Designing User Interfaces Spring 1999

1
SE 746-NT Embedded Software Systems
Development Robert Oshana Lecture
12 For more information, please
contact NTU Tape Orders NTU Media
Services [phone]
oshana_at_airmail.net
tapeorders_at_ntu.edu
2
Lecture 12Sequence EnumerationA technique for
specifying embedded systems (cntd)
3
Example Specification of a Security Alarm
SET
4
5
6
7
8
9
CLEAR
4
Tagged Requirements for the Security System
5
Security Alarm Stimuli
6
Security Alarm Stimuli

• Trip, Set, Clear are atomic stimuli
• GoodDigit and BadDigit are abstractions
• Represent correct and incorrect behavior of
  digits in a three-digit code
• Abstraction serves the purpose of hiding well
  understood atomic level details (whether a digit
  is good or bad)

7
Security Alarm Responses
8
System Boundary Diagram
Trip
Light On
Set
Light Off
Clear
Alarm On
GoodDigit
Alarm Off
BadDigit
9
Security Alarm Responses

• Two additional responses used in sequence
  enumeration
• Null response occurs when there is no external
  system response
• System ignoring stimuli
• System accumulating stimuli
• Illegal response sequence is impossible (e.g.
  stimuli presented before invocation)

10
Sequence Enumeration
Carry to Next level
11
(No Transcript)
12
(No Transcript)
13
(No Transcript)
14
(No Transcript)
15
(No Transcript)
16
Sequence Length Five
Each entry has an equivalence Therefore we can
stop enumerating!!!
17
Enumeration complete

• Every scenario has been mapped to a response
  (complete)
• Every scenario has been mapped to only one
  response (set), (consistent)
• Requirements can now confirm that assumptions and
  derived requirements are correct

18
Canonical Sequence Analysis

• State data encapsulates and retains the
  components of stimulus history that must be
  preserved for the system to produce the correct
  response
• Canonical sequence sequences that are not
  equivalent to any previous sequence
• Invent state variables to represent the canonical
  sequences

19
Canonical

S
tate
Value
Value
sequence

Variables

before
after
current
current
stimulus

stimulus

Empty

N/A



S The user has
Device

OFF

ON

pressed the Set
button to
activate the
device

S T The device
Device

ON

ON

has been set



and the trip
Alarm

OFF

ON

signal has
occurred,
setting off the
alarm

S B The device
Device

ON

ON

has been set



the user has
Code

NONE

ERROR

entered an
invalid digit


20
(No Transcript)
21
(No Transcript)
22
State Variables
23
Recast as a State-based Specification

• When the system receives the stimulus ____ and
  the state data values are ____, the system
  response is ____ and the state update is ____.
  This use can be traced to sequence ____.

24
Sequences ending in T
25
Tag

Current State

R
esponse

State Update

Sequence
Trace

1

Device ON

Alarm on

Alarm ON

S

Alarm OFF

Code NONE

2

Device ON

Null


S T

Alarm OFF

Code NONE

3

Device ON

Alarm on

Alarm ON

S B

Alarm OFF

Code NONE

4

Device ON

Alarm on

Alarm ON

S G

Alarm OFF

Code
Code NONE

ERROR

5

Device ON

Null


S T B

Alarm OFF

Code NONE

6

Device ON

Null


S T G

Alarm OFF

Code NONE

7

Device ON

Alarm on

Alarm ON

S G G

Alarm OFF

Code
Code NONE

ERROR

8

Device ON

Null


S T G G

Alarm OFF

Code NONE


26
State Transition Diagram
GoodDigit
GoodDigit
GoodDigit/ Alarm off
Device on Alarm on Code 2_OK
Device on Alarm on Code 1_OK
Trip/ Alarm on
Device on Alarm on
BadDigit
BadDigit
Clear
Device on Alarm on Code ERROR
Device on
init
BadDigit
Set/ Light on
invoke
Clear
Device on Alarm off Code ERROR
BadDigit
BadDigit
GoodDigit
Device on Alarm off Code 1_OK
Device on Alarm off Code 2_OK
GoodDigit
GoodDigit/Light off
27
Procedural view
Security Alarm ---------------------------------
------------------------------- Declarations -
--------------------------------------------------
------------- Constants CLEAR constant 0 no
error or alarm STOP constant 1 stops main
loop on correct code TRIPSIGNAL constant
99 hardware trip wire signal SET constant
100 set button on keypad pressed
Variables Event trigger init (CLEAR) any
keypad entry or hardware signal SecurityStat
us boolean init (CLEAR) alarm on/off
28
Procedural view
-------------------------------------------------
--------------- Main Program -----------------
-----------------------------------------------
start the device SB 9 DisplayManager
(Start) While (Event ! STOP) Do get next
user input or hardware signal get
(Event) switch (Event) SB 10-17
29
Procedural view
SB 10-17 case (SET) do nothing
SB 1-8 case (TRIPSIGNAL) AlarmManager
(Query, SecurityStatus) if (SecurityStatus
CLEAR) then SB 1,3,4,7 AlarmManager
(Start) SB 4,7 CodeManager (Alert,
Event) else do nothing SB 2,5,6,8 endif
30
Procedural view
SB 18-37 default CodeManager (Evaluate,
Event) CodeManager will return STOP if
code entry is complete endswitch enddo
SB 38,39 AlarmManager (Stop) DisplayManager
(Stop) end of security Alarm main program
31
Procedural view
DisplayManager (DisplayService) ----------------
--------------------------------------------------
------ Data ---------------------------------
---------------------------------------
Constants ON constant 1 light is on OFF
constant 0 light is off State
Data LightStatus boolean static init (OFF)
device activation light ------------------
--------------------------------------------------
---- Services -------------------------------
-----------------------------------------
32
Procedural view
SB 9 Start LightStatus ON SB
38-39 Stop LightStatus OFF end
DisplayManager AlarmManager (AlarmService,
Status) ----------------------------------------
-------------------------------- Data -------
--------------------------------------------------
--------------- Constants
33
Procedural view
ON constant 1 alarm is on OFF constant 0
alarm is off State data AlarmStatus boolean
static init (OFF) alarm activation stat
us ----------------------------------------------
-------------------------- Services ---------
--------------------------------------------------
------------- SB 1,3,4,7 Start AlarmStatus
ON Query Status AlarmStatus
34
Procedural view
SB 39 Stop AlarmStatus OFF end
AlarmManager Codemanager (CodeService,
Event) -----------------------------------------
------------------------------- Data --------
--------------------------------------------------
-------------- Constants NONE constant 0 no
keypad entry 1_OK constant 1 first correct
digit in code entered 2_OK constant 2 second
correct digit in code entered
35
Procedural view
CLEAR constant 0 Clear button on keypad
pressed COMPLETE constant 1 correct
code entered ERROR constant 2 error in code
entry state data CodeCombination array static
init (17 2537) code is
757 EntryStatus integer static init (NONE)
code entry status -------------------------------
----------------------------------------- Serv
ices --------------------------------------------
---------------------------- SB 4,7 Alert
36
Procedural view
if (EntryStatus 1_OK) (EntryStatus
2_OK)) then EntryStatus ERROR endif SB
18-37 Evaluate if (Event CLEAR) then
clear button has been pressed SB
26-33 EntryStatus NONE else digit
has been pressed
37
Procedural view
switch (EntryStatus) case (NONE) SB
34, 35 if (Event CodeCombination1) the
n EntryStatus 1_OK SB 18, 19 else
EntryStatus ERROR endif case
(1_OK) SB 36, 37 if (Event
CodeCombination2) then EntryStatus
2_OK SB 21, 23 else EntryStatus
ERROR endif
38
Procedural view
case (2_OK) SB 38, 39 if (Event
CodeCombination3) then EntryStatus
NONE Event COMPLETE SB 24,
25 else EntryStatus ERROR endif default
if EntryStatus ERROR, do nothing SB
20, 22 endswitch endif end CodeManager
39
Conclusion

• Sequence enumeration leads to complete,
  consistent, traceable, and verifiably correct
  specifications
• State data values, system response, and state
  update requirements for every scenario have been
  defined, so the specification is complete
• State data values, system response, and state
  update requirements for every scenario have been
  unambiguously defined , so the specification is
  consistent

40
Conclusion

• Sequence enumeration leads to complete,
  consistent, traceable, and verifiably correct
  specifications
• Each element of the state-based specification can
  be compared to the corresponding element of the
  previously verified sequence-based specification
  to confirm that correctness has been preserved

41
Where to Find More

• Sequence Enumeration, Embedded Systems
  Programming, September 2000
• Cleanroom Software Engineering, Prowell,
  Trammell, Linger, Poore, Addison-Wesley, 1998,
  0-201-85480-5

42
SE 746-NT Embedded Software Systems
Development Robert Oshana 10 minute
break For more information, please
contact NTU Tape Orders NTU Media
Services [phone]
oshana_at_airmail.net
tapeorders_at_ntu.edu
43
Backup data
44
Current Stimulus S
45
Current Stimulus BadDigit
46
Current Stimulus Clear
47
Current Stimulus GoodDigit