November 18, 2004 Conservative Approximations for Heterogeneous Design Roberto Passerone Alessandro Pinto Jerry R. Burch Alberto Sangiovanni Vincentelli Transport Layer Network Layer MAC Layer Link Layer Discrete Event Physical Layer Application Pre-Post Process Networks x Low pass Manager Tables and Parameters User CSP Continuous Time m + c s Systems are heterogeneous Separation convenient, but interactions difficult to define Build relations between the models in the form of abstractions and refinements Conservative approximations is one such class of relations H concrete abstract H concrete abstract Q Q’ uu ll concrete abstract H concrete abstract uu ll concrete abstract uu ll Q Q’  inv Refinement preserving abstraction –A function H between two models preserves refinement if and only if p 1  p 2 implies H(p 1 )  H(p 2 ) –In other words, H is monotonic –Analogy for real numbers r and s if r  s then  r    s  Monotonic functions are important, but not very useful in isolation –Proving refinement at the concrete level is harder than at the abstract level –Implication going in the wrong direction! Refinement preserving abstraction –A function H between two models inversely preserves refinement if and only if H(p 1 )  H(p 2 ) implies p 1  p 2 –In other words, H is “inverse” monotonic –Analogy (not) for real numbers r and s if  r    s  then not r  s Inverse monotonic functions are not useful –Say H(p 1 ) = H(p 2 ). Then p 1 = p 2 –In other words, H is injective (not giving up information) –Hence H is not an abstraction at all! One function does not fit all Conservative approximation –A pair of functions  = (  l,  u ) is a conservative approximation if and only if  u (p 1 )   l (p 2 ) implies p 1  p 2 –Analogy: if  r    s  then r  s –Abstract implies detailed Conservative approximations are useful –Implication going in the right direction –  l and  u are both abstractions (they need not be injective) The inverse of an abstraction does not necessarily exist –H( p ) does not determine p uniquely –Similarly,  u ( p ) and  l ( p ) do not determine p uniquely Inverse defined when upper and lower bound coincide –If  u (p) =  l (p), then p can be represented exactly at the abstract level –p is uniquely determined in this case –For induced approximations, inverse defined when  u ( p’ ) =  l ( p’ )  inv identifies agents that can be used indifferently in either domain –If Q’ is an abstraction of Q, then  inv is an injection from Q’ to Q –Agents are “domain polymorphic” Other agents are only approximated by the other semantic domain –  u and  l are different “views” –  inv   u is a closure operator –  inv   l is an interior operator Architecture Platform Semantic Platform Platform Instance All Platform behaviors (non deterministic) Function Function Space Architecture Platform Library Elements Closure under constrained composition (term algebra) Platform Instance Function Semantic Platform Function Space Mapped Instance Admissible Refinements Platform-based Design Motivations Abstractions A specification q requires that action “b” always be preceded by action “a” –q contains behaviors such as x = { (a, 1.1), (b, 2.3), (a, 3.4), (b, 3.8) } Take the abstraction  ( q ) of q –x’ = { (a, 1), (b, 2), (a, 3), (b, 3) } Assume  ( p )   ( q ) –Yet, it is possible that p has a behavior y = { (a, 1.1), (b, 2.3), (b, 3.8), (a, 3.9) } –Hence not p  q Upper and lower bounds –If b is a behavior of  u (p), then p has at least one concretization of b (same as Galois connection) –If b is a behavior of  l (p), then p has all the concretization of b Refinements and Embeddings Does  u ( p )   l ( q ) hold? –No, x’ = { (a, 1), (b, 2), (a, 3), (b, 3) } is not in  l ( q )! –The conservative approximation correctly points out that it is unable to solve the problem (incomplete, but sound) But  l ( q ) is not empty! –It has all the behaviors for which a and b are separated by at least one time unit –Verification possible if the implementation is “slow enough” There is a relation between our sampling frequency and the ability to verify in the abstract –Subtle interaction between implementation and verification strategy –Conservative approximations separate those concerns Refinement Verification Conservative Approximations useful in relating hybrid models –Can be used in translations to/from the Hybrid System Interchange Format –Full information not always needed (nor desirable!) See our other poster!! Interchange Format