6-10 Handbook of Dynamic System Modeling
well as timing property of the protocol to be analyzed. The following questions–answers for ping-pong
protocol can be performed using Figure 6.4:
•
Question 1 on safeness: Is the protocol deadlock-free?
Answer 1: Yes, because each state in the Figure 6.4 has a next state to move.
•
Question 2 on liveness: Can 10 !msg be eventually transmitted to RECEIVER?
Answer 2: Yes, because SENDER will eventually receive 10 ?ack if the probability of loss of !ack is
less than 1.0.
•
Question 3 on a discrete state sequence: Is (SD, RV) → (RV, AP) →(SD, AP) a legal state sequence?
Answer 3: No, because no such sequence can be constructed in Figure 6.4.
•
Question 4 on the minimum and maximum round trip times from (SD, RV) to (SD, RV)?
Answer 4: ST(!m) +ST(!a) is minimum; ST(!m) +Timeout is maximum.
Although the above example shows the concepts of DES analysis using composed DEVS models, comput-
erized automatic verification needs a systematic method for construction of a complete global state space
from a composed DEVS model. Generally, the global state space is represented by an infinite number of
timed events/states sequences. The sequences can be constructed by a combination of basic sequences each
of which is a loop in the composed model. Once all possible events/states sequences are constructed, a
complete verification of a system’s property and behavior is possible.
Consider Figure 6.4, the composed DEVS model of Figure 6.3, and assume that states sequences are of
interest in analysis. Intuitively, Figure 6.4 has the following two basic states sequences:
•
((SD, RV), ST(!m)) → ((RV, AP), ST(!a)) →((SD, RV), ST(!m));
•
((SD, RV), ST(!m)) →((RV, AP), ST(!a)) →((RV, RV), Timeout −ST(!a)) →((SD, RV), ST(!m)).
The first sequence is a sequence for a successful message transmission, and the second for a failure one. Let
us call the successful one and the failure one ss and fs, respectively. Combinations of the two sequences can
construct all possible states sequences of the composed DEVS model, which include ss →ss →ss… →ss,
ss →fs →fs →ss… →fs, fs →fs →ss →ss →… →ss, and so on. Note that each sequence may be infinite
in general, but it can be finite if conditions, such as a total number of messages to be transmitted and a
failure rate of each transmission are given. A method for the systematic generation of the minimum set of
basic loops of states/events sequences is a research issue and one such method can be found in Hong and
Kim (2005).
Once all possible sequences of a composed DEVS model are given, questions on the system can be
answered. To get an answer required is an efficient search method that finds properties translated from
questions in the state space. Recall that the size of a global state space of DES is infinite. Thus, a construction
of the state space causes a well-known state explosion problem, a general solution of which has not been
proposed so far. To solve the problem, subclasses of DEVS, such as schedule-preserved DEVS (SP-DEVS)
(Hwang and Cho, 2004) and schedule-controllable DEVS (SC-DEVS) (Hwang, 2005), have been proposed
in which some restrictions are applied to bound an infinite state space to a finite one.
6.5 Simulation of DEVS Model
DEVS models can be used for performance simulation of a DES. Since DEVS modeling is based on
the concept of the object-oriented (OO) worldview so does simulation of such models. Recall that DEVS
defines two model classes, atomic and coupled models, with which a hierarchical construction of a complex
model is specified.
6.5.1 DEVS Modeling Simulation Methodology and Environment
Figure 6.5 shows a generic architecture for a DEVS-based modeling and simulation environment using
a programming language L, where L can be any OO language such as C++and Java.
Note that the DEVS modeling environment and the simulation engine are explicitly separated. Within
the environment, modelers can develop DEVS models using modelers’interface which is a set of application