Embedded Systems Specification Using CIRTA: Application to an Acoustic Echo Canceller GMDFα

Transcription

1 Embedded Systems Specification Using CIRTA: Application to an Acoustic Echo Canceller GMDFα N. Zeghib Laboratoire LIRE - Université de Constantine - Algeria n_zeghib@hotmail.com M. Bettaz Department of Computer Science -Philadelphia University - Jordan bettaz@philadelphia.edu.jo ABSTRACT Design of embedded systems must be based on formal specifications so that the synthesis process can be easily carried out. This paper presents CIRTA ( Construction Incrémentale des Réseaux à Termes Algébriques ), an ECATNets ( Exted Concurrent Algebraic Terms Nets ) [7] based model suited to embedded systems. This model allows to specify several level of details using the feature of hierarchical decomposition. It also includes an explicit notion of time. Moreover, both concurrency and sequential behavior might be naturally represented in CIRTA. Keywords: Embedded systems, ECATNets, Petri nets, Algebraic specification, Rewriting logic. 1. Introduction Embedded systems are characterized by their dedicated function, real-time behavior, and high requirements on reliability and correctness [2]. In order to devise systems with such features, the design process must be based upon a formal specification that captures the characteristics of embedded systems. Many models have been proposed in the literature to specify embedded systems [1], including extensions to finite-state machines, data-flow graphs, and communicating processes. Particularly, Petri nets (PNs) are interesting for the specification of this sort of systems: for instance, they may specify parallel as well as sequential activities and they easily capture non-deterministic behaviors. In embedded systems specification, PNs have been exted in various ways to fit the most relevant aspects of such systems. We can find several PNs based models with different flavors in [5][4]. ECATNets [6][7][9] are high-level PNs model, in which tokens are algebraic terms [14] holding information. The important intrinsic features of ECATNets are their concurrency and asynchronous nature. These features together with their flexibility have stimulated their application in different areas [6][7][9]. However two main drawbacks of classical ECATNets model have been pointed out along the years. First, ECATNets lack a mechanism of hierarchical decomposition making them unsuitable for the specification of complex systems. Second, ECATNets lack the notion of time while in many embedded applications, time is a critical factor. To overcome these limitations we propose an extension to ECATNets, namely CIRTA, allowing to deal with time and hierarchical decomposition. 1.1 Related work There have been several approaches to the introduction of hierarchy into PNs models. Earliest approaches such [17], were not completely appropriate for embedded systems since they lack essential notions like timing. In our approach timing is explicitly handled in the hierarchy. Recently, some approaches like [11][13]

2 address the definition of hierarchical timed high level nets. They particularly ext colored or stochastic PNs. Our approach is quite different, since we ext ECATNets, where the hierarchy do not only concern the net but also the algebraic specification of data. Moreover, compared to other PNs models, ECATNets have formal semantics [9] defined in the rewriting logic framework allowing formal analysis of systems specified by ECATNets [1]. 1.2 Paper organization The remainder of this paper is structured as follows. Section 2 gives an overview of ECATNets. Section 3 shows how ECATNets are exted by the notion of time and hierarchical constructs. The CIRTA model is formally defined in Section 4. Section 5 illustrates the CIRTA use on a real-life application. Section 6 proposes an approach to translate CIRTA specifications into rewriting theories to allow formal analysis of embedded systems. Concluding remarks are outlined in Section An Overview of ECATNets ECATNets are High-Level PNs [6][7][9] devoted to modeling concurrent systems. They allow to describe compactly complex systems, using PNs [16] to model synchronization constraints and abstract data types [14] for specifying data structures. 2.1 Definition An ECATNet is a pair ξ = ( Spec, N) where Spec = ( Σ, E) is an algebraic specification of an abstract data type, and N defined by N = ( P, T, σ, Cap, IC, DT, CT, TC, M ) is a net such that: - Σ= ( SOp, ) is a signature where S is a set of sorts and Op is a set of operations. - E is a set of Σ equations. - P is a finite set of places, and T is a finite set of transitions ( P T = ). - σ : P S is a map which associates a sort to each place. - Cap : P is the capacity function. - IC : P T mtσ ( V ) { } is the input condition ( mtσ ( V ) denotes multisets of Σ terms with variables in V ). - DT : P T mtσ ( V) specifies the destroyed tokens. - CT : P T mtσ ( V ) defines the created tokens. - TC : T mtσ, bool ( V ) is the transition condition (also named guard). A set mtσ, s ( V ) denotes multisets of Σ terms of sort s with variables in V. - : mt Σ ( ) is a marking where p PM ( ( p) T ( ) σ ( p) = s Σ, s M ( p) Cap( p)). The graphical representation of a generic net N is given in Figure 1. DT(p,t) M (p) M TC(t) (p ) IC(p,t) CT(p,t) p: s,n t p : s,n Figure 1 : A generic representation of an ECATNet. The notation p : s, n indicates a place p of sort s and capacity n (we use p : s if the place p has infinite capacity). For notation convenience we omit DT(p, t) or IC(p, t) in the graphical representation of a net when IC(p, t)= DT(p, t). 2.2 Dynamic behavior At any time, a transition t is enabled to fire in a marking M when various conditions are simultaneously true. The first condition is that every IC(p, t) for each input place p is enabled (i.e. IC( p, t) M( p) if IC( p, t), and M( p ) = if IC( p, t ) = ). The second condition is that the transition condition TC(t) must evaluate to true. Finally the addition of CT(p, t) to each output place p must not result in p exceeding its capacity when this capacity is finite. When t is fired, DT(p, t) is removed from the input place p and simultaneously CT(p, t) is added to the output place p.

3 2.3 Example Figure 2 shows a simple example used to illustrate the main characteristics of ECATNets. The tokens in the net are of sort data, the algebraic specification of which is given by Spec 1. In the initial state only transition t 1 is enabled. When t 1 fires, the token a (=a) is removed from place p 1 and simultaneously a token b (f() = b) is added to p 2. Spec Spec 1 is sort data op a : data op b : data op f(_) :data data eq f(a)=b eq f(b)=a f() t 2 f() p 3 : data p 1 :data Figure 2: An ECATNet example. 3. ECATNets Extension The goal of this section is to ext ECATNets regarding the desirable characteristics of embedded systems specification model. 3.1 Timing In PNs models, several extensions have been proposed in order to capture timing aspects of modeled systems. Some extensions assign time mechanisms to transitions while other assign them to places. CIRTA works with two time structures: one that assigns time intervals to transitions (denoting the minimum and the maximum delays for the firing of an enabled transition) and other that assigns time-stamps for tokens representing the instant at which the token was "created". Hence for every transition t, there exist a minimum transition delay min and a maximum transition delay max. The nonnegative numbers min and max (min max) represent the lower and upper bounds for the execution time (delay) of the action a t 1 p 2 :data p 4 :data t 3 associated to the transition. Transition delays give the limits in time for the firing of a transition since it becomes enabled, unless it is disabled by the firing of another transition. On the other hand, transitions without firing time interval denote occasional events in the modeled system which may occur or not. A special case is the firing time interval [,] that denotes immediate firing of transitions as soon as the necessary tokens for its enabling become available. By this way, the ECATNets (without time extension) can be seen as CIRTA specifications where all time intervals are absent (and time-stamps for tokens are omitted). For instance, assuming that the transition t 1 (in Figure 3) fires at 1 time units and accordingly the token in p 1 is removed and a new token <b,1 > is deposited in p 2. The transitions t 2 and t 3 become enabled at 1 time units. Thus t 2 may not fire before 4 time units and must fire before or at 5 time units, unless it becomes disabled by the firing of transition t 3. Spec Spec 1 is sort data op a : data op b : data op f(_) :data data eq f(a)=b eq f(b)=a t 2[3, 4] f() f() Figure 3: An example of timed ECATNet. 3.2 Hierarchy Embedded systems are complex structures which require models that allow a sound specification throughout their design cycle. CIRTA supports systems modeled at different level of granularity with transitions representing simple arithmetic operations or complex algorithms. In order to handle efficiently the modeling of large systems, a mechanism of hierarchical p 3 : data p 1 :data <a,> t 1[1, 1.7] p 2 :data p 4 :data t 3[1,4]

4 composition is needed so that the model may be constructed in a structured way, composing a number of simple units fully understandable by the designer. Hierarchical modelling can be conveniently applied along the design process of embedded systems. Sometimes the specification or requirements may not be complete or thoroughly understood. In a top-down approach, a designer may define the interface to each component and then gradually refine those components. On the other hand, a system may be constructed reusing existing elements in a bottom-up approach. In CIRTA, a hierarchical specification can be devised bottom-up, top-down, or by mixing both approaches. Informally, the net of a hierarchical ECATNet contains two types of nodes: elementary nodes (i.e. ordinary places and transitions) and composed-nodes (composed-transitions and composedplaces). The intuitive idea behind composed-nodes is to allow the user to relate a node to a more precise and detailed specification of the activity represented by the composed-node. At one level, we want to give a simple description of the specified system without having to consider internal details about how it is carried out. At another level, we want to specify the more detailed behavior. Every composed-node has an associated ECATNet (called subnet) which may, in turn, contain composed-transitions and/or composed-places. Composed-transitions and composed-places are represented in nets using thick lines. Given the hierarchical ECATNet of Figure 4 where the part C 1 in Figure 5 is a refinement of transition t 1 ; we can construct the equivalent non-hierarchical net as illustrated in Figure 6. The approach refines a net by replacing a single composed-node by a subnet connected to the input and output sets of the replaced element. t 2 Spec Spec 1 is sort data op a : data op b : data op f(_) :data data eq f(a)=b eq f(b)=a t 1:C 1 p 3 : data p 1 :data a p 2 :data f() p 4 :data Figure 4 : An example of hierarchical ECATNet. Figure 5 : ECATNet sub-module C 1. p 1 p 1 p 2 p 2 Spec Spec 2 is Ext Spec 1 by op g(_,_) :data data data eq g(,)=f() eq g(a, b)=a eq g(b, a)=b p 3 : data t 3 T f() p 4 :data T g(,) p 1 :data p 2 :data

5 Spec Spec is sort data op a : data op b : data op f(_) :data data op g(_,_) :data data data eq f(a)=b eq f(b)=a eq g(,)=f() eq g(a, b)=a eq g(b, a)=b p 1 :data a p 3 : data T f() p 4 :data T g(,) p 2 :data t 2 f() t 3 p 3 : data Figure 6 : An equivalent non-hierarchical ECATNet. 4. CIRTA Model p 4 :data 4.1 Systems Specification In this section we formalize the concepts of time and hierarchy for CIRTA specifications Definition 1 A token is a pair K =< v, r > where vk mtσ ( V) is the token value and r k is the time-stamp (non-negative real number) of the token Definition 2 A CIRTA specification is a pair ς = ( Spec, HTN) where Spec = ( Σ, E) is an algebraic specification of an abstract data type, and HTN is a hierarchical timed net defined as follows. HTN = ( P, Pˆ, T, Tˆ, σ, Cap, IC, DT, CT, TC, λ, SN, π, δ, M ) such that: - Σ= ( SOp, ) is a signature, and E is a set of Σ equations. - P is a finite set of places, and ˆP is a finite set of composed-places P Pˆ k k ( = ). - T is a finite set of transitions, and ˆT is a finite set of composed-transitions ( P T =, T Tˆ = ). - σ : P S is a map which associates a sort to each place. * - Cap : P is the capacity function. - IC :( P P ˆ ) ( T Tˆ) mtσ ( V ) { } is the input condition function. - DT :( P Pˆ) ( T Tˆ) mtσ ( V) specifies the destroyed tokens. - CT :( P Pˆ) ( T Tˆ) mtσ ( V ) defines the created tokens. - TC : T mtσ, bool ( V ) is the transition condition. - λ : T { [ min,max ]/min,max } is a map which associates to each transition t the estimated lower (min) and upper (max) limits for the execution time of t ( min max). - SN : is a finite set of subnets. - π : Pˆ Tˆ SN is the map of subnet assignment - δ : is a port assignment function. It associates adjacent nodes of a composednode to the nodes of the associated subnet. - M : is a marking of the net such that for each place p it associates a multiset of pairs of the form < vr, > where Σ, s σ ( v mt ( )) ( r ) ( ( p) = s) ( M ( p) Cap( p)). 4.2 Dynamic Behavior The behavior of a CIRTA specification is defined by giving the behavioral equivalent non-hierarchical specification. Therefore composed-nodes must be substituted by the associated subnets. Each such substitution is a step refinement in the hierarchical specification. We present bellow the suited approach to refine a composed-transition in a hierarchical CIRTA specification (the definition of a refinement of a composed-place may be easily deduced). Let us consider the hierarchical ECATNet HTN= ( PPTT, ˆ,, ˆ, σ, CapICDTCTTC,,,,, λ, SN, π, δ, M) ( ˆ) where t is a composed-transition t T and the subnet refining t is defined by HTN = ( P, Pˆ, T, Tˆ, σ, Cap, IC, DT, CT, TC, λ, SN, π, δ, M )

6 The equivalent hierarchical net one level lower in the hierarchy tree is defined as follows: HTN' = ( P', Pˆ', T', Tˆ', σ ', Cap', IC', DT', CT', TC', λ', SN', π ', δ ', M ) - P = P P { p P dom δ } ' ( ( ) ) ˆ ˆ ˆ - P ' = P P1 - T ' = T T1 1 1 ˆ ˆ ˆ - T ' = ( T { t} ) T1 - The functions σ ', Cap', IC ', DT ', CT ', TC ', ' λ', SN ', π', δ ', M are deduced respectively from σ, Cap, IC, DT, CT, TC, λ, SN, π, δ, M and σ1, Cap1, IC1, DT1, CT1, TC1, λ1, SN1, π1, δ1, M1 according to whether their arguments belong to HTN or HTN 1. For instance: ( σ '( p) = σ( p) if p P) ( σ '( p) = σ ( p) if p P) CIRTA Modeling of a GMDF α The application example we have chosen to outline the possibilities of using CIRTA for modeling embedded systems is a GMDF α (standing for Generalized Multi- Delay frequency-domain Filter with oversampling factor α) system [3]. GMDF α has been used in acoustic echo cancellation for improving the quality of hand-free phone and teleconference applications. The GMDF α algorithm is a frequency-domain block adaptive algorithm: a block of speech input data is processed at one time, producing a block of output data. The impulse response of length L is segmented into K smaller blocks of size N ( K = L/ N), thus leading to better performance (short processing delay). R new samples are processed at each iteration and the filter is adapted α times per block (R = N/α ). This increased updating rate of the filter coefficients in the ratio α improves both the convergence speed and tracking capability of the algorithm. The filter inputs are the signal and its echo E, and the output is the reduced or cancelled echo E. In Figure 7 we show the CIRTA model for a GMDF α. The transition t 1 transforms the input signal into the frequency domain by a FFT (Fast Fourier Transform). t 2 corresponds to the normalization block. In each one of the basic cells T 3. i the filter coefficients are ' updated. Transitions t 4.i serve as delay blocks. t 5 computes the estimated echo in the frequency domain by a convolution product and then it is converted into the time domain by t 6. The difference between the estimated echo and the actual one (signal E) is calculated by t 7 and output as E. Such a cancelled echo is also transformed into the frequency domain by t 8 to be used in the next iteration when updating the filter coefficients. In Figure 7 we also specify the environment with which the GMDF α interacts: t e, t s, t r and t d represent, respectively, the echoing of signal, the sing of the signal, the reception of the cancelled echo, and the entity that emits. t r E F.K t d t 4. k-1 [,1] t 4. 1[,1] t 1[.8,1.2] t 2[.3,.4] F. K F. 2 F. 1 F.2 F.1 E The basic cells T 3,i detailed specification is shown in Figure 8 where the filter coefficients are computed and thus the filter is adapted by using FFT -1 and FFT operations. It is worth noticing that instances of the same net (Figure 8) are used as refinements of the different cells t 8 T 3.K T 3.2 T 3.1 t 5 [.7,1] t 8 [.8,1.2] t 6 [.8,1.1] t 7 [.1,.2] t e [.1,.5] GMDFα µ F.K µ F.1 µ F.2 E F.K E F.2 E F.1 Figure 7 : Modeling of a GMDF α using CIRTA.

7 T 3.i. Transition delays as well as estimated delays of composed-transitions in Figure 7 are given in milliseconds. The algebraic specifications of the signal type and the operations performed on it (such as FFT conversion, normalization, difference between signals...etc. are trivial. They are omitted here since the main principle of a GMDF α can be understood from the graphical representation of the net. F t a[.7,.9] µ F E F system (specified using CIRTA model) we execute the following steps: Step1: We translate a CIRTA specification into a (non hierarchical) timed ECATNet. This is achieved by constructing the non-hierarchical ECATNet as stated in section 4.2. Step 2: We disregard time information of timed ECATNets, and we generate a rewrite theory as detailed in [6] and [1]. Step 3: We ow the obtained theory by time information using the approach proposed in [18] Step 4: We use analysis tools [8] to check properties expressed as a rewriting logic formulas. t b[.8, 1.1] t c[.4,.5] Coef It should be noted that all the translation steps can be done automatically so that the designer is not concerned with this translation. t d[.8, 1.2] F Figure 8 : A subnet of GMDF α. 6. Specification Analysis For the levels of complexity typical to embedded systems, traditional validation techniques like simulation and testing are neither sufficient nor viable to verify their correctness. Formal methods are becoming an alternative to ensure the correctness of designs. In this section we present a systematic procedure to translate CIRTA specifications into rewriting theories. The advantages of using rewriting logic as a semantic framework for concurrency models has been amply demonstrated in [12]. Essentially, rewriting logic has a simple formalism, with only few rules of deduction. Besides, it is intrinsically concurrent; and it is realizable in a wide spectrum of logical languages like Maude [8], supporting executable specifications. To verify the correctness of an embedded 7. Conclusion Our investigation has shown the advantages of using CIRTA, an ECATNets based model, for embedded systems specification. CIRTA allows to capture relevant information characteristics of such systems. In our approach it is feasible to specify large systems as a set of comprehensible nets structured in a hierarchy and, at the same time, the essential characteristics of the system may be captured by the model. Moreover, our notion of hierarchy explicitly handles timing. We have also presented an example of a practical system specification, namely a GMDF α in order to illustrate the modeling capabilities of CIRTA. To make easy the formal analysis step of embedded systems specified using CIRTA, we propose an approach to translate CIRTA specifications into rewriting theories. Hence, we take advantages of practical tools developed in the rewriting logic framework. In future, we will use CIRTA to develop a formal approach to verification and transformation based synthesis of embedded systems.

8 References [1] L. Lavagro, A. Sangiovanni-Vicentilli, and E.Sentovich. Models of Computation for Embedded System Design, in System- Level Synthesis, ed. Dordecht: Kluwer, 1999, pp [2] R.Camposano and J. Wilberg, Embedded System Design, in Design Automation for Embedded Systems, Vol. 1, pp. 5-5, Jan [3] L.Freund, M.Israel, F.Rousseau, J.M. Bergé, M Auguin, C. Belleudy, and G. Gogniat, A Codesign Experiment in Acoustic Echo Cancellation GMDF α, in ACM Trans. on Design automation of Electric Systems, Vol. 4, pp , Oct [4] P.Maciel, E. Barros, and W. Rosenstiel, A Petri net Model for Hardware/Software codesign, in Design Automation for Embedded Systems, Vol.4 pp , Oct [5] M.Varea, and B. Al-Hashimi, Dual Transitions Petri Net Based Modelling Technique for Embedded Systems Specification, in Proc. DATE Conference, 21, pp [6] M. Bettaz, M. Maouche Modelling of Object Based Systems with hidden sorted ECATNets MASCOTS 95, Durham, North-Carolina, IEEE 1995, pp [7] M. Bettaz, M. Maouche, M. Soualmi, and M Boukebeche, Compact modelling and rapid prototyping of communication software with ECATNets: a case study. Simulation Series Vol.25 N.1, SCS 1993, pp [8] M. Clavel, F. Duran, S. Eker, J. Meseguer, and M.-O. Stehr. Maude as a Formal meta-tool Proc. FM 99, LNCS 179, pp ,springer,1999. [9] K.Djemame, D.G. Gilles, L.M. Mackenzie, and M.Bettaz, Performance comparison of high-level algebraic nets distributed simulation protocols. In JSA 44 (1998) pp [1] F.Belala Un cadre Formel pour l Analyse des ECATNets Ph.D thesis, Univ.Constantine, 22. [11] E.Pelz, and H.Fleishhack, Compositional high level Petri nets with timing constraints. Proc. ACSD 3, June 23, Guimaraes, Portugal. [12] J.Meseguer. Rewriting Logic as a Semantic Framework for Concurrency. In Proc. Concur 96, Vol.1119 of LNCS, pp , Springer, [13] H. Fleishhack, and E. Pelz, Hierarchical timed high level nets and their branching processes, in ICATPN 3, LNCS 2679, pp , Spinger, 23. [14] N. Zeghib ASTRE: un environnement de spécification algébrique. in Proc. of 2 nd MCAISE, Tunis 13-16/4/1992, pp [15] N.Zeghib, and M. Maouche Proposition d une approche pour la paramétrisation des ECATNets: application à un système de production. Proc. of MOSIM 97 Rouen France 5-6/6/1997 pp [16] H.J.Genrich. Predicates/transition nets. In High-Level Petri Nets: Theory and Practice, pp Springer-Verlag, [17] I. Suzuki, and T. Murata, A Method for Stepwise Refinement and Abstraction of Petri Nets, in Journal of Computer and System Sciences Vol.27, pp ,1983. [18] P.C. Olveczky, and J. Meseguer, Specification of Real-time and Hybrid Systems in Rewriting Logic, in Theoretical Computer Science, Vol.285 issue August 22, pp [19] N.Zeghib and M.Bettaz, On Synchronous and Asynchronous Communication in Modular High Level Nets: the Case of ECATNets, ICTTA 4, April Damascus, Syria, 24. [2] N. Zeghib, K. Barkaoui and M. Bettaz CIRTA: An ECATNets Based Model for Embedded Systems Specification, Proceeding of the 25 international conference on Embedded Systems and Applications ESA 5, Las Vegas, Nevada, June 27-3, 25.