A Multiparadigm Language for Reactive Systems

Transcription

1 A Multiparadigm Language for Reactive Systems M. Jourdan ) F. Lagnier ) F. Maraninchi and P. Raymond VERIMAG-SPECTRE* Miniparc ZIRST- rue Lavoisier Montbonnot-St Martin - FRANCE Abstract A system is said to be reactive if it interacts continuously with an environment, at a speed imposed by the environment. The system deals with inputs and outputs and the languages for programming reactive systems aim at describing the complex ordering and causality relations between the inputs and the correspo n d in g outputs. The synchronous approach, based upon the assumption that a system reacts an zero the, allows the definttion of compositional semantics for various kinds of lan uage constructs, in data-flow frameworks (Lustre /9! Signal [4]) as well as in imperative frameworks (Esterel [l, 21, Argos [d]). In this paper we take advantage of this compositionality property to define the mixing of data-flow constructs with automaton compositions in a single language. We apply the results to Lustre and Argos, and discuss some implementation issues. 1 Introduction According to the classification of computer systems inhoduced by A. Pnueli and D. Hare1 [6], a system is either transformational, or interactive or reactive. A tran.sformationa1 system acquires some data at the beginning of its execution, and produces some data as a result, on termination. A compiler is a typical example of such a system. On the contrary, interactive and reactive systems maintain a continuous interaction with their environment. They react' to inputs coming from this environment, by sending outputs to it. These interactions with the environment are based upon a set of atomic interactions called signals. The behavior of the system is a complex set of event sequences, describing which signals are relevant for the system at a given instant, and how it reacts to them, by sending output signals and preparing itself to receive new inputs. The languages for programming reactive systems aim at describing the reactive kernel of the system, i.e. the complex ordering and causality relations between the inputs and the corresponding outputs. The synchronous approach is based upon the assumption that the systems react in zero time: outputs 'Verimag is a joint laboratory of CNRS, Institut National Polytechnique de Grenoble, UniversitC J. Fourier and Verilog SA, associated with IMAG. Spectre is an INRIA project. are simultaneous with the inputs that cause them. This so called synchrony hypothesis is justified in 171. An important point is that it allows the definition of compositional semantics for various kinds of language constructs, in data-flow frameworks (Lustre [3], Signal [4]) as well as in imperative frameworks (Esterel [l, 21, Argos [8]). In this approach, a complex reactive system may be viewed as a set of subsystems which evolve simultaneously (in parallel) and communicate with each other in order to achieve a common behavior. Thanks to the compositionality of the semantics, each subsystem relates to the other ones in the same way the global system relates to its environment, and subsystems can be designed independently. The elementary object to be described is a function f which, taking the whole history of the system inputs into account, produces a single output. We are only interested in regular systems, for which the infinite set of input histories can be partitioned into a finite set of congruence classes: two histories hl and hz are equivalent if and only if f(h1) = f(h2), and this equivalence is a congruence for the operation which adds a new input i to the histories: if hl and h2 are equivalent, then so are h1.i and h2.i. These classes correspond to the states of a Mealy machine. Describing the reactive system then amounts to giving the transition and output functions of the machine. In a language like Lustre, the elementary systems are described by sets of recursive equations on the history of inputs and outputs, and composed by connecting the inputs of an object to the outputs of another one, thus forming a data-flow network. Moreover, these networks are described in a functional style: each node is parameterized and may be re-used in different contexts. In a language like Argos, the elementary systems are identified to Mealy machines, and described in extension by giving their sets of states and labeled transitions. They are composed using product-like operators on finite state machines. Subprograms may be encapsulated and parameterized, in order to be reused. The reader may find more details about Lustre and Argos in [5]. These two approaches, although starting from the same simple notion of an elementary reactive system, /94 $3.00 Q 1994 IEEE 211

2 The lead to quite different programming styles. These styles are complementary for several reasons. First, each of them may be the most appropriate for a particular program or subprogram; secondly, within the domain of reactive programming, people may be used to one style or to the other, depending on their scientific background. This paper presents an approach in which the two styles are mixed. The idea is to allow the descript,ion of elementary reactive objects in each of the two styles, and their combination with both constructs. This gives a new language in which the constructs can really be mixed, and not only juxtaposed. The important point is that the merging is done ut the source level. We do not want to define a kind of linker which would build an executable code from the objects created by compiling the two languages independently. The idea is to use the structures of one language to enrich the other one. This is like requesting a set of Prolog clauses to be the body of a C function! We show how to define the mixed language by identifying the common semantical basis of the two languages. The paper is organized as follows. In section 2 we define the Mealy machine model of reactive systems; section 3 presents the two styles informally and compares them. Section 4 gives the syntax and semantics of the languages A and L: A is a restriction of Argos to pure control (no data) and L is a restriction of Lustre to Boolean dat,a. Section 5 presents the mixed language. Its abstract syntax is obtained by combining the structures of the two languages; its semantics is given by the juxtaposition of the two semantics (with a slight extension of the L semantics); we illustrate it with an example. Section 6 discusses some implementation results obtained when applying these ideas to the Lustre and Argos programming environments. Section 7 is the conclusion. 2 The model of reactive systems We consider a finite alphabet of signals: cli = {a, b,c,...}. The model of a reactive system is a machine M defined by a tuple (In, Out, States, Init, U, I), where In C_ Q (resp. Out cli) is the set of inputs (resp. outputs) of the machine, Init E States is its initial state, U : States x 21n -+ 2OUt is the output function and I : States x 2"' + States is the transition function. Mem(X),X C_ Q, is the set of X-memories, i.e. functions from X to Boolean values. If u1 E Mem(X1) and u2 E Mem(XZ), then C T ~ u2] E Mem(X1 U XZ) is defined by: ul[~](t) = 02(x i if t E X2, U~[U~](I).= CT~(Z) otherwise. ulx, where X E Q, is the restriction of U to X. r] = u1.u2.....u,...., is a possible run of a machine (In, Out, States, Init, U, 7) if and only if there exists an infinite sequence of states ~ 1... ~ s, 2... with s1 = Init and V i > 0 ailout = O(si,uaIIn) and si+l = I(&, UilIn). In the sequel, we define the semantics of a language by giving, for each program, the set of model states, the initial state and the U and 7 functions. 3 Informal presentation of the languages L and A 3.1 ~ language L The language L is a Boolean restriction of the language Lustre. It adopts a data-flow approach to describe reactive systems. Each variable or expression represents the history of a signal, viewed as an infinite sequence of Boolean values. For instance, if X is an input signal, the input variable X of the corresponding L program represents an infinite sequence of Boolean values to, 21,..., xi,... where ti is true if and only if the corresponding signal is present during the ith reaction of the program. An L program consists of a header, which declares the names of input, output and local variables, and a set of equations defining the output and local variables. An equation id = exp should be considered in a mathematical sense: it means that the variable id is identical to the expression exp. This provides an important principle, the substitution principle: id can be substituted to exp everywhere in the program, and conversely. As a consequence, equations can be written in any order. Expressions are built with Boolean operators (true, and, not,...), which operate pointwise on sequences. For instance, true denotes the infi- nite sequence: (true, true,...); not X denotes (not to, not 21,...). To define recurrent sequences, L provides a binary delay operator pre ( exp, value), where exp is the delayed sequence, and the Boolean value the initial value. For instance, pre(x, false) denotes: (fufse,to,tl,...,~i,...) In fact, an L program can be viewed as a textual representation of an operator network, with a simple data-flow interpretation. This is why an L program, which is a user-defined operator, is called a node. The node after (see below) is an example of a simple L program, with a unique input e, and a unique output s. The output s becomes true after the first occurrence of e (i.e. the first time e is true), and remains true forever. node after.(e : bool) returns (s : bool); s = pre(e or s,false); tel A user-defined node can be instanciated within another node, using a functional style. In the node after-two (see below), two instances of the after node are used. Its output becomes true if and only if the two inputs were true at least once time in the past. This example also shows the use of local variables. node after-tvo (el,e2 : bool) returns (s : bool); var after_el,after-e:! : bool; after-el = after(e1); after-e2 = after(e2); s = after-el and after-e2; t el. 212

3 The data-flow network which corresponds to this L program is given by Figure 1. Figure 1: The network of after-two 3.2 The language A In the language A, simple reactive systems are described by giving the sets of states and labeled transitions of a Mealy machine, in extension. In the sequel, the states of these basic A programs will be called boxes, in order to avoid confusion with the states of the models. Complex systems are built from such objects, by applying operators. Parallel composition and refinement express the simultaneous evolution of several subsystems, which take inputs from, and emit outputs towards their global environment or the other components. Two components communicate if the input of one is an output of the other. The Argos communication mechanism is the synchronous broadcast of Esterel. It requires the use of internal signals, which can be used either as inputs or outputs. When an internal signal is output by a component, it may give raise to several transitions, in others components, which are simultaneous. To illustrate the A style, we give the A pro rams equivalent to the L programs after (figure 27 and after-two (figure 3). The three sets given with the name of the program are respectively the inputs, the outputs and the internal signals of the program. The initial box is marked by an arrow wit,hout source; the transition labels are of the form input-condition/outputs; the outputs part is optional; overlining of signals denotes Boolean negation. The dotted line is the graphical syntax for the parallel operator. of these components are subprogram calls to the aft er program. A subprogram call is a way to reuse a subprogram by renaming its inputs and outputs. The third component expresses the relation between the result s and the two intermediate results after-el and after&. To understand how these three automata communicate, suppose the first two (which are subprogram calls) are in their A boxes, and the third is in box G1. In response to a simultaneous occurrence of el and e2 in the environment, one transition in each automaton is triggered and their current boxes become respectively B and C3. During the following reaction, whatever the status of e is, since after-ei and after-& are emitted, s will be output. The refinement is the most interesting A operator when mixing the A and L styles, as there exists no equivalent structure in L. This operator is used to express a structure in which a controller may start and kill subprograms. It may be used to express the sequencing of subprograms. The operator is parameterized by a Mealy machine, whose boxes are said to be refined by subprograms. Hence it is a n-ary operator if the machine has n boxes. The intuitive semantics of the refinement operator is the following: when the system enters a refined box, the refining subprogram is started in its initial state. Leaving a refined box X kills the refining subprogram P; all information about its current state is lost. This subprogram may react and emit outputs at the instant when it is killed. A transition sourced in X and triggered by an external input expresses an interruption of P. Such a transition may also be triggered by an internal signal output by P, upon termination for instance. Consider a system whose inputs are a and e and whose single output is s. The occurrences of a define time intervals which begin with an odd occurrence and end with an even occurrence, both excluded. Within such an interval, the output s is true if and only if the input e has occurred during the same interval. Outside these intervals, s is always false. In A, this system is described by using a refinement structure. The controller is a two-box automaton which records the parity of the number of Q occurrences. The ODD box of the controller corresponds to the intervals defined above (cf. Figure 4). This box is refined by the after program. between-two ({U, e}, {s}, 0) Figure 2: The A program after (the structure is given graphically) The af ter-two program is the parallel composition of three components which communicate by exchanging two internal signals after-el and after-e2. Two Figure 4: The A program between-two 213

4 ~~~~ ~ ~ ~ ~ after-two ({el, ea}, {s}, {after-el, after-ea}) I after-el = after(e1)... after-e2 = after(e3) Figure 3: The A program after-two (the structure is given graphically) 3.3 Comparison of the two languages If we want to describe the between-two system in L, the node after cannot be used. Indeed, once its output s becomes true, it remains true forever. There exists no compositional way to express that the node should be restarted. The only way to do this is to take this possibility into account when writing the node newafter. We add an input restart to the node after and change its body. node new-after (e,restart : bool) returns (s : bool); s = if restart then false else pre((e and not restart) or s,false); tel This new node can be used in order to give the wanted system. node between-two( a, e : bool) returns ( s : bool); var EVEN, ODD, EVEN-was-active, ODD-was-active, ODD-s, ODD-restart : bool; s = ODD-was-active and ODD-s; ODD-s = new-after(e, ODD-restart); EVEN-was-act ive = pre (EVEN, true) ; ODD-was-active = pre(odd, false); EVEN = if (EVEN-was-active and a) then false else if (ODD-was-active and a) then true else EVEN-was-active; ODD = not EVEN; ODD-restart = EVEN-was-active and a; t el 4 Syntax and semantics of the languages L and A 4.1 The syntax of L An L program is denoted by N. The abstract syntax of L programs is : N ::= (I,O,L,Ep) Eq ::= idf=e IN1 EqEq e ::= c I idf 1 not e I e ope I pre(e, c) with c E {true, false} In a node (I, 0, L, Eq), I, 0 and L denote respectively the inputs, the outputs and the local variables of the node. Eq is the set of equations which defines the body of the node. An equation is, either an equality between an identifier and an expression, or a node call. In order to simplify the semantics of L, we consider that the body of the nodes have been copied (with a suitable renaming of the inputs and outputs) in place of each of their instanciations. We are not interested here in the capability of instanciating a node as a function of actual parameters, but only in the encapsulation of a set of equations with local variables. 4.2 The semantics of L Recall that the states of the model represent an abstraction of the input history of the system, necessary for the program to compute the correct outputs. In L, the only way to reference the input history is to use pre operators. This gives the states of the model: suppose we associate a Boolean memory with each expression which appears as the first argument of a pre operator; the state set of the model is the state space of this set of memories. In the semantic rules, the second argument of the pre operators is used as the memory. The states of the model are represented by the text of the program, where the second pre arguments vary. In the sequel, we define when a memory c is compatible with a state N, and if so, how the state is rewritten. 2 14

5 N Q. N (resp. Eq A Eq ) means that U is compatible with the state N (resp. the equations Eq), which is rewritten into N (resp. Eq ). This predicate is defined in terms of the predicate N 5 N (resp. Eq 3 Eq ), which means that under the hypothesis that U is the current memory, the state N (resp. Eq) is rewritten into N (resp. Eq ), while the output or local variables in w are set to true. (110, L, Eq) ++ (I,O, L, Ed) {z E 0 U L/a(x) = tt} = w (I, 0, L, Eq) 5 (I,O, L, Eq ) ut e A e, if ti = tt t,hen w = {zdf} else w = 0 idf = e L idf = e [Lgl [L21 Eql + Eql Eq2 $+ Eq2 Eql Eq2 Eql Eq3 [L31 U I- e A e means that 11 is the value of e evaluated in U, and that e is rewritten in e. is its set of boxes, qinit the initial box and T the set of transitions. A transition is of the form (qs, na,/p, pt). q3 and qt are the source and target boxes of the transition. me is a boolean condition on signal values. p is the set of signals which are emitted when the transition is taken. Ri is the subprogram which refines the ith box of the automaton. If it is nil, this box is not refined. 4.4 The semantics of A In A, the programmer references the input history by defining explicitly the boxes of the automaton components. The state space of the model can be identified to the Cartesian product of the sets of boxes of all the automata that appear in the program. In the semantics, a model state is a couple (PSI, Psz). Psi is used to represent an element of the abovementioned Cartesian product: it is the text of the program, where the qinit parts of the automaton definitions vary. Ps? is the text of the program. It is copied into Psl when the subprogram has to be restarted (cf. the rule A3 below). The notations are the same as for the L semantics. The predicate s -+ s is also used with a couple of program structures. We write U me when the boolean condition denoted by m, evaluates to true in U. u ~ Le e J U t- pre(e, U) A pre(e, w ) ~ 4 1 ui-e L e U t not e not e [L61 U I- idf + idf ~ 7 1 utc c. c [L*I 4.3 The syntax of A An A program is denoted by P. The abstract syntax of A programs is : P ::= (I, 0, L. Ps) subprogram Ps ::= PsllPs parallel operator I R(,Q,Y,~.~,T)(R~~...I fin) with R = IQ1 refinement operator I P R ::= Pslnil In an A program P = (IqO, L,Ps), 1.0 and L respectively denote the sets of inputs, outputs and internal signals of P. Ps is its structure. As we did for L, we consider that the body of the subprograms have been copied (with a suitable renaming of the inputs and outputs) in place of each of their instanciations. R(Q,~,~~~,T)(R~,..., R,) denotes a refinement operator parameterized by the automaton (Q, qzntt, T). Q In [A31 both the automaton and the subprogram which refines its current box participate in the reaction. The reaction of the subprogram is taken into account for its outputs only. The subprogram which refines the new current box qd is re-started in its initial state, using the information contained in the second component of a state. $(gc, me/p, qd) E T s.t. U I- me (RC, R:) 5 (R:, R:) PS = R(Q,,;,Tj(Ri>...,RL) ~ 4 1 (R(Q,~,,T)(RI~...tRn), f s) 5 R(Q,~,,T)(RI~...,R:,...,Rn)> PS) 215

6 In [A41 only the subprogram which refines the current box is involved in the global reaction. (nil, nil) + (nil, nil) ~ The mixed language 5.1 Syntax A mixed program is denoted by NP. The abstract syntax of a mixed program is : NP ::= NIP N I, 0, L, Eq) p ij: [ I, 0, L, PS) Eq e ::= ::= idf = e I P I N I Eq Eq c I idf I not e 1 e op e I pre(e, c) with c E {true, false} Ps ::= PsllPs I R[Q,~,,,,~,T)(RI, -..t Rn) with = IQI I PIN R ::= Pslnil 5.2 Semantics The semantics of the mixed language is obtained by juxtaposing the A semantics and a slightly modified version of the L semantics. Indeed, the syntax of the mixed language allows a L node to be embedded int,o a refinement structure. As a consequence, it has to be made restartable. As we did for the language A, a state of the model in the semantics of L is now a couple (NI, N2) where NI is the same as before, and N2 is a copy of the original program, to be used when the node is restarted. The new semantic rules are obtained by adding t,he second element of the couple which never varies. For example, L1 becomes L1 : UL E Mem(L) Eq Ed ~ ((190, L, Eq), + ((I,O, L, & I, N) The second element of the couple is used in the rule A An example described in the mixed language The assembly line controller specification The assembly line is composed of three parts: a conveyor belt, a stock of bottles and two machines. These parts are controlled by the system we want to describe. First we describe how each part interacts with the controller (see figure 5). Then, we describe how the assembly line must operate. The conveyor belt can be stopped (resp. started) by the input stop (resp. go). Its direction can be reversed by inv. On the conveyor belt, four sensors inform the controller that a bottle is in a given position by posi for i E [1,4]. The bottle stock reacts to the input open by put,ting a bottle on the conveyor belt. The two machines Ad1 and M2 are used for different tasks, so they are not always available for the controller. The output availl is true as long as M1 is available for the controller. which can request M1 to remain available by issuing req-1. M1 should start working on receiving startl, and send end-1 when it has finished. The same is true for M2. The assembly line must operate in the following way. When it is switched on (by the input onoff), the conveyor belt starts to the right, and a bottle must be set down on it. M1 and M2 can operate in any order. When a bottle is at the first position, the controller starts taking into account the availability of the two machines. As soon as a machine is available, it must be started or requested, depending on the position of the bottle. When a machine is requested, it stays available until it has done its task. Moreover, the conveyor belt must operate in order to convey the bottle in the right position. As soon as a machine is started, the belt should be stopped. A bottle may go through the fourth position when it has been processed by both machines The assembly line controller program Figure 6 gives a program for the assembly line controller. The main structure is a two-state automaton: OFF and ON. The ON state is refined by another two-state automaton: NoBottle and OneBottle. OneBottle is refined by the system which controls the assembly line when a bottle is under the conveyor belt between pos-1 and pos-4. It is easier to describe this subsystem in L than in A, because of the declarative form of its informal specification. The handler node is a possible descript,ion of it. The handler is composed of three node calls, which correspond to the three parts of the system: M1, M2 and the conveyor belt. node handler (end-l,avail-l,end-2,avail-2, pos-2,pos-3: bool) returns (req-1,start-1, req-2. start-2, inv,go,stop : bool); (req-1,start-1) = M-controller (end-1, avail-1,pos-2); (req-2, start-2) = M-controller (end-2,avail-2,pos-3); (inv,go.stop) = Belt(pos-2,pos-3, req-1,req-2, start-1,start-2,end-l,end-2); tel; The M-controller node expresses when a machine should be requested and/or started. It needs to know if the machine is available, if it has already performed its task and what the current position of the bottle on the belt is. It uses two local variables: Msasiequired, MSinished. These variables give information about the evolution of the M task. 216

7 avail-i - pos-1 pos 2 pos-3 Figure 5: The assembly line controller onoff / onof f pos-i \ (req-i,req2,start-i,start2, inv,go,stop) = handler(availl,avail2, end-1, end2,pos2,pos3) J pos-4 / open Figure 6: The assembly line controller program node M-controller (end,avail,pos : bool) returns (req,start : bool); var M-vas-required, M-finished : bool; M-was-required = after(req); M-f inished = after(end1; req = avail and not M-finished and not pos ; start = pos and avail and not M-finished; tel ; The Belt node controls the activitv and the direction of the conveyor belt. node Belt (pos-2,pos-3,req-l,req-2,start-l, start-2,end-l,end-2 : bool) returns (inv,go,stop : bool); var Right-dir, Run-ON, end : bool; Right-dir = if inv then not pre(right-dir,true) else pre(right-dir,true); Run-ON = if stop then not pre(run-on,true) else pre(run-on,true) ; end = after-tuo(end-l,end-2); stop = start-1 or start-2; go = end-1 or end-2; inv = (pos-2 and not pre(right-dir,true)) or (pos-3 and pre(right-dir,true) and not end); tel; 6 Implementation issues Lustre and Argos are both implemented. Their programming environments provide compilers which produce labeled transition systems in a form suitable for formal verification or code generation. Each of the compilers implements a version ofthe semantics which is equivalent'to the one presented here, but more operational. Since these semantics cannot be merged easily, there is no direct way of extending them to the mixed language. However, implementing the mixed language can be done by defining a compositional translation of a language into the other. The idea is to translate a mixed language program into a single language program, by translating the components which are not written in the target language. If this can be done in either direction, the programming environment of the mixed language may benefit from the functionalities of both environments (however, gettin back to the source level requires particular attention7. The translation of the mixed language into Argos is the simplest. Indeed the Lustre compiler may be 217

8 used to obtain, for each node, a labeled transition system usable as an Argos component. Then the Argos compiler is used. The translation of the mixed language into Lustre is more complex. The basic automaton components which appear in the Argos parts have to be translated into re-startable Lustre nodes. This can be done by associating one variable with each state of the automaton, in a standard way. The Lustre nodes which appear in the Lustre part have to be made re-startable, by adding a restart input. Then the Argos operators have to be interpreted as operators on nodes. This is the most difficult part. It can indeed be done in a compositional way: for a program P1 op P2, where op is an Argos operator, we first obtain re-startable Lustre nodes N1 and N2 for P1 and P2; then the node for P1 op P2 is built with a call to N1, a call to N2 and some additional equations which express the semantics of the operator. 7 Conclusions We have shown how two very different programming styles for reactive kernels may be mixed, having a common semantical basis. Programming experience has shown that the imperative style of Argos, together with its hierarchical structure, are adequate for expressing interruptions, or exceptions. On the other hand, the declarative style of Lustre is adequate for describing the regular behaviors. The example given in the paper is a typical case where the overall structure is better described with an imperative style, while the regular behavior is better described with a declarative style. We propose an implementation in which the mixed language programs are translated into single language programs and then compiled by the existing compiler of this language. This is a way of using the functionalities of both programming environments for the mixed language. Further work must be devoted to: the detection of non-causal situations intrinsic to the synchronous broadcast in Argos; the use of clocks in Lustre; non Boolean data in Lustre and valued signals in Argos. We are now working on the extension of the mixed language to non Boolean data. Reintroducing clocks in the Lustre part requires an extension of the model of reactive systems. Acknowledgments We would like to thank Nicolas Halbwachs for his helpful comments. References 111 G. Berry and G. Gonthier. The esterel synchronous programming language: Design, semantics, implementation. Technical report, 842, INRIA, [2] G. Berry and G. Gonthier. The Esterel synchronous programming language: Design, semantics, implementation. Science Of Computer Programming, 19(2):87-152, [3] P. Caspi, N. Halbwachs, D. Pilaud, and J. Plaice. Lustre, a declarative language for programming synchronous systems. In 14th Symposium on Principles of Programming Languages, January [4] P. Le Guernic, A. Benveniste, P. Bournai, and T. Gauthier. Signal: A data flow oriented language for signal processing. Technical report, IRISA report 246, IRISA, Rennes, France, [5] N. Halbwachs. Synchronous programming of reactive systems. Kluwer Academic Pub., [6] D. Hare1 and A. Pnueli. On the development of reactive systems. In Logic and Models of Concurrent Systems, NATO Advanced Study Insiatute on Logics and Models for Verification and Specification of Concurrent Systems, volume 13. NATO AS1 series F, Springer Verlag, [7] Another look at real-time programming. Special Section of the Proceedings of the IEEE, 79(9), September [8] F. Maraninchi. 0perat.ional and compositional semantics of synchronous automaton compositions. In CONCUR. LNCS 630, Springer Verlag, August