A Boolean algebra of contracts for logical assume-guarantee reasoning

(1)

HAL Id: inria-00292870

https://hal.inria.fr/inria-00292870v7

Submitted on 13 Jan 2009

HAL is a multi-disciplinary open access archive for the deposit and dissemination of sci-

L’archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents

assume-guarantee reasoning

Yann Glouche, Paul Le Guernic, Jean-Pierre Talpin, Thierry Gautier

To cite this version:

Yann Glouche, Paul Le Guernic, Jean-Pierre Talpin, Thierry Gautier. A Boolean algebra of contracts for logical assume-guarantee reasoning. [Research Report] RR-6570, INRIA. 2008, pp.41. �inria- 00292870v7�

(2)

a p p o r t

d e r e c h e r c h e

9-6399ISRNINRIA/RR--6570--FR+ENG

Thèmes COM et SYM

A Boolean algebra of contracts for logical assume-guarantee reasoning

Yann Glouche, Paul Le Guernic, Jean-Pierre Talpin et Thierry Gautier

N° 6570

Juillet 2008

(3)

(4)

Yann Glouhe, PaulLe Guerni,Jean-Pierre Talpin et Thierry Gautier

∗

ThèmesCOMet SYMSystèmesommuniantset Systèmessymboliques

ProjetsESPRESSO

Rapportdereherhe n°6570Juillet200838pages

Abstrat: Assume-guaranteereasoning isa popular andexpressiveparadigm foramod-

ularand ompositionalspeiationofprograms. It isin turn ofbeoming afundamental

oneptin mainstreamindustrialomputer-aideddesigntoolsforembeddedsystemdesign.

In this paper, we elaborate new foundations for ontrat-based embedded system design

byproposingageneral-purposealgebraofassume/guaranteeontratsbasedontwosimple

onepts: rst,theassumptionorguaranteeofaomponentisdenedasalterand,seond,

ltersenjoythestrutureof aBoolean algebra. This yieldsan algebraiallyrih struture

whih allowsustoreasononontrats.

Key-words: assume/guarantee,ontrat,embeddedsystem,veriation,Booleanalgebra

∗

{yann.glouhe,paul.leguerni,jean-pierre.talpin,thierry.gautier}irisa.fr

(5)

Résumé : Le raisonnement basé surhypothèses/garantiesest unparadigme populaireet

expressifpourlaspéiationmodulaireetompositionnelledeprogrammes. Cetteapprohe

devient un onept fondamental dans l'informatique industrielle des outils de oneption

assistée par ordinateur pour les systèmes embarqués. Dans e rapport, nous élaborons

de nouvelles bases pour la oneptiondes systèmes embarquésfondée sur les ontrats, en

proposantune algèbrede ontratsgénérale,basée surdeux oneptssimples: d'unepart,

leshypothèsesetgarantiesd'unomposantsontdéniesentantqueltres,etd'autrepart,

lesltresontunestrutured'algèbrebooléenne. Ilenrésulteunestruturealgébriquerihe

quipermetderaisonnersurlesontrats.

Mots-lés : hypothèse/garantie, ontrat, système embarqué, vériation, algèbre boo-

léenne

(6)

Contents

1 Introdution 4

2 Analgebra ofproesses 4

3 Analgebra oflters 9

4 Analgebra ofontrats 14

5 Related work 18

6 Disussion 18

7 Conlusion 20

Referenes 22

A Proofs ofSetion2 23

B Proofs ofSetion3 25

C Proofs ofSetion4 30

(7)

1 Introdution

Commonmethodologialpreeptsfor attakingthedesignoflargeembedded arhitetures

advisethevalidationofspeiationsasearlyaspossibleandaniterativevalidationofeah

renementormodiationmadetotheinitialspeiation,untiltheimplementationofthe

systemisnalized. Additionally,ooperativeomponent-baseddevelopmentrequirestouse

andtoassembleomponents,thathavebeendevelopedbydierentsuppliers,andinasafe

andonsistentway. Theseomponentshavetobeprovidedwiththeironditionsofuseand

someguaranteesthattheyhavebeenvalidated whentheseonditionsaresatised.

We adopt the paradigmof ontrat to dene aomponent-basedvalidation proess in

theontextofasynhronousmodelingframework. Wedeneanovelalgebraiframeworkto

enablelogialreasoningonontrats. Itisbasedontwosimpleonepts. First,theassump-

tionsandguaranteesofaomponentaredened aslters: assumptionslterthebehavior

aomponentmayaeptandguaranteeslterthebehaviorsaomponentprovides. Seond

andforemost,wedeneaBooleanalgebratomanipulatelters. Thisyieldsanalgebraially

rihstruturewhihallowsustoreasononontrats(toabstrat,rene,ombineandnor-

malize them). This algebrai model is based on a minimalist model of exeution traes,

allowingonetoadaptiteasilyto apartiulardesignframework.

The most important aspet introdued by the framework is the notion of lter, for

whih the negationis learly dened. A lter onstrainsa nite set ofvariables, whih is

representedbythesetoftheproesseswhihsatisfytheseonstraints.

Plan Thepaperisorganizedasfollows. Setion2introduesasuitablygeneralalgebraof

proesseswhihborrowsitsnotationandoneptstodomaintheory[10℄. Aontrat(A,G )

isviewedasapairoflogialdevieslteringproesses:theassumptionAltersproessesto

selet(aept oronverselyrejet)thosethatareasserted(aeptedoronverselyrejeted)

bytheguaranteeG. Proess-ltersaredenedinSetion3andontratsinSetion4. Se-

tion5presentsrelatedworkandwhihisfurtherdisussedaroundanexamplein Setion6.

Setion7onludes thepresentation.

2 An algebra of proesses

We startwith thedenition of asuitable algebrafor behaviorsand proesses. Usually, a

behaviordesribesthetraeofadisreteproess(aMazurkiewiztraeoratupleofsignals

inLee'staggedsignalmodel). Wedeliberatelyhooseamoreabstratdenitioninorderto

enompassnotonlydisretebehaviorsonBoolean,integer,realvariablesbutalsobehaviors

ofmoreomplexsystems,suhasontinuousfuntions.

Denition 1. [Behavior℄ Let V be an innite, ountable set of variables, and D a set of values; for Y, a nite set of variables inluded in V (written Y ⊂_≀V), Y nonempty, a

→D B

(8)

emptyvariable domain:

B^Y =∆ ^Y→D andB∅ =∆ ∅

ForY,anitesetofvariablesinludedinV,Ynonempty,aY-behavior,Xa(possibly empty)subsetofY,|^X îs ^the^X-behaviorêqual^toôn^X:

|^X =∆{(^x,(^x))/^x∈^X}and_|∅=∅and_|Y = ⁽¹⁾

FromlefttorightThex, y^-behaviorsb1^andb2^are^funtions^from^the^variablesx, y ^to

funtionsthatdenotesignals. Left,behaviorb1îsâ^disrete^sampling^mappingâ^domainôf

timerepresentedbynaturalnumberstovaluesinrationalsQ^. ^Right,^behaviorb2^assoiates

x, y ^to ôntinuous^funtions ôf^time. Â^proess îs^denoted ^byâ^set ôf^behaviorsônâ^given

set of variables. For instane, the proess of behaviorb1^, ^below, ^ontains ^other ^possible

behaviorsonthevariablesx^andy^.

Denition 2. [Proess℄ For X, a nite set of variables (X ⊂_≀V), an X -proess p is a nonemptysetofX-behaviors.

Thus, sine B∅ =∆ ∅^, ^there îs âûnique ∅^-proess^designated ^by Ω =∆ ^{∅^}; Ω ^has^the

emptybehaviorasuniquebehavior. Theemptyproess isdenotedby0=∆ ∅^.

Sine Ω^does^not^haveâny^variable, ît ^has^noêet ^whenômposed (interseted) with other proesses. It an be seen as the universal proess, for onstraint onjuntion, in

(9)

ontrast with 0, the empty set of behaviors, the use of whih in onstraint onjuntion alwaysresultsin theemptyset. 0anbeseenasthenullproess.

ForX , a nite set of variables (X ⊂_≀V), we denote by P^X ^the ^set ôf X-proesses. A proessinP^X^dened ônâ^nite^setôf^variables^Xîs^said^strit^(thusΩîsâ^strit^proess).

P^denotes^the^set^of^all^strit^proesses.

P^X =∆P(B^X)\ {0}, P=∆∪(X⊂≀V)P^X (P∅ ={Ω})

Thedomain of behaviorsin anX-proess pis denotedby var^(p)=∆ ^X. 0is theonly non-stritV-proess: var⁽0)=V. Aproessiseither0,orastritproess. Hene,theset ofall proessesP^⋆ îs ^dened ^byP^⋆ =∆ P∪ {0} ând∀^X⊂≀V,P^⋆^X =∆ P^X∪ {0}^. ^Fôr^R⊆ P^⋆^,^R^denotes^theomplementaryofR. Wedenetheomplementaryofaproessandits restritionor extensionofthebehaviorsto agivensetof variables.

Denition3. [Complementary ofaproess℄ ForX, aniteset ofvariables (X⊂≀V),the omplementarye^pôfâ^proess^p∈P^X îs^dened ^by:

p∈P^X=⇒e^p=∆(B^X\^p) ={^b∈B^X/^b6∈^p} (Bf^X =0) ⁽²⁾

Denition 4. [Proess restritionand extension℄ When X, Y are nite sets of variables

suhthatX⊆^Y ⊂_≀V,Ynonempty,wedenetherestritionq

|^X∈P^X ^of^q∈P^Y^to^X^and

onverselytheextensionp

|^Y∈P^Y^of^p∈P^X ^to^Y^by:

q|^X =∆ {_|X/∈^q} (then^q_|∅ = Ω,^q_|var(q) =^q) ⁽³⁾

p

|^Y =∆ {∈B^Y/_|X∈^p} (thenΩ^|^Y=B^Y,^p^|^var^(p) =^p) ⁽⁴⁾

Left, the omplementary e^p ôf â ^proess p ^dened ôn ^the ^variables x ând y ônsists

x, y p

(10)

proessp^dened ôn x, y, zônsists ôfîts ^projetionôn^the ^restrited^domain^Right,^the

extension p

|{x, y, z}

of a proess p ^dened ôn x, y îs ^the ^largest ^proess ^dened ôn x, y, z

whoserestritiononx, y ^is^equal^top^.

ThesetP^⋆^X^,êquipped^withûnion,intersetionandomplementaryisaBooleanalgebra withsuprenumP^⋆^X ând înnum0. Restritionisextended to 0, theblokingproess,by

0_|

X = ^{_|X

/∈ ∅^}= 0. The restritionand extension of strit proesses satisfythe followingproperties.

Property 1. WhenW, X, Y, Z are nite sets ofvariables, Y, Z nonempty,p , q strit

proesses:

var^{(p )} ⊆^Z ⊆^Y =⇒ (^p^|^Z^|^Y =^p^|^Y)∧(^p^|^Y_|Z =^p^|^Z) ⁽⁵⁾ var^(p)=var^{(q )}⊆^Y =⇒ (((^p∩^q)^|^Y = (^p^|^Y∩^q^|^Y))∧((^p∪^q)^|^Y = (^p^|^Y∪^q^|^Y)))⁽⁶⁾ var^(p)=var^{(q )}⊆^Y =⇒ ((^p⊆^q)⇐⇒(^p^|^Y ⊆^q^|^Y)) ⁽⁷⁾

X⊆var^(p)=var^(q) =⇒ ((^p⊆^q) =⇒(^p_|X⊆^q_|X)) ⁽⁸⁾

Wedenetheposetofstritproesses.

Denition5. [Stritproessesextension℄FornonemptynitesetsofvariablesX⊆^Y ⊂_≀V

andforp∈P^X^,^the^relation^p^q^means^that^qîsânêxtensionôf^p^to^Y:

(^p^q)⇐⇒((var^(p)⊆var^{(q )})∧(^p^|var^(q) =^q))

Property 2. (P^,⁾^is^a^poset.

Theupperset[↑^p]ôfâ^proess^pîs ^the^set ôfâllîtsextensions:

[↑^p] =∆{^q∈P/^p^q} ([↑Ω] ={B^X}

X⊂≀V) ⁽⁹⁾

Denition6. [Variableontrol℄Aproess qontrolsavariabley,written (qy),i

((^y∈var^{(q )})∧^q(((^q_|(var^(q)\{^y}⁾)^|^var^(q))) ⁽¹⁰⁾

AproessqontrolsavariablesetX,written(qX)i

(∀^x∈^{X )}(^qx) (Ω∅) ⁽¹¹⁾

Moreover, isextendedto P^⋆ ^with0 V.

(11)

Left, theupperset [↑^p] îs^the^set ôfâll^proesses^q∈P ^suh ^that(^p^q)^Center, ^let

X ={x, y, z}^, â^proess ^p ∈P^X ôntrols ^the^variables x ând y ând ^letsz ^free ^Right, â

proessp∈P^X ^ontrols^the^variablesx, y, z^.

Note that, if a proess p ontrols X, this does not imply that, for all x∈^X, ^y∈^X,

x6=^y^,^(p_|(X\{^x}⁾⁾^ontrols^{y .}

Denition7. [Reduedproess℄Astritproesspisredued iitontrolsallitsvariables:

pisredued ipvar^{(p )}^.

Forinstane,Ω^is^redued. ^Redued^strit^proesses ^are^minimalⁱⁿ⁽P^,^). ^We^denote^by

▽

q,alledredutionofq ,the(minimal)stritproesssuhthat

▽

q^q^(p ^is^reduedⁱ^▽^p=^{p ).}

Right, the redution

▽

q of a proess q

and a proess p in the upper set [↑^q]^.

Assuming that var^{(q )} = ({x1. . . xn} ∪ {y1. . . ym}) ^and ^that ^q ^ontrols ^the ^vari-

ables {x1. . . xn}^, ^we ^have var⁽^▽^q) = {x1. . . xn}^. ^The ^proess ^p ^is ^suh ^that

p ∈ [↑^▽^q] ^with var^(p) ⊆ ({x1. . . xn} ∪ {y1. . . ym}∪{z1. . . zl})^. ^Proess^p^ontrols

thevariables{x1. . . xn}^,ând{y1. . . ym} ∪ {z1. . . zl} îs â ^set ôf ^free ^variables, ^suh

that

▽

q=^▽^p.

Property 3. Theomplementarye^pôfâ^strit ^proess^pîs^reduedⁱ^pîs^redued;e^pând

pontrolthesamesetofvariablesvar^(p).

Fromtheabove,wededuethat[↑^▽^p]^,^theûpper^setôf^the^redutionôf^p,îsâ^(prinipal)

lteredset[10℄: itisnonemptyandeahpairofelementshasalowerbound.Wealsoobserve

that var⁽^▽^q)îs ^the^greatest ^subsetôf ^variables^suh ^that ^qvar⁽^▽^q); ^forâ^strit ^proess ^q,

weextendthedenitionofvar⁽⁾^to^theûpper^setôfîts^redution^byvar⁽[↑^▽^q]⁾=∆var⁽^▽^q).

(12)

Property 4. Theuppersetofastrit proesspontainsauniqueproessp

|^Y

denedon

agivenset ofvariables Y⊇ var^{(p ) ;}^the ^proess^pând îtsêxtension ^p^|^Y ôntrol^the ^same

setofvariables,that istheset ofvariablesontroledbytheredutionofp.

((^q∈[↑^p])∧(^r∈[↑^p])∧(var^(q)=var^{(r )})) =⇒(^q=^r) ⁽¹²⁾ (var^(p)⊆^Y) =⇒((^p^|^Y)var⁽^▽^p)) ⁽¹³⁾ ((var^(p)∪var^(q))⊆^Y) =⇒((^p^|^Y =^q^|^Y) =⇒(^▽^p=^▽^q)) ⁽¹⁴⁾

Fortheblokingproess,weset 0 Vand[↑0] =^{0}.

Wedenetheinlusionlower set ofaproesstoaptureallthesubsetsofitsbehaviors.

LetR⊆P^⋆^,[^R↓_⊆] ^is^the^lower^set ^of^R^for⊆^:

[^R↓_⊆] =∆{^p∈P^⋆/⁽∃^q∈^R)(^p⊆^q)} ⁽¹⁵⁾

Property 5. Fromtheabovedenitions, weonludethat:

[[↑

▽

0]↓_⊆] = {0} ⁽¹⁶⁾ [[↑

▽

Ω]↓_⊆] = P^⋆ ⁽¹⁷⁾

3 An algebra of lters

Inthissetion,wedeneaproess-lterbythesetofproessesthatsatisfyagivenproperty.

Weproposeanorderrelation(⊑⁾ôn^the^setôfproess-ltersΦ^. ^Weêstablish^that⁽Φ^,⊑⁾îs

alattieand aBoolean algebra. A proess-lter Ris asubsetof P^⋆ ^that ^lters^proesses.

It ontainsallproessesthat are equivalent with respet tosomeonstraintorproperty,

sothatallproessesinRareaeptedorallofthembut 0arerejeted. Aproess-lteris builtfrom auniqueproess generator byextendingit to largersets ofvariables, and then

byinludingsubproessesofthese maximalallowedbehaviorsets.

Denition8. [Proess-lter℄AsetofproessesRisaproess-lter i(∃^r∈P^⋆⁾^(((r=^▽^r)

∧^(R= [[↑^r]↓_⊆] ^))). ^The^proess^rîs â^generator ôf^R^(Rîs^generated^by^r). ^We^denote

byΦ^is ^the^set ^ofproess-lters.

(13)

Theproess-ltergeneratedbytheredutionofaproesspisdenotedbyc[p] =∆ [[↑^▽^p]↓_⊆]^.

Left, a proess-lter is generated from the proess

p ^(depited ^by^a^bold ^line)^via^two^suessive^oper-

ations. The rst operation onsists of building the

uppersetoftheproess: takesalltheproessesthat

areompatiblewithpând^thatâre^denedônâ^big-

ger set ofvariables. Theseond operationproeeds

usingtheinlusion lowersetofthisset ofproesses:

it takes all the proesses that are dened by sub-

sets ofbehaviorsfrom proessesin theupperset(in

otherwords,thoseproessesthatremainompatible

whenaddingonstraints,beauseaddingonstraints

removesbehaviors).

Aproess-lterR=c[r]^satises^the^followingproperties:

Property 6. Thevariablesetofaproessp ,thatbelongsto aproess-ltergeneratedby

areduedproess

▽

r,ontainsthevariablesetofthisproess

▽

r. Thegeneratorofaproess-

lteris unique;wereferto itas

▽

R. Finally Ω^generates^the ^set ^of^all^proesses^(inluding 0),0belongstoalllters. Formally(∀^p,r,s∈P^⋆^):

(^p∈c[r]) =⇒ (var⁽^▽^r)⊆var^(p)) ⁽¹⁸⁾

c[r] =c[s] ⇐⇒ ^▽^r =^▽^s ⁽¹⁹⁾

Ω∈c[r] ⇐⇒ c[r] =P^⋆ ⁽²⁰⁾

0∈^R ⁽²¹⁾

Letp∈P^{x}^be^a^proess^dened^onx∈Vavariable whosebehaviorsareafuntionfromatotallyordered

domainoftimeT^to^rationalsQ^. ^Dene^the^proess-

lterptosatisfy:

∀b∈^p, b(x) :T7→Q

∀t, t^′∈T, t≤t^′⇔b(x)(t)≤b(x)(t^′)

Thenc[p]îs^the^setôfâll^proesses^s.t. ∀b∈B^,b∈^p, b(x) îs ^monotoni înreasing ^funtion ^from ^the ^do-

mainoftimeT^toQ^.

(14)

Weallstrit proess-lterstheproess-ltersthat areneitherP^⋆^nor^{0}. Theltered variablesetofRisvar^{(R )}^dened ^by:

var^{(R )}=∆ var⁽

▽

R) (22)

Theorem1. Astritproesspbelongsto aproess-lterRi

(∀^X,Y⊂_≀V)(var^{(R )}⊆^X⊆^Y),(^p∈^R) ⇐⇒





(var^{(R )}⊆var^{(p )})

(var^{(p )}⊆^Y) =⇒ ((^p^|^Y)_|X

⊆

▽

R

|^X

)

Corollary1. Thetwoequivalentpropertiesaresatised:

R⊆^S⇐⇒((var^(S)⊆var^{(R )})∧(

▽

R|var^(S)⊆

▽

S)) ⁽²³⁾

R⊆^S⇐⇒

▽

R∈^S ⁽²⁴⁾

Corollary2. Thefollowingpropertiesaresatised:

(^R⊆(^S∩^T)) ⇐⇒ ((^R⊆^S)∧(^R⊆^T))(ôrollary¹−êquation²⁴) ⁽²⁵⁾ (^R⊆(^S∪^T)) ⇐⇒ ((^R⊆^S)∨(^R⊆^T))(ôrollary¹−êquation²⁴) ⁽²⁶⁾

Wedeneanorderrelationonproess-lters,whihweallrelaxation,andwriteR⊑^S^to

meanthatRislesswidethanS.

Denition9. [Proess-lterrelaxation℄ForRandS,twoproess-lters,therelationRis

lesswidethanS,writtenR⊑^S^is^dened^by:

{0} ⊑^S (^R⊑ {0})⇐⇒ {0} =^R (^R⊑^S⇐⇒

▽

R

|^Z

⊆

▽

S

|^Z

) ⁽²⁷⁾

where^Z =var^{(R )}∪var^{(S )}