
- •CONTENTS
- •PREFACE
- •LIST OF FIGURES
- •INTRODUCTION
- •1.1 WHAT IS TIME?
- •1.2 SIMULATION
- •1.3 TESTING
- •1.4 VERIFICATION
- •1.6 USEFUL RESOURCES
- •2.1 SYMBOLIC LOGIC
- •2.1.1 Propositional Logic
- •2.1.2 Predicate Logic
- •2.2 AUTOMATA AND LANGUAGES
- •2.2.1 Languages and Their Representations
- •2.2.2 Finite Automata
- •2.3 HISTORICAL PERSPECTIVE AND RELATED WORK
- •2.4 SUMMARY
- •EXERCISES
- •3.1 DETERMINING COMPUTATION TIME
- •3.2 UNIPROCESSOR SCHEDULING
- •3.2.1 Scheduling Preemptable and Independent Tasks
- •3.2.2 Scheduling Nonpreemptable Tasks
- •3.2.3 Nonpreemptable Tasks with Precedence Constraints
- •3.2.5 Periodic Tasks with Critical Sections: Kernelized Monitor Model
- •3.3 MULTIPROCESSOR SCHEDULING
- •3.3.1 Schedule Representations
- •3.3.3 Scheduling Periodic Tasks
- •3.4 AVAILABLE SCHEDULING TOOLS
- •3.4.2 PerfoRMAx
- •3.4.3 TimeWiz
- •3.6 HISTORICAL PERSPECTIVE AND RELATED WORK
- •3.7 SUMMARY
- •EXERCISES
- •4.1 SYSTEM SPECIFICATION
- •4.2.1 Analysis Complexity
- •4.3 EXTENSIONS TO CTL
- •4.4 APPLICATIONS
- •4.4.1 Analysis Example
- •4.5 COMPLETE CTL MODEL CHECKER IN C
- •4.6 SYMBOLIC MODEL CHECKING
- •4.6.1 Binary Decision Diagrams
- •4.6.2 Symbolic Model Checker
- •4.7.1 Minimum and Maximum Delays
- •4.7.2 Minimum and Maximum Number of Condition Occurrences
- •4.8 AVAILABLE TOOLS
- •4.9 HISTORICAL PERSPECTIVE AND RELATED WORK
- •4.10 SUMMARY
- •EXERCISES
- •VISUAL FORMALISM, STATECHARTS, AND STATEMATE
- •5.1 STATECHARTS
- •5.1.1 Basic Statecharts Features
- •5.1.2 Semantics
- •5.4 STATEMATE
- •5.4.1 Forms Language
- •5.4.2 Information Retrieval and Documentation
- •5.4.3 Code Executions and Analysis
- •5.5 AVAILABLE TOOLS
- •5.6 HISTORICAL PERSPECTIVE AND RELATED WORK
- •5.7 SUMMARY
- •EXERCISES
- •6.1 SPECIFICATION AND SAFETY ASSERTIONS
- •6.4 RESTRICTED RTL FORMULAS
- •6.4.1 Graph Construction
- •6.5 CHECKING FOR UNSATISFIABILITY
- •6.6 EFFICIENT UNSATISFIABILITY CHECK
- •6.6.1 Analysis Complexity and Optimization
- •6.7.2 Timing Properties
- •6.7.3 Timing and Safety Analysis Using RTL
- •6.7.5 RTL Representation Converted to Presburger Arithmetic
- •6.7.6 Constraint Graph Analysis
- •6.8 MODECHART SPECIFICATION LANGUAGE
- •6.8.1 Modes
- •6.8.2 Transitions
- •6.9.1 System Computations
- •6.9.2 Computation Graph
- •6.9.3 Timing Properties
- •6.9.4 Minimum and Maximum Distance Between Endpoints
- •6.9.5 Exclusion and Inclusion of Endpoint and Interval
- •6.10 AVAILABLE TOOLS
- •6.11 HISTORICAL PERSPECTIVE AND RELATED WORK
- •6.12 SUMMARY
- •EXERCISES
- •7.1.1 Timed Executions
- •7.1.2 Timed Traces
- •7.1.3 Composition of Timed Automata
- •7.1.4 MMT Automata
- •7.1.6 Proving Time Bounds with Simulations
- •7.2.1 Untimed Traces
- •7.2.2 Timed Traces
- •7.3.1 Clock Regions
- •7.3.2 Region Automaton
- •7.4 AVAILABLE TOOLS
- •7.5 HISTORICAL PERSPECTIVE AND RELATED WORK
- •7.6 SUMMARY
- •EXERCISES
- •TIMED PETRI NETS
- •8.1 UNTIMED PETRI NETS
- •8.2 PETRI NETS WITH TIME EXTENSIONS
- •8.2.1 Timed Petri Nets
- •8.2.2 Time Petri Nets
- •8.3 TIME ER NETS
- •8.3.1 Strong and Weak Time Models
- •8.5.1 Determining Fireability of Transitions from Classes
- •8.5.2 Deriving Reachable Classes
- •8.6 MILANO GROUP’S APPROACH TO HLTPN ANALYSIS
- •8.6.1 Facilitating Analysis with TRIO
- •8.7 PRACTICALITY: AVAILABLE TOOLS
- •8.8 HISTORICAL PERSPECTIVE AND RELATED WORK
- •8.9 SUMMARY
- •EXERCISES
- •PROCESS ALGEBRA
- •9.1 UNTIMED PROCESS ALGEBRAS
- •9.2 MILNER’S CALCULUS OF COMMUNICATING SYSTEMS
- •9.2.1 Direct Equivalence of Behavior Programs
- •9.2.2 Congruence of Behavior Programs
- •9.2.3 Equivalence Relations: Bisimulation
- •9.3 TIMED PROCESS ALGEBRAS
- •9.4 ALGEBRA OF COMMUNICATING SHARED RESOURCES
- •9.4.1 Syntax of ACSR
- •9.4.2 Semantics of ACSR: Operational Rules
- •9.4.3 Example Airport Radar System
- •9.5 ANALYSIS AND VERIFICATION
- •9.5.1 Analysis Example
- •9.5.2 Using VERSA
- •9.5.3 Practicality
- •9.6 RELATIONSHIPS TO OTHER APPROACHES
- •9.7 AVAILABLE TOOLS
- •9.8 HISTORICAL PERSPECTIVE AND RELATED WORK
- •9.9 SUMMARY
- •EXERCISES
- •10.3.1 The Declaration Section
- •10.3.2 The CONST Declaration
- •10.3.3 The VAR Declaration
- •10.3.4 The INPUTVAR Declaration
- •10.3.5 The Initialization Section INIT and INPUT
- •10.3.6 The RULES Section
- •10.3.7 The Output Section
- •10.5.1 Analysis Example
- •10.6 THE ANALYSIS PROBLEM
- •10.6.1 Finite Domains
- •10.6.2 Special Form: Compatible Assignment to Constants,
- •10.6.3 The General Analysis Strategy
- •10.8 THE SYNTHESIS PROBLEM
- •10.8.1 Time Complexity of Scheduling Equational
- •10.8.2 The Method of Lagrange Multipliers for Solving the
- •10.9 SPECIFYING TERMINATION CONDITIONS IN ESTELLA
- •10.9.1 Overview of the Analysis Methodology
- •10.9.2 Facility for Specifying Behavioral Constraint Assertions
- •10.10 TWO INDUSTRIAL EXAMPLES
- •10.10.2 Specifying Assertions for Analyzing the FCE Expert System
- •Meta Rules of the Fuel Cell Expert System
- •10.11.1 General Analysis Algorithm
- •10.11.2 Selecting Independent Rule Sets
- •10.11.3 Checking Compatibility Conditions
- •10.12 QUANTITATIVE TIMING ANALYSIS ALGORITHMS
- •10.12.1 Overview
- •10.12.2 The Equational Logic Language
- •10.12.3 Mutual Exclusiveness and Compatibility
- •10.12.5 Program Execution and Response Time
- •10.12.8 Special Form A and Algorithm A
- •10.12.9 Special Form A
- •10.12.10 Special Form D and Algorithm D
- •10.12.11 The General Analysis Algorithm
- •10.12.12 Proofs
- •10.13 HISTORICAL PERSPECTIVE AND RELATED WORK
- •10.14 SUMMARY
- •EXERCISES
- •11.1 THE OPS5 LANGUAGE
- •11.1.1 Overview
- •11.1.2 The Rete Network
- •11.2.1 Static Analysis of Control Paths in OPS5
- •11.2.2 Termination Analysis
- •11.2.3 Timing Analysis
- •11.2.4 Static Analysis
- •11.2.5 WM Generation
- •11.2.6 Implementation and Experiment
- •11.3.1 Introduction
- •11.3.3 Response Time of OPS5 Systems
- •11.3.4 List of Symbols
- •11.3.5 Experimental Results
- •11.3.6 Removing Cycles with the Help of the Programmer
- •11.4 HISTORICAL PERSPECTIVE AND RELATED WORK
- •11.5 SUMMARY
- •EXERCISES
- •12.1 INTRODUCTION
- •12.2 BACKGROUND
- •12.3 BASIC DEFINITIONS
- •12.3.1 EQL Program
- •12.3.4 Derivation of Fixed Points
- •12.4 OPTIMIZATION ALGORITHM
- •12.5 EXPERIMENTAL EVALUATION
- •12.6 COMMENTS ON OPTIMIZATION METHODS
- •12.6.1 Qualitative Comparison of Optimization Methods
- •12.7 HISTORICAL PERSPECTIVE AND RELATED WORK
- •12.8 SUMMARY
- •EXERCISES
- •BIBLIOGRAPHY
- •INDEX

LIST OF FIGURES
1.1 |
A real-time system |
2 |
2.1 |
Truth table of P → R |
12 |
2.2 |
Truth table for simple formulas |
12 |
2.3 |
Equivalent formulas |
13 |
2.4 |
Truth table for proving F4 |
15 |
2.5 |
Resolution procedure for propositional logic |
16 |
2.6 |
Deduction tree 1 |
18 |
2.7 |
Deduction tree 2 |
18 |
2.8 |
Unification algorithm |
26 |
2.9 |
Transition table 1 |
30 |
2.10 |
Automaton A1 |
31 |
2.11 |
Transition table 2 |
31 |
2.12 |
Automaton A2 |
31 |
2.13 |
Automaton α for automatic air conditioning and heating system |
34 |
2.14 |
Smart traffic light system |
35 |
2.15 |
Safety property for smart traffic light system |
36 |
2.16 |
Revised pedestrian automaton |
36 |
3.1 |
RM schedule |
45 |
3.2 |
RM schedule |
49 |
3.3 |
FIFO schedule |
50 |
3.4 |
EDF schedule |
51 |
xix
xx |
LIST OF FIGURES |
|
3.5 |
EDF schedule |
53 |
3.6 |
Infeasible RM schedule |
54 |
3.7 |
RM schedule |
55 |
3.8 |
EDF schedule |
55 |
3.9 |
Schedule for example task set using approach 1 |
56 |
3.10 |
Schedule for example task set using approach 2 |
57 |
3.11 |
Schedule for example task set using approach 3: deferred server |
57 |
3.12 |
Scheduling algorithm A for tasks with precedence constraints |
59 |
3.13 |
Precedence graph |
60 |
3.14 |
Scheduling algorithm B for tasks with precedence constraints |
60 |
3.15 |
Schedule for tasks with precedence constraints |
61 |
3.16 |
Schedule for tasks with precedence constraints after shifting tasks |
61 |
3.17 |
Scheduling algorithm for tasks with rendezvous constraints |
62 |
3.18 |
Infeasible EDF schedule for tasks with rendezvous constraints |
63 |
3.19EDF schedule for tasks with rendezvous constraints, after
|
revising deadlines |
64 |
3.20 |
Infeasible EDF schedule for tasks with critical sections |
64 |
3.21 |
Scheduling algorithm for tasks with critical sections |
65 |
3.22 |
Schedule for tasks with critical sections |
65 |
3.23 |
Gantt chart |
66 |
3.24 |
Timing diagram |
66 |
3.25 |
Scheduling game board |
67 |
3.26 |
Game board showing deadline miss |
68 |
3.27 |
Game board showing a feasible schedule |
69 |
3.28 |
Schedule for four periodic tasks on two processors |
71 |
4.1 |
CTL structure for the railroad crossing system |
88 |
4.2 |
BDD for formula ( p q) (r s) (t u) |
117 |
4.3 |
BDD for formula ( p q) (r s) (t u) |
118 |
4.4 |
Algorithm restrict |
119 |
4.5 |
Symbolic model checking algorithm |
120 |
4.6 |
Minimum delay algorithm |
122 |
4.7 |
Maximum delay algorithm |
122 |
4.8 |
Minimum condition-counting algorithm |
124 |
4.9 |
Maximum condition-counting algorithm |
124 |
4.10 |
TTG minimum delay algorithm |
126 |
5.1 |
Special events, conditions, and actions |
136 |
5.2 |
Two Statecharts of the behavior of a car’s pedals |
137 |
5.3 |
Statechart A of a solution to the mutual exclusion problem |
138 |
|
LIST OF FIGURES |
xxi |
5.4 |
Statechart B of a solution to the mutual exclusion problem |
138 |
5.5 |
Module-chart of a simplified car |
141 |
6.1 |
Constructing the constraint graph corresponding to example |
156 |
6.2 |
Worst-case search tree for example |
159 |
6.3 |
Rearranging positive cycles to trim the search tree |
161 |
6.4 |
Modechart 1 |
172 |
6.5 |
Modechart 2 |
173 |
6.6 |
Algorithm for checking minimum distance |
178 |
6.7 |
Algorithm for checking maximum distance |
179 |
7.1 |
Automaton α1 for automatic air conditioning and heating system |
196 |
7.2 |
Automaton α2 for message sending and acknowledgment |
198 |
7.3 |
Clock regions for two clocks, ci = 1 and c j = 2 |
203 |
7.4 |
Automaton α3 |
204 |
7.5 |
Verification algorithm |
205 |
8.1 |
Petri net of a three-process mutual exclusion algorithm |
213 |
8.2 |
Sample ER net |
220 |
8.3 |
Partial TERN for a smart traffic light system |
221 |
9.1 |
CCS laws |
240 |
9.2 |
ACSR-specific laws |
251 |
9.3 |
Differences between ACSR and VERSA |
253 |
10.1 |
A real-time decision system |
261 |
10.2 |
State-space graph of a real-time decision program |
270 |
10.3 |
Development of real-time decision systems |
272 |
10.4 |
Computer-aided design tools for real-time decision systems |
274 |
10.5Complete finite state-space graph representing the program
|
example2 |
279 |
10.6 |
A two-counter machine for testing odd input |
281 |
10.7Continuous functions f1 and f2 approximating the discrete
|
functions q1 and q2 |
299 |
10.8 |
Overview of the analysis methodology |
303 |
10.9 |
The Estella-General Analysis Tool |
305 |
10.10A high-level dependency graph and its strongly connected
|
components |
327 |
||||||
10.11 |
The high-level dependency graph construction procedure |
337 |
||||||
10.12 |
The HLD graph of Program |
|
1 |
339 |
||||
10.13 |
Algorithm |
|
A |
343 |
||||
10.14 |
The ME graph of Program |
|
2 |
344 |

xxii |
LIST OF FIGURES |
|
|||||||||
10.15 |
Depth-first-search algorithm |
349 |
|||||||||
10.16 |
Algorithm |
|
|
D |
350 |
||||||
10.17 |
(a) The RD graph of Program |
|
3. (b) The SRD graph of Program |
|
3 |
351 |
|||||
10.18 |
Traversing orders by the subrule 11 |
352 |
|||||||||
10.19 |
The ME graph of Program |
|
3 |
352 |
|||||||
10.20 |
The general analysis algorithm |
353 |
|||||||||
10.21 |
Rule enabling patterns |
356 |
|||||||||
10.22 |
VM cycles |
359 |
|||||||||
11.1 |
An example of a Rete network |
372 |
|||||||||
11.2 |
State-space graph of an OPS5 program |
374 |
|||||||||
11.3 |
Enabling relation with pessimistic estimation |
392 |
|||||||||
11.4 |
CPU timing report of the OMS expert system |
399 |
|||||||||
11.5 |
Test results of the OMS expert system |
399 |
|||||||||
11.6 |
PI graph cycle classification |
403 |
|||||||||
11.7 |
PI graph of Waltz program segment |
405 |
|||||||||
11.8 |
Algorithm |
|
A |
410 |
|||||||
11.9 |
The Rete network for r4 |
413 |
|||||||||
11.10 |
Algorithm |
|
M |
417 |
|||||||
11.11 |
The Rete network for the Waltz program segment |
418 |
|||||||||
11.12 |
ri dis-instantiates r j |
420 |
11.13A cycle violates the assumption if p does not have a bounded
|
response time |
421 |
11.14 |
Old PI graph of Waltz |
425 |
11.15 |
New PI graph of Waltz |
428 |
12.1 |
An example of the EQL(B) rule-based expert system |
441 |
12.2 |
An EQL program-based decision system |
441 |
12.3 |
State-space graph for the EQL(B) program in Figure 12.1 |
443 |
12.4 |
Derivation of fixed-point assertion F P2 |
445 |
12.5 |
General optimization schema |
446 |
12.6Rule-dependency graph (a) and a corresponding high-level
|
dependency graph (b) for the EQL(B) program in Figure 12.1 |
447 |
12.7 |
Bottom-up generation of an optimized transition system |
448 |
12.8State-space graphs for independent rule-sets R1 and R2 as
generated from the EQL(B) program in Figure 12.1 using the BU |
|
algorithm. xxxd denotes all eight states for which the value of |
|
variable d is equal to 1 |
449 |
12.9Transformation of the state-space graph generated with the BU algorithm to the graph with grouped equivalent states. Equivalence
is based on an equally labeled single-rule transition to a single state. |
|
The transformation is initiated with a call to Transform BU |
449 |
LIST OF FIGURES |
xxiii |
12.10Bottom-up generation of an optimized transition system with
derivation of equivalent states |
450 |
12.11State-space graphs for independent rule-sets R1 and R2 as generated
from the EQL(B) program in Figure 12.1, using the ES algorithm |
451 |
12.12Bottom-up generation of an optimized transition system with
generation of equivalent states and multiple-rule transitions |
452 |
12.13State-space graphs for independent rule-sets R1 and R2 as generated
from the EQL(B) program in Figure 12.1, using the ESM algorithm |
452 |
12.14An example of a non-deterministic section of a transition system
{a,b,c}
S2 −→ S1(a) and its corresponding deterministic system
{c} {b,a} |
{a,b,c} |
(b) |
453 |
S2c −→ S2b −→ S2a |
−→ S1 |
12.15An optimized EQL(B) program derived from the program in Figure
12.1, using either the BU or ES algorithm |
455 |
12.16An optimized EQL(B) program derived from the program in Figure
12.1, using the ESM algorithm |
455 |
REAL-TIME SYSTEMS