Specification of Reactive Hardware/Software Systems - Electronic ...

304 Behaviour-Preserving Transformations
10.1 Introduction
Behaviour-preserving transformations form an important part of the SHE method. In
this chapter we will develop a formal transformation system consisting of 15 behaviourpreserving
transformations. This chapter is to a great extent based on [Voe, VvdPS96].
10.1.1 Motivation
During analysis and design, the Essential Behaviour Model is gradually transformed
to incorporate high-level level structural decisions and constraints specified in the Architecture
Structure Model. Similarly, the Extended Behaviour Model is transformed in
accordance with the Implementation Structure Model. Of all possible transformations
an important class can be distinguished. This class consists of transformations that
introduce, modify or delete boundaries and channels in Instance Structure Diagrams
(and in the underlying POOSL description). The transformations of this class are required
to leave the (abstract) dynamic behaviour and functional behaviour invariant.
The transformations can modify a system with respect to architecture and topology, but
they should leave the overall functionality unchanged.
One way to make sure that a performed transformation indeed preserves behaviour,
is to verify that the system specifications before and after the transformation are in
some way behaviour equivalent. However, due to the size of real-life specifications,
such an a posteriori verification approach is often practically not feasible. Especially if
transformations have a non-local impact, verification becomes cumbersome because of
state explosion problems.
An alternative approach to verify transformations is to offer a collection of simple transformations
which are known to be behaviour-preserving in advance. This leads to the
notion of behaviour-preserving transformation. By putting a number of these simple transformations
in sequence, complex behaviour-preserving transformations can be obtained.
If these transformations are applied to some initial system specification, specifications
are obtained that are correct by construction (in the sense that they are equivalent to the
initial specification).
10.1.2 Related Work
For about two decades behaviour-preserving (also called correctness-preserving or
semantics-preserving) transformations, have been subject of active research in different
fields of application. For example, [Cam89] and [Mid93] describe how behaviourpreserving
transformations can be applied in high-level synthesis (synthesis of circuit
structures from behavioural domain descriptions). The LotoSphere design methodology
[Pir92, Pav92] uses correctness-preserving transformations to support system designers
and implementers along the trajectory from initial, abstract specification, down to concrete
design and implementation. A catalogue of LOTOS transformations is given in
[Bol92]. Transformational programming [Fea87, Par90] is another related research field.
Transformational programming consists of a collection of transformation approaches