The 7th International Workshop on Java Technologies for Real-time and - - PowerPoint PPT Presentation

The 7th International Workshop on Java Technologies for Real-time and Embedded Systems

September 24, 2009 Jean-Pierre Talpin, INRIA

Virtual prototyping Simulation Verification Virtual machines Models of architectures Models of concurrency

Plan Why ? The issue we address How ? Synchronous modeling Introduction to polychrony Modeling programs by data-flow equations Modeling threads, scheduler, resources Applications Conclusions

Java Statemate Simulink Scade Rhapsody … CAN JVM ARINC 653 AADL Flexray ECU

Heterogeneity

• f skills,

teams, tools, methods

…

co-modeling

analyse simulate map

Java Statemate Simulink Scade Rhapsody … CAN JVM ARINC 653 AADL Flexray ECU …

Engineering Mathematics Composition is easy Execution is hard Composition is hard Execution is easy Synchronous modeling Synchronous composition is easier Code generation is a bit harder => Generating code by solving equations in a specific model of computation

Composition of equations over signals x = f (y , z) equation P | Q composition P / x restriction A signal x, y, z is a discrete stream of values Values of a signal x are sampled at a clock ^x 0 1 2 3 4 ...

x ^x

x = y + z

y z

4 2 3 1 8 7 2 0 ... 9 1 8 3 2 0 5 1 ... 13 3 11 4 10 7 7 1...

x

x = pre y v

y

4 2 3 1 8 7 2 0 ...

x

v 4 2 3 1 8 7 2 ...

x = y when z

y

4 2 3 1 8 7 2 0 ...

x

3 7 0 ...

z

t t f t f t ...

x = y default z

y z

4 3 1 2 ... 9 1 8 3 2 0 5 ...

x

4 9 1 3 1 3 2 2 5

C, C++, SystemC, Java SIGNAL GCC SSA Verification

automatic automatic automatic

Model of concurrency

templates

int ones (int data) { int c, d; d = data; c = 0; while (d) { c += (d & 1); d >>= 1; } return c; } bb_0 : d1 = data; c1 = 0; L2 : return c3; L0 : d3 = phi (d1, d2); c3 = phi (c1, c2); if d3 goto L2; L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; goto L0;

bb_0 : d1 = data; c1 = 0; L2 : return c3; L0 : d3 = phi (d1, d2); c3 = phi (c1, c2); if d3 goto L2; L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; goto L0; bb_0 = pre false true d1 = data when bb_0 c_1 = 0 when bb_0 L0 = true when bb_0 default pre L1 false d3 = d1 when bb_0 default d2 when L1 c3 = c1 when bb_0 default c2 when L1 L1 = true when L0 when not d3 c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 = true when d3 when L0

• nes = c3 when L2

A label is represented by a boolean signal

bb_0 : d1 = data; c1 = 0; L2 : return c3; L0 : d3 = phi (d1, d2); c3 = phi (c1, c2); if d3 goto L2; L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; goto L0; bb_0 = pre false true d1 = data when bb_0 c1 = 0 when bb_0 L0 = true when bb_0 default pre L1 false d3 = d1 when bb_0 default d2 when L1 c3 = c1 when bb_0 default c2 when L1 L1 = true when L0 when not d3 c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 = true when d3 when L0

• nes = c3 when L2

Operations in a block are guarded by its label

bb_0 : d1 = data; c1 = 0; L2 : return c3; L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; goto L0; bb_0 = pre false true d1 = data when bb_0 c1 = 0 when bb_0 L0 = true when bb_0 default pre L1 false d3 = d1 when L0 default d2 when L1 c3 = c1 when L0 default c2 when L1 L1 = true when L0 when not d3 c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 = true when d3 when L0

• nes = c3 when L2

Transitions from a block are guarded by the label

L0 : d3 = phi (d1, d2); c3 = phi (c1, c2); if d3 goto L2;

bb_0 : d1 = data; c1 = 0; L2 : return c3; L0 : d3 = phi (d1, d2); c3 = phi (c1, c2); if d3 goto L2; L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; goto L0; bb_0 = pre false true d1 = data when bb_0 c1 = 0 when bb_0 L0 = true when bb_0 default pre L1 false d3 = d1 when L0 default d2 when L1 c3 = c1 when L0 default c2 when L1 L1 = true when L0 when not d3 c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 = true when d3 when L0

• nes = c3 when L2

Conditional branches are guarded by the label and condition

bb_0 : d1 = data; c1 = 0; L2 : return c3; L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; goto L0; bb_0 = pre false true d1 = data when bb_0 c1 = 0 when bb_0 L0 = true when bb_0 default pre L1 false d3 = d1 when L0 default d2 when L1 c3 = c1 when L0 default c2 when L1 L1 = true when L0 when not d3 c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 = true when d3 when L0

• nes = c3 when L2

and so on,

L0 : d3 = phi (d1, d2); c3 = phi (c1, c2); if d3 goto L2;

bb_0 : d1 = data; c1 = 0; L2 : return c3; L0 : d3 = phi (d1, d2); c3 = phi (c1, c2); if d3 goto L2; L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; goto L0; bb_0 = pre false true d1 = data when bb_0 c1 = 0 when bb_0 L0 = true when bb_0 default (pre L1 false) d3 = d1 when L0 default d2 when L1 c3 = c1 when L0 default c2 when L1 L1 = true when L0 when not d3 c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 = true when d3 when L0

• nes = c3 when L2

Going backwards consumes time

bb_0 : d1 = data; c1 = 0; L2 : return c3; L0 : d3 = phi (d1, d2); c3 = phi (c1, c2); if d3 goto L2; L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; goto L0; bb_0 = pre false true d1 = data when bb_0 c1 = 0 when bb_0 L0 = true when bb_0 default (pre L1 false) d3 = d1 when bb_0 default (pre d2 0) when L0 c3 = c1 when L0 default (pre c2 0) when L1 L1 = true when L0 when not d3 c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 = true when d3 when L0

• nes = c3 when L2

Phi-nodes are modeled by merging signals

bb_0 : d1 = data; c1 = 0; L2 : return c3; L0 : d3 = phi (d1, d2); c3 = phi (c1, c2); if d3 goto L2; L1 : c2 = (d3 & 1) + c3 d2 = d3 >>1; goto L0; bb_0 = pre false true d1 = data when bb_0 c1 = 0 when bb_0 L0 = true when bb_0 default (pre L1 false) d3 = d1 when bb_0 default (pre d2 0) when L0 c3 = c1 when L0 default (pre c2 0) when L1 L1 = true when L0 when not d3 c2 = d3 & 1 + c3 when L1 d2 = d3 >> 1 when L1 L2 = true when d3 when L0

• nes = c3 when L2

One data-flow equation per SSA instruction

bb_0 : L2 : return; L0 : yield; L1 : aa_0 : K2 : return; K0 : yield; K1 :

bb_0 = true when (pre K0 false) K1 = true when when (pre LO false) L1 = true when (pre K2 false)

bool running bool yield bool termitaed L0 bb_0 L1 L2 yield

bb_0 = (pre false true) when running yield = true when L0 when running terminated = true when L3 when running

P1

tick

P2 P3 Scheduler

running1

Scheduler | P1 | P2 | P3

P1

tick

P2 P3 Scheduler

Scheduler | P1 | P2 | P3

yield1

tick

P2 P3 Scheduler

Scheduler | P1 | P2 | P3

running2

P1 P2

tick

P2 Scheduler

Scheduler | P1 | P2 | P3

running3

P3 P1

terminate2

P1

tick

P2 P3 Scheduler

running1

Scheduler | P1 | P2 | P3

terminate3

write

Scheduler | P1 | P2 | P3 | Resource

P1

tick

P2 P3 Scheduler

write read

Resource

lock unlock

SIGNAL compiler performs static analysis: inconsistent synchronizations, cyclic definitions SIGALI model checker performs dynamic analysis : enforcement

• f liveness, safety, reachability

properties and controller synthesis SME, a synchronous modeling environment and open-source Eclipse plugin

Synoptic – a domain-specific design language for spacecraft control software

• Structural, architecture components with real-time characteristics
• Data-flow diagrams, mode automata, imperative programs

Import in SME (using SSA) for formal verification and code generation Connection with RT-Builder for real-time simulation

RT-Builder (Geensys) real-time, hardware in-the-loop, simulation of automotive equipments

Sequential code automatically translated to a synchronous formalism via SSA Parallel programs are modeled by instantiating templates of concurrency primitives Scales to modeling real concurrency and/or architecture modeling concepts : ARINC-653 services, AADL, Synoptic

On the model of computation "Polychrony for system design" Le Guernic, P., Talpin, J.-P., Le Lann, J.-C. Journal for Circuits, Systems and Computers. Special Issue on Application Specific Hardware Design. World Scientific, August 2003. On desynchronization "Compositional design of isochronous systems" Talpin, J.-P., Ouy, J., Besnard, L., Le Guernic, P. In Science of Computer Programming. Elsevier, 2010 (to appear). On architecture modeling "Polychronous design of embedded real-time systems" Gamatié, A., Gautier, T., Le Guernic, P., Talpin, J.-P. ACM Transactions on Software Engineering and Methodology. ACM Press, 2006. On virtual prototyping "Formal refinement checking in a system-level design methodology" Talpin, J.-P., Le Guernic, P., Shukla, S. K., Gupta, R., Doucet, F. Special Issue of Fundamenta Informaticae on Applications

• f Concurrency to System Design. IOS Press, 2004.

On model-driven engineering "A metamodel for the design of polychronous systems" Brunette, C., Talpin, J.-P., Gamatié, A., Gautier, T. Journal of Logic and Algebraic Programming, Special Issue on Applying Concurrency Research to Industry. Elsevier, 2008. Website http://www.irisa.fr/espresso/polychrony