Search

Reflex is a process-oriented language that provides a design of easy-to-maintain control software for programmable logic controllers. The language has been successfully used in a several reliability critical control systems, e. g. control software for a silicon single crystal growth furnace and electronic equipment control system. Currently, the main goal of the Reflex language project is to develop formal verification methods for Reflex programs in order to guarantee increased reliability of the software created on its basis. The paper presents the formal operational semantics of Reflex programs extended by annotations describing the formal specification of software requirements as a necessary basis for the application of such methods. A brief overview of the Reflex language is given and a simple example of its use – a control program for a hand dryer – is provided. The concepts of environment and variables shared with the environment are defined that allows to disengage from specific input/output ports. Types of annotations that specify restrictions on the values of the variables at program launch, restrictions on the environment (in particular, on the control object), invariants of the control cycle, pre- and postconditions of external functions used in Reflex programs are defined. Annotated Reflex also uses standard annotations assume, assert and havoc. The operational semantics of the annotated Reflex programs uses the global clock as well as the local clocks of separate processes, the time of which is measured in the number of iterations of the control cycle, to simulate time constraints on the execution of processes at certain states. It stores a complete history of changes of the values of shared variables for a more precise description of the time properties of the program and its environment. Semantics takes into account the infinity of the program execution cycle, the logic of process transition management from state to state and the interaction of processes with each other and with the environment. Extending the formal operational semantics of the Reflex language to annotations simplifies the proof of the correctness of the transformation approach to deductive verification of Reflex programs developed by the authors, transforming an annotated Reflex program to an annotated program in a very limited subset of the C language, by reducing a complex proof of preserving the truth of program requirements during the transformation to a simpler proof of equivalence of the original and the resulting annotated programs with respect to their operational semantics.

Reflex is a process-oriented language for developing easy-to-maintain control software for programmable logic controllers. The language has been successfully used in several safety-critical control systems, e.g., in control systems of a silicon single crystal growing furnace and electronic equipment. Currently, the main goal of the Reflex language project is to develop formal verification methods for Reflex programs in order to guarantee increased reliability of the software created on its basis. The paper presents formal operational semantics of Reflex programs extended with annotations describing the formal specification of software requirements as a necessary basis for the application of such methods. A brief review of the Reflex language is given, and a simple example of its use, a control program for a hand dryer, is provided. The concepts of environment and variables shared with the environment are defined, which make it possible to abstract from specific input/output ports. Types of annotations that specify constraints on the values of the variables at program start, constraints on the environment (in particular, on the control object), control cycle invariants, and pre- and postconditions of external functions used in Reflex programs are defined. Annotated Reflex also uses standard annotations assume, assert, and havoc. The operational semantics of annotated Reflex programs uses the global clock and the local clocks of individual processes, the time of which is measured in the number of control cycle iterations, to simulate time constraints on process execution in certain states. It stores a complete history of changes in the values of the shared variables for a more complete description of time properties of the program and its environment. Semantics takes into account the infinity of the program execution cycle, the logic of controlling transitions of processes from state to state and the interaction of processes with each other and with the environment. Extending the formal operational semantics of the Reflex language to annotations simplifies the proof of the correctness of the transformation approach to deductive verification of Reflex programs developed by the authors that transforms an annotated Reflex program to an annotated program on a very limited subset of the C language by reducing a complex proof of preserving the truth of requirements for the program when transforming to a simpler proof of equivalence of the original and resulting annotated programs with respect to their operational semantics. [ABSTRACT FROM AUTHOR]