A tag contract framework for modeling heterogeneous systems

Abstract

In the distributed development of modern IT systems, contracts play a vital role in ensuring interoperability of components and adherence to specifications. The design of embedded systems, however, is made more complex by the heterogeneous nature of components, which are often described using different models and interaction mechanisms. Composing such components is generally not well-defined, making design and verification difficult. Several denotational frameworks have been proposed to handle heterogeneity using a variety of approaches. However, the application of heterogeneous modeling frameworks to contract-based design has not yet been investigated.In this work, we develop an operational model with precise heterogeneous denotational semantics, based on tag machines, that can represent heterogeneous composition, and provide conditions under which composition can be captured soundly and completely. The operational framework is implemented in a prototype tool which we use for experimental evaluation. We then construct a full contract model and introduce heterogeneous composition, refinement, dominance, and compatibility between contracts, altogether enabling a formalized and rigorous design process for heterogeneous systems. Besides, we also develop a generic algebraic method to synthesize or refine a set of contracts so that their composition satisfies a given contract.

Conditions of contracts for separating responsibilities in heterogeneous systems

“…In fact, the work in [39] is the only theory that allows assumptions to constrain ports in the environment of a component, but not guarantees. Thus, in contrast to [39], and also [3][4][5]35,[37][38][39][41][42][43]45,46,[49][50][51][52][56][57][58][59], the present paper allows both assumptions and guarantees to constrain ports that extend outside of the set of ports of a component and, thus, fully relaxes the limitation that contracts must be limited to component ports.…”

“…While none of theories [3][4][5]35,[37][38][39][41][42][43]45,46,[49][50][51][52][56][57][58][59] fully relax the limitation that contracts must be limited to component ports, it can be argued, considering the particular aspect of relaxing such a limitation, that these theories could serve as equivalent formalisms to the one in the present paper if the set of ports of a component is allowed to simply include any port of the environment. These additional ports could further be labeled as "environment ports" to distinguish them from those inherent to the component.…”

“…However, in addition to this, for these theories to serve as equivalent formalisms to the one in the present paper, there would also be a need to enforce the condition that the component implementation can only constrain the subset of its ports that are not labeled as environment ports. Notably, the theories [3][4][5]35,[37][38][39][41][42][43]45,46,[49][50][51][52][56][57][58][59] do not support a straightforward way to enforce such a condition since, analogous to [34,40], they do not incorporate a means to distinguish a port that an implementation constrains from one that it does not in the set over which the implementation is expressed. This can be contrasted with the present paper where such a condition is enforced at the foundation of the theory, influencing almost all definitions and theorems.…”

“…This can be contrasted with the present paper where such a condition is enforced at the foundation of the theory, influencing almost all definitions and theorems. Hence, considering the particular aspect of relaxing the limitation that contracts must be limited to component ports, it is clear that theories [3][4][5]35,[37][38][39][41][42][43]45,46,[49][50][51][52][56][57][58][59] do not serve as equivalent formalisms to the present paper and can neither be trivially extended to serve as such.…”

“…In general assume-guarantee theories [3,4,35,[37][38][39][41][42][43]45,46,[49][50][51][52][56][57][58][59] where ports are explicit, contract C l Meter is not supported since assumption A l Meter and guarantee G l Meter are not specified only over the set of ports of E l Meter , i.e. over the voltage connections v branch and v gnd , and the indicated level l. In contrast to these theories, the present paper supports specifying a contract for E l Meter where both A l Meter and G l Meter constrain port variables that are not in the set of port variables of E l Meter as exemplified in Fig.…”