Transcription

1 3Dept.ofComputerScience,U.ofYork,Heslington,York,YO15DD,UK SpecicationandVericationofMedia 1ComputingLab.,U.ofKent,Canterbury,Kent,CT27NF,UK HowardBowman1,GiorgioP.Faconti2andMiekeMassink3 2CNR-IstitutoCNUCE,ViaS.Maria36,56126-Pisa-Italy ConstraintsusingUPPAAL? 1Introduction usedisthereal-timemodelcheckeruppaal. timediastream.thestreamisdescribedinatimedautomatanotation. Weverifythatthestreamsatisescertainqualityofserviceproperties, inparticular,throughputandend-to-endlatency.thevericationtool Abstract.Wepresenttheformalspecicationandvericationofamul- Theacceptanceandutilityofabroadrangeofapplicationsystemsissubstantiallyaectedbytheirabilitytopresentinformationinaneectiveandappealing informationneedswillvaryfromusertouserandfromsituationtosituation. tionproblem.furthermore,inthevastmajorityofnon-trivialapplicationsthe telligiblepresentationsperse.appropriatedesigndecisionsmustbedrawnthat leadtoanegraincoordinationofcommunicationmediaandmodalities.this mayevenbecomeaharderandmorecomplextaskthansolvingtheapplica- waytohumanusers.rapidprogressinthedevelopmentofmultimediatechnologypromisesmoreecientformsofman/machinecommunication.however,the useofmultimediaforconveyinginformationdoesnotguaranteeeectiveandin- Consequently,amultimediasystemshouldbeabletoexiblygeneratevarious ualrequirementsofusersandsituations,resourcelimitationsofthecomputing comprehensionofaparticulardesignspaceeitherbycontributingcomplementaryinformationorbyprovidingcriteriaaddressingequivalentrequirements.in reasoninganddecisions.dierentkindsofanalysiscontributetoaugmentthe thosecontributionsneedtoberelatedtooneanothertohelpsupportdesign system,andsoforth. addition,somedesignissuesmayberaisedbyoneparticularkindofanalysis manycomponentscontributingtothedesignofaninteractivesystem.otherdisciplinesprovidecomplementaryviewsandperspectivesondesignproblemsand Inthisrespect,technologybasedtechniquesandmodelsarejustoneoutof presentationsforoneandthesameinformationcontentinordertomeetindivid-?therstauthoriscurrentlyonleaveatcnuceunderthesupportoftheeuropean ResearchConsortiumforInformaticsandMathematics(ERCIM).

2 anotherdiscipline. fromadiscipline,butonlysolvedifanotherkindofanalysisisappliedfrom theliteratureofbothsoftwareengineeringandhuman/computerinteraction.althoughsignicantconceptualprogresshasbeenmadeinbothofthesedirections, theirgeneralapplicationrequiresustounderstandhowthebasicapproachescan nologybutrequirethatsystemdesignersbeinformedbothofwhyrequirements requirementscannotbeboundedinastraightforwardmannertoaspecictech- cognitivepsychology.withthecurrentstateoftheartinsystemdesign,these alizingmoreanalyticapproachesintothepracticalitiesofdesignexistalreadyin havebeenformulatedandhowtheycanpossiblybesatised.techniquesfor representingdesigndecisions,andframeworksforcommunicatingandcontextu- disciplinesdistantfromtechnologyandcomputersciencesuchassemioticsand Insuchascenario,manysystemrequirementsaregeneratedandderivedfrom actuallybeusedinpracticalsettings;thisremainsanopenissue. formultimediaobjects[11].examplesofapplicationsthatcanbedescribedare ispresented,integratingsystemconcernswiththenecessaryrepresentationof thatarelocatedintheabstractmodel,suchasthepresentationenvironment modeling.themodelisabstractsinceitidentiesthebasiccomponentsofapresentationsystemandrelatesthem.thedetailsareaddressedbyspecicmodels thecontextualizedknowledgeaboutdomainproblem,designprocess,anduser MediaPresentationSystems.Thisclassofsystemshasbeencharacterizedin [5]whereaReferenceModelforIntelligentMulti-MediaPresentationSystems Here,werefertoaparticularclassofinteractivesystems,namelyMultiindirectinteractionwiththemediaobjectstinguishingfeaturesbeingthecontinuityoftheinvolvedmedia,andthekindof teleconferencesandautomaticgenerationofmultimediahelpsystems,theirdis- underlyingtechnologyanditisdiculttopredictthedemandofcomputational resourcesrequiredtoachievethequalityofservicesetbytheend-user. tersreectperceivablepropertiesofthemediaobjectswithnodirectlinktothe sliderseachdealingwithaspecicparameter.theissueisthatsomeparame- algorithms,allocationofband)andtheglobalqualityofservice.in[2],forexample,itissuggestedthataudio/videoqualityofservicebecontrolledbyseparate themechanismsinuencingtheirpresentation(i.e.compression/decompression tionofthemediaobjectsthemselves(i.e.thevideocontent);rather,itaddresses Interactioninthesesystemsisindirectsinceitdoesn'tconcernthemanipula- ofasinglemediastreamsinceitdemandsintra?streamsynchronization,i.e. therelationshipbetweenmediaobjectswithinthesamedatastreamthusadding synchronization.however,continuityplaysalsoanimportantroleinthecontext timeconstraints,distinguishingtheseapplicationsfromtraditionalprotocols. mustsatisfyinter?mediasynchronizationconstraintsasinthecaseofthelip- Usualtechniquessuchasretransmissionofdataincaseoffaultsorlossesareno longerapplicableandthevericationofsystemthroughputandlatencyagainst thetimeconstraintsbecomesamust.asanexample,video/audiostreams Continuityreferstomediastreamsconveyingdigitalobjectswithassociated tothroughputandlatencyafurtherconstraintonjitter.

3 ofservicethatcanbeoeredbythemediumoverwhichtheinformationis thosesystemsistoimplementnewideasdirectlyinaprototypeandtomeasure theperformance.thisapproachisnotalwayssatisfactory.thecomplexityofthe transported.specicationandvericationofreal-timeaspectsof(multi)media systems.thequalityandtheusabilityofthosesystemsiscruciallydependent systemsishoweveradicultproblem.themostcommonapproachtobuilding tweenthequalityofthepresentationofmultimodalinformationandthequality ontheirperformancewithrespecttotimeliness.oftenthereisatrade-obe- Consequently,timingplaysanimportantroleinmultimediapresentation behaviourofthedistributedalgorithmsisoftenconsiderableandtheircorrectnessisdiculttoestimatebymeretesting.furthermore,itisoftenveryhard Thishasbeenillustratedforexamplein[10]whereanAudio/Videoprotocolhas beenanalyzedthathadbeendevelopedinanindustrialsetting. tondthecausesofrareerrorsandtoimprovetheimplementationaccordingly. issuesforthesingledatastreamcase.thisallowsustosetupabasicframework forfurtherworkonmulti-(inter-)mediasynchronizationwhileenablingtheinvestigationofthecapabilitiesandthepracticaluseofformalnotationsandtheir associatedtoolswithsmallsizeexperiments. Inthispaper,werestrictouranalysistotheinvestigationofanumberof 2ASimpleMediaStream Themostbasicrequirementforsupportingmultimediaistobeabletodene constraintmodelingusingsuchamultimediastream. Inthispaper,wewilldiscussandillustrateanumberofaspectsrelatedtomedia continuousowsofdata;suchstructuresaretypicallycalledmediastreams[4]. sinkinandplay,whichrespectivelytransferpacketsfromthesourcetothe Medium,fromtheMediumtotheSinkanddisplaythemattheSink. fromnowonsimplyrefertoasthemedium).thescenarioisthatthesource processgeneratesacontinuoussequenceofpackets1whicharerelayedbythe components:asource,asinkandacommunicationmedium(whichwewill MediumtoaSinkprocesswhichdisplaysthepackets.Threebasicinter-process communicationactionssupporttheowofdata(seegure1again),sourceout, Thebasicmediastreamisasdepictedingure1.Ithasthreetoplevel Howevertoourknowledge,noformalvericationshavebeenperformed.Thisis onecontributionofthispaper. similartothelotos/qtlspecicationthatappearsin[4]. Formaldescriptionsofmediastreamshavebeengivenbefore,e.g.[4]etc. 1Thesecouldbevideoframes,soundsamplesoranyotheriteminacontinuousmedia {TheMediumisunreliable;itmaylooseandreorderpackets. {AllcommunicationbetweentheSourceandtheSinkisasynchronous. tiationofdataparameterswillspecializethescenario. transmission.inthiswaythescenarioremainscompletelygeneric.however,instan- Thefollowinginformaldescriptionofthebehaviourofthestreamiskept

4 Fig.1.AMultimediaStream Process Process play sourceout sinkin tainqualityofserviceproperties.conceptually,thesepropertiescanbeviewed Thenwefocusonourmainobjective:tocheckthatthissystemsatisescer- {TheSourcetransmitsapacketevery50ms(i.e.20packetspersecond). {PacketsthatdonotgetlostarriveattheSinkbetween80msand90ms {WhenevertheSinkreceivesapacket,itneeds5mstoprocessit,afterwhich Insection4,wewillpresentanUPPAALdescriptionofthisbasicbehaviour. aftertheirtransmission.thisisthelatencyofthemedium. itisreadytoreceivethenextpacket. propertiesthatwewishtoverifyare: asbeingderivedfromuserpresentationrequirements.thequalityofservice 1.Throughput.WewouldliketoensurethattheSinkprocessreceivespacketsattherateofbetween: 2.Latency.Wewillcheckthefollowinglatencyproperty: Clearly,thereisadirectlinkbetweentherateoflossoftheMediumand thethroughputatthesink.thus,theavourofourinvestigationofthis Wewillalsobuildintothesystemthepossibilitythatitcangointoanerror propertywillbetodeterminewhataretheboundsontherateatwhichthe stateandhalt,ifthethroughputpropertyisinvalidated. Mediumloosesmessagesinordertosatisfythisthroughputproperty. 15and20packetspersecond. 3.Jitter.Jitterisdenedasthevarianceofdelay.Itensuresthatthereisnot anunacceptablevariabilityaroundtheoptimumpresentationtime,e.g.if onepacketispresentedquiteearlyandthenextispresentedrelativelylate anunacceptablestutterinthepresentationwillresult.afullanalysisofjitter wouldrequirestochastictechniques[9]tobeemployed.thisisclearlynot whichputsanupperboundontheend-to-endtransmissiondelay. Theend-to-enddelaybetweenasourceoutactionanditscorrespondingsinkinactioncannotbemorethan95ms.

5 possiblewiththevericationtechnologywehaveavailabletous.however, timesystems.ithasbeendevelopedatbricsindenmarkandatuppsala UPPAALisatool-suiteforthespecicationandautomaticvericationofreal- 3IntroductiontoUPPAAL boundonjitter.apartfromnotingthatwecouldextendourlatencyanalysis todothis,wedonotconsiderthepropertyanyfurtherinthispaper. placingbothanupperandlowerboundonthelatencywouldimposeacrude specicationcanbeusedbythegraphicalsimulator`simta'orbeautomatically thetoolautographortextuallybymeansofanormaltexteditor.thegraphical Thebehaviourofanetworkofautomatacanbeanalyzedbymeansofthesimulatorandreachabilitypropertiescanbecheckedbymeansofthemodelchecker. ofextendedtimedautomatawithglobalreal-valuedclocksandintegervariables. UniversityinSweden.InUPPAALareal-timesystemismodeledasanetwork togetherwithalewithrequirementstobecheckedonthemodel.there- thatshowsapossibleviolationoftheproperty.thistracecanbefedbacktothe propertyissatisedornot.itthepropertyisnotsatisedatraceisprovided quirementsareformulasinasimpletemporallogiclanguagethatallowsforthe formulationofreachabilityproperties.themodelcheckerindicateswhethera InUPPAAL,automatacanbespeciedintwoways.Graphicallybyusing translatedintotextualformandusedasinputforthemodelchecker`verifyta' ofthecongurationofthenetwork.inthecongurationtheglobalreal-time labeled.anetworkofautomataconsistsofanumberofautomataandadenition nodes,whicharecalledlocations,andtheedges,whicharecalledtransitions,are 3.1TheUPPAALmodel UPPAALautomataconsistofnodesandedgesbetweenthenodes.Boththe simulatorsothatitcanbeanalyzedwiththehelpofthegraphicalpresentation. clocks,theintegervariables,thecommunicationchannelsandthecomposition ofthenetworkaredened. {aguardonclocksanddatavariablesexpressingunderwhichconditionthe {asynchronizationorinternalactionthatisperformedwhenthetransition Thelabelsonedgesarecomposedofthreeoptionalcomponents: withacomplementaryactioninanotherautomatonisenforcedfollowing istaken.incasetheactionisasynchronizationactionthensynchronization transitioncanbeperformed.absenceofaguardisinterpretedastheconditiontrue. {anumberofclockresetsandassignmentstointegervariables asaninternalactionsimilarto-actionsinccs. ceivingonthechannela.absenceofasynchronizationactionisinterpreted a?denotecomplementaryactionscorrespondingtosendingrespectivelyre- similarsynchronizationrulesasinccs[14].givenchannelnamea,a!and

6 Thelabeloflocationsconsistsalsoofthreeparts: {thenameofthelocationwhichisobligatory. Intheconguration,thefollowingaspectsofthenetworkaredened: {anoptionalmarkingofthelocationbyputtingc:infrontofitsnameindicatingthelocationascommitted.thisoptionisusefultomodelatomicity {aninvariantexpressingconstraintsonclockvalues,indicatingtheperiod duringwhichcontrolcanremaininthatparticularlocation. {thechannelnamesthatarethenamesoftheactions.channelscanbedened {declarationsofglobalclockandintegervariables transitionmustbeperformed(ifany)withoutanydelayorinterleavingof otheractions. oftransition-sequences.whencontrolisinacommittedlocationthenext asnormalcommunicationchannelsorurgentchannels.whenachannelis thatchannelandnoinvariantcanbedenedonthelocationfromwhich urgentnotimingconstraintscanbedenedonthetransitionlabeledby thecurrentvalueforeachclockandintegervariable.allclocksproceedatthe thattransitionleaves.urgentactionshavetohappenassoonaspossible, samespeed.therearethreetypesoftransitionsinanuppaalmodel: controllocationforeachcomponentofthenetwork.thevalueassignmentgives controlvectorandvavalueassignment.thecontrolvectorindicatesthecurrent {thelistofnamesofautomatathesystemiscomposedof. Formally,thestatesofanUPPAALmodelareoftheform(l;v),wherelisa i.e.withoutdelay,butinterleavingofotheractionsisallowedifthisdoesnot causedelays. DelayAdelaytransitioncanoccurwhennourgenttransitionsareenabled, InternaltransitionsSuchtransitionscanoccurwhenanautomatoninthe SynchronizationAsynchronizationtransitioncanoccurwhentherearetwo networkisatalocationinwhichitcanperformaninternalaction.the guardofthattransitionhastobesatisedandtheremustbenoother betweens1ands2canonlybetakenwhenthevalueofclockyisgreaterthan AnexampleofanUPPAALspecicationisgiveninFigure2.Thetransition transitionsenabledthatstartfromacommittedlocation. isallowedbytheinvariantsofthecurrentcontrollocations. noneofthecurrentcontrollocationsisacommittedlocationandthedelay automatawhichareinlocationsthatcanperformcomplementaryactions. orequalto3.thisholdsalsoforthetransitionbetweenr1andr2becausethe Theguardsofbothtransitionsmustbesatisedandtheremustbenoother automataaandbaresynchronizedonchannela.thetransitionmusthappen beforeyisequalto6becauseoftheinvariantatlocations1.ifthisinvariant wouldnotbetherecontrolcouldhaveremainedins1andinr1indenitely.

7 A Config y >= 3 b? a! clock x, y; y := 0 int n; n == 3 chan a; chronizationonactionb.thisisbecausebhasbeendeclaredasanurgentchannel urgent chan b; s1 s2 s3 s4 system A, B; (y <= 6) y 4 ingthetransitionbetweens2ands3inabothtransitionsbetweenthosetwo intheconguration.notethatiftheguardy>=4wouldnothavebeenlabel- locationswouldhavebeenenabled!thisisbecauseurgencyonlypreventsthe Fig.2.ExampleofanUPPAALspecication B x 2 a? n := 3 b! tionr2canbeannotatedasacommittedlocation.thisforcestheactionbto x := 0 n := n + 1 happenwithoutdelayorinterferenceofotheractions. enabledatthesametime.topreventinterleavingactionsinthiscasetheloca- passingoftime,butdoesnotpreventtheoccurrenceofotheractionsthatare Whencontrolisins2andr2theonlytransitionthatispossibleisthesyn- r1 c:r3 r4 dierentclockvalueshaverunsstartingfromlthatare\verysimilar".alurand Dilldescribedexactlyhowtoderivethesetsofclockvaluesforwhichthemodel vationmadebyaluranddillwasthatstateswiththesamelbutwithslightly shows\similar"behaviour[1].thesetsofclockvaluesarecalledtimeregions. state,i.e.thecontrolvectorl,andthevalueofallitsclocksanddatavariables. Clearlythisleadstoamodelwithinnitelymanystates.Theinterestingobser- Thefuturebehaviourofanetworkoftimedautomataisfullydeterminedbyits 3.2SimulationandModelChecking Regionscanbederivedfromtheguards,theinvariantsandthereset-setsinthe UPPAALmodel.Sinceclockvariablesintheconstraintsarealwayscompared oftheseconstraintsetsforsimulationandmodelcheckingcanbefoundin[15]. withintegersandbecauseineverymodelthereisamaximumintegerwithwhich areconjunctionsofatomicclockanddataconstraints.detailsonthecalculation aclockiscomparedthestatespaceofamodelcanbepartitionedintonitely manyregions.thismakesmodelcheckingfordensetimedecidable. InUPPAALtheregionsarecharacterizedbysimpleconstraintsystemswhich

8 properties.theyareformulasofthefollowingform: Thepropertiesthatcanbeanalyzedbythemodelcheckerarereachability ande<>,where,informally,a[]requiresallreachablestatestosatisfyand E<>requiresatleastonereachablestatetosatisfy. lalocationofaiorvinwhereviisavariable,nanaturalnumberand whereaisanatomicformulaoftheform:ai:lwhereaiisanautomatonand arelationinf<;<=;>;>=;==g.thebasictemporallogicoperatorsare,a[] ::=aj1and2j1or2j1implies2jnot ::=A[]jE<> formedinuppaalrangingfromsmallexamplestorealindustrialcasestudies, e.g.[3,7,12]. inglanguagethatisascloseaspossibletoahigh-levelreal-timeprogramming languagewithvariousdatatypesthe,currentversionisratherrestrictive.for exampleitdoesnotallowassignmentofvariablestoothervariablesandthereis novalue-passinginthecommunication. Despitetheserestrictions,quiteanumberofcase-studieshavebeenper- AlthoughthenalaimofthedevelopersofUPPAAListodevelopamodel- 4StreamexampleformalizedinUPPAAL 4.1Thebasicmodel guardt1==50enablesthesendingofsourceoutatexactly50msafterthelast sentevery50ms.tomakethismorepreciseweassumethattherstpacketis sentattimeequal0andalllaterpacketsexactly50msoneaftertheother.this Considerthestreamexampleintroducedinsection2.Thesimplestpartofthe one.theinvariantatenforcesthattheenabledtransitionreallyhappens location(indicatedbyadoublecircle)isannotatedascommittedtoenforcethat therstpacket(sourceout!)issentimmediately.toassurethateveryfollowing packetissentexactly50msafterthepreviousone,aclockt1isintroduced.the exampleisthesource.intheinformalspecicationitissaidthatapacketis att1==50.whenthetransitionisperformedt1isresetandthebehaviour behaviourismodeledasanuppaalautomatonwithtwolocations.theinitial repeatsitself. itmaylooseandreorderpackets.atrstsightweshouldmodelthemedium packet.wheneveritreceivesapacketitplaysitimmediatelyduringthenext thatitactsasaninnitebuer,ithasalatencyofbetween80msand90ms, 5ms.Thisbehaviourismodeledbyanotherautomatonwithtwolocations.In theinitiallocationtheautomatonwaitsforapacketfromthemedium.whenit arrivesatimert2issetthatisusedtomodelthe5msdelaycausedbyplaying ofthepacketbeforecontrolreturnstotheinitiallocation. TheSinkisrequiredtoalwaysacceptapacket,exceptwhenitisplayinga Thethirdparttomodelisthemedium.Whatisknownofthemediumis

9 asaninnitestructure.however,ifweareonlyinterestedinthethroughputof andatmost90ms. medium.thesinkinactionfollowingthesourceoutisdelayedbyatleast80ms fromthesource.atthatpointatimerisstartedtomodelthelatencyofthe thatwemodelthemediuminsuchawaythatitalwaysallowsthesourceto performthenextsourceout.wewillshowthatthemediumcanbemodeledby themedium,theorderinwhichpacketsarriveisirrelevant.whatisrelevantis locations(seefigure3).attheinitiallocationthebuercanreceiveasourceout twoindependentone-place-buers.werstmodelthemediumassumingthat itdoesnotloosepackets.eachbuerismodeledasanautomatonwithtwo Source Place1 Place2 buers,weshouldprovethatitisneverthecasethatwhenthesourcewishes theyareinlocation.inuppaalthissituationcanbeformalizedas: toperformasourceout,i.e.whent1==50,bothone-place-buersarefull,i.e. Tobesurethatitwascorrecttomodelthemediumbyonlytwoone-place- E<>(t1==50andPlace1:andPlace2:) Fig.3.UPPAALspecicationofmediastream belessthan45mstherearegoingtobeproblems.inourmodelwecaneasily constraintsusedinthemodel.ifthetimebetweenpacketsatthesourcewould toguaranteethatthesourcecanalwayssenditspacketdependsonthetime whichusingtheuppaalmodelcheckercanbeshownnottohold. ItisimportanttonotehoweverthattheminimalnumberofPlacesneeded Config c:state0 sourceout! t1 == 50 sourceout! t1 := 0 (t1 <= 50) clock t1, t2, t3, t4; int l; chan sourceout, sinkin, play; system Source, Sink, Place1, Place2; sinkin! t4 > 80 sourceout? t4 := 0 (t4 <= 90) sinkin! t3 > 80 sinkin? t2 := 0 play t2 == 5 sourceout? t3 := 0 (t3 <= 90) (t2 <= 5) Sink

10 timebetweenpacketssentbythesourcethen: latency.letpbethenumberofplaces,mthemaximallatencyanddtheinterval ofplacesneededasafunctionofthetimebetweenthepacketsandthemaximal exampleitisnotdiculttondageneralformulathatgivestheminimalnumber verifythisbymeansofthereachabilitypropertyweformulatedbefore.inthis retransmissionprotocol[7]. modelcheckingcanbefoundinthedescriptionofacasestudyonabounded Ingeneralhowever,timedependentbehaviourcanbeveryhardtopredictand holdbetweenparametersofthesystem.aninterestingillustrationofthisuseof amodelcheckercanbehelpfultogetagoodintuitionabouttherelationsthat p=dm=de(+) 4.2Modelingamediumwithlosses Inthissectionwerelaxtheassumptionthatthemediumdoesnotloosepackets. Weassumethatthelossesarelimitedtonotmorethan4packetspersecond. thenextsection). andweneedtoadapttheautomatamodelingtheplaces.wemodeltheloss containsmoreadditionsthanjustthenewmedium;thesewillbeexplainedin thenumberoflosses.thetransitionisguardedbyaconstraintonthemaximal numberoflosses.figure4showsthenewmedium(infact,thisspecication automatathatmodeltheplaces.furtherweaddaglobalvariablelthatrecords ofapacketbyanadditionalinternaltransitionfromtointhe TomodelthisweneedaMonitorthatkeepstrackofthepassingseconds 5VerifyingQualityofServicewithUPPAAL whenitisbelowthethresholdof15packetspersecondanerrorissignaled. 5.1Throughput Letusassumethatthethroughputofthemediumischeckedeverysecondand earlierinthispapercanbeveriedusinguppaal. Inthissectionweinvestigatehowthequalityofservicepropertiesidentied i.e.ifx<15,thisisbecausethepossibilityoftoomanyframesarriving,i.e. forthemonitorandthesinkareshown. generated.assoonasthesinkreachesstateitwillsynchronizeonthe thetimerstartsagain.ifthethroughputistoolowanurgentactionerroris erroractionandthemediastreamwillbestopped.infigure4theautomata xwhichisupdatedeverytimeasinkinactionoccurs.themonitorchecks thevariablexeverysecond.ifthethroughputissucientthenxisresetand TheMonitorthatwepresentonlyforcesanerroriftoofewframesarrive, ThenumberofpacketsthatarriveattheSinkiscountedbyaglobalvariable

11 catersforthissituation. necessarywecouldeasilyaddanextrabranchinthetransitionsystemwhich x>20,cannotarisebecauseoftheparametersofthesystem.however,ifitwas rateoflossinthemedium.usinguppaalwecanshowthatiftheconstraint hold.assuggestedearlier,theobviousparameterthataectsthroughputisthe ourspecicationsatisestheformula: ourthroughputproperty.specically,wecancheckunderwhatcircumstances Satisfactionofthisformulaimpliesthatourthroughputrequirementdoesnot Inaddition,wecanuseUPPAALtodeterminetheparametersthatbound l<4isassociatedwiththelossactioninthemedium,asitisingure4,then thestopstatecanbereached,anduppaalprovidesasampletrace.however, ifwechangetheconstrainttol<3thenthestopstatecannotbereached.thus, thisgivesusaclearboundonthenumberoferrorsthatanacceptablemedium E<>(Sink:Stop) shouldallow. hastwooutgoingtransitions,errorandsinkin,ifisreachedatatime atarateofaframeevery50msthenthissituationcannotarise(interestingly,if itwastransmittingattherateofaframeevery53msthesituationcouldindeed pointinwhichbothtransitionsareenabledtheneventhougherrorisanurgent ananalysiscanbemadethatshowsthataslongasthesourceistransmitting action,eithertransitionmaybetaken.thiswouldclearlybeundesirableasone wouldlikethesystemtostopassoonasitisinerror.however,usinguppaal arise). AsubtlepointthatarisesfromthisspecicationisthatsinceinSink notalwaysbethecase.infact,inrealworldsystems,communicationmediums easilydiscernedbyinspectionfromtheautomataspecicationgiven,thiswill Althoughinfact,upperandlowerboundsforlatencyofthestreamcanbevery 5.2VerifyingLatency somemeansofidentifyingcorrespondingpackets,e.g.bymeansoftimestamps wemustrelatecorrespondingsourceoutandplayactions.inordertodothis latencydelays.furthermore,inthepresenceofcongestion,analysisoflatencyis farfromstraightforward.thus,eventhoughanalysinglatencyisrathersuperuousinourstreamscenario,itisavaluableexercisetodeterminethesuitability ofuppaalinthisrespect. havehighlycomplexreal-timebehaviour.forexample,theremaybeanumberof dierentpotentialroutesthatframescantake,eachaccumulatingverydierent orsequencenumbers,mustbeincluded. numbering.theobviouspropertythatwewouldliketoverifyis: So,letusformulateourbasiclatencypropertywiththerequiredsequence Therstthingtonoteisthatinordertoexpressourlatencyrequirement 8x2IN:(2(play(x))3-95sourceout(x)))

12 Source Place1 Place2 Config c:state0 sourceout! t1 == 50 sourceout! t1 := 0 (t1 <= 50) sinkin! t4 > 80 clock t, t1, t2, t3, t4; int x, l; urgent chan error; chan sourceout, sinkin, play, stop, loss; system Source, Sink, Place1, Place2, Monitor; t == 1000 t == 1000 x >= 15 x < 15 x <= 20 l := 0 l := 0 x := 0 x := 0 t := 0 t := 0 error! (t <= 1000) sourceout? t4 := 0 l < 4 loss l := l + 1 Monitor (t4 <= 90) Stop sinkin! t3 > 80 error? Stop )islogicalimplicationand3-tpisapasttenseoperatorstatingthat,pmust contrastwiththebranchingtimeoperatorsusedinuppaal.2pisthealways/henceforthoperator(i.e.inthefutureitisalwaysthecasethatpholds), statesthatitisalwaysthecasethat,ifaplayoccursthenatsomepointnot wheretheoperatorsusedarelineartimetemporallogicoperators[13],which Fig.4.UPPAALspecicationofmediastreamwithQoSMonitor holdnomorethanttimeunitsbeforethecurrentmoment.so,theformula morethan95msbeforeasourceoutmusthavetakenplace.thesignicanceof thepastoperatoristhatitallowsforlossinthesystem,i.e.itonlyenforcesa timingconstraintontheplaysthatarisefromsuccessfullyreceivedpackets. themoment,letusconcentrateontherst.theproblemisthatweneedto arenotsupportedatpresentbyuppaal. reasonsforthis. 2.expressingdatapassingactions 1.Innitedatasets,suchasthenaturalnumbers;and Wewillshowhowtohandlethesecondofthesedicultiesshortly,butfor However,thispropertycannotbeveriedusingUPPAAL.Therearetwo resultingautomatonandthestatespaceexplosionproblemifwecankeepthe boundthesetofsequencenumbersusedandinfact,itwillgreatlysimplifythe sizeofthisboundverysmall. numbersthatwedonotgettwopacketswiththesamesequencenumberinthe Whatwewouldliketoensureisthatwehaveasucientnumberofsequence sourceout? t3 := 0 sinkin? x := x + 1 t2 := 0 play t2 == 5 (t3 <= 90) l < 4 loss l := l + 1 (t2 <= 5) Sink

13 systematthesametime.thisisasimilarrequirementtotheboundingofthe sizeofthemediuminvestigatedinsection4.1.infact,wecanuseformula(+) behavingsystem.importantlythough,wereplacemintheformulawiththe statedtheretoderivethattwosequencenumbersaresucientinacorrectly passingactionsbyincludingamorediscriminatingsetofactionsandincluding extratransitions2.thesinkinfigure5isagoodillustrationoftheapproach. actionsinuppaalarenotdatapassinghowever,wecangettheeectofdata desiredlatencyvalueratherthantheknownone. Specically,ratherthanreferingtoactionssinkinandplayaswasthecase wehavetoadaptourautomataspecicationaccordingly.nowasalreadynoted, sinkin1?,play0?andplay1?.thus,wehaveattenedoutourdatatypeintoa inourearlierformulationsofthestream,nowitreferstoactionssinkin0?, morediscriminatingsetofactionnames. Havingdecidedthattwosequencenumbers,i.e.1and0,willbesucient operators3.wecouldthoughreformulatethepropertyas: Theformulathatwewouldliketoverifyoverthisautomatais: Unfortunatelyafurtherproblemremains:UPPAALdoesnotsupportpast whichavoidsthepastoperator.howeverwepreferanalternativeapproach 8x2f0;1g:(2(sourceout(x))395(play(x)_loss(x))))() 8x2f0;1g:(2(play(x))3-95sourceout(x)))() thatavoidsthereferencetoloss.thisisbecauselatencyisanend-to-endpropertyandformulatingintermsofactionslocaltocomponentsofthecommunicationpathseemsconceptuallyunsatisfactory.thus,wewouldliketoview themediumasablackboxandformulateourpropertypurelyintermsofthe \end-point"actionssourceoutandplay. willimplicitlyreducelatencyvalues.thus,areasonablestrategyistodetermine Inthepresenceofcongestion,losswillrelievecongestionandthusallowingloss knowingthatifitisadded,thisboundwillstillbevalid.thisisthestrategy toloosepackets.themediumisasshowninfigure5. upperboundsonlatencyonastreamspecicationwhichdoesnotallowloss, thatweadopt. Inordertodothis,letusconsidertheinterplaybetweenlossandlatency. 2Thisisinfactastandardapproachinprocessalgebrasforgettingfromadatapassing 3Actually,thereisinanycasearathersubtleproblemwiththisformula,todowiththe So,letusworkwithabasicmediumwhichdoesnotcontainthepossibility latency. interplaybetweenthepossibilitytoloosemessagesandnotknowingtheend-to-end calculustoabasiccalculus,seeforexample[14]. Nowthepropertythatwehavetocheckis: 8x2f0;1g:(2(sourceout(x))395play(x)))

14 ordertomatchactiondenotationsintheautomaton). quantier,whichisnotsupportedinuppaal(note:wewritea(n)asanin whichcan,inthestandardway,beexpandedouttoavoidtheuniversal algorithm,composethetestingautomatoninparallelwiththesystemandverifyasimplereachabilityproperty.thisstrategyisnotyetimplementedinthe istoderiveatestingautomatonfromthepropertyusingaformoftableau UPPAALtool,sotheautomatonhasbeenderivedbyhandusingtheinformal veriedusinguppaal.astrategyoutlinedin[12]canthoughbeusedtoverify sucha\boundedliveness"propertyusingreachabilityanalysis.theapproach However,thisisnotareachabilitypropertyandcanthus,notbedirectly 2(sourceout0)395play0)^2(sourceout1)395play1) usedtochecksourceout1'sandplay1's. algorithmstobefoundintheliterature[12]. areexpressedinadierentlogictoanythatwehaveseensofar:stl,atimed thatsourceout0sandplay0sarecorrectlymatched.asimilarapproachcanbe automatonthatisderivedfromtheformula.itisshowninfigure5alongwith thefullrevisedstreamspecication.infact,thisisthescenariousedtocheck modallogic.ourpropertycan,withrelativeease,beexpressedinthislogic however,ratherthanintroduceanotherlogic,wewillgostraighttothetesting Notethatsgout0isaprobeactionthathasbeeninsertedatappropriate Theboundedlivenesspropertiesacceptedbythetestingautomatonapproach currenceofsourceoutstothetestautomaton. placesinthesystem.itisinserted(usingacommittedstate)tosignaltheoc- Thepropertythatwecheckis: applicable. forcheckinglatencywhichcanbeappliedtosystemsthatarenotsoeasily directlydeduciblebyinspectionofthesystem.thus,thecontributionofthis interpreted.itisclearthatthestrategywehavedocumentedisindeedgenerally Howeverasindicatedearlier,thisisnotaveryinterestingresultbecauseitis sectionisnotthisverication,butrathertheinvestigationofageneralstrategy which,whencheckedwithuppaaldoes,aswouldbehoped,failtohold. E<>(Tester:bad) 6ConcludingRemarks WehaveinvestigatedthesuitabilityofUPPAALforthevericationofmultimediasystems.Thespecicationandanalysisofasimplemultimediastreacationofgenerallyapplicablestrategiesforcheckingreal-timequalityofservice properties,specically,checkingthroughputandlatency. somecriticismsoftheapproachcanbehighlighted.[6]considersanumberof waspresentedforthispurpose.themainresultsofthispaperaretheidenti- AlthoughourexperienceswithUPPAALhavegenerallybeenfavourable,

15 c:state0 Source Place1 Place2 sourceout0! c:s01 sgout0! (t1 <= 50) t1 == 50 sourceout1! sgout0! sinkin0! t4 > 80 sourceout0? t4 := 0 sinkin1! t3 > 80 sourceout1? t3 := 0 (t1 <= 100) c:s02 t1 == 100 sourceout0! t1 := 0 (t4 <= 90) (t3 <= 90) Config clock t, t1, t2, t3, t4; chan sourceout0, sourceout1, sinkin0, sinkin1, play0, play1, sgout0; system Source, Sink, Place1, Place2, Tester; st1 sgout0? t := 0 st3 t <= 95 play0? t > 95 bad st4 Tester sinkin1? t2 := 0 sinkin0? t2 := 0 play1! t2 == 5 State3 (t2 <= 5) t := 0Fig.5.TheStreamwithTestingAutomata play0! t2 == 5 (t2 <= 5) Sink suchcriticisms.onecriticismisthoughparticularlyworthconsideringhereas itarisesdirectlyfromourcasestudy.itisthatduetoexpressivenesslimitations directlyverifythestandardtemporallogicformulationsofqualityofservice, ofthetemporallogicacceptedbytheuppaalmodelcheckeritisdicultto ratherthebasicsystemspecicationhastobeadaptedinorderthatchecking thepropertycanbereducedtocheckingareachabilityproperty.thiscanmost noticeablybeseeninthelatencyvericationwherethebasicsystemspecication hastobeadaptedthroughcompositionofatestautomataandadditionofprobe actions.consequentlythevericationisnot\transparent"tothebehavioural arichersetoftemporallogicproperties.thus,wehopethatvericationthat specication. avoidssuchinvasiveadaptationofthebasicsystemspecicationmaybepossible withkronos.ongoingresearchisinvestigatingapplicationofkronostothe multimediastreamcasestudy. Otherreal-timemodelcheckingtools,inparticularKRONOS[8],support

16 WewouldliketothankStavrosTripakisofSPECTRE-VERIMAGandPaul timedautomataanduppaalrespectively. Acknowledgements References PetterssonofUPPSALAwhoeldedqueriesthatwehadonmodelcheckingof 2.V.BellottiandA.MacLean.Integratingandcommunicatingdesignperspec- 1.R.AlurandD.Dill.Atheoryoftimedautomata.TheoreticalComputerScience, 3.JohanBengtsson,W.O.DavidGrioen,KareJ.Kristoersen,KimG.Larsen, (126):183{235,1994. ingsofthe8thinternationalconferenceoncomputer-aidedverication,lncs tiveswithqocdesignrationale.technicalreportid/wp29,esprit7040- FredrikLarsson,PaulPettersson,andWangYi.Vericationofanaudioprotocol withbuscollisionusinguppaal.inr.alurandt.a.henzinger,editors,proceed- AMODEUS, H.Bowman,G.Faconti,J-P.Katoen,D.Latella,andM.Massink.Automaticveri- 4.G.S.Blair,L.Blair,H.Bowman,andA.Chetwynd.FormalSpecicationofDistributedMultimediaSystems.UniversityCollegeLondonPress,September ,pages244{256,NewBrunswick,NewJersey,USA,July M.Bordegoni,G.Faconti,S.Feiner,M.Maybury,T.Rist,S.Ruggieri,P.Trahanias, ComputerStandardsandInterfaces,1998. andm.wilson.astandardreferencemodelforintelligentpresentationsystems. cationofalipsynchronisationalgorithmusinguppaal.acceptedatfmics'98, Amsterdam,TheNetherlands,May KlausHavelund,ArneSkou,KimG.Larsen,andKristianLund.Formalmodelling 8.C.Daws,A.Olivero,S.Tripakis,andS.Yovine.ThetoolKRONOS.InHybrid 9.P.G.HarrisonandN.M.Patel.PerformanceModellingofCommunicationNetworksandComputerArchitectures.Addison-Wesley,1993transmissionprotocolmustbeontime!InProceedingsofthe3rdInternational 7.P.R.D'Argenio,J.-P.Katoen,T.C.Ruys,andJ.Tretmans.Theboundedre- andanalysisofanaudio/videoprotocol:anindustrialcasestudyusinguppaal. LNCS1217,pages416{431,Enschede,TheNetherlands,April1997. SystemsIII,LNCS1066.Springer-Verlag,1996. WorkshoponToolsandAlgorithmsfortheConstructionandAnalysisofSystems, InProceedingsofthe18thIEEEReal-TimeSystemsSymposium,pages2{13,San 15.WangYi,PaulPettersson,andMatsDaniels.Automaticvericationofreal-time 14.R.Milner.CommunicationandConcurrency.Prentice-Hall, Z.MannaandA.Pnueli.TheTemporalLogicofReactiveandConcurrentSystems. 12.HenrikEjersboJensen,KimG.Larsen,andArneSkou.Modellingandanalysis 11.I.Herman,G.Reynolds,andJ.VanLoo.PREMO:Anemergingstandardfor Springer-Verlag,1992. SPINWorkshop,RutgersUniversity,NewJersey,USA,August1996. multimedia.parti:overviewandframework.ieeemultimedia,3:83{89,1996. ofacollisionavoidanceprotocolusingspinanduppaal.inproceedingsofthe2nd Francisco,California,USA,3-5December1997. nationalconferenceonformaldescriptiontechniques,berne,switzerland,4-7 October1994. communicatingsystemsbyconstraintsolving.inproceedingsofthe7thinter-