Functional scenarios describing system views, uses, or services are a common way of capturing requirements of distributed systems. However, integrating individual scenarios in different ways may result in different kinds of unexpected or undesirable interactions. We present an innovative approach based on the combined use of two notations. The first one is a recent visual notation for causal scenarios called use case maps (UCMs), which is used to capture and integrate the requirements. Integrating UCMs together helps avoiding many interactions before any prototype is generated. The second notation is the formal specification language LOTOS. UCM scenarios are translated into high-level LOTOS specifications, which can be used to validate the requirements formally through numerous techniques, including functional testing based on UCMs. LOTOS possesses powerful testing concepts and tools that we use for the detection of remaining undesirable interactions. To illustrate these concepts, we use a simple connection example and results from the capture and the validation of several telephony features from the First Feature Interaction Contest.

The paper presents a novel, scenario based notation called Use Case Maps (UCMs) for describing, in a high level way, how the organizational structure of a complex system and the emergent behavior of the system are intertwined. The notation is not a behavior specification technique in the ordinary sense, but a notation for helping a person to visualize, think about, and explain the big picture. UCMs are presented as "architectural entities" that help a person stand back from the details during all phases of system development. The notation has been thoroughly exercised on systems of industrial scale and complexity and the distilled essence of what has been found to work in practice is summarized. Examples are presented that confront difficult complex system issues directly: decentralized control, concurrency, failure, diversity, elusiveness and fluidity of runtime views of software, self modification of system makeup, difficulty of seeing large scale units of emergent behavior cutting across systems as coherent entities (and of seeing how such entities arise from the collective efforts of components), and large scale.

Understanding how a complex system works as a whole can be difficult because it requires blending information about structure and behaviour into a coherent whole that can be understood without reference to details of how its parts are constructed, behave internally, or interact. The problem is doubly difficult for software systems, because we do not know any good large-scale models of such systems to keep in the mind's eye. We have details in code files, low-level diagrams of software details (for example, class inheritance hierarchies), and system views of hardware environments, but these are not enough. We suggest that model of whole systems that we can diagram and hold in the mind's eye are so important for human understanding of complex systems of all kinds that, if they do not exist, they must be invented. Use case maps are an example of a model invented for this purpose. While use case maps were invented to deal with the problems of understanding software systems, they are useful for complex systems of all kinds.

Object-oriented design methods and notations do not adequately address the concerns of real-time-and-distributed (RTD) systems. Issues critical to such systems, like performance, robustness, and concurrency are not seriously considered until detailed design. We propose an object-oriented approach that allows RTD design issues to be considered before detailed design. The approach revolves around timethread-role maps that present composite pictures of concurrent, interacting, end-to-end responsibility paths through a system. It is related to responsibility-driven design approaches, but extended for RTD systems. The paper illustrates by example how timethread-role maps can be used to explore, compare and explain different organizations for achieving the paths. The paper also illustrates how timethread-role maps may be used to represent dynamic structure.

Abstract ‘Pictures that play’ are design diagrams that give enough visual cues to enable a person to trace causality sequences that cut across them, without referring to (or even knowing) the kind of details that would enable a tool to execute the design or to generate executable code. Playing design diagrams is particularly important while exploring alternative solutions during the early stages of designing all kinds of systems. It is done either by mentally tracing sequences across diagrams on paper or a computer screen, or physically tracing them on whiteboards with a pointer or finger during design meetings. Two complementary pictorial design notations are described and used together in an example to illustrate the concept of play and to show how to do it: timethreads, a new notation for causality sequences that cut across many components and across the system end‐to‐end, and machine charts, an older notation for architecture presented here from a new angle. These notations are specifically designed to support play during the design process, not just record the end result. The focus is on real‐time and distributed (RTD) systems, but the approach has wider applicability.

article Architectures with pictures Share on Authors: Raymond J. A. Buhr View Profile , Ronald S. Casselman View Profile Authors Info & Claims ACM SIGPLAN NoticesVolume 27Issue 10Oct. 1992 pp 466–483https://doi.org/10.1145/141937.141973Online:31 October 1992Publication History 14citation395DownloadsMetricsTotal Citations14Total Downloads395Last 12 Months7Last 6 weeks1 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

A temporal logic-based specification language and deadlock analyzer for Ada is described. The deadlock analyzer is intended for use within Timebench, a concurrent system-design environment with support for Ada. The specification language, COL, uses linear-time temporal logic to provide a formal basis for axiomatic reasoning. The deadlock analysis tool uses the reasoning power of COL to demonstrate that Ada designs specified in COL are systemwide deadlock-free: in essence, it uses a specialized theorem prover to deduce the absence of deadlock. The deadlock algorithm is shown to be decidable for finite systems and acceptable otherwise. It is also shown to have a worst-case computational complexity that is exponential with the number of tasks. The analyzer has been implemented in Prolog. Numerous examples are evaluated using the analyzer, including readers and writers, gas station, five dining philosophers, and a layered communications system. The results indicate that analysis time is reasonable for moderate designs in spite of the worst-case complexity of the algorithm.>

Starvation and critical race analysis tools for Ada designs are described. These tools are part of a temporal analysis toolset that includes an operational specification language, a language interpreter, and a deadlock analyzer for Ada. The starvation analyzer is based on a set-theoretic model of starvation. It uses a proof tree produced by the deadlock analyzer to define the possible computation space of the design. A preprocessing phase of the starvation tool optimizes the analysis so that the resulting analysis is efficient. Unlike livelock analysis in state machines, the starvation analyzer does not require a priori specification of home states to discern liveness. The critical race analysis tool provides semiautomatic proof of critical races by identifying nondeterministic rendezvous (races) from the proof tree generated by the deadlock analyzer, and then assisting the human operator in identifying which of these constitute critical races. Several design examples are used to demonstrate the capabilities of the two analysis methods.>

A research project is described in which an experimental software CAD environment called the Carleton embedded system design environment (CAEDE), oriented toward embedded systems and Ada, was developed to provide a demonstration of the concept and to serve as a research testbed. The major contribution of CAEDE is a demonstration of a visual paradigm which combines semantic depth and syntactic shallowness, relative to Ada, in a manner that makes it possible for the embedded-system designer to work in terms of abstract machines while still thinking Ada. A secondary contribution is the identification of Prolog as a promising approach for supporting tool development in an environment which supports the visual paradigm. Also described are experimental tools for temporal analysis, performance analysis, and the generation of skeleton Ada code.>

The requirements of an algorithmic level hardware description language can be met by a software language with only limited feature enhancement. This paper discusses the feasibility of using a subset of Ada as a hardware description language. Methods are presented for realizing the extra features required for hardware description within the syntax of Ada. This allows the compiled Ada program to act as a functional simulator. Our particular context for hardware description is as a source language for a hardware compiler. Rules are presented for translating a circuit described in the Ada subset onto a control/data-flow graph (CDFG), our intermediate level form.

This paper develops algorithms for verifying pointer values in DBTG (Data Base Task Group) type databases. To validate pointer implemented access paths and set structures, two algorithms are developed. The first procedure exploits the “typed pointer” concept employed in modern programming languages to diagnose abnormalities in directories and set instances. The second algorithm completes pointer validation by examining set instances to ensure that each DBTG set has a unique owner. Sequential processing is used by both algorithms, allowing a straightforward implementation which is efficient in both time and space. As presented, the algorithms are independent of implementation schema and physical structure.