4.1 Definitions
In the following, let N be a countable set of indexes (in practice, we set \(N=\mathbb Z\)). An index set is a finite subset of N. Given a set S and an index set I, S is indexed by I iff there exists a bijective mapping from I to S. If S is indexed by I, we write \(S=\{s_i\}_{i\in I}\). An index set parameter is a variable whose domain is the set of finite subsets of N.
Definition 1
An architectural configuration is a pair (C, E), where C is a set of components and \(E \subseteq C \times C\) is a set of connections between components.
We now define a more structured version of architecture, still flat but in which components are grouped into sets. We use indexed sets of components. For example, \(I=\{1,2,3\}\) is a set of indexes and \(C=\{c_1,c_2,c_3\}\) and \(C'=\{c'_1,c'_2,c'_3\}\) are two sets of components indexed by I.
Definition 2
An architectural structured configuration is a pair \((\mathcal {C}, E)\), where:
-
\(\mathcal {C}\) is a finite set of disjoint sets of components indexed by some index sets;
-
\(E \subseteq \bigcup _{C\in \mathcal {C}} \times \bigcup _{C\in \mathcal {C}}\) is a set of connections between components.
If \(c\in C\) and \(C\in \mathcal {C}\) we write simply (abusing notation) \(c\in \mathcal {C}\).
For example, consider index sets \(I_1,I_2\), where \(I_1=\{1,2,3\}\), \(I_2=\{2\}\), \(\mathcal {C}=\{C_1,C_2, C_3\}\), \(C_1=\{c_{1i}\}_{i\in I_1}\), \(C_2=\{c_{2i}\}_{i\in I_1}\), \(C_3=\{c_{3i}\}_{i\in I_2}=\{c_{32}\}\), \(E=\{\langle c_{1i},c_{2i}\rangle \mid i\in I_1\}\).
Definition 3
A system of parameters is a pair \((\mathcal {I}, \mathcal {V})\) where \(\mathcal {I}\) is a finite set of symbols for index set parameters and \(\mathcal {V}\) is a finite set of symbols for indexed sets of parameters, where each \(V \in \mathcal {V}\) is associated with an index set parameter symbol \(I_V \in \mathcal {I}\) and with a sort \(\texttt {sort} _V\) (in practice, \(\texttt {sort} _V \in \{\texttt {bool} , \texttt {int} \}\)).
Definition 4
An assignment to a system of parameters \((\mathcal {I},\mathcal {V})\) is a tuple \(\mu =(\mu _\mathcal {I}, \{\mu _V\}_{V\in \mathcal {V}})\), where
-
\(\mu _\mathcal {I}: \mathcal {I} \rightarrow \{S \subset N: S \text {finite}\}\);
-
For \(V\in \mathcal {V}\), \(\mu _V: \mu _\mathcal {I}(I_V) \rightarrow R(sort_V)\) (in practice, \(R(\texttt {bool} ) = \mathbb {B} = \{\top , \bot \}\) and \(R(\texttt {int} ) = \mathbb {Z}\)).
The following definitions refer to formulas of the logic for systems of parameters and the evaluation (under an assignment \(\mu \)) \(\llbracket \mathord {\cdot }\rrbracket _\mu \) of its expressions and formulas. These are defined later in Sect. 4.2.
Definition 5
A parametrized architecture is a tuple \(A=(\mathcal {I},\mathcal {V},\mathcal {P},\varPsi ,\varPhi )\) where
-
\((\mathcal {I}, \mathcal {V})\) is a system of parameters;
-
\(\mathcal {P}\) is a finite set of parametrized indexed sets of components; each set \(P\in \mathcal {P}\) is associated with an index set \(I_P\in \mathcal {I}\);
-
\(\varPsi =\{\psi _P(x)\}_{P\in \mathcal {P}}\) is a set of formulas (component guards) over \((\mathcal {I}, \mathcal {V})\) and a free variable x;
-
\(\varPhi =\{\phi _{PQ}(x,y)\}_{P,Q\in \mathcal {P}}\) is a set of formulas (connection guards) over \((\mathcal {I}, \mathcal {V})\) and free variables x, y.
Given an assignment \(\mu \) to the system of parameters \((\mathcal {I}, \mathcal {V})\), the instantiated (structured architectural) configuration defined by the assignment \(\mu \) is given by \(\mu (A):= (\mathcal {C},E)\) (we also write \((\mathcal {C}_\mu ,E_\mu )\)) where
-
\(\mathcal {C} = \{C_{\mu P}: P \in \mathcal {P}\}\). For all \(C_{\mu P}\in \mathcal {C}\), for all indexes i, \(c_{Pi} \in C_{\mu P}\) iff \(i\in \mu _{\mathcal {I}}(I_P)\) and \(\llbracket \psi _P(i/x)\rrbracket _\mu = \top \).
-
for all \(C_{\mu P},C_{\mu Q}\in \mathcal {C}\), for all component instances \(c_{Pi}\in C_{\mu P}\), \(c_{Qj}\in C_{\mu Q}\), \((c_{Pi},c_{Qj})\in E\) iff \(\llbracket \phi _{PQ}(i/x,j/y)\rrbracket _\mu = \top \).
Syntactic restrictions: formulas in \(\varPsi \) and \(\varPhi \) are quantifier-free and do not contain index set predicates \(=\), \(\subseteq \).
Example: For \(\mathcal {I}=\{I_1,I_2\}\), \(\mathcal {V}=\{V\}\), V a set of Boolean variables, with \(I_V=I_1\), \(\mathcal {P}=\{P_1,P_2,P_3\}\), \(I_{P_1}=I_1\), \(I_{P_2}=I_1\), \(I_{P_3}=I_2\), \(\psi _{P_1}(x) = \psi _{P_2}(x) = \psi _{P_3}(x):=\top \), \(\phi _{P_1P_2}(x,y):=x=y\wedge x\in I_V\wedge V[x]\), \(\phi _{P_1P_3}(x,y):=x\in I_V\wedge \lnot V[x]\), \(\phi _{P_2P_3}(x,y)=\phi _{P_2P_1}(x,y)=\phi _{P_3P_1}(x,y)=\phi _{P_3P_2}(x,y):=\bot \). By assigning \(\mu _\mathcal {I}(I_1)=\{1,2,3\}\), \(\mu _\mathcal {I}(I_2)=\{2\}\), \(\mu _V(1)=\mu _V(2)=\mu _V(3)=\top \), we get the configuration in the previous example.
Definition 6
A dynamic parametrized architecture is a tuple \((A, \iota , \kappa , \tau )\), where
-
\(A = (\mathcal {I},\mathcal {V},\mathcal {P},\varPsi ,\varPhi )\) is a parametrized architecture;
-
\(\iota \) is a formula over \((\mathcal {I}, \mathcal {V})\), specifying the set of initial assignments;
-
\(\kappa \) is a formula over \((\mathcal {I}, \mathcal {V})\), specifying the invariant;
-
\(\tau \) is a transition formula over \((\mathcal {I}, \mathcal {V})\), specifying the reconfiguration transitions.
The dynamic parametrized architecture defines a dynamically changing architecture as a transition system over (structured architectural) configurations obtained by instantiation from A. The set of initial configurations is given by
A configuration \(\mu '(A)\) is directly reachable from a configuration \(\mu (A)\) iff
and
.
Syntactic restrictions:
-
\(\iota \) is of the form \(\forall _{\underline{I}_1}\underline{i}_1\forall _{\underline{I}_2^C}\underline{i}_2\ \alpha \), where \(\alpha \) is a quantifier-free formula in which index set predicates \(=\), \(\subseteq \) do not appear under negation.
-
\(\kappa \) is a quantifier-free formula without index set predicates \(=\), \(\subseteq \).
-
\(\tau \) is a disjunction of transition formulas of the form \(\exists _{\underline{I}_1}\underline{i}_1\exists _{\underline{I}_2^C} \underline{i}_2 \left( \alpha \wedge \beta \wedge \gamma _\beta \right) \) where \(\underline{I}_1,\underline{I}_2 \subseteq \mathcal I\), \(\alpha \) is a quantifier-free formula, \(\beta \) is a conjunction of transition formulas of the forms 1) \(I' = I \cup \{t_k\}_k\), 2) \(I' = I \setminus \{t_k\}_k\), 3) \(t \in I'\), 4) \(V'[t] = e\), 5) \(\forall _{I'_{V'}} j\ V'[j] = e\), where \(I\in \mathcal I,I'\in \mathcal I'\) are variables of sort is (each variable \(I'\in \mathcal I'\) may appear at most once), \(t,t_k\) are terms over \((\mathcal {I}, \mathcal {V})\) of sort idx, \(V'\in \mathcal {V'}\) is a variable of one of the sorts \(\texttt {vs} _k\) (for each \(V'\), either atoms of the form 4 appear in \(\beta \), or at most a single atom of the form 5 appears: atoms of forms 4, 5 never appear together), e are terms over \((\mathcal {I}, \mathcal {V})\) of sorts \(\texttt {el} _k\), and j is a variable of sort idx; furthermore, value \(V'[t_k]\) of every introduced (by an atom of form 1,with \(I' = I'_{V'}\) and \(I = I_V\)) parameter must be set in \(\beta \) with an atom of form 4 or 5; finally, the frame condition \(\gamma _\beta \) is a conjunction of
-
transition formulas \(\forall _{I'_{V'}} j \left( \left( \bigwedge _{t\in t_{ V'}}(j\ne t)\right) \rightarrow V'[j]=V[j]\right) \) for all \(V' \in \mathcal {V}\) which do not appear in a conjunct of form 5 in \(\beta \), where \(t_{V'}\) is the (possibly empty) set of all terms which appear as indexes of \(V'\) in \(\beta \), and
-
transition formulas \(I' = I\) for all \(I' \in \mathcal {I}'\) which do not appear in conjuncts of forms 1, 2 in \(\beta \).
(In practice, when specifying the transition formulas, the frame condition \(\gamma _\beta \) is generated automatically from \(\beta \), instead of being specified directly by the user.)
Example: Consider the parametrized architecture from the previous example, with \(\iota :=I_1=\{1,2,3\}\wedge I_2=\{2\}\wedge V[1]\wedge V[2]\wedge V[3]\); , \(\kappa :=\top \) and \(\tau :=\tau _1\vee \tau _2\), where \(\tau _1:=\exists _{I_1^C}i\left( I_1'=I_1\cup \{i\}\wedge V'[i]\right) \) and \(\tau _2:=\exists _{I_1} i\left( \lnot V'[i]\right) \). This defines the set of initial architectures which contains only the single architecture from the previous example and two transitions. The transition \(\tau _1\) adds a new index \(i\in I_1^C\) into the index set \(I_1\), adding two new components \(C_{1i}\) and \(C_{2i}\) and a new parameter V[i] and sets the value of the newly added parameter V[i] to \(\top \), adding a connection between the two new components \(C_{1i}\) and \(C_{2i}\). The transition \(\tau _2\) changes the value of some V[i] to \(\bot \), removing the connection between components \(C_{1i}\) and \(C_{2i}\) and adding connections between component \(C_{1i}\) and each of the components \(C_{3j},j\in I_2\).
Definition 7
Given a dynamic parametrized architecture \((A, \iota , \kappa , \tau )\), where \(A = (\mathcal {I}, \mathcal {V},\mathcal {P}, \varPsi ,\varPhi )\), a configuration is an assignment to the system of parameters \((\mathcal {I}, \mathcal {V})\). For a configuration \(\mu (A) = (\mathcal {C}, E)\), a communication event is a connection \(e \in E\).
Trace of the dynamic parametrized architecture is a sequence \(e_1, e_2, \ldots \) of configurations and communication events, such that:
-
\(e_1 = \mu _1\) is a configuration such that \(\mu _1(A)\) is in the set of initial configurations.
-
The subsequence \(e_{k_1}, e_{k_2}, \ldots \) of all configurations in the trace is such that for all \(k_i\), \(e_{k_{i+1}}(A)\) (if it exists) is directly reachable from \(e_{k_i}(A)\).
-
For all communication events \(e_k = (c_k, c_k')\) in the trace, \((c_k, c_k') \in E_{e_{r(k)}}\), where \(e_{r(k)}\), \(r(k) := \max \{n \in \mathbb {N}: n < k, e_n \text {is a configuration}\}\), is the last configuration prior to \(e_k\).
Definition 8
An instance of the dynamic information flow problem is a tuple \((D, P_{src}, \rho _{src}, P_{dst}, \rho _{dst})\) where
-
\(D=(A,\iota ,\kappa ,\tau )\) is a dynamic parametrized architecture;
-
\(P_{src}\in \mathcal P_A\) and \(P_{dst}\in \mathcal P_A\) are (source and destination) parametrized indexed sets of components;
-
\(\rho _{src}(x)\) and \(\rho _{dst}(x)\) (source and destination guard) are formulas over \((\mathcal I_A,\mathcal V_A)\).
The problem is to determine whether there exists a finite trace (called information flow witness trace) \(e_1, e_2, \ldots , e_n\) of D with a subtrace \(e_{k_1} = (c_{k_1}, c_{k_1}'), \ldots , e_{k_m} = (c_{k_m}, c_{k_m}')\) of communication events such that:
-
\(c_{k_1}=c_{P_{src}i_{src}}\in C_{e_{r(k_1)}P_{src}}\) for some \(i_{src}\), and \(\llbracket \rho _{src}( i_{src}/x)\rrbracket _{e_{r(k_1)}}=\top \) (the information originates in a source component);
-
\(c_{k_m}'=c_{P_{dst}i_{dst}}\in C_{e_{r(k_m)}P_{dst}}\) for some \(i_{dst}\), and \(\llbracket \rho _{dst}( i_{dst}/x)\rrbracket _{e_{r(k_m)}}=\top \) (the information is received by a destination component);
-
for all n such that \(1 \le n < m\), \(c_{k_n}' = c_{k_{n+1}}\) (the intermediate components form a chain over which the information propagates);
-
for all n, \(1 \le n < m\), for all configurations \(e_{k'}\) such that \(k_n< k' < k_{n+1}\), \(c_{k_{n+1}} \in \mathcal {C}_{e_{k'}}\) (after an intermediate component receives the information and before it passes it on, it is not replaced by a fresh component with the same index).
If such a trace exists, we say that information may flow from a source component which satisfies the source condition given by \(P_{src},\rho _{src}\) to a destination component which satisfies the destination condition given by \(P_{dst},\rho _{dst}\).
Syntactic restrictions: \(\rho _{src}\) and \(\rho _{dst}\) are quantifier-free formulas, without index set predicates \(=\), \(\subseteq \).
4.2 Logic for Systems of Parameters
In the following, we define a many-sorted first-order logic [15]. Signatures contain no quantifier symbols except those explicitly mentioned.
Syntax. Theory \(T_{IDX} = (\varSigma _{IDX}, \mathcal C_{IDX})\) of indexes with a single sort idx (in practice, we are using the theory of integers with sort int and with standard operators).
A finite number K of theories \(T_{EL_k} = (\varSigma _{EL_k}, \mathcal C_{EL_k})\) of elements, each with a single sort \(\texttt {el} _k\) with a distinguished constant symbol \(d_{\texttt {el} _k}\) (a default value) (in practice, we consider the theory of booleans with sort bool and the theory of integers, the same as the theory \(T_{IDX}\)).
The theory \(SP^{EL_1,\ldots ,EL_K}_{IDX}\) (or simply \(SP^{EL}_{IDX}\)) of systems of parameters with indexes in \(T_{IDX}\) and elements in \(EL_1,\ldots ,EL_K\) is a combination of the above theories. Its sort symbols are idx, is, \(\texttt {el} _1,\ldots ,\texttt {el} _K\), \(\texttt {vs} _1,\ldots ,\texttt {vs} _K\), where is is a sort for index sets and \(\texttt {vs} _k\) is a sort for indexed sets of parameters of sort \(\texttt {el} _k\). The set of variable symbols for each sort \(\texttt {vs} _k\) contains a countable set of variables \(\{V^I_{k,n}\}_{n\in \mathbb {N}}\) for each variable symbol I of sort is (we omit the superscript and subscripts when they are clear from the context). The signature is the union of the signatures of the above theories, \(\varSigma _{IDX}\cup \bigcup _{k=1}^K\varSigma _{EL_k}\), with the addition of: for sort idx, quantifier symbols \(\forall \), \(\exists \), and \(\forall _I\), \(\forall _{I^C}\), \(\exists _I\), \(\exists _{I^C}\) for all variables I of the sort is; predicate symbol \(\in \) of sort \((\texttt {idx} ,\texttt {is} )\); predicate symbols \(=, \subseteq \) of sort \((\texttt {is} ,\texttt {is} )\); function symbols \(\cup , \cap , \setminus \) of sort \((\texttt {is} ,\texttt {is} ,\texttt {is} )\); for every \(n\in \mathbb N\), n-ary function symbol \(\{\mathord {\cdot },\ldots ,\mathord {\cdot }\}^{(n)}\) (we write simply \(\{\mathord {\cdot },\ldots ,\mathord {\cdot }\}\)) of sort \((\texttt {idx} ,\ldots ,\texttt {idx} ,\texttt {is} )\); function symbols \(\mathord {\cdot }[\mathord {\cdot }]_k,k=1,\ldots ,K\) (we write simply \(\mathord {\cdot }[\mathord {\cdot }]\)) of sorts \((\texttt {vs} _k,\texttt {idx} ,\texttt {el} _k)\).
Semantics. A structure \(\mathcal M = (\texttt {idx} ^\mathcal M,\texttt {is} ^\mathcal M, \texttt {el} _1^\mathcal M,\ldots ,\texttt {el} _k^\mathcal M, \texttt {vs} _1^\mathcal M,\ldots ,\texttt {vs} _k^\mathcal M, \mathcal I_\mathcal M)\) for \(SP^{EL}_{IDX}\) is restricted in the following manner:
-
\(\texttt {is} ^\mathcal M\) is the power set of \(\texttt {idx} ^\mathcal M\);
-
each \(\texttt {vs} _k^\mathcal M\) is the set of all (total and partial) functions from \(\texttt {idx} ^\mathcal {M}\) to \(\texttt {el} _k^\mathcal {M}\);
-
\(\in \) is interpreted as the standard set membership predicate;
-
\(=\), \(\subseteq \) are interpreted as the standard set equality and subset predicates;
-
\(\cup \), \(\cap \), \(\setminus \) are interpreted as the standard set union, intersection and difference on \(\texttt {is} ^\mathcal M\), respectively;
-
for every \(n\in \mathbb N\), \(\mathcal I_\mathcal M (\{\mathord {\cdot },\ldots ,\mathord {\cdot }\}^{(n)})\) is the function that maps the n-tuple of its arguments to the set of indexes containing exactly the arguments, i.e. it maps every \((x_1,\ldots ,x_n) \in (\texttt {idx} ^\mathcal M)^n\) to \(\{x_1,\ldots ,x_n\} \in \texttt {is} ^\mathcal M\);
-
\(\mathord {\cdot }[\mathord {\cdot }]_k, k=1,\ldots ,K\) are interpreted as function applications:
.
The structure \(\mathcal {M}\) is a model of
iff it satisfies the above restrictions and
,
are models of
, \(T_{EL_1}, \ldots ,T_{EL_K}\), respectively.
Definition 9
A formula (resp. term) over a system of parameters \((\mathcal I, \mathcal V)\) is a formula (resp. term) of the logic \(SP^{EL}_{IDX}\) in which the only occurring symbols of sort idx are from \(\mathcal I\) and the only occurring symbols of sort \(\texttt {vs} _k\) are from the set \(\{V \in \mathcal V: \texttt {sort} _V = \texttt {el} _k\}\), for \(k=1,\ldots ,K\). Furthermore, in the formula all accesses \(V[\mathord {\cdot }]\) to parameters \(V\in \mathcal V\) are guarded parameter accesses, i.e. each atom \(\alpha (V[t])\) that contains a term of the form V[t] must occur in conjunction with a guard which ensures that index term t is present in the corresponding index set: \(t\in I_V\wedge \alpha (V[t])\).
Definition 10
A transition formula over the system of parameters \((\mathcal I, \mathcal V)\) is a formula of the logic \(SP^{EL}_{IDX}\) in which the only occurring symbols of sort idx are from \(\mathcal I \cup \mathcal I'\) and the only occurring symbols of sort \(\texttt {vs} _k\) are from the set \(\{W \in \mathcal V\cup \mathcal V': \texttt {sort} _W = \texttt {el} _k\}\), for \(k=1,\ldots ,K\). Furthermore, all accesses \(W[\mathord {\cdot }]\) to parameters \(W\in \mathcal V\cup \mathcal V'\) are guarded parameter accesses (as defined in Definition 9).
The subscripted quantifier symbols are a syntactic sugar for quantification over index sets and their complements: all occurrences of the quantifiers \(\forall _I i\ \phi \), \(\forall _{I^C} i\ \phi \), \(\exists _I i\ \phi \), \(\exists _{I^C} i\ \phi \)—where I is a variable of sort is, i is a variable of sort idx, and \(\phi \) is a formula—are rewritten to \(\forall i\ (i \in I \rightarrow \phi )\), \(\forall i\ (i \not \in I \rightarrow \phi )\), \(\exists i\ (i \in I \wedge \phi )\), \(\exists i\ (i \not \in I \wedge \phi )\), respectively, after which the formula is evaluated in the standard manner.
Definition 11
Evaluation \(\llbracket \phi \rrbracket _\mu \) with respect to an assignment \(\mu \) to a system of parameters \((\mathcal I, \mathcal V)\), of a formula (or a term) \(\phi \) over \((\mathcal I, \mathcal V)\) is defined by interpreting I with \(I^\mathcal M = \mu _\mathcal I(I)\) for every \(I \in \mathcal I\) and interpreting V[x] as follows for every \(V \in \mathcal {V}\): \((V[x])^\mathcal {M} = \mu _V(x^\mathcal {M})\) if \(x^\mathcal {M} \in \mu (I_V)\), and \((V[x])^\mathcal {M} = d_{\texttt {sort} _V}^\mathcal M\) otherwise. The evaluation \(\llbracket \phi \rrbracket _{\mu \mu '}\) of a transition formula with respect to two assignments \(\mu \), \(\mu '\) is defined by interpreting, in the above manner, \((\mathcal {I},\mathcal {V})\) with \(\mu \) and \((\mathcal {I}',\mathcal {V}')\) with \(\mu '\).