Patent Application
20090168785
The present invention generally relates to design verification, and more specifically to the use of model checking to verify that the design of a device holds certain correctness properties. Even more specifically, the preferred embodiment of the invention relates to a model checking technique that is very well suited for use with embedded processing devices.
Embedded devices are becoming pervasive and playing increasing role in our lives. We depend on cell phones and ATMs. Embedded systems are also used in mission critical applications such as aircraft navigation and control systems, heart pacemaker devices, and military systems. Correct functioning of these devices is crucial. To establish correctness, subjecting them to various possible inputs tests these devices. However, exhaustive testing is not only costly and time consuming but also impossible for non-trivial devices. A complementary approach is to apply static model checking techniques to verify that the design of a device holds certain correctness properties.
Model Checking is used to establish correctness of a given program. Model Checking techniques typically convert program constructs in a program into equivalent mathematical logic or constructs. These mathematical constructs collectively define the underlying mathematical model of the program. In essence, the mathematical model defines the various states a given program can be in, and the conditions (inputs) required for various state transitions.
The correctness is established by exploring the state space of the mathematical model and verifying that none of the execution paths will lead to a program state that violates one or more constraints from a pre-defined constraint set.
Evidently, the correctness proof of a program with any Model Checking technique is based on the assumption that the translation of a program to a mathematical model is flawless. If the translation is incorrect, then the correctness proof is unreliable. That is why it is very important that the translation is correct without a doubt.
Model Checking techniques are very useful in embedded devices that have real-time software. In such devices, all possible inputs cannot be tested, but the correctness of software is vital because these devices have critical applications such as health and military applications. Real time systems are concurrent reactive systems represented by communicating state machines. The communication channels between state machines are defined using Priority Message Queue programming construct.
The embedded devices fall into the category of concurrent reactive systems and their design can be expressed through Unified Modeling Language (UML) state machines communicating with each other through signal and message passing. For static model checking, the UML state machines have to be converted into modeling languages suitable for model checking. A challenging aspect of the conversion is efficient modeling of communication channels between the state machines. This aspect is difficult because the scalability of model checking techniques is limited due to the problem of state space explosion. A channel is essentially a non-deterministic priority message queue. The model should be expressive enough to capture the behavior of a non-deterministic priority queue, yet the possible permutations should occupy small state space.
Existing techniques to model priority queues typically have a single queue, and allow each cell to swap its content with the cell before it depending upon the different priorities of the cells. Though this model is concise (i.e. less bits to model), the behavior is complex (i.e. model of each bit is complex). For symbolic model checking, the behavior needs to be encoded into a representation suitable for model checking (such as SAT (Satisfiability problem) or BDD (Binary Decision Diagram)). Complex behavior results in bigger encoding. Therefore, the complexity of the behavior is an important issue for performing model checking.
An object of the present invention is to improve model-checking techniques.
Another object of this invention is to model non-deterministic queues for efficient model checking.
A further object of the invention is to facilitate expressing complex behavior of priority queues in a simple and intuitive manner.
These and other objectives are attained with a method and system for modeling non-deterministic queues for efficient model checking. In this method and system, a multitude of messages are held in a plurality of queues. These messages have n priorities, and the method comprises the step of providing (n+1) queues, including a first queue, and n priority queues. The method comprises the further steps of passing said messages from a source to the first queue; passing each of said messages from the first queue to one of said n priority queues based on the priority of the message; and passing each of said messages from the n queues to a destination based on the priority of the message. One or more non-deterministic waits are introduced into one or more of the passing steps to simplify passing the messages into or out of the n priority queues in a preferred or predetermined manner.
For example, a non-deterministic wait may be introduced between the first queue and said n priority queues to control the timing of the passing of messages into the first queue. In addition, or as an alternative, a non-deterministic wait may be introduced between the n priority queues and the destination to control the timing of the passing of messages from the n priority queues to the destination.
In the preferred embodiment of the invention, non-deterministic behavior is simulated using a non-deterministic wait at various stages. Since it has a larger number of queues in comparison to the single queue model, this preferred technique takes more space (i.e. more bits to model). But the behavior is very simple (i.e. the model of each bit is simple). This technique facilitates expressing complex behavior of a priority queue in a simple and intuitive manner, which is closer to the system being modeled, and hence leads to a compact representation to allow efficient model checking.
Existing methods use a single queue, whose logic is very complex, and hence has significant potential for errors, which jeopardizes the correctness of model checking and renders it useless. The method described herein uses (n+1) queues, where n is the number of priorities. For example, if there are three types of priorities—such as low, medium and high—that a message (from a state machine to another state machine) can have, then this method will use four queues instead of one queue, as done by existing methods. This greatly simplifies the translation and eliminates the risk of mistake while translating communication channels to equivalent mathematical models. An important advantage of this invention is in the great amount of simplification (and hence correctness) achieved in the logic and translation by using (n+1) queues. The invention is particularly useful in the critical role of accurate translation of communication channels to respective mathematical models in Model Checking real time software correctly.
Further benefits and advantages of this invention will become apparent from a consideration of the following detailed description, given with reference to the accompanying drawings, which specify and show preferred embodiments of the invention.
The foregoing will be apparent from the following more particular description of example embodiments of the invention, as illustrated in the accompanying drawings in which like reference characters refer to the same parts throughout the different views. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating embodiments of the present invention.
A description of example embodiments of the invention follows.
As indicated above, when modeling embedded devices, and other concurrent reactive systems, their designs can be expressed through UML state machines communicating with each other through signal and message passing. For static model checking, the UML state machines have to be converted into modeling languages suitable for model checking. An important aspect of the conversion is efficient modeling of communication channels between the state machines because the scalability of model checking techniques is limited due to the problem of state space explosion. A channel is essentially a non-deterministic priority message queue. The model should be expressive enough to capture the behavior of a non-deterministic priority queue yet the possible permutations should occupy small state space. The present invention provides a technique to model non-deterministic queues for efficient model checking.
Generally, a communication channel provides the following guarantee: given two messages m1 and m2, m1 is guaranteed to be processed before m2, if m1 has arrived before m2 and m2's priority is the same as or lower than the priority of m1. Otherwise, the processing order is non-deterministic.
The first queue 32 gets messages, which are then passed to the correct priority queue. The first message available in the non-empty priority queue with the highest priority gets processed first. The nondeterministic behavior is achieved by introducing nondeterministic waits between first queue 32 and the queues 34, 36, 40 for the different priorities, and between the queues 34, 36, 40 for priorities and destination process 44. The non-deterministic wait between the first queue 32 and the queues 34, 36, 40 for the priorities allows the destination process 44 to look at lower priority messages before a high priority message enters the high priority queue 34. The non-deterministic wait between the queues 34, 36, 40 for priorities and the destination process 44 allows the destination process to look at higher priority messages before early low priority message.
These features of the invention are illustrated in
At states 54 and 55 (States 4 and 5), a non-deterministic wait, represented at 58, occurs between the first queue 32 and the priority queues 34, 36, 40. This wait allows the two low priority messages to be sent to the destination 44 before the high priority message in queue 32 is passed to the high priority queue 34. At states 56 and 57 (States 6 and 7), this high priority message is sent to queue 34 and then to the destination 44. Thus, with the procedure of
At state 64, a non-deterministic wait, represented at 68, is introduced between the priority queues 34, 36, 40 and the destination 44. This wait allows the high priority message h to be passed from queue 32 to high priority queue 34 before the low priority messages are passed from the low priority queue 40 to the destination 44. Then, at state 65, the high priority message h is passed from queue 34 to the destination 44; and at states 66 and 67, the low priority messages are passed from the low priority queue 40 to the destination 44. Thus, with this procedure of
The preferred mechanism of the present invention allows also that the high priority message may be handled between two low priority messages that came earlier. For example, if there is no wait, as would be the case in standard priority queue model, the order in which messages are processed is “m”, “m”, “l”, “h”, “l”.
This operation is illustrated in
The preferred embodiment of the invention provides a number of significant advantages. One important advantage is the great amount of simplification (and hence correctness) achieved in the logic and translation by using (n+1) queues. A particular advantage of this invention is in the critical role of accurate translation of communication channels to mathematical model in Model Checking real time software correctly.
Included herewith is an Appendix that provides an encoding for a message queue with three priorities and where the size of the FIFO channel is four.
As will be readily apparent to those skilled in the art, the present invention can be realized in hardware, software, or a combination of hardware and software. Any kind of computer/server system(s)—or other apparatus adapted for carrying out the methods described herein—is suited. A typical combination of hardware and software could be a general-purpose computer system with a computer program that, when loaded and executed, carries out the respective methods described herein. Alternatively, a specific use computer, containing specialized hardware for carrying out one or more of the functional tasks of the invention, could be utilized.
The present invention, or aspects of the invention, can also be embodied in a computer program product, which comprises all the respective features enabling the implementation of the methods described herein, and which—when loaded in a computer system—is able to carry out these methods. Computer program, software program, program, or software, in the present context mean any expression, in any language, code or notation, of a set of instructions intended to cause a system having an information processing capability to perform a particular function either directly or after either or both of the following: (a) conversion to another language, code or notation; and/or (b) reproduction in a different material form.
While it is apparent that the invention herein disclosed is well calculated to fulfill the objects stated above, it will be appreciated that numerous modifications and embodiments may be devised by those skilled in the art, and it is intended that the appended claims cover all such modifications and embodiments as fall within the true spirit and scope of the present invention.
