Causality analysis of synchronous programs with delayed actions

Schneider, Klaus; Brandt, Jens; Schuele, Tobias

doi:10.1145/1023833.1023859

Cited by 30 publications

(37 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The partitioning into micro and macro steps is explicitly *Correspondence: gemuende@cs.uni-kl.de Department of Computer Science, University of Kaiserslautern, Kaiserslautern, Germany given by the programmer, and the micro steps are executed in a causal ordering so that there are no read-afterwrite conflicts [7,15]. As a consequence, all threads of a program run in lockstep: they execute the micro steps of their current macro steps in the common global variable environment, and therefore automatically synchronize at the end of the macro step.…”

Section: Reviewmentioning

confidence: 99%

See 1 more Smart Citation

Clock refinement in imperative synchronous languages

2013

View full text Add to dashboard Cite

The synchronous model of computation divides the program execution into a sequence of logical steps. On the one hand, this view simplifies many analyses and synthesis procedures, but on the other hand, it imposes restrictions on the modeling and optimization of systems. In this article, we introduce refined clocks in imperative synchronous languages to overcome these restrictions while still preserving important properties of the basic model. We first present the idea in detail and motivate various design decisions with respect to the language extension. Then, we sketch all the adaptations needed in the design flow to support refined clocks. Reviewhave been proposed for the development of safety-critical embedded systems. They are based on a convenient programming model, which allows one to generate deterministic single-threaded code from multi-threaded synchronous programs. Thus, synchronous programs can directly be executed on simple micro-controllers without having the need to use complex operating systems. In addition, synchronous programs can straightforwardly be translated to hardware circuits [4][5][6], which makes synchronous languages attractive for the use in hardware-software co-design. Furthermore, the concise formal semantics of synchronous languages is the basis for formal verification of the correctness of the programs as well as of the used compilers [7][8][9][10]. Finally, since macro steps consist of only finitely many micro steps whose number is known at compile-time, one can determine tight bounds on the reaction time by a simplified worst-case execution time analysis [11][12][13][14].All these advantages are due to the underlying synchronous model of computation [1], which divides the execution of programs into micro and macro steps, where variables change synchronously only between macro steps and remain constant during micro steps. The partitioning into micro and macro steps is explicitly *Correspondence: gemuende@cs.uni-kl.de Department of Computer Science, University of Kaiserslautern, Kaiserslautern, Germany given by the programmer, and the micro steps are executed in a causal ordering so that there are no read-afterwrite conflicts [7,15]. As a consequence, all threads of a program run in lockstep: they execute the micro steps of their current macro steps in the common global variable environment, and therefore automatically synchronize at the end of the macro step.Obviously, the synchronous model of computation enforces deterministic concurrency, which has many advantages in system design, e.g., to avoid Heisenbugs [16] and to allow compile-time analyses, e.g., on WCET. At the same time, however, it imposes tight restrictions on modeling possibilities, since there is no means to express the independence of threads in certain program locations. This phenomenon-where synchronous lockstep execution of threads is enforced even though it is not necessary-is often referred to as over-synchronization. Over-synchronization occurs quite frequently, since the input signals of a system us...

show abstract

Section: Reviewmentioning

confidence: 99%

“…Instead it should be possible to evaluate those control-flow conditions from already known values. Checking this property statically is known as causality analysis [7,15,[23][24][25][26][27][28] in the context of synchronous programs.…”

Section: Logical Correctness and Causalitymentioning

confidence: 99%

Clock refinement in imperative synchronous languages

2013

View full text Add to dashboard Cite

show abstract

“…Thus, the number of iteration steps is bounded by the number of variables. A detailed description of causality and the corresponding causality analysis is given in [Schn09,ScBS04b,BrSc08a,Berr00,Berr99]. The causality analysis has to determine that the statements of a synchronous program can be executed in a causal order where all trigger conditions are determined before the corresponding statements are executed and a written value/variable is not overwritten.…”

Section: Causalitymentioning

confidence: 99%

Interactive verification of synchronous systems

Gesell

Schneider

2012

Tenth ACM/IEEE International Conference on Formal Methods and Models for Codesign (MEMCODE2012)

View full text Add to dashboard Cite

Embedded systems, ranging from very simple systems up to complex controllers, may nowadays have quite challenging real-time requirements. Many embedded systems are reactive systems that have to respond to environmental events and have to guarantee certain real-time constrain. Their execution is usually divided into reaction steps, where in each step, the system reads inputs from the environment and reacts to these by computing corresponding outputs.The synchronous Model of Computation (MoC) has proven to be well-suited for the development of reactive real-time embedded systems whose paradigm directly reflects the reactive nature of the systems it describes. Another advantage is the availability of formal verification by model checking as a result of the deterministic execution based on a formal semantics. Nevertheless, the increasing complexity of embedded systems requires to compensate the natural disadvantages of model checking that suffers from the well-known state-space explosion problem. It is therefore natural to try to integrate other verification methods with the already established techniques. Hence, improvements to encounter these problems are required, e.g., appropriate decomposition techniques, which encounter the disadvantages of the model checking approach naturally. But defining decomposition techniques for synchronous language is a difficult task, as a result of the inherent parallelism emerging from the synchronous broadcast communication.Inspired by the progress in the field of desynchronization of synchronous systems by representing them in other MoCs, this work will investigate the possibility of adapting and use methods and tools designed for other MoC for the verification of systems represented in the synchronous MoC. Therefore, this work introduces the interactive verification of synchronous systems based on the basic foundation of formal verification for sequential programs -the Hoare calculus. Due to the different models of computation several problems have to be solved. In particular due to the large amount of concurrency, several parts of the program are active at the same point of time. In contrast to sequential programs, a decomposition in the Hoare-logic style that is in some sense a symbolic execution from one control flow location to another one requires the consideration of several flows here. Therefore, different approaches for the interactive verification of synchronous systems are presented.Additionally, the representation of synchronous systems by other MoCs and the influence of the representation on the verification task by differently embedding synchronous system in a single verification tool are elaborated.The feasibility is shown by integration of the presented approach with the established model checking methods by implementing the AIFProver on top of the Averest system.

show abstract

“…Moreover, they allow direct translations to synchronous hardware circuits. On the other hand, the synchronous programming model challenges the compilers: Intrinsic problems like causality and schizophrenia problems must be solved [18], [19].…”

Section: Synchronous Programsmentioning

confidence: 99%

Verifying the adaptation behavior of embedded systems

Schneider

Schuele

Trapp

2006

Proceedings of the 2006 International Workshop on Self-Adaptation and Self-Managing Systems

View full text Add to dashboard Cite

Many complex embedded systems dynamically adapt their components, services, algorithms, and parameters to the environment. This leads to new classes of design errors, since adaptation has become an increasingly complex part of the systems' behavior. In particular, as adaptations often continuously trigger further adaptations in other components, inconsistent and unstable configurations may be reached. Formal verification, which is routinely applied in safety-critical applications, must therefore consider not only temporal and functional properties of a system, but also its ability to dynamically adapt itself according to external and internal stimuli.In this paper, we describe how the adaptation behavior of embedded systems can be modeled, specified, and verified at design time. The systems are thereby given at a high level of abstraction, where adaptation is triggered by the quality of data values. This allows to extract the relevant information in a form that can be directly used for verification. Moreover, we demonstrate how state-of-the-art model checkers can be used to formally reason about the resulting system description.

show abstract

Causality analysis of synchronous programs with delayed actions

Cited by 30 publications

References 40 publications

Clock refinement in imperative synchronous languages

Clock refinement in imperative synchronous languages

Interactive verification of synchronous systems

Verifying the adaptation behavior of embedded systems

Contact Info

Product

Resources

About