The Clock Constraint Specification Language (CCSL) is a clock-based formalism for the specification and analysis of real-time embedded systems. The major goal of schedulability analysis of CCSL specifications is to solve the schedule problem, which is to answer ‘whether there exists a clock behaviour (also called a ‘schedule’) that conforms to a given CCSL specification’. Existing works on schedulability analysis of CCSL specifications are mainly based on model checking or SMT-solving. In this paper, however, we propose a theorem-proving approach to the problem. To this end, we define a clock-based dynamic logic (cDL) in which we can specify the clock behaviours and the clock relations in CCSL. With cDL, given a CCSL specification SP, we can express its schedule problem as a cDL formula . Then solving the schedule problem is equivalent to checking the validity of in the proof system of cDL. By analyzing the proof tree of , we can generate a concrete schedule satisfying SP. Compared to the previous approaches, our method is not limited to special types of CCSL specifications and schedules and does not depend on the bounds that are set for approximate checking. We implement our cDL in Coq. We use an example throughout the paper to illustrate our method.

۱٫ Introduction

The clock constraint specification language (CCSL) [2] is a specification language for specifying the constraints between the occurrences of events in real-time embedded systems (RTESs). It was firstly defined as an annex of UML/MARTE [3], but later developed as an independent language equipped with a formal semantics [4]. CCSL gives a concrete syntax to deal with logical clocks, made popular by Leslie Lamport [5] and synchronous languages (such as Esterel). In CCSL, ‘clocks’ are treated as first-class citizens for capturing discrete-time events, and clock expressions are used for specifying the logical and chronometrical constraints between the occurrences of events. CCSL is a specification language and not a programminglanguage. It only allows an abstract specification of a set of possible behaviours and does not attempt to provide a single operational deterministic execution. All the values are ignored to focus only on clock issues. CCSL has been widely used in the specification and analysis of different RTESs, e.g. see [6–۸].