The Input Output Timed Automaton - A model for real-time parallel computation

In this paper we present the Input Output Timed Automaton IOTA model for the speci ca tion and veri cation of parallel real time digital systems Our model extends Nancy Lynch s IOA model Lynch a to allow for the inclusion of timing properties We have used the IOTA model to study a range of real time digital systems In particular we used it to specify and verify asynchronous circuit designs Bestavros a and to specify analyze and simulate behaviors of autonomous creatures Bestavros b In Bestavros a we developed a lan guage and environment for the executable speci cation of parallel real time interactive tasks based on the IOTA model A IOTA is an abstraction that encapsulates a real time task A system is modeled as a network of such IOTAs communicating with each other over channels A IOTA might be the speci cation or the actual implementation of a software hardware module This allows the representation of both the external environment and the programmed system along with the available computational resources in a unique framework IOTAs can be composed together to form higher level IOTAs A IOTA implements another if all external behaviors of the rst the implementation are also external behaviors of the second the speci cation We use timed possibility mappings to test for the implementation relationship This is the primary tool that is used to verify that an implementation meets the required speci cation This work was supported by DARPA N C It s Time to make Real Time Computing Real Real time computing systems are and will continue to play an increasingly vital role in our world Current real time systems are expensive to build and their properties are usually veri ed with ad hoc techniques or with expensive and extensive simulations Stankovic a Di erent components of such systems are extremely di cult to integrate with each other which adds to the cost and complexity of these systems Minor changes in any of these components result in another round of testing and xing Zave This brute force approach is not likely to scale up with future systems It has become clear that more work is needed in the area of real time systems if we are to meet the needs and challenges of the future Viewed simply any real time system has two parts an external environment and a pro grammed system The external environment consists of a number of devices such as sensors and actuators that interact with the real world The programmed system collects information from the sensors and responds by producing actions to drive the actuators The continual demands of the unintelligent external environment poses relatively rigid and urgent requirements on the per formance of the programmed system These requirements are usually stated in terms of real time constraints Examples of such systems include ballistic missile defense systems nuclear reactors robotics process control plants ight and space shuttle control real time databases real time communication networks etc Zave Zave The complexity of these systems coupled with an obvious lack of powerful speci cation and veri cation techniques made it impossible to assess their performance or even to judge their correct operation In the past few years di erent aspects of real time systems have been studied namely speci cation languages models and semantics However the absence of a uni ed formal frame work that addresses the a orementioned issues severely limited the usefulness of these studies Stankovic a Joseph In this paper we present a single framework for real time systems which makes it possible to see the relation between speci cation implementation correctness and performance issues The framework we suggest is based on the Input Output Timed Automaton IOTA read yota model We have used the IOTA framework to model robotics applications Bestavros b The tasks involved in a robotic application are diverse vision BBN motion control Brockett high level planning and behavioral speci cation Brooks etc and usually make use of very di erent resources special purpose image processors tailor made controllers and drivers general purpose processors etc Furthermore these tasks interact in a non trivial way Being able to specify and verify such complex systems in a single framework is both challenging and attractive The IOTA model An introduction In this section we introduce the Input Output Timed Automaton IOTA which is an extension of Nancy Lynch s Input Output Automaton IOA introduced in Lynch a to study discrete event systems e g distributed databases Lynch b The IOTA model provides a formal semantics de nition for Esprit Bestavros a a speci cation language for real time systems We used the IOTA model and the Esprit language to specify and analyze a number of real time applications Bestavros b Channels Signals Events and Actions In our model time is a measurable continuous in nitely divisible quantity We represent any point in time by a nonnegative real t Time intervals are de ned by specifying their end points which are drawn from the set of nonnegative rationals or nonnegative integers D Time intervals might be closed open or semi open If t and t are two points in time t t D then t t t t t t t t are the possible closed right closed left closed and open intervals respectively We use ft t g to denote any one of these cases A real time system is viewed as a set of interacting IOTAs IOTAs communicate with each other and with the external environment through channels A channel is an abstraction for an ideal communication media Among others a channel might represent a simple physical wire that carries an electrical signal be it binary or analogue It might represent a Unix like socket or pipe Or it might represent a function invocation and a possible transfer of information through function calls and returns The information that a channel carries is called a signal A signal consists of a sequence of events An event underscores the instantiation of an action at a speci c point in time Figure illustrates the notions of channels actions events and signals Our concept of actions is similar to that used in the IOA model Lynch a In particular we view actions as tokens that are generated as outputs and consumed as inputs More formally let ai be an action of a IOTA A that was signaled at time ti and remained active till time tj where tj ti when another action aj was signaled The tuples ai ti and aj tj are called events Furthermore the sequence of events a t a t a t ak tk is called a signal As in Lynch a channels are classi ed as internal or external and as input or output Signals from external channels are observable from outside the IOTA Signals from internal chan nels are only observable locally Signals from input channels are uncontrollable since they are supplied by the environment or by other IOTAs Unlike other models Hoare they cannot be blocked Signals from output channels on the other hand are the way an IOTA reacts to the outside stimuli Thus a IOTA can be considered as performing a mapping from its external input signals to its external output signals In a sense it acts as an actor in a data ow graph Veen As was done in Lynch a we formally de ne the signature sig A of a IOTA A to be a partition on the channels of A into three disjoint sets of input output and internal channels For a IOTA A we denote these sets by in sig A out sig A and int sig A respectively The set consisting of both input and output channels is the set of external channels observable from outside the IOTA We denote this set by ext sig A where ext sig A in sig A out sig A The set consisting of both output and internal channels is the set of local channels These are the locally controlled channels of A We denote this set by loc sig A where loc sig A out sig A int sig A We denote the set of all the channels of a IOTA A by channels A where channels A in sig A out sig A int sig A By remained active we mean that no other actions were activated on the same channel during that period The interval for which the action ai was active is ti tj and consequently signals and actions that they carry XXXXXXXXXXz J J J J J J J J J J