The 7th International Workshop on Java Technologies for Real-time and - PowerPoint PPT Presentation

The 7th International Workshop on Java Technologies for Real-time and Embedded Systems September 24, 2009 Jean-Pierre Talpin, INRIA

Virtual prototyping Simulation Verification Virtual machines Models of architectures Models of concurrency

Plan Why ? The issue we address How ? Synchronous modeling Introduction to polychrony Modeling programs by data-flow equations Modeling threads, scheduler, resources Applications Conclusions

Java Statemate Simulink Scade Rhapsody … Heterogeneity of skills, teams, tools, methods ARINC CAN JVM ECU AADL Flexray … 653

Java Statemate Simulink Scade Rhapsody … analyse simulate map co-modeling ARINC CAN JVM ECU AADL Flexray … 653

Engineering Mathematics Composition is hard Composition is easy Execution is easy Execution is hard Synchronous modeling Synchronous composition is easier Code generation is a bit harder => Generating code by solving equations in a specific model of computation

Composition of equations over signals x = f (y , z) equation P | Q composition P / x restriction A signal x, y, z is a discrete stream of values Values of a signal x are sampled at a clock ^x 0 1 2 3 4 ... x ^x

4 2 3 1 8 7 2 0 ... y 9 1 8 3 2 0 5 1 ... z 13 3 11 4 10 7 7 1... x x = y + z

4 2 3 1 8 7 2 0 ... y v 4 2 3 1 8 7 2 ... x x = pre y v

4 2 3 1 8 7 2 0 ... y t t f t f t ... z 3 7 0 ... x x = y when z

4 3 1 2 ... y 9 1 8 3 2 0 5 ... z 4 9 1 3 1 3 2 2 5 x x = y default z

Model of concurrency C, C++, SystemC, Java automatic templates GCC SSA automatic SIGNAL automatic Verification

int ones (int data) { bb_0 : d1 = data; int c, d; c1 = 0; d = data; L0 : d3 = phi (d1, d2); c = 0; c3 = phi (c1, c2); if d3 goto L2; while (d) { c += (d & 1); L1 : c2 = (d3 & 1) + c3 d >>= 1; d2 = d3 >>1; } goto L0; return c; L2 : return c3; }

bb_0 = pre false true d1 = data when bb_0 bb_0 : d1 = data; c_1 = 0 when bb_0 c1 = 0; L0 = true when bb_0 L0 : d3 = phi (d1, d2); default pre L1 false c3 = phi (c1, c2); d3 = d1 when bb_0 if d3 goto L2; default d2 when L1 c3 = c1 when bb_0 L1 : c2 = (d3 & 1) + c3 default c2 when L1 d2 = d3 >>1; goto L0; L1 = true when L0 when not d3 c2 = d3 & 1 + c3 when L1 L2 : return c3; d2 = d3 >> 1 when L1 A label is represented by L2 = true when d3 when L0 ones = c3 when L2 a boolean signal

bb_0 = pre false true d1 = data when bb_0 c1 = 0 when bb_0 bb_0 : d1 = data; c1 = 0; L0 = true when bb_0 default pre L1 false L0 : d3 = phi (d1, d2); d3 = d1 when bb_0 c3 = phi (c1, c2); default d2 when L1 if d3 goto L2; c3 = c1 when bb_0 default c2 when L1 L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; L1 = true when L0 when not d3 goto L0; c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 : return c3; L2 = true when d3 when L0 Operations in a block are ones = c3 when L2 guarded by its label

bb_0 = pre false true d1 = data when bb_0 c1 = 0 when bb_0 bb_0 : d1 = data; c1 = 0; L0 = true when bb_0 default pre L1 false L0 : d3 = phi (d1, d2); d3 = d1 when L0 c3 = phi (c1, c2); default d2 when L1 if d3 goto L2; c3 = c1 when L0 default c2 when L1 L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; L1 = true when L0 when not d3 goto L0; c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 : return c3; L2 = true when d3 when L0 Transitions from a block ones = c3 when L2 are guarded by the label

bb_0 = pre false true d1 = data when bb_0 c1 = 0 when bb_0 bb_0 : d1 = data; c1 = 0; L0 = true when bb_0 default pre L1 false L0 : d3 = phi (d1, d2); d3 = d1 when L0 c3 = phi (c1, c2); default d2 when L1 if d3 goto L2; c3 = c1 when L0 default c2 when L1 L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; L1 = true when L0 when not d3 goto L0; c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 : return c3; L2 = true when d3 when L0 Conditional branches are ones = c3 when L2 guarded by the label and condition

bb_0 = pre false true d1 = data when bb_0 c1 = 0 when bb_0 bb_0 : d1 = data; c1 = 0; L0 = true when bb_0 default pre L1 false L0 : d3 = phi (d1, d2); d3 = d1 when L0 c3 = phi (c1, c2); default d2 when L1 if d3 goto L2; c3 = c1 when L0 default c2 when L1 L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; L1 = true when L0 when not d3 goto L0; c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 : return c3; L2 = true when d3 when L0 and so on, ones = c3 when L2

bb_0 = pre false true d1 = data when bb_0 c1 = 0 when bb_0 bb_0 : d1 = data; c1 = 0; L0 = true when bb_0 default (pre L1 false) L0 : d3 = phi (d1, d2); d3 = d1 when L0 c3 = phi (c1, c2); default d2 when L1 if d3 goto L2; c3 = c1 when L0 default c2 when L1 L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; L1 = true when L0 when not d3 goto L0; c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 : return c3; L2 = true when d3 when L0 Going backwards consumes ones = c3 when L2 time

bb_0 = pre false true d1 = data when bb_0 c1 = 0 when bb_0 bb_0 : d1 = data; c1 = 0; L0 = true when bb_0 default (pre L1 false) L0 : d3 = phi (d1, d2); d3 = d1 when bb_0 default c3 = phi (c1, c2); (pre d2 0) when L0 if d3 goto L2; c3 = c1 when L0 default (pre c2 0) when L1 L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; L1 = true when L0 when not d3 goto L0; c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 : return c3; L2 = true when d3 when L0 Phi-nodes are modeled by ones = c3 when L2 merging signals

bb_0 = pre false true d1 = data when bb_0 c1 = 0 when bb_0 bb_0 : d1 = data; c1 = 0; L0 = true when bb_0 default (pre L1 false) L0 : d3 = phi (d1, d2); d3 = d1 when bb_0 default c3 = phi (c1, c2); (pre d2 0) when L0 if d3 goto L2; c3 = c1 when L0 default (pre c2 0) when L1 L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; L1 = true when L0 when not d3 goto L0; c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 : return c3; L2 = true when d3 when L0 One data-flow equation ones = c3 when L2 per SSA instruction

aa_0 : bb_0 : K0 : L0 : yield; yield; K1 : L1 : K2 : return; L2 : return; bb_0 = true when (pre K0 false) � K1 = true when when (pre LO false) L1 = true when (pre K2 false)

bool running bb_0 L0 yield bool yield L1 bool termitaed L2 bb_0 = (pre false true) when running � yield = true when L0 when running terminated = true when L3 when running

tick P1 running1 P2 Scheduler P3 Scheduler | P1 | P2 | P3

tick P1 yield1 P2 Scheduler P3 Scheduler | P1 | P2 | P3

tick P1 P2 P2 running2 Scheduler P3 Scheduler | P1 | P2 | P3

tick P1 terminate2 P2 Scheduler running3 P3 Scheduler | P1 | P2 | P3

tick P1 running1 P2 Scheduler terminate3 P3 Scheduler | P1 | P2 | P3

tick lock P1 write unlock P2 write Scheduler Resource read P3 Scheduler | P1 | P2 | P3 | Resource

SME, a synchronous modeling environment and open-source Eclipse plugin SIGNAL compiler performs static analysis: inconsistent synchronizations, cyclic definitions SIGALI model checker performs dynamic analysis : enforcement of liveness, safety, reachability properties and controller synthesis

Synoptic – a domain-specific design language for spacecraft control software • Structural, architecture components with real-time characteristics • Data-flow diagrams, mode automata, imperative programs Import in SME (using SSA) for formal verification and code generation Connection with RT-Builder for real-time simulation

RT-Builder (Geensys) real-time, hardware in-the-loop, simulation of automotive equipments

Sequential code automatically translated to a synchronous formalism via SSA Parallel programs are modeled by instantiating templates of concurrency primitives Scales to modeling real concurrency and/or architecture modeling concepts : ARINC-653 services, AADL, Synoptic