A Formalism for Functionality Preserving System Level Transformations

Transcription

1 A Formlism for Functionlity Preserving System Level Trnsformtions Smr Abdi Dniel Gjski Center for Embedded Computer Systems UC Irvine Center for Embedded Computer Systems UC Irvine Irvine, CA Irvine, CA Tel: Tel: Fx: Fx: e-mil: e-mil Abstrct With the rise in complexity of modern systems, designers re spending significnt time on modeling t the system level of bstrction. This pper introduces Model Algebr, formlism built on top of system level design lnguges, tht cn be used for implementing functionlity preserving trnsformtions on system level models. Such trnsformtions enble us to implement high level design decisions without hving to write new models for ech design decision. Moreover, since these trnsformtions preserve functionlity, the trnsformed models do not need to be re-verified. We present the definition of Model Algebr nd show how system level models cn be represented s expressions in this formlism. The lws of Model Algebr re use to define correct model trnsformtions. We show system level design scenrio, where design decisions grdully refine the functionl model of the system to n rchitecturl model with components nd communiction structure. The refinement cn be performed using the correct model trnsformtions in our formlism. I. Introduction Due to the complexity of modern systems, designers hve to describe them t high level of bstrction using system level design lnguges (SLDLs).However, independently written models in SLDLs hve little correltion between them which mkes it intrctble to compre them for equivlence. A possible solution is to derive the detiled system level models from the specifiction by series of functionlity preserving trnsformtions. The specifiction is cptured using n executble model, which is purely functionl description of the design. As design decisions re mde during system synthesis, the designer refines the functionl specifiction model to more detiled model representing the trget rchitecture. Such design methodology requires formlisms to represent the system level models nd notions for their correctness refinement. In this pper, we introduce Model Algebr (MA), which is one such formlism. Significnt reserch hs been done in the pst for developing modeling formlisms for system level design. Process lgebrs, such s CSP [4] nd CCS [8] hve been used for verifying distributed softwre, but hve limittions in modeling. For exmple, CSP llows only rendezvous communiction between prllel processes. StteChrts [3] provide for hierrchy, synchroniztion nd exceptions, but hve uncler execution semntics, which hve led to severl vrints. Colored Petri Nets re widely used for nlysis nd modeling of concurrent systems, nd verifiction techniques hve been developed to check for their equivlence [5]. Forml methods, developed for hrdwre verifiction, hve been pplied to embedded systems like bounded model checking [2] nd theorem proving [9]. The problem with most stte bsed pproches, s bove, is tht their complexity increses exponentilly with design size. Our gol is to correctly derive detiled system level models, so tht we cn leve the functionl verifiction tsk for only the specifiction model. Correct by construction techniques hve been widely pplied t RT Level to prove the correctness of high level synthesis steps [9] [1]. A complete methodology for correct digitl design hs been proposed in [7], but they only consider synchronous models which re insufficient t system level. The rest of the pper is orgnized s follows. Section II gives the definition of MA. In Section III we demonstrte how to represent hierrchicl system level models in MA. In Section IV we present the forml execution semntics nd notions for functionl equivlence of models in MA. Section V presents functionlity preserving trnsformtions on models nd in Section VI we show how these trnsformtions my enble useful refinements during system level design. II. Model Algebr The objects of MA cn be defined s the tuple < B, C, I, V >, where B is the set of behviors C is the set of chnnels I is the behvior interfce V is the set of vribles We lso define subset B I of B representing the set of identity behviors. Identity behviors re those behviors tht, upon execution, produce n output tht is identicl to their input. We define the subset Q to be the set of ll

2 boolen functions on V. A. Ports Ech behvior hs n ssocited object clled its interfce. The interfce crries the dt ports of the behvior. In the cse of hierrchicl behvior, the ports re identified by ssocition of vrible to the interfce. Hence, to sub-behviors of hierrchicl behvior, the port is seen s I < p >, where p V. The port is treted like ny other locl vrible except tht we llow only one kind of i/o opertion on it. Locl behviors cn either write to port, in which cse it is known s the out-port, or they my red from the port, in which cse it is clled the inport. When the sme port p is ccessed from outside the behvior, it is identified by its ssocition to the behvior. For exmple, in our cse, port p of behvior b would be written s b < p >, s seen by externl behviors. B. Addressing Behviors executing concurrently use synchronized dt trnsctions mongst themselves for communiction. Chnnels serve s the medi for such trnsctions. Ech trnsction uses n ddress to identify the sender nd the receiver behviors. The trnsctions cn, thus, be visulized to tke plce over virtul links, tht re lbeled by distinct ddresses. Ech of the links is ssocited with chnnel. Hence, such link my be identified s c < >, where the link uses chnnel c nd hs the ddress. Two trnsctions on chnnel cnnot shre link if they might tke plce simultneously. In other words, ll trnsctions on single link must be totlly ordered in time. C. Composition Rules Composition rules on the bove objects re defined s reltions in MA. Ech composition cretes term in MA. 1. Control flow: A control flow composition (R c )determines the execution order of behviors during model simultion. We write the reltion s q : b 1 &b 2 &...&b n b, where i, 1 i nb, b i B I, q Q. The composition rule implies tht b executes fter ll the behviors b 1 through b n, clled predecessors in the reltion, hve completed nd q evlutes to TRUE. R c is sid to led to b under the condition q, implying tht b must wit for ll predecessors. 2. Non-blocking write: This composition rule (R nw ) is used to indicte tht behvior writes to vrible or n out-port of its prent behvior. In the cse of write to dt vrible, we use the expression b < p > v, where b < p > is the out-port of the writing behvior nd v indictes the memory into which the dt is written. In its other mnifesttion, this composition rule cn be used to crete port connection, written s b < p > I < p >, In this cse, the composition rule indictes n out-port-mp. 3. Non-blocking red: This composition rule (R nr ) is used to indicte tht behvior reds dt from vrible or through n in-port of its prent behvior. In the cse of red from dt vrible, we use the expression v b < p >, where b < p > is the in-port of the reding behvior nd v indictes the memory from which the dt is red. In its other mnifesttion, this composition rule cn be used to crete port connection, written s I < p > b < p >, In this cse, the composition rule indictes n in-port-mp. 4. Chnnel trnsction: This composition rule (R t ) indictes dt trnsfer link from the sender behvior to one or more receiver behvior(s) over chnnel. The semntics of the composition rule ensure rendezvous communiction mechnism. We write this reltion s c < >: b < p > b 1 < p 1 > &b 2 < p 2 >...&b n < p n >, where b < p > is the outport of the sending behvior nd b 1 < p 1 > through b n < p n > re the in-ports of the receiving behviors. The trnsction tkes plce over chnnel c nd uses the link ddressed by c < >. Also, ny two trnsctions over the sme chnnel re mutully exclusive in time. 5. Blocking write: This composition rule (R bw ) is used to indicte the port connection for the sender prt of trnsction. The sender behvior writes to the out-port of its prent behvior through one of its own out-ports. We represent blocking write by the expression b < p > I < p >, where b < p > is the out-port of the writing behvior nd I < p > is n out-port on the prent of b. 6. Blocking red: This composition rule (R br ) is used to indicte the port connection for the receiver prt of trnsction link. The receiving behvior(s) red(s) from the in-port of their prent behvior through one of their own in-ports. We represent blocking red by the expression < >: I < p > b 1 < p 1 > &b 2 < p 2 >...&b n < p n >, where b 1 < p 1 > through b n < p n > re the in-port(s) of the receiving behvior(s) nd I < p > is n in-port on the prent of b. The ddress of the virtul link (< >) will be used for binding this port. 7. Grouping: This composition rule (R g )is used to indicte collection of compositions. Essentilly, grouping is used to crete hierrchy of behviors, by collecting the vrious compositions of sub-behviors, locl chnnels nd locl vribles. This commuttive reltion is written s r 1.r 2...r n, where i, 1 i n nd r i {R c, R nw, R nr, R t, R bw, R br, R g }. III. Model Construction with MA In this section, we look t how to construct hierrchicl system models s expressions in MA. A given hierrchicl behvior b hs unique virtul strting point(vsp)

3 nd the virtul terminting point(vtp). The VSP is the identity behvior vsp b tht is the first to execute inside b. Other sub-behviors of b re executed fter vsp b, depending on outgoing control reltions from vsp b. Due to its nture, VSP behvior would only hve outgoing control edges to other sub-behviors of b. Similrly, the identity behvior vtp b is the lst behvior to execute inside b. In other words, the completion of b is indicted by the execution of vtp b. Due to its nture, the VTP behvior will only hve incoming edges from other sub-behviors of b. bpr vsp b pr b 1 b 2 b 1 vtp b pr () bfsm q' 1 vsp b fsm q 1 b 2 q' 2 vtp b fsm (b) Fig. 1. ()Prllel nd (b)fsm style compositions of behviors A. Prllel nd Conditionl Execution Most SLDLs provide for specil lnguge constructs to crete different types of behviorl hierrchies. The common ones re prllel composition nd fsm-style composition. A sequentil composition is simply degenerte form of the fsm-composition. In MA, we cn relize both these types of composition by using control reltions. Figure 1() shows prllel composition of behviors b 1 nd b 2. A typicl SLDL my llow construction of prllel composition using sttement like pr {run b 1 ; run b 2 }. Let the resulting behvior be clled b pr. The execution of b pr indictes tht both b 1 nd b 2 re redy to execute. The execution of b pr completes when both b 1 nd b 2 hve completed. In the corresponding MA expression, vsp bpr nd vtp bpr serve s the strting nd terminting points, respectively, of the hierrchicl behvior b pr. We cn see, tht inside b pr, b 1 nd b 2 re llowed to strt simultneously. This is ensured by the control reltions vsp bpr b 1.vsp bpr b 2 Hence, the prllelism is relized by orthogonlity of the execution of behviors b 1 nd b 2. The control reltion t the end (b 1 &b 2 vtp bpr ) ensures tht both b 1 nd b 2 must complete their execution before vtp bpr executes. The execution of vtp bpr indictes the completion of the hierrchicl behvior b pr. A typicl FSM style composition of behviors is shown in Figure 1(b). The control flow between behviors is typiclly expressed using switch-cse or goto constructs in SLDLs. A simple pseudo code exmple for hierrchicl behvior b fsm is s follows l1: run b 1 ; if q 1 == 1 goto l2 else brek; q 2 l2: run b 2 ; if q 2 == 1 goto l1 else brek; The control reltions of b fsm cn be written s follows vsp bfsm b 1.q 1 : b 1 b 2.q 1 : b 1 vtp bfsm. q 2 : b 2 b 1.q 2 : b 2 vtp bfsm bhier v2 out b p2 b 1 p1 b 2 in Fig. 2. Using ports for non-blocking dt flow B. Vrible Access vi Ports In MA, s in most SLDLs, vrible is directly visible only to the behviors tht re t the sme level of hierrchy s the vrible itself. Therefore, in order to ccess vribles t higher levels of hierrchy, dt ports re used. As shown in Figure 2, behvior b 1 reds vrible v 1 present in b hier vi the port in of its prent b. Hence, to relized this port connection, we use the non-blocking reltion v 1 b < in >. At the level of b, we crete port connection from the interfce of b to b 1 using the term I < in > b 1 < p 1 >. The dul of red port connection is the write port connection s shown by the ccess of vrible v 2 from behvior b 2 in figure 2. In this cse, the port out of b is used to relize the vrible ccess. The term t the level of b hier is b < out > v 2, while the term t the level of b is b 2 < p 2 > I < out >. b 1 b' 1 p1' p1 c Fig. 3. Blocking dt flow bound to chnnel C. Chnnel Access vi Ports v1 p2 b 2 p2' b' 2 As in the cse of non-blocking reds nd write, MA provides mechnism for blocking reds nd writes vi ports. For instnce, in Figure 3, we see chnnel trnsction from b 1 to b 2 over c. After zooming into the hierrchy of b 1 nd b 2, we see tht the trnsction is tking plce from b 1 to b 2. The port p 1 of b 1 mkes the chnnel c visible to b 1. Therefore, using the reltion < >: b 1 < p 1 > I < p 1 > behvior b 1 cn ccess chnnel c. However, this requires p 1 to be bound to the virtul link ddressed by. Similrly, on the other side, sub-behvior b 2 inside b 2, uses the blocking reltion < >: I < p 2 > b 2 < p 2 > to ccess the red method of c vi port p 2. In this cse, port p 2 mkes the chnnel c visible to b 2. As before, p 2 must be bound to the virtul link ddressed by.

4 b hier vspb hier 1 b1 p11 p12 p1 b1_queue b 1 b1_'_queue b1_qn'_queue ' p2 ' p22 b2 1 vtp bhier p21 v qm qn' b k Fig. 5. The firing semntics of BCG nodes bk_qn_queue Fig. 4. A hierrchicl behvior with locl objects nd reltions D. Internl nd Interfce Terms Figure 4 shows hierrchicl behvior b hier. The expression for the hierrchicl behvior is written using compositions involving locl objects nd the interfce. The grouping of reltions between locl objects will be referred to s the internl terms of hierrchicl behvior. Similrly, the grouping of reltions involving the interfce will be referred to s the interfce terms of the hierrchicl behvior. We cn write the hierrchicl behvior s grouping of ll its internl nd interfce terms, long with the internl terms of its sub-behviors. The grouping of internl terms for given behvior b is represented s [b]. Thus, we cn write [b hier ] = [vsp bhier ].[b 1 ].[b 2 ].[vtp bhier ].vsp bhier b 1. q 1 : b 1 b 2.q 1 : b 1 vtp bhier.b 2 vtp bhier. b 1 < p 12 > v.v b 2 < p 21 > The interfce terms of b hier is represented by b hier. From figure 4, we cn see tht b hier =< >: I < p 1 > b 1 < p 11 >. b 2 < p 22 > I < p 2 > Finlly, we write the hierrchicl behvior s grouping of its internl nd interfce terms. Therefore, we get b hier = ([b hier ]. b hier ) IV. Execution Semntics nd Equivlence Before we ttempt to estblish equivlence notions for models expressed in MA, we must clerly define the execution semntics of such models. The control dependencies in the model re cptured using the Behvior Control Grph (BCG), which is similr to the populr computtion model of Khn process network (KPN) [6]. The chnnels in the model re bstrcted wy nd replced by corresponding control dependencies, resulting from their rendezvous semntics. A. Behvior Control Grph The BCG is directed grph (N,E) with two types of nodes, nmely behvior nodes(n B ) nd control nodes(n Q ). The behvior nodes, s the nme suggests, indicte behvior execution, while the control nodes evlute control conditions tht led to further behvior executions. Directed edges re llowed from behvior nodes to control nodes nd vice vers. Also, control node cn hve one, nd only one, out going edge. The execution of behvior node, nd similrly, evlution in control node, will be referred to s firing. Node firings re fcilitted by tokens tht circulte in the queues of the BCG s shown in Figure 5. Ech behvior node (shown by rounded edged box) in the BCG hs one queue, for instnce b1 queue for behvior node b 1. All incoming edges to behvior node represent the vrious writers to the queue. A behvior node blocks on n empty queue nd fires if there is t lest one token in its queue. Upon firing, one token is dequeued from the node s queue. The control node (shown by circulr node), on the other hnd, hs s mny queues s the number of incoming edges. For instnce q n hs k queues, one ech for edges from b 1 through b k. A control node, sequentilly checks ll its queues nd blocks on empty queues. If the queue is not empty, it dequeues token from the queue nd proceeds to check the next queue. The node fires fter it hs dequeued one token from ech of its queues. After firing, behvior node genertes s mny tokens s its out-degree, nd ech token is written to the corresponding queue of the destintion control node in nonblocking fshion. Upon firing, the control node evlutes its condition. If the condition evlutes to TRUE, then token is generted nd written to the queue of the destintion behvior node. B. Chnnel Semntics e1 b1 c q2 e2 b2 e1 b1 Fig. 6. Resolution of chnnels into control dependencies The rendezvous property of chnnel would ensure tht ny behvior following the sender behvior would not execute until the receiver behvior hs executed nd e2 b2 q2

5 ny behvior following the receiver behvior would not execute until the sender behvior hs executed. If we were to optimize wy the chnnel to extrct only the control dependencies, the result will be s shown in figure 6. As per the bove premises, behvior b 1 following sender e 1 cnnot strt until e 2 hs completed. This is gurnteed by including the term q 1 : e 1 &e 2 b 1 In the dul of the bove cse, b 2 following e 2 is blocked until the sender e 1 hs executed. This premise is ensured by the term q 2 : e 2 &e 1 b 2 C. Notion of Functionl Equivlence Our notion of functionl equivlence is bsed on the trce of vlues tht the vribles hold during model execution. In prticulr, we re interested in the vribles tht re written to by non-identity behviors. We will refer to such vribles s observed vribles. The resoning is tht vribles tht re connected to the output ports of identity behviors re simply copy of nother vrible. Informlly speking, we consider two models to be functionlly equivlent, if they hve identicl observed vribles nd the trce of vlues ssumed by those vribles during model execution is identicl, given the sme initil ssignment.formlly, Given model M, let I(M) be the initil ssignment of observed vribles in M. v, wr(v) N B (BCG(M)) Let d i, i > 0 be the vlue written to v fter the i th execution of wr(v). Let d 0 be the initil ssignment vlue of v. We define the ordered set τ(v, M, I(M)) = {d 0, d 1, d 2,...} We clim tht two models M nd M re equivlent iff v, I(M) = I(M ) τ(v, M, I(M)) = τ(v, M, I(M )) V. Functionlity Preserving Trnsformtions In this section, we present some lws of MA tht llow us to define functionlity preserving model trnsformtions. A. Behvior Flttening Lws Hierrchy is only modeling rtifct, without ny influence on functionlity. Hence, it my be optimized wy. By the semntics of the VSP, ny control reltion leding to b hier is effectively leding to vsp bhier. Similrly, in ny control reltion where b hier is predecessor, it my be replced by vtp bhier. Thus, we hve L 1 q : x b = q : x vsp b L 2 q : b x = q : vtp b x We lso hve the following lws for port optimiztion during behvior flttening. L 3 (...y I < p >...) < p > x = y x L 4 x (...I < p > y...) < p >= x y > L 5 c < >: x (... < >: I < p > y...) < p >= c < >: x y > L 6 c < >: (... < >: y I < p >...) < p > x = c < >: y x > B. Identity Elimintion Lws The identity behvior does not modify ny vrible, so it my be optimized wy using pproprite trnsformtions to control nd dt flow reltions in model. L 7 q 1 : x e.q 2 : e y = q 1 q 2 : x y L 8 x < p > v 1.v 1 e < in >.e < out > v 2 = x < p > v 2 L 9 c < >: e 1 < out > e 2 < in >.e 2 < out > v = e 1 < out > v L 10 c < >: e 1 < out > e 2 < in >.c < >: e 2 < out > e 3 < in >= c < >: e 1 < out > e 3 < in > C. Control Relxtion Lws Control dependencies between two behviors, sy x nd y do not influence the functionlity of the model if there is no dt dependence between x nd y. Thus control dependence q : x y my be removed if v such tht x < p > v.v y < p > or q depends on v. Under these conditions, we cn sy L 11 R.q : x y = R L 12 R.q : x 1 &x 2 &...&x y = R.q : x 1 &x 2 &... y VI. System Level Design nd Verifiction Methodology In our system level design methodology, the following design steps re encountered s we strt from functionl specifiction model nd produce scheduled bus trnsction level model. 1. Behvior prtitioning: During behvior prtitioning, we choose the number of PEs tht will be needed to implement the design nd the mpping of lef behviors in the specifiction to those PEs. The output is prllel composition of hierrchicl PE behviors. Ech PE behvior is composed from the lef level behviors tht were mpped to it. Hence, the trnsformtion produces rerrngement of behviors. Additionl chnnels re dded for synchroniztion mongst behviors to preserve the originl order of execution of the lef behviors. The dt flow reltions re modified to reflect the loclity of memory in ech PE. The originl dt trnsfers between lef behviors, mpped to different PEs, will now go cross PEs, nd needs to be routed vi identity behviors using chnnels. The trnsformtions to derive the output prtitioned model use the identity elimintion nd flttening lws (in either direction).

6 2. Sttic scheduling: Sttic scheduling is performed in system level models either due to resource constrints or timing optimiztion. Behviors mpped to HW re typiclly trgeted for implementtion with single controller. As result, ny prllelism in the HW PEs must be serilized stticlly. Reordering of behviors cn lso tke plce s result of communiction scheduling. Essentilly, we cn use the trnsformtions llowed by control relxtion lws (in either direction) to crete new schedule stticlly. 3. RTOS insertion: PEs tht implement softwre my provide for dynmic scheduling. In this cse, the nondeterminism of concurrency is resolved t execution time. The ordering of prllel behviors is performed by scheduler tht is prt of the PE s operting system. In SLDL implementtion, the scheduler is nother behvior tht models the Rel Time Operting System (RTOS).Therefore, for functionlly correct implementtion of dynmic scheduling, we need to ensure tht the scheduler behvior, nd hence the scheduling policy, stisfies the sme properties s the scheduler of the SLDL simultor. This cn be verified using property verifiction tool. If the property verifiction is successful, the scheduler behvior cn be bstrcted wy from the model. The MA expression during this SLDL trnsformtion cn, thus, remin unchnged if the dynmic scheduler of the RTOS follows the simultor s properties. 4. Bus protocol insertion: After behvior prtitioning nd scheduling, the system model consists of concurrent behviors communicting with severl chnnels. Although, the model shows the computtion structure correctly, the communiction structure still needs to be implemented. In bus-bsed SoC communiction scheme, the vrious PEs re connected to system busses. The communiction model cn thus be represented using chnnels for busses. All virtul links in the input model re shred over the new bus chnnels. The design decision in this cse is choosing the number of bus chnnels nd mpping the virtul links to the bus chnnels. Also, the ordering of trnsctions on the bus my be done using n rbitrtion policy. Trnsctions on chnnel re mutully exclusive nd the new rbiter must stisfy this property. For correct implementtion of rbitrtion policy, we hve the sme scenrio s tht in RTOS insertion. We cn use property checking to verify tht the rbitrtion policy preserves the functionlity of the model. If we cn prove tht the rbiter behvior will never cuse dedlock nd will eventully schedule trnsction request then we cn bstrct it wy. level models from more bstrct ones using correct trnsformtions. We estblished notion of functionl equivlence nd refinement using prtil order trces. The xioms nd rewriting rules of MA were then shown to be sound, which led us to defining functionlity preserving model trnsformtions. Finlly, we presented system synthesis scenrio nd showed how our formlism cn be used in system design methodology. The complexity of modern systems stresses upon the need for such forml pproch, so s to void the overhed of verifying nd debugging ll models during design spce explortion. References [1] R. Cmposno. Behvior-preserving trnsformtions for high-level synthesis. In Proceedings of the Mthemticl Sciences Institute workshop on Hrdwre specifiction, verifiction nd synthesis: mthemticl spects, pges Springer-Verlg New York, Inc., [2] X. Chen, H. Hsieh, F. Blrin, nd Y. Wtnbe. Cse studies of model checking for embedded system designs. In Third Interntionl Conference on Appliction of Concurrency to System Design, pges 20 28, June [3] D. Hrel. Sttechrts: A visul formlism for complex systems. Science of Computer Progrmming, 8(3): , June [4] C. Hore. Communicting Sequentil Processes. Prentice Hll, [5] J. Jorgensen nd L. Kristensen. Verifiction of colored petri nets using stte spces with equivlence clsses. In Proceedings of the Workshop on Petri Nets in System Engineering, pges 20 31, September [6] G. Khn. The semntics of simple lnguge for prllel progrmming. In Info. Proc., pges , August [7] Middlehoek. A methodology for the design of gurnteed correct nd efficient digitl systems. In IEEE Interntionl High Level Design Vlidtion nd Test Workshop, November [8] R. Milner. A Clculus of Communicting Systems. Springer, [9] S. Rjn. Correctness of trnsformtions in high level synthesis. In Interntionl Conference on Computer Hrdwre Description Lnguges nd their Applictions, pges , June VII. Conclusions In this pper, we introduced formlism clled Model Algebr, which is employed in deriving detiled system