deep nested modes. Nested state references break encapsulation. Regular transitions -> Entry/exit points (control interface) call answ Group transitions -> Default points (control interface) Regular transitions connect deep nested modes. telSw offHookonHook rtB onH answ call ini

8. Semantics of Modes Game Semantics Environment round: from exit points to entry points. Mode round: from entry points to exit points. The set of traces of a mode Constructed solely from the traces of the sub-modes and the mode’s transitions. Refinement Defined as usual by inclusion of trace sets. Is compositional w.r.t. mode encapsulation.

9. Modular Reasoning Compositional Reasoning Central to many formalisms: CCS, I/O Automata,TLA, etc. Circular Assume/Guarantee Reasoning Valid only when the interaction of a module with its environment is non-blocking. Terminology Compositional and assume/guarantee reasoning based on observable behaviors. Application area Only recently is being automated by model checkers, Until now restricted to architecture hierarchies.

10. Compositional Reasoning N N’ < G M < G M’ N M N’ M < Sub-mode refinement N M < N M’ Super-mode refinement

11. Assume/Guarantee Reasoning MM’ N’ < N N M < M’ N’ N M’ N’ N < N

12. M2M2 M’ 1 svrs Translation with modes Conjunctive Modes read i 1,i 2 ; write o 1,o 2,p 1,p 2 ; local p’ 1 ; p’ 1 := p 1 ;p 1 := p’ 1 ; M2M2 i2i2 M1M1 i1i1 o2o2 o1o1 p1p1 p2p2 Parallel composition of reactive modules Synchronous semantics State s = (i 1, i 2, o 1, o 2, p 1, p 2 ) Execution s 1 s 2 s 3 s 4 … s k … syst env

13. Ongoing Work Both an enumerative and a symbolic model checker. Reachability analysis exploits the structure: Transition relation is indexed by control points speeds up enumerative search, generalization of conjunctively partitioned bdds, Transition type exploited to flush the stack in the enumerative search, for early quantification in the symbolic search, Reached state space indexed by control points pool of variables is not global, Mode definitions are shared among instances.

14. Roadmap 1.Architecture diagrams 2.Mode diagrams 3.From statecharts to modes 4.Semantics and refinement 5.Compositional and assume/guarantee rules 6.Conjunctive modes 7.Implementation

15. Characteristics Description is hierarchic. group transitions, history. Well defined interfaces. data & control interfaces black-box view. Model checking Compositional reasoning. Assume/guarantee reasoning. in Mocha Telephone Exchange: Behavior onH connecting talking ok call gettingNo ok rtB answ onHookoffHook onH call answ rtB tel?onH read ti : TelI; write to : TelO; local nr : (0..n)