Analizar, interpretar y comparar novelas de anticipación social distópica

The stuck fault is inherently lossy, so the correctness of the pattern is shown in two parts. First, if no stuck faults occur then we show that the behavior with the pattern is a bisimulation. Second, if a stuck fault occurs, we can no longer guarantee any correspondence in behavior to the ideal case, but we can guarantee detection of the fault within a certain time.

For the case with absence of stuck faults, we again show correspondence with a projection relation from a wrapper system:

op remove-wrapper : Configuration -> Configuration . eq remove-wrapper(CC < O : StuckDetector | inside : CC’ > ) = CC CC’ . endtom)

The projection πstuck from a wrapped system for stuck detection to an ideal input system with no

wrapper is just simply the function remove-wrapper.

Again, we use the same definitions as with the button bounce case:

Definition. States of the transition system Sideal are system configurations with a single instance of a

wrapped (StuckDetector) object, and such that the input button press messages are spaced by at least the assumed minimal time spacing, and the input button press durations (time between consecutive press and release events) are always at most Tstuck time units apart. States of the transition system Swrapped are

system configurations with a single instance of a wrapped object in a wrapper object, and such that input button press messages are related to an ideal button press configuration by the button press fault Fstuck.

Define a relation H ⊆ Sideal× Swrapped such that siHsf iff πstuck(sf) = si and time(sf) = time(si).

Definition. Consider a system with a wrapped object, which in the most general case is a soup of the form S = { C < O : Wrapper | inside : C0 > } in time T .

We define the following functions:

• nmsgsto(S) computes the number of messages in configuration C being sent to oid O.

• nmsgsf rom(S) computes the number of messages in configuration C0 which is being sent to an oid

• χtimeris 1 when the timer T M is set, and 0 when T M is just no-timer.

Theorem 3.5.1. The relation H is a well-founded bisimulation, and thus H defines a stuttering bisimulation between Sideal and Swrapped when considering natural number time.

Proof. First, we show that a well-founded simulation from Sideal to Swrapped exists.

Define µ(si, sf) = 0 and µ0(si, s0i, sf) = 2(nmsgsto(sf) + nmsgsf rom(sf)) + χtimer.

Suppose that siHsf. We consider possible cases for the transition si → s0i. For convenience, we denote

the object ID of the internal wrapped object to be Ow.

(1) mte(si) = 0 because a message M needs to be delivered in si, we consider the following cases:

(1.a) M is not a message to Ow, and M is in the external configuration of sf, then sf → s0f takes a

corresponding transition by using the same rule, and we have s0_iHs0_f.

(1.b) M is a message to Ow, and M is in the internal wrapped configuration of sf, then, again, we can

just take a corresponding transition sf → s0f in the wrapped configuration using the same rule, and we have

s0_iHs0_f.

(1.c) M is a message to Ow, and M is in the external configuration of sf, and M is not a press message,

then the [forward-in] rule is used to transition sf → s0f, and we have siHs0f, and µ(si, s0i, s0f) < µ(si, s0i, sf)

since nmsgsto decreases.

(1.d) M is a message not to Owbut in the internal configuration of sf. Then the [forward-out] rule is

used to transition sf→ s0f, we have siHs0f and µ(si, si0, s0f) < µ(si, s0i, sf) since nmsgsf rom decreases.

(1.e) M is a message to Owin the external configuration of sf, and M is a press. The rule [set-timer]

can be applied to transition sf → s0f. In this case, we have siHs0f, and µ(si, s0i, s0f) < µ(si, s0i, sf) since

2nmsgsto+ χtimer decreases.

(1.f) In the case that M is a release message, then the [release-event] rule is used, and it will be similar to the [forward-in] case with a possible added decrease in the value of χtimer.

(2) if mte(si) > 0, then si→ s0iis a tick rule advancing time by one time unit, and we have a few subcases

to consider for possible transitions sf → s0f. Note that in this case, by the strict nature of the projection

relation, there cannot be any messages waiting to be delivered in sf.

(2.a) mte(sf) > 0, we have a corresponding tick rule sf → s0f by one time that preserves the relation H.

(2.b) mte(sf) = 0 because the timer in the wrapper is expired, in this case, the only rule to take is to

stop the timer, so sf → s0f changes the timer from t(0) to no-timer and changes the value of stuck-err.

We have siHs0f and µ(si, s0i, s0f) < µ(si, s0i, sf), since the value of χtimer decreases and all other values stay

the same.

Define ν(sf, si) = 2(nmsgsto(sf) + nmsgsf rom(sf)) + χtimer(sf) and ν(sf, s0f, si) = 0. Let H0 = H−1,

and suppose sfH0si. We consider the following cases:

(1’) mte(sf) > 0, and sf → s0f is a tick rule by 1 time unit. By the homomorphic definition of mte, if

sfH0si, then mte(si) > 0, and a corresponding 1 time unit tick step can be taken si→ s0i with s0fH 0_s0

i.

(2’) sf → s0f uses the [forward-in] rule. In this case, s0fH0si, and ν(sf, si) > ν(s0f, si), since nmsgsto

decreases.

(3’) sf → s0f uses the [forward-out] rule. Again, we have s0fH0si, and ν decreases, since nmsgsf rom

decreases.

(4’) sf → s0f uses the [set-timer] rule. Since sfH0si, we know that the press message forwarded also

exists in si, and again, s0fH0si, and ν decreases, since 2nmsgsto+ χtimerdecreases.

(5’) sf → s0f uses the [release-event] rule. We have s0fH0siand ν decreases, since 2nmsgsto+ χtimer

decreases.

(6’) sf → s0f uses the [stuck-event] rule. We have s 0

fH

0_s

i and ν decreases, since χtimerdecreases.

(7’) sf → s0f has mte(sf) = 0, and it transitions by a rule not in the pattern module. We assume that

all zero-time rules not in the pattern module are about consuming messages by objects, and additionally the wrapper object is not on either side of these rules. Since sfH0si, we can take a corresponding transition

si→ s0i using the same rule with s0fH0s0i.

This shows that H and H−1 are well-founded simulations, and therefore, we have a bisimulation between the two systems as desired.

This shows that under a strict relation H that does not allow for differences in the faulty model (i.e. no stuck faults occur), then the behavior is a bisimulation, and the added wrapper makes no changes to the behavior of the system. However when a button does become stuck, we can no longer give any guarantees about correct behavior, but we can still detect it.

Theorem 3.5.2. Consider a system in Swrapped. If we have a stuck fault such that there exist two consecutive

press and release events on the input delay(press, t) delay(release, t0) such that t0− t > Tstuck then

the wrapper attribute stuck-err will be set after t + Tstuck time units.

Proof. First, notice that by the characterization of inputs, the press and release events must alternate. Thus, at t time units, we either have the first press event, in which case the timer is initalized to no-timer, or we have the press event following a previous release event which must have been consumed by applying the [release-event] rule, in which case the timer attribute is still set to no-timer. Thus upon receiving

the press event at time t, the rule [set-timer] must be applied. This will set the timer value to be Tstuck

and at t + Tstuck time units, we still have received a release message since t0 > t + Tstuck. Thus, the rule