Operational Semantics of Annotated Reflex Programs.

Reflex is a process-oriented language for developing easy-to-maintain control software for programmable logic controllers. The language has been successfully used in several safety-critical control systems, e.g., in control systems of a silicon single crystal growing furnace and electronic equipment. Currently, the main goal of the Reflex language project is to develop formal verification methods for Reflex programs in order to guarantee increased reliability of the software created on its basis. The paper presents formal operational semantics of Reflex programs extended with annotations describing the formal specification of software requirements as a necessary basis for the application of such methods. A brief review of the Reflex language is given, and a simple example of its use, a control program for a hand dryer, is provided. The concepts of environment and variables shared with the environment are defined, which make it possible to abstract from specific input/output ports. Types of annotations that specify constraints on the values of the variables at program start, constraints on the environment (in particular, on the control object), control cycle invariants, and pre- and postconditions of external functions used in Reflex programs are defined. Annotated Reflex also uses standard annotations assume, assert, and havoc. The operational semantics of annotated Reflex programs uses the global clock and the local clocks of individual processes, the time of which is measured in the number of control cycle iterations, to simulate time constraints on process execution in certain states. It stores a complete history of changes in the values of the shared variables for a more complete description of time properties of the program and its environment. Semantics takes into account the infinity of the program execution cycle, the logic of controlling transitions of processes from state to state and the interaction of processes with each other and with the environment. Extending the formal operational semantics of the Reflex language to annotations simplifies the proof of the correctness of the transformation approach to deductive verification of Reflex programs developed by the authors that transforms an annotated Reflex program to an annotated program on a very limited subset of the C language by reducing a complex proof of preserving the truth of requirements for the program when transforming to a simpler proof of equivalence of the original and resulting annotated programs with respect to their operational semantics. [ABSTRACT FROM AUTHOR]