The Property of the PSM

We explain the property of the PSM that has been transformed from the PIM according to the proposed algorithm. Here are definitions of three types of maximum delays of a pair (j) of input and output:

1) M-C Delay∆mc: specifies the maximum time passage from the instant the environment

triggers an input (mj, tmj) until the instant the environment observes an output (cj, tcj)

at the mc-boundary, i.e., ∆_mc = tcj - tmj; this delay is illustrated in Fig. 21 as the time

passage between the two synchronizations (mk! andck?) ofENVMC.

2) Input-Delay ∆_mi: specifies the maximum time passage from the instant the environ- ment triggers an input (mj,tmj) at themc-boundary until the instant theCode(PIM) reads

the input (ij,tij) at theio-boundary,i.e.,∆mi=tij -tmj; this delay is illustrated in Fig. 21

as the guarded section ofIFMI.

3) Output-Delay ∆oc: specifies the maximum time passage from the instantCode(PIM)

the output (cj, tcj) at the mc-boundary, i.e., ∆oc = tcj - toj; this delay is illustrated in

Fig. 21 as the guarded section of IF_OC.

GivenPIM |=P(∆mc), our goal is to find ∆0mc such that,

PSM |= P(∆0_mc), and ∆0_mc ≥∆mc.

∆0_mcis a relaxed timing constraint from the original constraint ∆mc. Such relaxation should

be considered in terms of theInput-Delay and theOutput-Delay. TheInput-Delayis a func- tion ofENV_MC,IF_MI,EXE_IO; that is, once the environment triggers an input, the sustained duration of the input signal, the input interaction scheme (e.g.,polling or interrupt-scheme), invocation-scheme (e.g., periodic or aperiodic scheme) constitute the delay. On the other hand, the Output-Delay is a function of ENV_MC,IF_OC,EXE_IO; that is, once Code(PIM) produces an output, the output interaction scheme, invocation-scheme, and the environ- mental behavior constitute the delay.

Remark 1. In general, we cannot determine the bound of ∆0_mc because some combinations of platform-specific parameters (Pmc,Pio) make ∆0mc unbounded. However, we can derive

timing constraints on implementation schemes that make ∆0_mcbounded. If they are satisfied, we can find such a bound.

We now show the four constraints that make ∆0_mc bounded:

• (Constraint 1) Detection of all input signals: Given an input pattern generated from ENVMC, (1)IFMI can detect all input signals, and (2) the maximum input processing

delay ofIFMI is shorter than the minimum inter-arrival time.

• (Constraint 2)No overflow of the input buffer: The invocation interval ofEXEIOshould

be small enough w.r.t. the input processing speed ofIF_MI so that each input can be read byEXE_IO before the input buffer overflows.

• (Constraint 3) No overflow of the output buffer: Given an output pattern generated by M_IO, (1) IF_OC has sufficient processing speed to process all outputs before the

output buffer overflows, and make them visible toENV_MC, and (2)ENV_MC can read the produced outputs byIF_OC fast enough.

• (Constraint 4) No internal transition occurrences: SinceENV_MC generates an input, MIO does not take internal transitions until the input is processed byIFMI, and read

by MIO.

Lemma 1. If the system constraints are verified in PSM , then (1) the Input-Delay is bounded by the function of all maximum platform-specific parameters that are used for ENV_MC, IF_MI, EXE_IO, (2) the Output-Delay is bounded by the function of all maximum platform-specific parameters that are used for ENV_MC, IF_OC, EXE_IO,

Proof. Here is the proof for the Input-Delay: Since the constraint 1 holds, the triggered input is read byIFMI until:

• (Case 1)type-1 signal is immediately accepted;

• (Case 2)type-2 signal is accepted up to max-sus time;

• (Case 3)type-3 signal is accepted up to polling-interval.

Once an input signal is read byIF_MI, since the constraint 2 holds, it takes up to delay_maxin- put processing delay until it is inserted into the input-buffer; the inserted input is waiting to be read by Code(PIM) whose behavior is modeled in EXE_IO. There are two different invocation mechanisms, and each introduce different maximum delays.

In case of the periodic invocation:

• (Case 1: Read-All policy) the buffered input is read within2*invocation-intervalsince EXE_IO will read the buffered input either in the current invocation or the next invo- cation;

• (Case 2: Read-One policy) the buffered input is read within (input-buffer-size)*2* invocation-interval since a buffered input needs to wait until other inputs that have

been previously inserted are read byCode(PIM); the buffer size determines the bound of the maximum waiting delay.

In case of the aperiodic invocation:

• (Case 1: Read-All policy) the delay takes up to 2*WCET, since if the current execution stage ofCode(PIM) already passes, the buffered input will be read immediately after completing the current invocation;

• (Case 2: Read-One policy) the delay takes up to (input-buffer-size)*WCET, which constitutes the delays taken for Code(PIM) to read other inputs that have been al- ready buffered.

Finally, since the constraint 4 holds, there is no internal transition occurring up to this point since the input is triggered from ENVMC; therefore, MIO can synchronize with the

input read from the buffer. Therefore, Input-Delay is bounded by the summation of these platform-specific timing parameters, and the upper bound of the Output-Delay can be proved similarly.

Recall that ∆_mi and ∆_oc are the upper bounds of Input-Delay and Output-Delay as ∆_mi and ∆_oc. Let ∆_io−internal be the maximum internal delay of the PIM for processing the

input and output pair (i,o). The following lemma holds:

Lemma 2. If the system constraints are verified in PSM , then, we can determine ∆0_mc such that, PSM |=P(∆0_mc), and ∆0_mc =∆mi + ∆oc +∆io−internal.

Proof. The rest of the delays that contribute to ∆0_mc is the internal delay of PIM for processing the input i and the output o. Therefore, the maximum possible M-C delay is bounded by the summation of these three types of delays.

We make the following claim:

using the implementation scheme, then PSM |= P(∆0_mc) implies IMP(Code(PIM ), IS ) |=

P(∆0_mc).

We can validate the assumption: "if a platform is correctly described using the implemen- tation scheme" through testing, and show the case-study in Section 6.8.