Tble 1: Syntx of LOTOS/T+ E :: stop (untimed dedlock) j exit (successful termintion) j ; E (ction prex, untimed) j [P (t; x)]; E (ction prex, timed) j

Transcription

1 Protocol Synthesis from Timed nd Structured Specictions Akio Nkt Teruo Higshino Kenichi Tniguchi Dept. of Informtion nd Computer Sciences, Osk University Toyonk, Osk 56, Jpn Abstrct In this pper, we propose method to synthesize protocol specictions utomticlly from service specictions written in time-extended LOTOS clled LOTOS/T+. In LOTOS/T+, structured descriptions, such s prllelism nd interruption re llowed to describe service specictions, nd time-constrints mong non-djcent ctions cn be described using Presburger formuls. Here we ssume tht there is relible communiction chnnel between ny two nodes nd the mximum communiction dely for ech chnnel is bounded by constnt. Moreover we ssume service specictions hve no dedlocks. Under our simultion policy, speciction S is derived from given service speciction S nd given mximum communiction dely of ech chnnel. In S, timeconstrints necessry for exchnging synchroniztion messges re dded. If S nd S cn crry out the sme behviour, i.e., if S nd S re bisimultion equivlent when time is ignored, then correct protocol speciction for simulting S is derived from S utomticlly. 1 Introduction For designing relible distributed systems, protocol synthesis methods re useful [1]. In the recent yers, severl methods for synthesizing correct protocol specictions from given service specictions mechniclly hve been proposed for FSM, EFSM, LOTOS nd Petri Net models [, 3, 4]. However those proposls do not consider quntittive time constrints for the systems. It is highly desirble to synthesize protocol specictions from time-constrined service speci- ctions. Recently, in [5], method to derive protocol specictions from timed service specictions written in FSM model hs been proposed, but in such FSM model we cn not specify complicted order of ctions in structurl wy. In this pper, we propose method for synthesizing correct protocol specictions utomticlly from given service specictions written in sub-clss of LOTOS/T+ (which is modied version of [6]), one of timed extensions of LOTOS [7]. LOTOS/T+ hs n bility to specify complicted ction ordering such s prllel composition nd interruption. Moreover, in LOTOS/T+, time constrints mong ctions cn be specied s formuls using ddition, subtrction nd inequlities on integers. In ddition, using vribles to hold the time when preceding ctions re executed, we cn specify time constrints for succeeding ctions. In our method, we ssume tht () ech communiction chnnel is error-free nd its mximum propgtion dely is bounded by constnt, nd tht (b) ll nodes with their clocks cn strt their executions simultneously nd the clocks lwys synchronize ech other. Under this ssumption, we give simultion policy for ech node to execute ctions in exctly the sme order s specied in given service speciction. Bsiclly, the simultion policy is bsed on the method which we hve proposed in [3, 8]. Tht is, fter executing ech ction, sy, synchroniztion messge is sent to the node which executes succeeding ction, sy b, to inform tht hs been executed. If the execution time of is needed, the time is lso trnsmitted. The ction b must be executed fter the messge is received. We derive protocol specictions under the bove policy. However, if we consider timeconstrints, mny problems rise. For exmple, if service speciction sttes \the ction must be executed before time 3 t node 1, nd then the ction b must be executed before time 5 t node," nd if the mximum communiction dely from node 1 to node is 3 units of time, the synchroniztion messge sent from node 1 fter is executed my not rech node before time 5. To cope with this kind of problem, we restrict, for exmple, the time constrint of the ction to \before time " so tht we cn gurntee the synchroniztion messge reches node in time. As nother exmple, suppose tht service speciction sttes \the ction must be executed between time 1 nd 3 t node 1, nd fter tht the ction b must be executed between time 4 nd 5 t node ". If the mximum communiction dely from node 1 to node is 3 units of time, the sme observtion s the previous exmple holds, i.e., the synchroniztion messge from node 1 to node my not rech in time. But s for the bove cse, dierent solution is possible. Since ech node hs its own clock nd ll clocks synchronize ech other, the ordering of ctions nd b is gurnteed without ny messge exchnge. Tht is, the temporl ordering s the totl system is gurnteed if ech node decides the execution time of its ction (or b) using its own clock. In our derivtion method, rst, from given service speciction S nd given mximum dely of ech chnnel, we derive speciction S where dditionl time constrints re ppended to S so tht the messge exchnges re crried out in time. We mke only the wekest timing restrictions to S so tht ech node cn simulte S under the bove policy. If

2 Tble 1: Syntx of LOTOS/T+ E :: stop (untimed dedlock) j exit (successful termintion) j ; E (ction prex, untimed) j [P (t; x)]; E (ction prex, timed) j E[]E (choice) j EjjjE (synchronous prllel) j EjjE (synchronous prllel) j Ej[A]jE (generic prllel composition) j E[> E (disbling) j E >> E (enbling) j hide A in E (hiding) j sp A in E (\s soon s possible" execution) j P [g 1 ; : : : ; gk](e) (process invoction) S nd S cn execute the sme behviour (note tht the trnsformtion from S to S does not necessrily preserve the equivlence), i.e., if they re observtionlly equivlent (bisimultion equivlent[6]) when we consider sending/receiving ctions of synchroniztion messges nd n ction representing one unit time progress s unobservble, then protocol speciction stisfying S is derived utomticlly from S. The pper is orgnized s follows. Section describes our speciction lnguge LOTOS/T+. In Section 3 we explin the protocol synthesis method. Section 4 concludes this pper. LOTOS/T+ The speciction lnguge we use for describing both service specictions nd protocol specictions is LOTOS/T+, which is slightly modied one from LOTOS/T[6]. The syntx nd informl semntics of LOTOS/T+ re described below. Denition 1 Behviour expressions of LO- TOS/T+ is dened s Tble 1 (the preference of ech opertor is the sme s LOTOS[7]), where Act [ fig( Act stnds for nite set of ll observble ctions, nd i represents n internl (unobservble) ction), A Act, k N(N is set of nturl numbers), nd P (t; x) stnds for Presburger formul[9], tht is, rst order logic formul whose toms re integer liner inequlities, which hs free vrible t nd other free vribles x i. Here x def (x 1 ; x ; : : : ; x k ) for some k. Intuitively, t represents the current time, e stnds for n integer liner expression (ILE for short) nd e def (e 1 ; e ; : : : ; e k ) for some k, where ech e i is n ILE. In LOTOS/T+, time constrints of ctions re described in subclss of Presburger formuls, more speciclly, logicl combintions of the toms ech of which tkes the form of either e l t, t e u or x t. Here, e l (e u ) is n ILE representing the lower bound (upper bound, respectively) of the time n ction is executble. The tomic formul x t mens tht the ction's executed time is ssigned to the vrible x. For simplicity, we use n bbrevition e l t e u for e l t ^ t e u. Other symbols of inequlity such s <,,etc. my lso be used. In our semntics, n upper bound e u specied s time constrint of n ction mens the ction must be executed no lter thn e u. In this cse, we sy tht urgency of the ction t time e u is specied. Note tht in our lnguge, executbility nd urgency of ech ction t ech given time t re decidble[6]. Exmple 1 B [ t 3 ^ x t]; b[t x + 3]; c[t x + 4]; stop The behviour expression B represents the following behviour. The ction must be executed between time nd 3, nd the execution time of is ssigned to the vrible x. Then b must be executed exctly 3 units of time fter the execution of. And then c must be executed exctly 4 units of time fter. Exmple 1. E [x t]; b; c[t x + ]; stop. P [t 5]; stop[]b[t 1]; P The rst behviour expression is n exmple tht n ction without time constrints is inserted between time constrined ctions. b in the rst exmple cn be executed t ny time fter is executed, tht is, we consider tht formul \true" is omitted s time constrint of b. Moreover, n unbounded intervl \t x + " is specied s time constrint of c. The second one is n exmple of recursive processes. A clock is reset to t ech moment P is invoked. Generlly, ech instnce of processes hs its own clock loclly, which is reset to t the beginning of the process's run. If process P hs process prmeter like P (t), however, the clock is not reset to but to the ctul time t, tht is, P (t ) is invoked. The corresponding LTS's re shown in Fig. 1. The dierence between LOTOS/T+ nd LO- TOS/T is n interprettion of the behviour of internl ctions. In the method we propose, the dely of internl messges exchnged mong nodes is ssumed to be uncertin. On the other hnd, in LOTOS/T internl ctions re dened to be executed s soon s possible fter it is enbled, so we cnnot describe uncertin dely of internl ctions in LOTOS/T. Thus, we dene LOTOS/T+ so tht the executble time of internl ctions my be decided nondeterministiclly in the rnge of time constrints. To describe this property, we dene construct \sp A in B," representing the sme behviour B except the ctions in A must be executed s soon s possible they re enbled. The forml denition of the semntics is given s the inference rules in Fig.. From the rules, we cn utomticlly decide whether n ction [P (t; x)] is executble, if stisbility of the corresponding predictes P (; x) nd 9t 9x[t > ^ P (t ; x)] is decidble. P (; x) denotes whether is executble t the current time nd 9t 9x[t > ^ P (t ; x)] denotes whether

3 [t x]; b; c[t x + ]; stop b; c[t ]; stop b; c[t + 1 ]; stop b; c[t + ]; stop b b b c[t ]; stop c[t + 1 ]; stop c[t + ]; stop c stop E stop P Figure 1: The semntics of E nd P b P [t 4]; stop[]b[t ]; P [t 3]; stop [t ]; stop [t 1]; stop [t ]; stop stop?! stop (S1) P (; c) [P (t; x)]; B?! [cx]b (TAP1) ; B?! ; [t + 1t]B (UAP)?! B 1 B?! B exit?! stop (E1) 9t 9x[t > ^ P (t ; x)] [P (t; x)]; B?! [P (t + 1; x)]; [t + 1t]B (TAP) []B?! B 1?! B 1?! B 1 i Act [ f; ig B 6?! (CH1) B []B exit?! exit (E) ; B?! B (UAP1)?! B?! B B?! B i Act [ f; ig 6?! (CH) []B?! B1 []B (CH3)?! B1 B?! B j[a]jb B j[a]jb?! B 1 j[a]jb?! B?! j[a]jb [> B?! B 1 i A [ fg (PA1) i 6 A _ i (PA4)?! B 1 [> B (DI1)?! B1 B?! B [> B?! B 1 [> B (DI4)?! B 1 >> B []B?! B1 (CH4)?! B 1 B?! B j[a]jb?! B1 j[a]jb (PA) B [> B j[;]jb jjjb?! B?! B >> B?! B?! B (PA5)?! B 1 i Act [ f; ig (DI)?! B 1 >> B (EN1) j[a]jb []B?! B (CH5)?! B 1?! B 1 j[a]jb j[act]jb jjb [> B >> B?! B i 6 A _ i (PA3)?! B (PA6)?! B 1?! B 1 B?! B 6?! B?! B i (Act n A) [ f; ig?! B1 >> B hide A in B?! hide A in B (EN3)?! B 1 (DI3) i?! B (EN) (HI1) B?! B i A hide A in B?! i hide A in B (HI)?! B B?! 6 for ll A B sp A in B?! sp A in B (ASAP) B?! B hide A in B?! hide A in B (HI3) B sp A in B?! B?! sp A in B (ASAP1) [ex]bfg 1 g 1; : : : ; g k g kg?! B i P [g P [g1 ; : : : ; ](e) 1 ; : : : ; g k ](x) : B is denition g k?! B (PR1) Figure : The opertionl semntics of LOTOS/T+ my be executble in the future. Since P (t; x), time constrint of the ction, is Presburger formul, ll the predictes bove re lso Presburger formuls, so their stisbility is decidble[9, 6]. Hence, we cn construct mechniclly the corresponding LTS's (possibly, of innite stte spces) from given behviour expressions. Here we give some rules to show how to construct LTS's. Firstly, for the process E in Exmple (see Fig.1): E [t x]; b; c[t x + ]; stop ]; stop [ from the rule (TAP1)],?! b; c[t b; c[t ]; stop?! b; c[(t + 1) ]; stop [ from the rule (TAP)], Secondly, for the process P in Exmple (see Fig.1): P?! [t 4]; stop[]b[t ]; P [from the rules (PR1), (CH3), (TAP)],

4 [t 4]; stop[]b[t ]; P?! [t 3]; stop [from the rules (CH4), (TAP)], 3 Protocol Synthesis 3.1 Protocol Synthesis Problem In this section, we dene protocol synthesis problem from timed service specictions. First we introduce some nottions. Let plce() denote node ssignment for the ction. In the rest of this pper, we ssume tht k stnds for n ction with plce() k. Moreover, we use some nottions SP (B), EP (B), AP (B), whose intuitive menings re the sets of the strting nodes of B, the ending nodes of B, ll the prticipting nodes in B, respectively. For exmple, if B 1 ; b ; exitjjje 3 ; d ; exit, then SP (B) f1; 3g, EP (B) fg nd AP (B) f1; ; 3g. We cn derive them from B nd plce() mechniclly. The forml denitions of these nottions ppered in [3]. [Protocol Synthesis Problem] Assumptions: 1. there exists relible(errorfree), synchronous, full-duplex communiction chnnel between every two nodes.. there's no limittions on contents of messges exchnged mong nodes. 3. ll nodes hve their own clocks nd they lwys synchronize ech other. Inputs: A service speciction S. A node ssignment plce() for ech ction. An upper bound of dely d ij mx for ech chnnel from node i to j, such tht d iimx nd 8k d ij mx d ikmx + d kj mx. Here, we give the following restrictions for simplifying the derivtion. Restriction 1. S does not contin ny dedlock sttes. And S does not contin the synchronous prllel composition (rendezvous). Restriction. If S contins [> B s subexpression, must be nite process, nd there exists constnt t such tht cn execute no ction fter time t nd B cn execute ny ction only fter time t. Restriction 3. If S contins >> B s subexpression, must be nite process. Restriction 4. Every process invoction in S must not hve ny process prmeters, i.e. the behviour of ech invoked process does not depend on the previous behviour. Restriction 5. The context of ech process invoction P must be either ; P or [P (t; x)]; P, so tht just one ction precedes P. Restriction 6. For every subexpression []B of S, there exists node p such tht SP ( ) SP (B ) fpg, nd EP ( ) EP (B )[3]. Restriction 7. For every subexpression [> B of S, EP ( ) EP (B )[3]. Outputs: Protocol entity specictions Node 1, Node, : : :, Node n for ll nodes, which re correct in the following mening: Let I be the composite system which connects Node 1, Node, : : :, Node n together with communiction medium which hs chnnels from node i to j with mximum dely of d ij mx. Intuitively, fn ode i g i1;;:::;n re correct w.r.t. S when S cn strictly simulte I including timing properties, wheres I cn simulte S if time is ignored. In this cse, set of executble time of ech ction in I is nonempty subset of tht of the corresponding ction in S. Formlly, the correctness is dened s follows. Let I hide G in (sp G s in ((Node 1 jjjnode jjj : : : jjjnode n )j[g]jmedium)); where G is set of ll sending/receiving ctions of synchroniztion messges fs ij (m); r ij (m) j i; j f1; ; : : : ; ng; m Mg nd G s is set of ll sending ctions of synchroniztion messges fs ij (m)ji; j f1; ; : : : ; ng; m Mg, nd M edium is speciction of the communiction medium dened s follows: Medium jjji;jf1;;:::;ngchnnel ij Chnnel ij jjjmm (s ij(m)[x t]; r ij(m)[x t x + d ijmx ]; Chnnel ij) Note tht under the synchronous communiction medium, the sending ctions re executed s soon s possible they re enbled, becuse they re spontnous. In contrst, the receiving ctions re not spontnous, so they re not executed s soon s possible. Before dening the correctness, we need some preliminry denitions. Denition Reltions ) t,?! u, ) u re dened s follows: ( B B B ) t B def?! u B def ) u B def 8 < : ( B(?!) i?! (?!) i B ; Act [ f; g B(?!) i B ; B(?!)?! (?!) B ; Act [ f; ig B(?!) B ; B(?! i u)?! u (?! i u) B ; Act [ fg B(?! i u) B ; Denition 3 A binry reltion v t on behviour expressions is dened s mximum one of reltions R stisfying the following condition: If IRS, then for ll Act [ f; g, ll of the following conditions hold: 1. If I ) t I, then there exists some S s.t. S ) t S nd I RS.. If I ) t I, then there exists some S s.t. S ) t S nd I RS. 3. If S ) u S, then there exists some I s.t. I ) u I nd I RS. Here we dene the correctness.

5 Denition 4 We cll derived protocol speci- ction fnode i g i1;;:::;n s v t -correct w.r.t. S if the following reltion holds: hide G in (sp G s in ( (Node 1jjjNode jjj : : : jjjnode n)j[g]jmedium)) vt S 3. Synthesis Method Now we describe our method for synthesizing protocol specictions from timed service specictions. Bsiclly, we follow similr ide to our previous work[3, 8]. Thus, fter ech node executed n ction, it sends messges to the nodes which execute the succeeding ctions, informing them tht it hs nished. We refer this kind of messges s synchroniztion messges. To hndle time constrints between ctions on dierent nodes, we nturlly ssume tht synchroniztion messges my lso contin, if needed, informtion bout the time t which preceding ctions were executed. One mjor problem is tht the communiction dely my mke it impossible to execute n ction in time. In generl, ll relistic communiction medi hve propgtion dely, nd we cnnot neglect uncertinty of such dely in most cses. To overcome this problem, we propose the following method. First, for given service speciction S, we decide where to insert ctions sending or receiving synchroniztion messges to simulte S, ccording to the policy similr to [3, 8]. Then we restrict time-constrints of some ctions in S in order to gurntee the execution of succeeding ctions re possible t the worst cse of communiction dely, keeping the restriction to minimum. We represent the obtined speciction s Restr(S). Finlly, from the restricted speciction S Restr(S), we derive protocol entity specictions for ll nodes. If S nd S re equivlent[6], the derived protocol specictions re gurnteed correct w.r.t. S. In the following subsections, we describe how the simultion of the service speciction S is done, nd how we cn dene the trnsformtion Restr(), for ech construct of LOTOS/T Action Prex We cn simulte Action Prex p [P (t; x)]; B by sending synchroniztion messge from node p to ll the nodes in SP (B). If time constrints re specied by ssignment nd referrence of the vribles, nodes t which such vribles re ssigned to some vlues must propgte the vlues to the succeeding nodes. Exmple 3 Node 1 Node S 1 [x t]; b [t x + 5 ^ y t]; c 3 [t x + 7 ^ t y + 5]; exit d 1mx d 13mx d 3mx [x t]; s 1(m; x); exit r 1(m; x); b[t x + 5 ^ y t]; s 3(m ; x; y); exit Node 3 r 3(m ; x; y); c[t x + 5 ^ t y + 5]; exit Here we cn remove some redundncies in inserting synchroniztion messges when time is considered. Speciclly, if there's no executble time of succeeding ction tht is erlier thn or equl to some executble time of the preceding ction, nd there's no vlues to propgte to succeeding nodes, the synchroniztion messge t this plce is of no need to gurntee ctions' order, i.e., time implicitly gurntees the order (recll Assumption 3 in Section 3.1). For exmple, let S 1 [P (t; x)]; b [Q(t; y)]; exit nd suppose 9t; t ; x; y[p (t; x)^ Q(t ; y)^ t t] is unstisble. Then from the time constrints, is lwys executed before b, so even if we simply execute nd b t dierent plces, the order is still preserved. Therefore, we cn remove the synchroniztion messge from node 1 to node in this cse. Exmple 4 If the input is the following: S 1 [1 t 3]; b [4 t 5]; exit we will simply derive: d 1mx 4, Node 1 [1 t 3]; exit Node b[4 t 5]; exit becuse [(1 t 3) ^ (4 t 5) ^ (t t)] is unstisble. From now, we consider the cse where communiction dely ects the simultion. For ction prex p [P (t; x)]; B, we will derive speciction Restr(S) whose time constrint of p is restricted so tht there exists time to execute the succeeding ctions in B no mtter how lte the messges from the node p rech the nodes in SP (B). Becuse we describe time constrints in Presburger formuls, we cn esily restrict time constrints by logicl conjunction. Exmple 5 If the input is: S 1 [1 t 3]; b [4 t 7]; c 3 [5 t 1]; d [6 t 1]; exit d 1mx 4, d 3mx 4, d 3mx 3, we restrict the time constrint of ech ction s follows: d : 6 t 1 (unmodied) c 3 : 5 t 1^ 9t (t t + d 3mx ^ 6 t 1) ( 5 t 9) b : 4 t 7^ 9t (t t + d 3mx^ 5 t 9 ) ( 4 t 5) 1 : t 4 (unmodied (by Exmple 4)) So the derived protocol entity speciction will be the followings: Node 1 1 [1 t 3]; exit Node b [4 t 5]; s 3 (m1); r 3 (m); d [6 t 1]; exit Node 3 r 3 (m1); c 3 [5 t 9]; s 3 (m); exit

6 Now we cn dene Restr(S) formlly s follows. Denition 5 If S [Q(t; x)]; B, then Restr(S) is dened inductively s follows: Restr(S) def Restr(S; ;) Restr(S; V ) def 8 >< >: S if B exit; B stop or B P (Process invoction), [Q(t; x) ^ Q (t)]; Restr(B; V [ x) otherwise. where, if fb k [Q k (t; y k )] j k Kg is the set of strting ctions of Restr(B; V [ x) with their time constrints, 8 V kk f9t 9y k [t t + d plce();plce(b k )mx ^Q k (t >< ; y k )]g if for some k K s.t. Q(t; x)^ Q (t) def Q k (t ; y k ) ^ t t is stisble, or ny of the vribles in V [ x re >: referenced in B, true otherwise. To summrize this section, our derivtion tkes 3 steps: Step 1 determine t wht position the synchroniztion messges re needed. Step ccording to the results of Step 1 nd d ij mx, construct Restr(S). Step 3 decompose Restr(S) into ech node by the similr method to [3, 8], lredy described bove. 3.. Choice To simulte choice expressions, we must solve the problem bout distributed choice nd empty lterntives[3]. A choice expression []B is clled distributed choice if the strting ctions of nd B my be executed t dierent nodes. And we sy tht node p hs n empty lterntive w.r.t. []B if some ctions in B i my be executed t node p, wheres no ctions in B (imod)+1 re executed t node p. Distributed choice my cuse simultneous execution of the strting ctions of both nd B. Empty lterntives on node p my cuse unconditionl execution of B i even if B (imod)+1 is chosen. As for distributed choice, we void it by putting the sme restriction (Restriction 6) s [3]. We hve proposed method for solving the empty lterntive problem for the untimed cse in [3]. But, here, we will use slightly modied method. Unlike [3], the node where choice ws mde should immeditely sends messges to the nodes tht hve empty lterntives in order not to violte time constrints of succeeding processes. Moreover, to mke sure ech B i would not terminte before the messges sent to the nodes which hs empty lterntives rech the destintions, the ending nodes of the chosen expression will receive cknowledgments from the nodes with empty lterntives before executing the ending ctions (note tht if the strting ction of B i coincides the ending ction of it, i.e., the mximum length of B i 's ction sequences is 1, this simultion method my not be pplicble). Furthermore, to simulte choice expression []B in the bove wy successfully, we must not remove redundnt synchroniztion messges in both nd B, discussed in Section 3..1 (Exmple 4), otherwise the intermedite ctions of ech B i my be executed independently, no mtter which lterntive is chosen. To mke it possible to simulte choice in the wy bove, we must gurntee tht ll the messges rech the destintions in time by restricting the time constrints of some ctions. For choice expression []B, if the messges sent from the node choice ws mde wouldn't hve reched the destintions, or the cknowledgments wouldn't return, before the chosen behviour B i hve been done, extr time would be spent witing for the messges. So we will restrict the time constrints of the strting ctions of nd B so tht the messges cn rech in time. Exmple 6 Consider the following input: S 1 [ t 5 ^ x t]; b [t x + 3]; c 3 [t x + 6]; exit []d 1 [3 t 9]; e 3 [t 1]; exit d 1mx, d 3mx 4, d 13mx 3 We must restrict the time constrint of d 1 in order to mke the messge from node 1 to nd the cknowledgment from node to 3 rech by time 1. Restr(S) 1 [ t 5 ^ x t]; b [t x + ]; c 3 [t x + 6]; exit []d 1 [3 t 4]; e 3 [t 1]; exit Then, the speciction of ech node will be derived s follows: Node 1 Node Node 3 1 [ t 5 ^ x t]; s 1(m1; x); s 13(m3; x); exit []d[3 t 4]; (s 13(m); exitjjjs 1(m4); exit) r 1(m1; x); b [t x + ]; s 3(m5); exit []r 1(m4); s 3(m4); exit r 13(m3; x); r 3(m4); c 3 [t x + 6]; exit [](r 13(m)jjjr 3(m4)) >> e 3 [t 1]; exit For dening Restr(S), we need the uxiliry function Restr (S), which is the sme s Restr(S) except tht no removl of redundnt messges is considered. The forml denition of Restr (S) ppers in [1]. Now we cn dene Restr(S) s follows: Denition 6 If S []B, then Restr(S) is de- ned inductively s follows: Restr(S) def Restr (f( ))[]Restr (f(b )) where, we ssume tht fb k [Q k (t; y k )] j k Kg is the set of the strting ctions of B i with their time constrints, nd tht f(b i ) is n expression B i whose time constrint of ech strting ction Q k (t; y k ) is replced

7 with Q k (t; y k ) ^ R (t). Here k R k (t) is Presburger formul dened ^ s follows. Rk(t) def f9t 9z l [t t + d pqmx + d qrmx ^ R l (t ; z l )]g q AP (B i) n AP (B (imod)+1 ) l L; r EP (B i) where fr l (t; z l )jl Lg denotes the time constrints of EP (B i ) nd SP (B i ) fpg Asynchronous Prllel For ny synchronous prllel expression jjjb, nd B re executed independently. So ny synchroniztion messges re necessry between nd B. Thus, Restr(S) is dened s follows: Denition 7 If S jjjb, then Restr(S) def Restr( ) jjj Restr(B ) 3..4 Enbling For enbling expression >> B, we cn pply essentilly the sme ide s ction prex. Due to the lck of spce, we omit the detils bout Restr() trnsformtion for the enbling expressions. The detils cn be found in [1] Disbling For ech disbling expression [> B, we mke strong restriction, Restriction, for simplicity. Tht is, for some t, ll ctions in re not executble fter time t, nd ll ctions in B re executble only fter time t. From Restriction, there is no cses tht ctions in nd B re simultneously enbled t dierent nodes. So [> B cn be simulted by inserting messges to notify successful termintion of to ll nodes. To mke this simultion method work,the messges notifying 's termintion hve to rech before t. Exmple 7 The input described below stises Restriction (t 11) nd Restriction 7: S 1 [1 t 4]; b [3 t 8]; c 3 [7 t 1]; exit [> d 3 [1 t]; exit d 1mx 3, d 3mx 4, d 31mx 3, d 3mx 4, d ij mx for other i,j. In order to gurntee tht the notiction of successful termintion sent from node 3 to nodes 1 nd cn rech before time t 11, the time constrint of c 3 must be restricted to 7 t 7, becuse the notiction from node 3 to node my tke d 3mx 4 units of time. Then, the restriction discussed in the previous section is pplied for b nd 1. Restr(S) 1 [1 t 1]; b [3 t 4]; c 3 [7 t 7]; exit[> d 3 [1 t]; exit From this, the protocol entity speciction of ech node will be derived s below: Node 1 1 [1 t 1]; r 31 (m1); exit[> i[t 1]; exit Node b [3 t 4]; r 3 (m1); exit[> i[t 1]; exit Node 3 c 3 [7 t 7]; (s 31 (m1)jjjs 3 (m1)) >> exit [> d 3 [1 t]; exit The denition of Restr(S) is s follows: Denition 8 If S [> B, Restr(S) def Restr(g ( ))[> Restr(B ); where g ( ) represents trnsformtion replcing the time constrint P (t; x) of ech ending ction of with P (t; x) ^ P (t). Here P (t) def ^ ft + d pq mx t g: pep ();qall 3..6 Process Invoction In our speciction lnguge, time is reset to t every moment processes re invoked, voiding ccumultion of time constrints. To simulte this in distributed environments, we mke ll nodes to pretend s if they invoke process simultneously. In order to do so, 1. Fix one node for responsible node, which decides the time to invoke process (the time just before invoking process). In this pper, from Restriction 5, the context of ech process invoction must be the form of ; B or [P (t; x)]; B. So we x the node plce() s the responsible node w.r.t. the process P.. The responsible node noties the invoction time of the process to ll nodes, nd immeditely invokes the process loclly. 3. The other nodes except the responsible node receive the notiction, nd invoke the process whose time constrints re modied to mke the invoction time be virtully equl to tht of the responsible node. Recll tht the ctul locl time is reset to just fter the process invoction of ech node. To implement 3., we modify ech process P without prmeters in service specictions to P (e P ) with just one prmeter e P in protocol specictions (Restriction 4), nd replce every occurrence of t in the right hnd of the process denition of P with t + e P. The prmeter e P represents the dierence between the ctul invoction time nd virtul invoction time. For exmple, P (3) mens the process P with replcing its time constrint, for instnce, t 5, with t Corresponding to ech process invoction of P in the service speciction, we derive protocol speciction such tht (1.)the responsible node sends the current time t P to every other node just before invoking P (), nd (.)the other nodes invoke P (t? t P ) fter receiving t P from the responsible node. The time t? t P corresponds to the ctul communiction dely from the responsible node. Note tht the process P my be clled by nother process Q. In such cse, the vrible t in P (t? t P ) should be djusted to represent the virtul time t which Q hd been invoked. So it should be modied to P (t + e Q? e P ) if this process invoction occurs in the right hnd of the denition of process Q, where

8 t + e Q represents the virtul invoction time of Q. Exmple 8 P : 1 [ t 4 ^ x t]; b [t x + 5]; P []c 1 [5 t]; exit d 1mx 4, d 1mx 3 Node 1 P (e P ) : 1 [ t + e P 4 ^ x t + e P ^ 9t (t t + e P + d 1mx ^ t x + 5)]; s 1 (m1; x); r 1 (m3; t P ); P (t + e P? t P ) >> s (m4); exit[]c 1 [5 t + e P ]; exit Node P (e P ) : r 1 (m1; x); b [t + e P x + 5]; s 1 (m; x); s 1 (m3; t + e P ); P () []r 1 (m4); exit To mke this simultion possible, we check whether the strting ction of ech process cnnot be lte if the notiction from the responsible node would rech in mximum dely. For consistency, we include this checking into Restr(). If the checking is flse, the time constrint of the strting ction becomes \flse." Denition 9 If S P where P : B, Restr(S) is dened inductively s follows: Restr(S) def P where P : h(restr(b)) where h(restr(b)) is n expression obtined by replcing the time constrint Q k (t; x k ) of ech strting ction k of Restr(B) with Q k (t; x k ) ^ Q. Here k Q k is Presburger formul dened s follows : Q def ^ k f9t 9x k [t +d p;plce( k )mx ^ Q(t ; x k )]g p1;:::;n 3.3 Synthesis Algorithm The synthesis lgorithm consists of two prts: 1. For given service speciction S, n ssignment of ech ction to node, nd mximum dely d ij mx for ech pir of nodes, construct S Restr(S).. If S u S, i.e., S nd S re bisimultion equivlent when time is ignored[6], derive protocol entity speciction N ode i of ech node i from S. Otherwise, do not derive nd hlt. In [1], we hve dened trnsformtion T p (B) which derives protocol entity speciction of node p from service speciction described by the behviour expression B. Although we omit the precise denition of T p (B) in this pper becuse of the spce limittion, we summrize our result by the following theorem: Theorem 1 For given service speciction S, let S Restr(S). If S u S, the protocol speciction ft i (S )g i1;;:::;n is v t -correct w.r.t. the service speciction S. 4 Concluding Remrks In this pper, we hve proposed method to synthesize protocol specictions from timed service specictions written in LOTOS/T+. The proposed method enbles us to synthesize protocol specictions from both timed nd structured service speci- ctions. In contrst to [5], our method restricts the time constrints of service specictions, not of the communiction medi, becuse the dely of the medi depends on the physicl lines, so it is more dicult to chnge them thn those of the specictions. Moreover, our correctness criterion gurntees tht the control structure of the derived protocol speciction is full, not prtil, implementtion of tht of the service speciction. Using the sme timing extension s ours, our result should esily pply to other process models such s CCS. The future work is to extend the clss of service specictions nd to estblish frmework for evluting performnce spects of the derived protocol entity specictions. References [1] R. L. Probert nd K. Sleh, \Synthesis of communiction protocols: Survey nd ssessment," IEEE Trns. Comput., vol. 4, pp. 468{475, [] P. M. Chu nd M. T. Liu, \Protocol synthesis in stte trnsition model," in Proc. IEEE COMPSAC '88, pp. 55{51, [3] C. Knt, T. Higshino, nd G. v. Bochmnn, \Deriving protocol specictions from service specictions written in LOTOS," in Proc. of 1th Annul Int'l Phoenix Conf. on Computers nd Communictions (IPCCC'93), pp. 31{318, IEEE, [4] H. Ymguchi, K. Okno, T. Higshino, nd K. Tniguchi, \Synthesis of protocol entities' specictions from service specictions in Petri net model with registers," in Proc. of 15th IEEE Int'l Conf. on Distributed Computing Systems, pp.51{517, [5] A. Khoumsi, G. v. Bochmnn, nd R. Dssouli, \On specifying services nd synthesizing protocols for reltime pplictions," in Protocol Speciction, Testing nd Veriction, XIV, pp. 185{, IFIP, Chpmn & Hll, [6] A. Nkt, T. Higshino, nd K. Tniguchi, \LOTOS enhncement to specify time constrints mong nondjcent ctions using rst order logic," in Forml Description Techniques, VI (FORTE'93), pp. 451{466, IFIP, North-Hollnd, [7] ISO, LOTOS { A Forml Description Technique Bsed on the Temporl Ordering of Observtionl Behviour. IS 887, [8] K. Ysumoto, T. Higshino, nd K. Tniguchi, \Softwre process description using LOTOS nd its enction," in Proc. of 16th IEEE Int'l Conf. on Softwre Engineering (ICSE-16), pp. 169{179, [9] J. E. Hopcroft nd J. D. Ullmn, Introduction to Automt Theory, Lnguges nd Computtion. Addison-Wesley, [1] A. Nkt, T. Higshino, nd K. Tniguchi, \Synthesis of protocol entity specictions from timed nd structured service specictions," I.C.S. Reserch Report 95-ICS-5, Dept. of Informtion nd Computer Sciences, Osk University, 1995.