[PPT] - Static Analysis by Abstract Interpretation of communicating PowerPoint Presentation

SLIDE 1

Static Analysis by Abstract Interpretation of communicating imperfectly-clocked Synchronous Programs

Julien Bertrane bertrane@di.ens.fr 2 d´ ecembre 2006

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 1 / 43

SLIDE 2

Introduction

System to analyse

SOFTWARE

n

synchronous hardware

SOFTWARE

n

synchronous hardware hardware synchronous

SOFTWARE

n

H A R D W A R E HARDWARE (environment, sensors, actuators) HARDWARE (environment, sensors, actuators)

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 2 / 43

SLIDE 3

Modelisation Hypotheses

Difficulties and subsequent hypotheses

Framework includes realistic executions issues : Clock desynchronization allowed Non-constant delays during communications Graphical syntax Simplifications : Quasi-synchrony :

◮ desynchronization : the cycle duration (period between two consecutive

ticks) belongs to [α, β], α > 0.

Presently considered variables only booleans blackboard for synchronous units input Serial transmission between synchronous systems at initialization, all the “variables” are set to false

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 3 / 43

SLIDE 4

Modelisation Hypotheses

Goal : Automatic proofs of specifications

safety specifications

◮ For any behaviour s, at any time t, s(t) = true Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 4 / 43

SLIDE 5

Modelisation Hypotheses

Goal : Automatic proofs of specifications

safety specifications

◮ For any behaviour s, at any time t, s(t) = true

temporal specifications For any behaviour s, there is no t such that : for any t′ ∈ [t, t + α], s(t′) = true

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 4 / 43

SLIDE 6

Modelisation Hypotheses

Goal : Automatic proofs of specifications

safety specifications

◮ For any behaviour s, at any time t, s(t) = true

temporal specifications For any behaviour s, there is no t such that : for any t′ ∈ [t, t + α], s(t′) = true quantitative specifications

◮ the outputs of 2 redondant systems match at least half the time of any

interval of width δ.

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 4 / 43

SLIDE 7

Modelisation Consequences

Typical system :details of hardware hypotheses

(environment, sensors, actuators)

n

synchronous hardware

1 C [1.9;2.1] 2 C [1.9;2.1]

SOFTWARE

n

synchronous hardware

[0.4;0.5]

3 C [0.3;0.4]

wiring HARDWARE

[0.4;0.5] [0.4;0.5]

H A R D W A R E HARDWARE (environment, sensors, actuators)

hardware synchronous

SOFTWARE

n

HARDWARE SOFTWARE

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 5 / 43

SLIDE 8

Modelisation Consequences

Subsequent difficulties

clock skew + delays in communications ⇒ non denumerable set of behaviors

δ−ε,δ+ε 1 O1

?

Xor Synchronous Synchronous system C: system C’: δ−ε,δ+ε I

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 6 / 43

SLIDE 9

Modelisation Consequences

Subsequent difficulties

system 1 ε ε ε ε Synchronous system Synchronous I

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 7 / 43

SLIDE 10

Modelisation Consequences

Subsequent difficulties

ε 1 O1 Xor Synchronous system Synchronous system δ−ε,δ+ε δ−ε,δ+ε C: C’: C"

?

ε ε ε I

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 8 / 43

SLIDE 11

Modelisation Consequences

Subsequent difficulties

ε 1 O1 Xor Synchronous system Synchronous system δ−ε,δ+ε δ−ε,δ+ε C: C’: C"

?

ε ε ε I

Proving specifications is difficult This is not the right way to handle redudancy

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 8 / 43

SLIDE 12

Modelisation Consequences

Behavior of a synchronous system

SOFTWARE

n

synchronous hardware

1 C [1.9;2.1] DISCR SHIFT C :1.9, 2.1 1 C C 1 1

a clock is a function :N → R+ clock parameter : [α, β], with α, β ∈ R+ and 0 < α β a clock c satisfies [α, β] iff cn+1 − cn ∈ [α, β] DISCRC1 models the periodic reading of the input buffer SHIFTC1 models the waiting for the next clock tick, and the emission

f its result at this next clock tick

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 9 / 43

SLIDE 13

Modelisation Semantics

Semantics : choices

Continuous-time semantics instead of classical discrete one (PC,Message passing,...) the semantics connects each point of control to a set of signals (i.e. element of f : R+ → B) a signal belongs to the semantics at point p if there is a vector connecting each any point but p to a signal compatible with p. if no-empty, the semantics often contains a non-countable infinity of signals

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 10 / 43

SLIDE 14

Modelisation Semantics

Semantics of time-independent operators

Or I2 O1 I1

so1(t) =       

true

if si1(t) = true

r si2(t) = true
false else

so1 ΨOR(si1, si2)

si 1 si 2 so 1

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 11 / 43

SLIDE 15

Modelisation Semantics

Semantics of time-dependent operators

I1 O1 DISCRC

[α, β] parameter of clock C so1(t) =       

false

if t < c(0)

si1(cn)

if t ∈ [cn, cn+1) so1 ΨDISCRc(si1)

β

C1 C2 C3 C4 C6 C5 C7 C8

α

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 12 / 43

SLIDE 16

Modelisation Semantics

Syntax and semantics

Syntax Semantics

1 I1 O2 O

∀t ∈ R+, O1(t) = I1(t) ∀t ∈ R+, O2(t) = I1(t)

CONST α

∀t ∈ R+, O1(t) = α

[α,β]

DELAY I1 O1

∀t ∈ R, O1(t) = I1(δ(t)) δ : ∃δ : R → R, monotonic, ∀t ∈ R, δ(t) − t ∈ [α, β]

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 13 / 43

SLIDE 17

Modelisation Semantics

Syntaxe et s´ emantique

D

p 3 p 4

NOT C :0.9, 1.1

p 1 p 2

DISCR C SHIFT C NOT

p 5 p 6 p 7

C’ :0.6, 0.7

[0.4;0.5] [0.;0.]

DISCR C SHIFT C

p

DISCR p 5 p 6 p 7 p p 1 p 2 p 3 p = f t f t f t f t f t f t f t

D

Ψ

DELAY

Ψ

SHIFT

Ψ

SHIFT time: f f f f f f f time: 0 1st Step

Ψ

DELAY 4

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 14 / 43

SLIDE 18

Modelisation Semantics

Syntaxe et s´ emantique

D

p 3 p 4

NOT C :0.9, 1.1

p 1 p 2

DISCR C SHIFT C NOT

p 5 p 6 p 7

C’ :0.6, 0.7

[0.4;0.5] [0.;0.]

DISCR C SHIFT C

p

4 p 5 p 6 p 7 p p 1 p 2 p 3 p = f t f t f t f t f t f t f t C1

D

0 C’ 1

Ψ

DELAY

Ψ

DISCR

Ψ

DISCR time: 2nd Step f f f f f f f f time: 0 f f

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 15 / 43

SLIDE 19

Modelisation Semantics

Syntaxe et s´ emantique

D

p 3 p 4

NOT C :0.9, 1.1

p 1 p 2

DISCR C SHIFT C NOT

p 5 p 6 p 7

C’ :0.6, 0.7

[0.4;0.5] [0.;0.]

DISCR C SHIFT C

p

f p 5 p 6 p 7 p p 1 p 2 p 3 p = f t f t f t f t f t f t f t f f f f f f f C 1

D

C’ 1

Ψ

NOT

Ψ

NOT time: f f f f f f f time: 0 3rd Step f f f f 4

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 16 / 43

SLIDE 20

Modelisation Semantics

Syntaxe et s´ emantique

D

p 3 p 4

NOT C :0.9, 1.1

p 1 p 2

DISCR C SHIFT C NOT

p 5 p 6 p 7

C’ :0.6, 0.7

[0.4;0.5] [0.;0.]

DISCR C SHIFT C

p

4 p 5 p 6 p 7 p p 1 p 2 p 3 p = f t f t f t f t f t f t f t f f f f f f f C1 f f t

D

f f t f C’ 1

Ψ Ψ Ψ

SHIFT DELAY SHIFT time: f f f f f f f 4th Step time: 0

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 17 / 43

SLIDE 21

Modelisation Semantics

Syntaxe et s´ emantique

D

p 3 p 4

NOT C :0.9, 1.1

p 1 p 2

DISCR C SHIFT C NOT

p 5 p 6 p 7

C’ :0.6, 0.7

[0.4;0.5] [0.;0.]

DISCR C SHIFT C

p

4 p 5 p 6 p 7 p p 1 p 2 p 3 p = f t f t f t f t f t f t f t C 2 C1

D

f f f f f f f C’ 1 C’ 2 time: f f t f f t f

Ψ

NOT f f t t 5th Step time: 0

Ψ Ψ

DELAY DISCR

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 18 / 43

SLIDE 22

Modelisation Semantics

Syntaxe et s´ emantique

D

p 3 p 4

NOT C :0.9, 1.1

p 1 p 2

DISCR C SHIFT C NOT

p 5 p 6 p 7

C’ :0.6, 0.7

[0.4;0.5] [0.;0.]

DISCR C SHIFT C

p

f p 5 p 6 p 7 p p 1 p 2 p 3 p = f t f t f t f t f t f t f t C2 C 1

D

f f f f f f f C’ 1 C’ 2 C’ 3 f f t t 6th Step time: 0 time: f f t f f t 4

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 19 / 43

SLIDE 23

Analysis Goals

Not design : specification proof Difficulties : tricks

◮ for robustness to desynchronization ◮ for error recovery ◮ for error robustness

Idea of separation of design people and verification people Automatically generated code : classical patterns difficult to recognize pattern may be simplified because classical academic tricks assume almost nothing Prototype and theory based on Abstract Interpretation Not complete : even safety undecidable

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 20 / 43

SLIDE 24

Analysis Abstract interpretation

Abstract interpretation

A set of elements A# set of abstract elements α : A → A# γ : A# → A

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 21 / 43

SLIDE 25

Analysis Abstract interpretation

Abstract interpretation

A set of elements A# set of abstract elements α : A → A# γ : A# → A A = Z A# = Z/9Z α : x → x mod 9 γ : y → {x, x = y mod 9}

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 21 / 43

SLIDE 26

Analysis Abstract interpretation

Abstract interpretation

A set of elements A# set of abstract elements α : A → A# γ : A# → A A = Z A# = Z/9Z α : x → x mod 9 γ : y → {x, x = y mod 9} +#(4 mod 9, 6 mod 9) = 1 mod 9 if Ψ ◦ γ ⊆ γ ◦ Ψ# gfp Ψ ⊆ γ(gfp Ψ#)

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 21 / 43

SLIDE 27

Analysis Abstract interpretation

Abstract interpretation based analysis

D is the semantics of a set D of systems. [P] is the set of behaviors satisfying a property P. Former goal : Prove that D ⊆ [P]. Now : (Ψ ∩ Id)(D ∩ [¬P]) ⊆ D ∩ [¬P] Thus : D ∩ [¬P] ⊆ gfp[¬P](Ψ ∩ Id) ⊆? ∅ True if (not iff) : gfp#

[¬P](Ψ ∩ Id) ⊆# ∅# = ⊥

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 22 / 43

SLIDE 28

Analysis Abstract interpretation

1st abstract domain

true

1 3 2 4

[3,4]:false <1,2>:true false

A constraint ∃[a; b] : x forces signals to be equal to x at least once during [a; b]. A constraint ∀a; b : x forces signals to be equal to x during the whole [a; b].

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 23 / 43

SLIDE 29

Analysis Abstract interpretation

Abstract Operators and Constraints : an example

α β

[a ,b ]:x

−β −α

ψDelay [α,β] #

<a ,b >:x

−α −β

ψDelay [α,β] #

<a,b>:x

α β

DELAY[ , ]

α β

α

[a,b]:x

β

DELAY[ , ]

← − Ψ #

DELAY[α,β](∃[a; b] : x) ∃[a − β; b − α] : x

← − Ψ #

DELAY[α,β](∀a; b : x) ∀a − α; b − β : x

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 24 / 43

SLIDE 30

Analysis Abstract interpretation

Abstract Operators and Constraints : an example

[µ,ν] −ν

[a ,b ]:x

ν ν

−ν

[a ,b ]:x

ν

−ν

[a ,b ]:x

# ψDISCR [µ,ν] α

[a,b]:x

DISCR[ , ]

µ ν

<a,b>:x

[ , ] DISCR

µ ν

ψDISCR #

← − Ψ #

DISCR[µ,ν](∃[a; b] : x) ∃[a − ν; b] : x

← − Ψ #

DISCR[µ,ν](∀a; b : x) t∈[a,b] ∃[t − ν; t] : x

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 25 / 43

SLIDE 31

Analysis Abstract interpretation

Iterating up to a fixpoint

DELAY 0.,10. DELAY 39,41 DELAY 39,41 t’ 5 AND

True <δ,δ+100>:

t4 t5 t6 t’ 6 t3 t2 DISCR 39,41 t1 DISCR 39,41 t’ 1 t’ 2 NOT Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 26 / 43

SLIDE 32

Analysis Abstract interpretation

Iterating up to a fixpoint

DELAY 0.,10. DELAY 39,41 DELAY 39,41 t’ 5 AND t4 t5 t6 t’ 6 t3 t2 DISCR 39,41 t1 DISCR 39,41 t’ 1 t’ 2

True <δ−39,δ+59>:

NOT Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 27 / 43

SLIDE 33

Analysis Abstract interpretation

Iterating up to a fixpoint

DELAY 0.,10. DELAY 39,41 DELAY 39,41 t’ 5 AND t4 t5 t6 t’ 6 t3 t2 DISCR 39,41 t1 DISCR 39,41 t’ 1 t’ 2

True <δ−39,δ+59>:

NOT Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 28 / 43

SLIDE 34

Analysis Abstract interpretation

Iterating up to a fixpoint

DELAY 0.,10. DELAY 39,41 DELAY 39,41 t’ 5 AND t4 t5 t6 t’ 6 t3 t2 DISCR 39,41 t1 DISCR 39,41 t’ 1 t’ 2

True <δ−39,δ+59>: True <δ−39,δ+59>:

NOT Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 29 / 43

SLIDE 35

Analysis Abstract interpretation

Iterating up to a fixpoint

t

DELAY 0.,10. DELAY 39,41 DELAY 39,41 t’ 5 AND t4 t5 t6 t’ 6 t3 t2 DISCR 39,41 t1 DISCR 39,41 t’ 1 t’ 2

False <δ−39,δ+59>: [t−41,t]: True

NOT

δ−39 < < δ+59

Λ

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 30 / 43

SLIDE 36

Analysis Abstract interpretation

Iterating up to a fixpoint

t

DELAY 0.,10. DELAY 39,41 DELAY 39,41 t’ 5 AND t4 t5 t6 t’ 6 t3 t2 DISCR 39,41 t1 DISCR 39,41 t’ 1 t’ 2

[t−41,t]: False

NOT

δ−39 < < δ+59

Λ

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 31 / 43

SLIDE 37

Analysis Abstract interpretation

Iterating up to a fixpoint

DELAY 0.,10. DELAY 39,41 DELAY 39,41 t’ 5 AND t4 t5 t6 t’ 6 t3 t2 DISCR 39,41 t1 DISCR 39,41 t’ 1 t’ 2

[t−51,t]: False δ−39 < < δ+59

Λ

t

NOT Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 32 / 43

SLIDE 38

Analysis Abstract interpretation

Iterating up to a fixpoint

t

DELAY 0.,10. DELAY 39,41 DELAY 39,41 t’ 5 AND t4 t5 t6 t’ 6 t3 t2 DISCR 39,41 t1 DISCR 39,41 t’ 1 t’ 2

[t−92,t−39]: False

NOT

δ−39 < < δ+59

Λ

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 33 / 43

SLIDE 39

Analysis Abstract interpretation

Iterating up to a fixpoint

t

DELAY 0.,10. DELAY 39,41 DELAY 39,41 t’ 5 AND t4 t5 t6 t’ 6 t3 t2 DISCR 39,41 t1 DISCR 39,41 t’ 1 t’ 2

[t−92,t−39]: False

NOT

δ−39 < < δ+59

Λ

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 34 / 43

SLIDE 40

Analysis Abstract interpretation

Example : Result of the analysis

Hence no behaviour can satisfy at control point t4 : δ − 39, δ + 59 : True and

δ−39tδ+59

([t − 92, t − 39] : False) because it implies [δ − 33, δ + 20] : False

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 35 / 43

SLIDE 41

Analysis Abstract interpretation

Weaknesses of the Constraints domain

Weak loss of precision in the case of : DELAY, DISCR, SHIFT, NOT, Unwished loss of precision in the case of : AND, OR, XOR

O1 AND I1 I2

∀0; 5 : false

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 36 / 43

SLIDE 42

Analysis Abstract interpretation

2nd Abstract Dom. : Changes Counting Dom.

2 1 3 4 width=δ # value chng 5 width=δ # value chng 5 width= δ false true # value chng 5

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 37 / 43

SLIDE 43

Analysis Abstract interpretation

Time-dependent Abstract Operators inside the Changes Counting Domain

<1 value changes

α α β

DISCRC [α, β] parameter of clock C − → Ψ #

DISCR[α,β]( ) (1, α)

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 38 / 43

SLIDE 44

Analysis Abstract interpretation

Time-independent Abstract Operators inside the Changes Counting Domain

AND

2.1 changes 4.7 <3 value changes <5 value

implies implies

− → Ψ #

AND((n1, δ1), (n2, δ2)) (

n1 + n2, δ1)

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 39 / 43

SLIDE 45

Analysis Abstract interpretation

Time-independent Abstract Operators inside the Changes Counting Domain

AND

2.1 changes <5 value <3 value changes 2.1 <8 value changes 2.1

implies implies

− → Ψ #

AND((n1, δ1), (n2, δ2)) (

n1 + n2, δ1)

◮ ϕ is a reframing function and Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 39 / 43

SLIDE 46

Analysis Abstract interpretation

Time-independent Abstract Operators inside the Changes Counting Domain

AND

2.1 changes <5 value <3 value changes 2.1 <8 value changes 2.1

implies implies

− → Ψ #

AND((n1, δ1), (n2, δ2)) (

n1 + n2, δ1)

◮ ϕ is a reframing function and ◮ ϕ((n1, δ1), (n2, δ2)) = ((

n1, δ1), ( n2, δ1)).

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 39 / 43

SLIDE 47

Analysis Abstract interpretation

Reduced Product Constraints-Changes Counting Domain

width= δ :x :x

. . .

:x : x :x # value chng 1

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 40 / 43

SLIDE 48

Analysis Abstract interpretation

Reduced Product Constraints-Changes Counting Domain

width= δ :x :x

. .

:x

.

# value chng 1

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 41 / 43

SLIDE 49

Analysis Abstract interpretation

3rd abstract domain : Integral bounding Dom.

<1

2 1 3 4

β β+2 α α+2

false true

<1

Express quantitative properties

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 42 / 43

SLIDE 50

Conclusion

Realistic ( ?) model of execution of imperfectly-clocked communicating synchronous systems (imperfect clocks, non-instantaneous delays, blackboard) Syntax includes annotations about hardware imperfections Semantics mixes discrete/continuous notions, but mainly continuous-time Analysis retrieves discrete behaviors (Value changes counting) Need for a better knowledge of robustness/redundancy techniques

Julien Bertrane bertrane@di.ens.fr () Imperfectly-clocked Synchronous Programs 2 d´ ecembre 2006 43 / 43