
- •CONTENTS
- •PREFACE
- •LIST OF FIGURES
- •INTRODUCTION
- •1.1 WHAT IS TIME?
- •1.2 SIMULATION
- •1.3 TESTING
- •1.4 VERIFICATION
- •1.6 USEFUL RESOURCES
- •2.1 SYMBOLIC LOGIC
- •2.1.1 Propositional Logic
- •2.1.2 Predicate Logic
- •2.2 AUTOMATA AND LANGUAGES
- •2.2.1 Languages and Their Representations
- •2.2.2 Finite Automata
- •2.3 HISTORICAL PERSPECTIVE AND RELATED WORK
- •2.4 SUMMARY
- •EXERCISES
- •3.1 DETERMINING COMPUTATION TIME
- •3.2 UNIPROCESSOR SCHEDULING
- •3.2.1 Scheduling Preemptable and Independent Tasks
- •3.2.2 Scheduling Nonpreemptable Tasks
- •3.2.3 Nonpreemptable Tasks with Precedence Constraints
- •3.2.5 Periodic Tasks with Critical Sections: Kernelized Monitor Model
- •3.3 MULTIPROCESSOR SCHEDULING
- •3.3.1 Schedule Representations
- •3.3.3 Scheduling Periodic Tasks
- •3.4 AVAILABLE SCHEDULING TOOLS
- •3.4.2 PerfoRMAx
- •3.4.3 TimeWiz
- •3.6 HISTORICAL PERSPECTIVE AND RELATED WORK
- •3.7 SUMMARY
- •EXERCISES
- •4.1 SYSTEM SPECIFICATION
- •4.2.1 Analysis Complexity
- •4.3 EXTENSIONS TO CTL
- •4.4 APPLICATIONS
- •4.4.1 Analysis Example
- •4.5 COMPLETE CTL MODEL CHECKER IN C
- •4.6 SYMBOLIC MODEL CHECKING
- •4.6.1 Binary Decision Diagrams
- •4.6.2 Symbolic Model Checker
- •4.7.1 Minimum and Maximum Delays
- •4.7.2 Minimum and Maximum Number of Condition Occurrences
- •4.8 AVAILABLE TOOLS
- •4.9 HISTORICAL PERSPECTIVE AND RELATED WORK
- •4.10 SUMMARY
- •EXERCISES
- •VISUAL FORMALISM, STATECHARTS, AND STATEMATE
- •5.1 STATECHARTS
- •5.1.1 Basic Statecharts Features
- •5.1.2 Semantics
- •5.4 STATEMATE
- •5.4.1 Forms Language
- •5.4.2 Information Retrieval and Documentation
- •5.4.3 Code Executions and Analysis
- •5.5 AVAILABLE TOOLS
- •5.6 HISTORICAL PERSPECTIVE AND RELATED WORK
- •5.7 SUMMARY
- •EXERCISES
- •6.1 SPECIFICATION AND SAFETY ASSERTIONS
- •6.4 RESTRICTED RTL FORMULAS
- •6.4.1 Graph Construction
- •6.5 CHECKING FOR UNSATISFIABILITY
- •6.6 EFFICIENT UNSATISFIABILITY CHECK
- •6.6.1 Analysis Complexity and Optimization
- •6.7.2 Timing Properties
- •6.7.3 Timing and Safety Analysis Using RTL
- •6.7.5 RTL Representation Converted to Presburger Arithmetic
- •6.7.6 Constraint Graph Analysis
- •6.8 MODECHART SPECIFICATION LANGUAGE
- •6.8.1 Modes
- •6.8.2 Transitions
- •6.9.1 System Computations
- •6.9.2 Computation Graph
- •6.9.3 Timing Properties
- •6.9.4 Minimum and Maximum Distance Between Endpoints
- •6.9.5 Exclusion and Inclusion of Endpoint and Interval
- •6.10 AVAILABLE TOOLS
- •6.11 HISTORICAL PERSPECTIVE AND RELATED WORK
- •6.12 SUMMARY
- •EXERCISES
- •7.1.1 Timed Executions
- •7.1.2 Timed Traces
- •7.1.3 Composition of Timed Automata
- •7.1.4 MMT Automata
- •7.1.6 Proving Time Bounds with Simulations
- •7.2.1 Untimed Traces
- •7.2.2 Timed Traces
- •7.3.1 Clock Regions
- •7.3.2 Region Automaton
- •7.4 AVAILABLE TOOLS
- •7.5 HISTORICAL PERSPECTIVE AND RELATED WORK
- •7.6 SUMMARY
- •EXERCISES
- •TIMED PETRI NETS
- •8.1 UNTIMED PETRI NETS
- •8.2 PETRI NETS WITH TIME EXTENSIONS
- •8.2.1 Timed Petri Nets
- •8.2.2 Time Petri Nets
- •8.3 TIME ER NETS
- •8.3.1 Strong and Weak Time Models
- •8.5.1 Determining Fireability of Transitions from Classes
- •8.5.2 Deriving Reachable Classes
- •8.6 MILANO GROUP’S APPROACH TO HLTPN ANALYSIS
- •8.6.1 Facilitating Analysis with TRIO
- •8.7 PRACTICALITY: AVAILABLE TOOLS
- •8.8 HISTORICAL PERSPECTIVE AND RELATED WORK
- •8.9 SUMMARY
- •EXERCISES
- •PROCESS ALGEBRA
- •9.1 UNTIMED PROCESS ALGEBRAS
- •9.2 MILNER’S CALCULUS OF COMMUNICATING SYSTEMS
- •9.2.1 Direct Equivalence of Behavior Programs
- •9.2.2 Congruence of Behavior Programs
- •9.2.3 Equivalence Relations: Bisimulation
- •9.3 TIMED PROCESS ALGEBRAS
- •9.4 ALGEBRA OF COMMUNICATING SHARED RESOURCES
- •9.4.1 Syntax of ACSR
- •9.4.2 Semantics of ACSR: Operational Rules
- •9.4.3 Example Airport Radar System
- •9.5 ANALYSIS AND VERIFICATION
- •9.5.1 Analysis Example
- •9.5.2 Using VERSA
- •9.5.3 Practicality
- •9.6 RELATIONSHIPS TO OTHER APPROACHES
- •9.7 AVAILABLE TOOLS
- •9.8 HISTORICAL PERSPECTIVE AND RELATED WORK
- •9.9 SUMMARY
- •EXERCISES
- •10.3.1 The Declaration Section
- •10.3.2 The CONST Declaration
- •10.3.3 The VAR Declaration
- •10.3.4 The INPUTVAR Declaration
- •10.3.5 The Initialization Section INIT and INPUT
- •10.3.6 The RULES Section
- •10.3.7 The Output Section
- •10.5.1 Analysis Example
- •10.6 THE ANALYSIS PROBLEM
- •10.6.1 Finite Domains
- •10.6.2 Special Form: Compatible Assignment to Constants,
- •10.6.3 The General Analysis Strategy
- •10.8 THE SYNTHESIS PROBLEM
- •10.8.1 Time Complexity of Scheduling Equational
- •10.8.2 The Method of Lagrange Multipliers for Solving the
- •10.9 SPECIFYING TERMINATION CONDITIONS IN ESTELLA
- •10.9.1 Overview of the Analysis Methodology
- •10.9.2 Facility for Specifying Behavioral Constraint Assertions
- •10.10 TWO INDUSTRIAL EXAMPLES
- •10.10.2 Specifying Assertions for Analyzing the FCE Expert System
- •Meta Rules of the Fuel Cell Expert System
- •10.11.1 General Analysis Algorithm
- •10.11.2 Selecting Independent Rule Sets
- •10.11.3 Checking Compatibility Conditions
- •10.12 QUANTITATIVE TIMING ANALYSIS ALGORITHMS
- •10.12.1 Overview
- •10.12.2 The Equational Logic Language
- •10.12.3 Mutual Exclusiveness and Compatibility
- •10.12.5 Program Execution and Response Time
- •10.12.8 Special Form A and Algorithm A
- •10.12.9 Special Form A
- •10.12.10 Special Form D and Algorithm D
- •10.12.11 The General Analysis Algorithm
- •10.12.12 Proofs
- •10.13 HISTORICAL PERSPECTIVE AND RELATED WORK
- •10.14 SUMMARY
- •EXERCISES
- •11.1 THE OPS5 LANGUAGE
- •11.1.1 Overview
- •11.1.2 The Rete Network
- •11.2.1 Static Analysis of Control Paths in OPS5
- •11.2.2 Termination Analysis
- •11.2.3 Timing Analysis
- •11.2.4 Static Analysis
- •11.2.5 WM Generation
- •11.2.6 Implementation and Experiment
- •11.3.1 Introduction
- •11.3.3 Response Time of OPS5 Systems
- •11.3.4 List of Symbols
- •11.3.5 Experimental Results
- •11.3.6 Removing Cycles with the Help of the Programmer
- •11.4 HISTORICAL PERSPECTIVE AND RELATED WORK
- •11.5 SUMMARY
- •EXERCISES
- •12.1 INTRODUCTION
- •12.2 BACKGROUND
- •12.3 BASIC DEFINITIONS
- •12.3.1 EQL Program
- •12.3.4 Derivation of Fixed Points
- •12.4 OPTIMIZATION ALGORITHM
- •12.5 EXPERIMENTAL EVALUATION
- •12.6 COMMENTS ON OPTIMIZATION METHODS
- •12.6.1 Qualitative Comparison of Optimization Methods
- •12.7 HISTORICAL PERSPECTIVE AND RELATED WORK
- •12.8 SUMMARY
- •EXERCISES
- •BIBLIOGRAPHY
- •INDEX

|
|
QUANTITATIVE TIMING ANALYSIS ALGORITHMS |
339 |
|
|
C 3 |
5 |
C 5 |
|
|
|
|
||
|
|
10 |
12 |
|
C |
6 |
7 |
|
|
1 |
|
|
|
|
|
1 |
11 |
13 |
|
|
|
|
|
|
|
2 |
8 |
|
|
|
3 |
|
|
|
|
|
14 |
|
|
|
|
|
|
|
|
C 2 4 |
9 |
C 6 |
|
|
C 4 |
|
|
|
|
|
|
|
Figure 10.12 The HLD graph of Program 1.
(*4*) [] d := c IF a > 0
(*5*) [] e := c + 1 IF c ≤ 1 and b > 0
(*6*) [] f := c + 1 | e := c − 1 IF c ≤ 1 and b ≤ 0 (*7*) [] f := c − 1 IF c ≥ 0
(*8*) [] g := 1 | h := 1 IF f > 1 and d > 1 (*9*) [] g := 2 | h := 2 IF f ≤ 1 and e > 1
(*10*) [] x := true IF g = 2 and y = true (*11*) [] x := false IF g = 1
(*12*) [] y := true IF h = 2 and x = false (*13*) [] y := false IF h = 1
(*14*) [] z := true IF x = true and y = true
END.
Applying the HLD graph construction procedure to Program 1, the resulting HLD graph GProgram 1 is shown in Figure 10.12. Rule 1 and rule 2 are assigned higher priorities than rule 3 and rule 4, which in turn are assigned higher priorities than rule 8 and rule 9, and so on. Note that rule 3 and rule 4 are assigned the same priority as rule 5, rule 6, and rule 7.
10.12.5 Program Execution and Response Time
The execution of the n-rule program p is a sequence of recognize–act cycles. Each recognize–act cycle consists of two phases: match and fire.
•During the match phase, a sequence of evaluations are conducted such that rules of p are evaluated in order of their priorities to determine a highest-priority fireable rule. The order of evaluating rules sharing the same priority is nondeterministic or up to the run-time scheduler. Suppose r is checked next. The enabling condition of r is evaluated first to see if r is enabled. If r is not en-
340 DESIGN AND ANALYSIS OF PROPOSITIONAL-LOGIC RULE-BASED SYSTEMS
abled, r is found to be not fireable and another rule is checked if an unchecked rule still exists; otherwise, all of the RHS expressions of r are evaluated in a parallel manner and the resulting values are compared with the values of corresponding LHS variables to see if the firing of r changes the value of a variable. If r is enabled and the firing of r changes the value of a variable, r is found to be fireable. This evaluation continues until either one rule is found to be fireable or all of the rules are found to be not fireable.
•During the fire phase, all of the assignment expressions of the selected fireable rule are carried out in parallel.
The recognize–act cycle continues until none of the rules is fireable. p reaches a fixed point if none of its rules is fireable. The execution of p terminates when p reaches a fixed point.
Since all rules may not have the same number of assignment expressions and the same size of enabling conditions, evaluating and firing different rules may take different amounts of time. However, for each rule r p, it takes only up to a fixed amount of time to evaluate the enabling condition of r, since the size of the enabling condition of r is finite. In addition, the time needed for selecting a rule to evaluate is also finite since only a finite number of rules exist from which to choose. Assume the maximal amount of time needed to select and evaluate a rule is x units of time. Since there are n rules in p, the match phase needs at most n x units of time.
Furthermore, since there are only up to a fixed number, say m, of assignment expressions in each rule, it also takes only up to a fixed amount of time to conduct the fire phase. Assume the maximal amount of time needed to carry out an assignment expression is y units of time. The fire phase needs at most m y units of time. Hence, the time spent during each cycle is at most n x +m y units of time. If the execution takes at most l recognize–act cycles to reach a fixed point, the response time is at most l (n x + m y) units of time. That is, the response time (i.e., execution time) of p is proportional to the number of recognize–act cycles (and thus the number of rule firings) during the execution of p. If we know the maximal amount of actual time needed to select and evaluate a rule and the maximal amount of actual time needed to carry out an assignment expression, then the response time of p can be easily calculated. Since these quantities are machine-dependent, the response time of p in this chapter is measured in terms of the number of rule firings during the execution of p. The program p has a bounded response time if and only if the number of rule firings during the execution of p is bounded by a fixed number.
The exact upper bound on the number of rule firings during the execution of p is the integer i representing the maximal number of rule firings that can possibly happen during the execution of p. An upper bound on the number of rule firings during the execution of p is an integer j, j ≥ i. In the remainder of this chapter, an upper bound for the program p refers to an upper bound on the number of rule firings during the execution of p, unless otherwise stated. Let T p represent an upper bound for the program p.
QUANTITATIVE TIMING ANALYSIS ALGORITHMS |
341 |
10.12.6 State-Space Graph
The execution of p can be lar to the execution graph in the graph represent all of p.
modeled by the state-space graph of p. This graph is simiused by [Aiken, Widom, and Hellerstein, 1992]. The paths of the possible rule firing sequences during the execution
State-Space Graph: The state-space graph of p is a labeled directed graph G p = (V, E). V is a set of distinct vertices representing states such that V contains a vertex labeled v if and only if v is a possible value of the state variable. Note that each label v is an (n+m)-tuple, where n is the number of input variables and m is the number of non-input variables. E is a set of edges representing rule firings such that E contains the edge i, j from the vertex i to the vertex j if and only if (1) there is a rule r that is enabled at i and (2) the firing of r at i results in the state variable having the same value as j.
A rule is enabled at the vertex (state) i if and only if its enabling condition is evaluated to be true with respect to the label value of i; otherwise, it is disabled at i. For each vertex v in the state-space graph G p, the label v corresponds to a value of the state variable, which consists of two parts: vi of the set of input variables X and vo of the set of non-input variables Y . The vertex v is a launch state if (1) the content of the label v is equal to the initial value of the state variable, or (2) vi is a potential value of the set of input variables and vo is a potential value of the set of non-input variables as a result of execution. On the other hand, v is a final state (i.e., fixed point) if it does not have an outgoing edge to another vertex. For each rule r p, r is not fireable when p reaches a final state.
The rule r is said to potentially enable the rule r if a state s exists, at which r is disabled, and firing r at s makes the value of the enabling condition of r true. On the other hand, r is said to disable r if, for each state s where r and r are both enabled, firing r at s makes the value of the enabling condition of r false.
10.12.7 Response-Time Analysis Problem and Special Form
Given a program p, the response-time analysis problem is to determine the response time of p. This problem consists of two parts: (1) checking whether or not the execution of p always terminates in a bounded number of rule firings and (2) if it does, obtaining an upper bound on the number of rule firings during the execution of p. Note that, if the execution of p does not always terminate in bounded time, the maximal response time of p is infinite.
p is analyzable by the algorithm α if α can determine whether or not the execution of p always terminates in a bounded number of rule firings. In general, the analysis problem is undecidable if the program variables have infinite domains and is PSPACE-hard in the case where all of the variables have finite domains [Browne, Cheng, and Mok, 1988]. Hence, even in the case where all of the variables have finite domains, the amount of time needed to analyze a system is usually very large.

342 DESIGN AND ANALYSIS OF PROPOSITIONAL-LOGIC RULE-BASED SYSTEMS
However, it has been observed by the authors that sets of syntactic and semantic constraint assertions exist such that if the set of rules S satisfies any of them, the execution of S always terminates in bounded time. A special form is a set of syntactic and semantic constraint assertions on a set of rules. A set of rules satisfying all assertions of special form F is said to be in special form F and is guaranteed to always reach a fixed point in bounded time. Two special forms have been observed and, for each of them, we have developed an algorithm used to calculate response-time upper bounds for programs satisfying it. Hence, if a program (or part of a program) is determined to be in a known special form, the corresponding response-time upper-bound algorithm can be used such that the use of expensive exhaustive state-space graph checks can be avoided (or at least minimized).
10.12.8 Special Form A and Algorithm A
The first set of syntactic and semantic constraint assertions is called Special Form A, which allows only constant expressions to be assigned to non-input variables. In addition, for each rule r in a Special Form A program p, r can be fired at most once during the execution of p.
10.12.9 Special Form A
Special Form A: Let S denote a set of rules. S is in Special Form A if the following conditions hold.
A1. RS = .
A2. For each pair of distinct rules r and r in S, r and r are compatible. A3. L S ∩ TS = .
To check if a set of n rules is in Special Form A, the recognition procedure requires O(n)-time for checking the satisfiability of (A1) and O(k2)-time for checking the satisfiability of (A3), where k is the number of variables in this set of rules. In addition, it takes quadratic time to check the satisfiability of (A2).
Theorem 5. If p is in Special Form A, then the execution of p always terminates in n rule firings, where n is the number of rules in p.
Proof of Theorem 5. The proof can be found in section 10.12.12.
Algorithm A We now improve the upper bound above by exploiting the property of mutual exclusiveness among rules. If r and r are compatible by mutual exclusiveness, then at least one of them, say r, is disabled at any moment during the execution of p. Hence, the rule r cannot be fired throughout the execution of p. This means that the value 1 can be subtracted from the value of n obtained by applying the theorem above to get a tighter (and better) upper bound for p. If a set of m rules exists in

QUANTITATIVE TIMING ANALYSIS ALGORITHMS |
343 |
which each pair of distinct rules are compatible by mutual exclusiveness, the argument above applies to each pair of rules in this set (i.e., at most one rule in this set can possibly be enabled and fired). This means that the value m −1 can be subtracted from the value n to get a better upper bound.
Let G1 and G2 be complete subgraphs of the ME graph G Mp E . We say that G1 and G2 are independent of each other if and only if V (G1) ∩ V (G2) = . Both G1 and G2 can contribute in deriving a better response-time upper bound. For each independent complete ME subgraph Gi , if Gi consists of mi vertices, then the value of mi − 1 can be subtracted from the value of n.
Assume k is the number of independent complete ME subgraphs and mi is the number of rules in the ith subgraph. As mentioned earlier, there is at most one rule firing by each set of rules corresponding to an independent complete ME subgraph during the execution of p. Hence, the smaller the value of k, the smaller the number of possible firings. For the purpose of deriving a tighter upper bound on the number of rule firings, we are interested in finding the minimal number of k. That is,
T p = n − |
i=1 |
(mi − 1) |
|
|
...k |
= n − |
mi + |
1 |
i=1...k |
|
i=1...k |
= n − n + k |
|
|
= k |
|
(10.1) |
Figure 10.13 shows Algorithm A, which results by applying the above strategy. Algorithm A requires, as mentioned earlier, quadratic time to perform step (1), to construct the ME graph. For step (2), the problem of finding the minimal number of independent complete subgraphs can easily be proved to be a transformation from the problem of partitioning a graph into cliques, which is an NP-complete problem [Garey and Johnson, 1979]. Hence, we use an approximation method that checks the existence of each edge at most once to partition the ME graph into a set of independent complete subgraphs. Since there are only at most n(n − 1)/2 edges in the ME graph, where n is the number of rules, step (2) also requires, at most, quadratic time. Step (3) requires a constant time to output the value of k.
Input A Special Form A program p.
Output An integer representing the upper bound found.
1.Construct the ME graph G Mp E .
2.Find the minimal number, k, of independent complete subgraphs of G Mp E .
3.Output(k).
Figure 10.13 Algorithm A.