Synchronous Reactive Models Research Articles

Verification of Safety for Synchronous-Reactive System Using Bounded Model Checking

Real-time embedded systems are increasingly applied in safety-critical areas, so guaranteeing the correctness of such systems by means of formal methods becomes particularly important. In this paper, we propose an optimized bounded model checking (BMC)-based formal verification approach for the verification of safety for synchronous-reactive (SR) models, which are often used to design systems with complicated control logic, especially the real-time embedded control systems. This method is based on the tackling of a series of challenging problems including the management of the logical clock, encoding of the contained ports, representation of the data types of ports, descriptions of behaviors of various components in a considered model, and formal consideration of the fixed-point semantics. We have implemented this proposed method in the prototype Ptolemy-Z3, and integrated this tool into the Ptolemy II environment. In addition, the experimental evaluation on 22 SR models has shown that our method performs better than the existing automatic verification method in Ptolemy II.

Toward a Lingua Franca for Deterministic Concurrent Systems

Many programming languages and programming frameworks focus on parallel and distributed computing. Several frameworks are based on actors, which provide a more disciplined model for concurrency than threads. The interactions between actors, however, if not constrained, admit nondeterminism. As a consequence, actor programs may exhibit unintended behaviors and are less amenable to rigorous testing. We show that nondeterminism can be handled in a number of ways, surveying dataflow dialects, process networks, synchronous-reactive models, and discrete-event models. These existing approaches, however, tend to require centralized control, pose challenges to modular system design, or introduce a single point of failure. We describe “reactors,” a new coordination model that combines ideas from several of these approaches to enable determinism while preserving much of the style of actors. Reactors promote modularity and allow for distributed execution. By using a logical model of time that can be associated with physical time, reactors also provide control over timing. Reactors also expose parallelism that can be exploited on multicore machines and in distributed configurations without compromising determinacy.

A comparison of schedulability analysis methods using state and digraph models for the schedulability analysis of synchronous FSMs

Synchronous reactive models are widely used in the development of embedded software and systems. The schedulability analysis of tasks obtained as the code implementation of synchronous finite state machines (FSMs) can be performed in several ways. One possible option is to leverage the correspondence between the execution of actions in an FSM and the execution of jobs in a digraph task model, thereby applying all the analysis methods developed for these digraph task systems. Another option is to directly leverage the state information and use dynamic programming methods to compute the worst possible sequence of (state dependent) reactions for a given FSM model. In this paper we compare these analysis methods in terms of accuracy and runtime.

Optimization of Real-Time Software Implementing Multi-Rate Synchronous Finite State Machines

Model-based design using Synchronous Reactive (SR) models is becoming widespread for control software development in industry. However, software synthesis is challenging for multi-rate SR models consisting of blocks modeled with finite state machines, due to the complexity of validating the system’s real-time schedulability. The existing approach uses the simplified periodic task model to allow an efficient schedulability analysis, which leads to pessimistic and suboptimal solutions. Instead, in this paper, we adopt a more accurate but more complex schedulability analysis. We develop several optimization techniques to improve the algorithm’s efficiency. Experimental results on synthetic systems and an industrial case study show that the proposed optimization framework preserves the solution optimality but is much faster (e.g., 1000× for systems with 15 blocks) than the branch-and-bound algorithm, and it generates better control software than the existing approach.

Optimized Implementation of Multirate Mixed-Criticality Synchronous Reactive Models

Model-based design using Synchronous Reactive (SR) models enables early design and verification of application functionality in a platform-independent manner, and the implementation on the target platform should guarantee the preservation of application semantic properties. Mixed-Criticality Scheduling (MCS) is an effective approach to addressing diverse certification requirements of safety-critical systems that integrate multiple subsystems with different levels of criticality. This article considers fixed-priority scheduling of mixed-criticality SR models, and considers two scheduling approaches: Adaptive MCS and Elastic MCS. We formulate the optimization problem of minimizing the total system cost of added functional delays in the implementation while guaranteeing schedulability, and present an optimal algorithm based on branch-and-bound search, and an efficient heuristic algorithm.

Formal modelling and verification of GALS systems using GRL and CADP

Abstract A GALS ( Globally Asynchronous, Locally Synchronous ) system consists of several synchronous components that evolve concurrently and interact with each other asynchronously. The design of GALS systems is tedious and error-prone due to the high degree of synchronous and asynchronous concurrency present in complex architectures. In this paper, we present GRL ( GALS Representation Language ), a formal language designed to model GALS systems, for the purpose of formal verification of the asynchronous aspects. GRL combines the synchronous reactive model underlying dataflow languages and the asynchronous concurrent model underlying process algebras. We propose a translation from GRL to LNT, a value-passing concurrent language with classical process algebra flavour. This makes possible the analysis of GRL specifications using all the state-of-the-art simulation and verification functionalities provided by the CADP toolbox.

Synthesis of Multitask Implementations of Simulink Models With Minimum Delays

Model-based design of embedded control systems using Synchronous Reactive (SR) models is among the best practices for software development in the automotive and aeronautic industry. SR models allow to formally verify the correctness of the design and automatically generate the implementation code. This feature is a major productivity enhancement and, more importantly, can ensure correct-by-design software provided that the code generator is provably correct. This paper presents an improvement of code generation technology for SR obtained via a novel algorithm for optimizing the multitask implementation of Simulink models on single-processor platforms with limited availability of memory. Existing code generation tools require the addition of zero-order hold (ZOH) blocks, and therefore additional memory, and possibly also additional functional delays whenever there is a rate transition in the computation and communication flow. Our algorithm leverages a novel efficient encoding of the scheduling feasibility region to find the task implementation of function blocks with minimum additional functional delays within timing and memory constraints. The algorithm is applied to an automotive case study with tens of function blocks and very high utilization to test its applicability to complex systems.

Optimal Synthesis of Communication Procedures in Real-Time Synchronous Reactive Models

Model-based design methodologies are gaining attention in the industrial community because of the possibility of early and efficient functional validation and formal verification of properties at high levels of abstraction. The advantages of validating the design using high-level models can be lost entirely if errors and modifications that are not back-annotated to the higher abstraction levels are introduced when refining the design to lower levels of abstraction. To overcome this problem and to reduce design time, automatic synthesis has been used for the refinement process from Register Transfer Languages (RTLs) to logic gates for digital circuit design. This approach guarantees (assuming that the synthesis algorithms are correctly implemented) that the semantic of the RTL description is semantically equivalent to the semantic of the logic circuit. Automatic code generation is similar in intent and applicability. However, the software implementation of the abstract model must make efficient use of the platform resources that may not reflect all the assumptions of the code generation algorithms. The implementation of communication in a synchronous reactive model requires buffering and access procedures at the kernel level. In previous work, we obtained tight bounds on the size of communication buffers to maintain semantic equivalence. In realtime systems, however, because of the longer execution times of access procedures, an implementation with minimum buffer size may lead to the violation of deadlines. To solve this problem, we propose a Mixed Integer Linear Programming (MILP)-based optimization approach that provides the minimum memory implementation of a set of communication channels while guaranteeing that the task deadline constraints are met. The analysis is validated by an OSEK/VDX-compliant implementation that provides an estimate of actual runtime overheads. The approach is applied to a set of task graphs and an automotive case study.

Moving From Federated to Integrated Architectures in Automotive: The Role of Standards, Methods and Tools

<para xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> Cost pressure, flexibility, extensibility and the need for coping with increased functional complexity are changing the fundamental paradigms for the definition of automotive and aeronautics architectures. Traditional designs are based on the concept of a <emphasis emphasistype="italic">Federated Architecture</emphasis> in which integrated hardware/software components [Electronic Control Units (ECUs)] realize mostly independent or loosely interconnected functions. These components are connected by bus and cooperate by exchanging messages. This paradigm is now being replaced by the <emphasis emphasistype="italic">Integrated Architecture</emphasis>,—the concept comes from Integrated Modular Avionics (IMA) introduced by the avionics community (see C. B. Watkins and R. Walter, “Transitioning from federated avionics architectures to integrated modular avionics,” in Proc. 26th Digital Avionics Syst. Conf., Oct. 2007) but it is certainly general and applicable to other fields and in particular, automotive—in which software components can be supplied from multiple sources, integrated on the same hardware platform or physically distributed and possibly moved from one CPU to another without loss of functional and time correctness and providing a guaranteed level of reliability. This shift will decouple software design from the hardware platform design and provide opportunities for the optimization of the architecture configuration, increased extensibility, flexibility and modularity. However, the integration of software components in a distributed system realizing a complex functional behavior and characterized by safety, time and reliability constraints requires a much tighter control on the component model and its semantics, new methods and tools for analyzing the results of the composition, whether by simulation or formal methods, and methods for exploring the architecture solution space and optimizing the configuration. We provide a general overview of existing challenges and possible solutions to the design and analysis problem, <emphasis emphasistype="italic">with special focus on the automotive domain</emphasis>. The development of such methods and tools must necessarily consider compatibility with existing modeling languages and standards, including UML, AUTOSAR and synchronous reactive models, on which the widely used commercial products Simulink and SCADE are based. </para>

SystemJ: A GALS language for system level design

In this paper we present the syntax, semantics, and compilation of a new system-level programming language called SystemJ. SystemJ is a multiclock language supporting the Globally Asynchronous Locally Synchronous (GALS) model of computation. The synchronous reactive (SR) model is used for synchronous parts of the modelled system, and those parts, which represent individual clock-domains, are coupled asynchronously each to the other on the top-level of system design. SystemJ is based on Java language, which is used to describe “instantaneous” data transformations. Hence, SystemJ is well suited for both software-based embedded and distributed systems. SystemJ offers effective modelling of (1) data transformations through the power of Java, (2) control and synchronous concurrency through the SR paradigm and (3) asynchronous concurrency through clock domains and rendezvous. The language is based on semantics that is amenable to efficient code generation and partial automatic verification. The SystemJ micro-step semantics provide asynchronous and synchronous extensions over the semantics of other SR languages such as Esterel and provide an ideal platform for efficient software implementation.

Improving the Size of Communication Buffers in Synchronous Models With Time Constraints

Model-based development of embedded applications is a major trend in industry because of the possibility of early validation and verification of properties by simulation or formal methods. Synchronous reactive models are characterized by a formally specified semantics, which avoids ambiguities in the interpretation of the model, and by the availability of efficient code generation tools, which help increase productivity. The validity of the simulation and/or verification results on the model is retained only if the generated code is guaranteed to preserve model semantics. At the same time, the implementation must make efficient use of the execution platform resources. One of the essential issues for efficient implementation is the use of communication buffers that exploit the multirate behavior of the components. In most embedded devices, RAM memory is scarce and buffer size should be kept at a minimum. We present an approach to buffer size optimization by using timing information about the components. The approach was applied to an automotive case study, showing for the specific case an improvement of at least 7.5% with respect to previous methods.

ReactiveML, un langage fonctionnel pour la programmation réactive

e modele reactif synchrone de Boussinot. Ce modele reprend des principes du synchrone tel s que la composition parallele deterministe et la communication par diffusion. Il les comb ine a des mecanismes de creation dynamique de processus. Cet article presente le langage, so n systeme de type et sa semantique. ABSTRACT.The programming of reactive systems such as simulators of dy namic systems or video games is a difficult task. We introduce theREACTIVEML language as an alternative to classical techniques such as event loops or thread-based programming . REACTIVEML is an extension of OCaml founded on the synchronous reactive model of Boussi not. This model combines the synchronous model which provides parallel composition andinstantaneous communications with dynamic creation of processes. This paper presents thelanguage, its type system and its formal semantics. MOTS-CLES :programmation reactive synchrone, programmation fonctio nnelle, concurrence, ty- page, semantique formelle.

Buffer optimization in multitask implementations of Simulink models

Automatic generation of a controller implementation from a synchronous reactive model is among the best practices for software development in the automotive and aeronautics industry, because of the possibility of simulation, model checking, and error-free implementation. This paper discusses an algorithm for optimizing the single-processor multitask implementation of Simulink models with real-time execution constraints, derived from the sampling rates of the functional blocks. Existing code generation tools enforce the addition of extra buffering and latencies whenever there is a rate transition among functional blocks. This work shows how timing analysis can be used to find the cases in which additional buffering and latency can be avoided, improving the space and time performance of the application. The proposed search algorithm allows finding a solution with reduced and possibly minimal use of buffering even for very high values of processor utilization.

Performance evaluation of a multithreaded RTS using a synchronous reactive model

Synchronous reactive modelling provides an optimal framework for the modular decomposition of programs that engage in complex patterns of deterministic interaction, such as many real-time and communication entities. This paper presents an approach which includes performance modelling techniques in the synchronous reactive modelling method supported by ESTEREL. It defines a methodology based on timing and probabilistic quantitative constructs that complete the synchronous reactive models. A monitoring mechanism allows the computation of performance results during the simulation. This methodology is applied to study a multithreaded runtime system for a distributed functional programming language. Performance metrics are computed and validated with experimental results.

Performance Evaluation of a Multithreaded Runtime System Using a Synchronous Reactive Model

Synchronous Reactive Modeling provides an optimal framework for the modular decomposition of programs that engage in complex patterns of deterministic interaction, such as many real-time and communication entities. This paper presents an approach which includes performance modeling techniques in the synchronous reactive modeling method supported by ESTEREL. It defines a methodology based on timing and probabilistic quantitative constructs which complete the synchronous reactive models. A monitoring mechanism allows the computation of performance results during the simulation. This methodology is applied to study a multithreaded runtime system for a distributed functional programming language. Performance metrics are computed and validated with experimental results.