Behavioral Requirements

Transcription

1 Functional Requirements: Behavioral Requirements Overview Decision-oriented Behavioral Models State-oriented Behavioral Models Finite State Machines (Protocol Validation & Verification) Statecharts SCR Petri Nets Function-oriented Behavioral Models Requirements should contain nothing but information about the environment. M G, Prog G = S G ; S G, D G = R G ; R G, D G = G; (G = P) V (G ~ P)

2 Recall:

3

4 Decision Tables: Another Ambiguity Test Natural Language The system shall report to the operator all faults that originate in critical functions or that occur during execution of a critical sequence and for which there is no fault recovery response. (adapted from the specifications for the international space station) A decision table originate in critical functions F T F T F T F T Occur during critical sequence F F T T F F T T No fault recovery response F F F F T T T T Report to operator???

5

6 requirements should contain nothing but information about the environment. [Zave&Jackson, p9]

7 AS-IS or TO-BE? Model or Anti-model? state invariants? Object-oriented?

8

9

10

11

12

13

14

15

16

17 S2 Valid configurations?

18 Recall: Four Variable Model SCR: Tabular Specifications Monitored variables Environment Input Devices input data Software output data Output Devices Controlled variables Environment SCR Specifications Dictionaries Tables Monitored/Controlled Mode Transition Tables Assertions, Scenarios, Variables Types TY(Pressure) = {TooLow, Permitted, High} TY(WaterPres) = {0; 1; 2; ; 2000} TY(Overridden) = {true, false} TY(Block) = {On; Off} Event Tables Condition Tables Constraints

19 SCR Basics Modes and Mode classes A mode class is a FSM, with states called system modes Transitions in each mode class are triggered by events Complex systems are described using a number of mode classes operating in parallel System States The system is in exactly one mode from each mode class Each variable has a unique value Events An event occurs when any system entity changes value An input event occurs when an input variable changes value Single input assumption - only one input event can occur at once means c changed from false to true A conditioned event is an event with a WHEN d means: c became true when c was false and d was WHEN d

20 SCR: Example - Safety Injection System (SIS) Goal: Maintain safety of a nuclear reactor. [adapted from Weimin Ma s drawing] Domain: 1. water pressure ranges between 0.0 and psi (pounds/square inch); 2. Low < Permit Safety Injection Nuclear Reactor Block Water Pressure Reset Requirements: 1. Perform safety injection when water pressure is too low; 2. Operator can either block or reset safety injection. Controlled Output Safety Injection System Monitored Input Term: Overridden softgoal satisficing Operator

21 SCR: Mode Classes Mode Class Tables Define a (disjoint) set of modes (states) that the software can be in. A complex system will have many different modes classes Each mode class has a mode table A mode table defines a partial function from modes and events to modes M n = F m (M c, E) Example:

22 SCR: Controlled Variables Dis-jointness Property: the pairwise conjunction of conditions (events) in each row of a condition (an event) table must always be false. Event Tables Defines how a controlled variable changes in response to input events Defines a partial function from modes and events to variable values Example: V = F e (M c, E) could be null no event can cause Overridden to become true.

23 SCR: Controlled Variables Dis-jointness Property: the pairwise conjunction of conditions (events) in each row of a condition (an event) table must always be false. Condition Tables Defines the value of a controlled variable under every possible condition Defines a total function from modes and conditions to variable values Example: V = F c (M c, C) could be null Coverage Property: the disjunction of the conditions in each row of the table must be true.

24 Mode Class Table SCR: Another Example Event Table Condition Table

25 Current Mode idle dialtone busytone ringtone connected EFSMs, Statecharts & SCR callee offhook - F T - - New mode dialtone ringtone busytone idle idle connected idle dialtone idle In WHEN callee_offhook -> Ringing In -> Idle

26 EFSMs, Statecharts & SCR All 3 models are approximately equivalent State machine models Emphasis is on states & transitions No systematic treatment of events Different event semantics can be applied Graphical notation enhances understandability Composition achieved through Statechart nesting Hard to represent complex conditions on transitions Hard to represent real-time constraints (e.g. elapsed time) SCR models Emphasis is on events Clear event semantics based on changes to environmental variables Single input assumption simplifies modeling Tabular notation easy to understand, modulo complex relationships (?) Composition achieved through parallel mode classes Hard to represent real-time constraints (e.g. elapsed time)

27 The particular Petri Net notation here makes a single token assumption and avoids no inhibitor arcs [LK]

28

29

30

31

32