1. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 1 State Machines and Statecharts Formal Specifications CS236368 Shmuel Katz The Technion

2. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 2 Gestalt Gestalt psychology or gestaltism (German: – "essence or shape of an entity's complete form") is a theory of mind and brain of the Berlin School; the operational principle of gestalt psychology is that the brain is holistic, parallel, and analog, with self-organizing tendencies. The principle maintains that the human eye sees objects in their entirety before perceiving their individual parts. Gestalt psychologists stipulate that perception is the product of complex interactions among various stimuli. The gestalt effect is the form-generating capability of our senses, particularly with respect to the visual recognition of figures and whole forms instead of just a collection of simple lines and curves. In psychology, gestaltism is often opposed to structuralism. The phrase "The whole is greater than the sum of the parts" is often used when explaining gestalt theory.GermanBerlin Schoolholistic structuralism

3. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 3 What is a State? x = 17 y = 0 z = 8 light_on alarm_off msg = “abc” (x=17, y=0, z=8) A snapshot of the system Set of values for variables Control location(s) Contents of channels May be written as a tuple

4. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 4 A Simple State Machine An abstract watch: state transition initial state time date battery-off p p rem insert

5. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 5 What if the state is complex? Write values of variables in the state For every possible combination of values, there is a different state Alternative terms: >State Machine Graph >State Transition Graph >Explicit State Graph Paths in the graph = Traces = Executions x = 17 y = 0 z = 8 x = 17 y = 7 z= 3

6. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 6 Execution sequences State view: Transition view: time date battery-off p p rem insert

7. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 7 Formal Definition A state machine is a 4-tuple (S, A, I, T) with >S : set of possible states >A: set of possible labels on transitions >I : set of initial states (subset of S) >T : transition relation over S x A x S (s1, a, s2) is in T when T is a relation because of nondeterminism s1 a s2 a s3 a s1

8. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 8 Example S = { time, date, bat-off } A = { p, rem, insert } I = { time } T = { (time, p, date), (date, p, time), (time, rem, bat-off),(date, rem, bat-off), (bat-off, insert, time) }

9. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 9 State Machines Are Used! When it is easy to abstract away irrelevant details, leaving only a small number of states When we want to precisely examine every possibility using model checking For communication protocols and complex distributed algorithms (EFT,....) For safety critical, or firmware that can’t be changed later

10. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 10 The State Explosion Problem State machines can get huge for very simple systems Need a more compact representation! Describe the set of states from which a transition appears through a predicate Describe the `target’ through the changes from the source Use text and not pictures

11. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 11 Z describes State machines! A collection of operation schemas, with explicit preconditions, can be seen as a state machine representation There are many other notations, that mainly treat concurrency To generate explicit version from schema, start from initial states, apply relevant operations. Repeat until nothing is added (a fixed point is reached).

12. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 12 A Z State Machine P == [ st, st’ | st = time or st = date and (st = time) => st’ = date and (st = date) => st’ = time ] rem ==[ st, st’ | (st = time or st = date ) and (st’ = bat-off) ] insert ==[ st, st’ | st = bat-off and (st’ = time) ] new == [st’ | st’ = time ]

13. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 13 Hints on translating Can do one-to one translation, > gather the arrows that correspond to a single label into a schema with the name of the label >preconditions are union of the source states >predicate has source => target’ for each arrow Can often combine into general predicates and state transformations Explicit graph means a different state for every possible combination of values

14. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 14 Statecharts Graphic state machine representation Compact--- avoids state explosion Uses zoom-in, zoom-out Separates concerns By David Harel, while consulting for industry (avionics)

15. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 15 Causes of clutter Pulling eject lever leads to a special situation (many arrows, can double the number of states) Changing gears and adjusting the lights are independent of each other (multiplies the number of states describing gears by the number describing light settings) There is a time display updated every 0.1 second, and a similar stopwatch display

16. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 16 Overcoming the Problems Group states into Superstates that can be entered or left under uniform conditions Keep independent parts separate-- do not take the cross product Hide and separate out most values of variables Keep `activities’ and data manipulation outside the statecharts

17. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 17 Superstate (without parallel) Composed of a lower level statechart in S == in time or in date In a superstate => in one of its substates Arrow from boundary = arrow from each (top level) interior state Still can have direct exit from a state time date p p battery-off rem insert

18. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 18 How to Enter Arrow to the boundary, and enter the default state (denoted by a short arrow) Direct to an inner state Unspecified at this level time date p p time date p p time date p p

19. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 19 More details on transitions Form: name [ cond ] / action >Only do the transition if the cond holds >Do the indicated action as a side effect Actions can include > Updating a variable >sending a message >starting or stopping an external “activity” >Output Conditional entrance to targets (and the alternatives have predicates) C

20. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 20 A Statechart for Power Failure normal alternate toolbox warm_start cold_start batterytake_down test EPF (in (test)) (not in (test)) reconfig done power_up power_off/ mode := ‘stop’ done mode long_p p p p / record EPF C p

21. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 21 Parallel Processes For describing independent components Dotted lines between statecharts, each with a default in S == in each component of S arrow to boundary == enter each default Arrow from boundary == leave all components Can have multi-headed or -tailed arrows

22. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 22 Transitions in Parallel Components Transitions are used to `coordinate’ components when needed Recall: name [ cond ] / action Conditions can include being in a certain state in a parallel component Actions can include > Updating a variable >sending a message >starting or stopping an activity >output >activating a transition in a parallel component

23. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 23 Joint Transitions If in A and in C, s is a joint transition to (B,D), but if in A and in D, s just does A->B If in E and in B, t does E->F, otherwise nothing happens when t ‘occurs’ A B s C D s E F t [in B]

24. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 24 Parallel “means” Almost Independent mode regdisp normal alternate pdonep long_p toolbox test p p displayable (in (regdisp)) (not in (regdisp)) hidden security total_kw_cum

25. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 25 Two Equivalent Statecharts B C G E F B,F B,E C,E C,F C,G B,G f [in G]e g k e h h h k k g g e e e e f =

26. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 26 Mini-steps in Transitions An action can be to activate another transition (from a parallel component). e / f could mean that transition e activates f, so both occur in the same step.... In UML version: e now activates f in the next step --avoids problems (`chain-reactions’ or even cycles) If only f occurs, there is no influence in the other direction.

27. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 27 History H (in a circle) means the state from which the superstate was last exited is `remembered’, and an arrow from outside to the H returns the superstate to the one last left (on the uppermost level) H* as above, but to lowest level of nesting (Warning: different tools use H differently—so check what happens in the one you use…) clh = `clear history’ A special action that erases the history, so the default is used for the next entry.

28. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 28 An Example: David Harel’s Watch main alarm1 - statuschime - statuslight displays alarms – beep disabled enabled disabled enabled quiet beep off on OK blink power batt. inserted batt.removed /clh(main*) decd weak batt. dies /clh(main*) bat. weakens d (in chime. off) d (in chime. on) d (in alarm1. off) d (in alarm1. on) d (in alarm2. off) d (in alarm2. on) alarm 2 - status T is whole hour 2 sec in beep Citizen Quartz multi-alarm III b -b

29. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 29 Zooming in on Displays in the watch displays 2 sec in wait update wait time date 2 min. in date stopwatchchimealarm 2 alarm 1 update 1update 2 off on off on off on H* H H H aaa a a b b c c d ddd dd b d d c c

30. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 30 The full watch

31. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 31 Tools Statemate, from I-Logix, uses statecharts as the basic design/specification notation, adds activities and module decomposition separately, emphasizes simulation Rhapsody, from I-Logix, and Rose, from Rational (both now inside IBM), incorporate statecharts into UML tools, for design level All UML tools have drawing capabilities, only a few have simulations

32. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 32 Scenarios Statemate gives feedback to clients through its simulation facility. >When can a beep occur? >If in states....we press d and then b without letting go, what will happen? >Where does an action have an effect? Can `test’ use-case scenarios and `debug’ the specification relative to client needs

33. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 33 Activities of Statemate Defined outside statecharts, ongoing and sustained over time. Each activity A has associated actions: > start(A) >stop(A) >suspend(A) >resume(A) and a condition active(A) and events that can trigger transitions: >started(A) >stopped(A) Can also link an activity to being in a state

34. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 34 Object Oriented Statecharts In UML, Statecharts describe internal behavior of objects, while sequence charts show scenarios of message calls among different objects Activations are usually message calls, and follow usual rules of delayed activation, and even queueing: different from original Different versions have somewhat different rules for ordering/synchronizing—see tirgul Less use of parallelism than in pure statecharts

35. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 35 OCL and State diagrams OCL can be used here too, and not just with class diagrams In UML 2.0, the condition for a transition can be any OCL expression that evaluates to Boolean OCL conditions can relate to being in a state of the state diagram, and add conditions that hold for that state (like invariant at a location) Useful for giving conditions not expressed at the level of the state diagram, without zooming in

36. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 36 Guard Conditions Act as preconditions

37. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 37 Statecharts: referring to states The operation oclInState returns true if the object is in the specified state.—gives ‘in’ used previously object.oclInState( statename )

38. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 38 Fuzzy parts Real-time will be treated later Updating the variables is `behind the scenes’ and not handled very well in Statecharts Note that in the watch statechart, the actual time is not treated! Connections to other notations (e.g., more informal UML parts) is so-so

39. ©Katz-2009CS236368 formal SpecificationsLecture--State machines 39 Summary on Statecharts A graphic notation: visual/Gestalt The precision of automata, without the clutter For precise design of key/complex protocols For control and modes of operation—not data manipulation Seems lower-level (assembly language of formal specifications?) First mention of parallel---for (almost) independent components Debug using simulation of use cases Can sometimes synthesize into code skeletons