An embedded architecture is an artefact of heterogeneous constituants and at the crossing of several design viewpoints: software, embedded in hardware, interfaced with the physical world. Time takes different forms when observed from each of these viewpoints: continuous or discrete, event-based or time-triggered. Unfortunately, modelling and programming formalisms that represent software, hardware and physics significantly alter this perception of time. Moreover, time reasoning in system design is usually isolated to a specific design problem: simulation, profiling, performance, scheduling, parallelisation, simulation. All these tasks would benefit from modularity and compositionally gained by globally reasoning about time. The aim of project-team TEA is to define a conceptually unified semantic framework for time reasoning in embedded system design, and to put it to practice by revisiting common analysis and synthesis issues in real-time system design with the compositionality gained from that formalisation.
Electronic appliances, embedded systems, or, more generally, Cyber-Physical Systems, abbreviated CPS, are systems that comprise sensors, to sense physical data; electronics, to digitise the sensed physical information; computing units, to monitor the physical process; actuators, to activate devices reacting with the physical world; and, finally, a mean of communication, interconnecting these components.
As Lee acknowledges on his website
Beyond the buzzword, a CPS is nothing new. In fact, it is an ubiquitous object of our everyday life. CPSs have evolved from individual independent units (e.g an ABS brake) to more and more integrated networks of units, which may be aggregated into larger components or sub-systems. For example, a transportation monitoring network aggregates monitored stations and trains through a large scale distributed system with relatively high latency. Each individual train is being controlled by a train control network, each car in the train has its own real-time bus to control embedded devices. More and more, CPSs are mixing real-time low latency technology with higher latency distributed computing technology.
CPS safety is often critical for society. Their failure may entail threatening human beings life in many applications such as transportations (whether automotive, trains or airplanes), power distribution, medical equipment and tele-medicine. Whether or not life is threatened, failures may have huge economic impact (e.g. Toyota's defect car equipment). The development of reliable CPS has become a critical issue for the industry and society. Safety and security requirements must be satisfied by using strong validation tools. Requirements for quality of service, safety and security imply to have formally proved the required properties of the system before it is deployed.
In the past 15 years, CPS development has moved towards Model Driven Engineering (MDE). With MDE methodology, first all requirements are gathered together with use cases, then a model of the system is built (sometimes several models) that satisfy the requirements. There are several modelling formalisms that have appeared in the past ten years with more or less success. The most successful are the executable models, models that can be exercised, tested and validated. This approach can be used for both software and hardware.
A common feature found in CPSs is the ever presence of concurrency and parallelism in models. Development of concurrent and parallel systems has traditionally been clearly split in two different families. The first family is based on synchronous models, primarily targeting design of hardware circuits and/or embedded and reactive systems, often safety-critical. Esterel, Lustre, Signal and SCADE are examples of existing technologies of that nature, and in many places these have been connected with models of environments as required for CPS modelling. The second family addresses more loosely coupled systems, where communication between distributed entities is asynchronous by nature. Analysis of asynchronous systems has often greater complexity, because of the greater size of state spaces; process algebras such as CSP and CCS, or component models such as Fractal and GCM are more relevant here.
Large systems are increasingly mixing both types of concurrency. Large systems are structured hierarchically and comprise multiple synchronous devices connected by buses or networks that communicate asynchronously. This led to the advent of so-called GALS (Globally Asynchronous, Locally Synchronous) models, or PALS (Physically Asynchronous, Logically Synchronous) systems, where reactive synchronous objects are communicating asynchronously. Still, these infrastructures, together with their programming models, share some fundamental concerns: parallelism and concurrency synchronisation, determinism and functional correctness, scheduling optimality and calculation time predictability.
It should also be noted that CPSs are used essentially to monitor and control real-world processes, the dynamics of which are usually governed by well known physical laws. These laws are expressed by physicists as mathematical equations and formulas. Discrete CPS models cannot ignore these dynamics, but whereas the equations express the continuous behaviour usually using real numbers (irrational) variables, the models usually have to work with discrete time and approximate floating point variables.
We consider that there are two key research directions, respectively, one for the theoretical basis underlying CPSs and one for the practical aspect of developing future applications that could be a major vector for scientific projects, developed in the next sections.
A cyber-physical (or reactive, or embedded) system is the integration of heterogeneous components originating from several design viewpoints: reactive software, some of which is embedded in hardware, interfaced with the physical environment through mechanical parts. Time takes different forms when observed from each of these viewpoints: it is discrete and event-based in software, discrete and time-triggered in hardware, continuous in mechanics or physics. Design of CPS often benefits from concepts of multiform and logical time(s) for their natural description.
High-level modelling and programming formalisms used to represent software, hardware and physic significantly alter this perception of time. In the model of the environment, the continuous evolution of time is represented by differential equations whose computerised resolution is inherently discrete. In hardware models, the system clock is an abstraction of the electrical behaviour of the circuit. It is usually further approximated by coarser-grain abstractions: register transfer level (RTL), transaction-level modelling (TLM) or system-level modelling.
In system design, time is usually abstracted to serve the purpose of one of many design problem: simulation, profiling, performance analysis, scheduling analysis, parallelisation, distribution, simulation, or virtual prototyping. For example in non-real-time commodity software, timing abstraction such as number of instructions and algorithmic complexity is sufficient: software will run the same on different machines, except slower or faster. Alternatively, in cyber-physical extensions, multiple recurring instances of meaningful events may create as many dedicated logical clocks, on which to ground modelling and design practices.
Time reasoning is further complicated by the inadequacy of conventional programming models for modern hardware, such as Network-On-Chips. As pointed out by Edward Lee in his position paper
This challenge explains why the mitigation of time constraints arising from heterogeneous time models or domains is equally isolated to one specific design problem. For instance,
scheduling analysis aims at reconciling software logical time with discrete hardware resources;
desynchronisation aims at reconciling the synchronous abstraction of software concurrency with the asynchronous abstraction of a distributed architecture;
virtual prototyping aims at simulating hardware events using software;
hybrid simulation mixes software time and simulated physical time.
None of these problems demand system-level timed reasoning. All these issues are usually addressed in isolation. Yet, all would benefit from modularity and compositionally gained by coordinated time reasoning. Proper handling of time requires a precise semantic foundations and the establishment of formal correctness properties. It allows powerful analysis and error-proof verification of functional behaviours and quantitative characteristics.
Time abstraction increases efficiency in event-driven simulation or execution (i.e SystemC simulation models try to abstract time, from cycle-accurate to approximate-time, and to loosely-time), while attempting to retain functionality, but without any actual guarantee of valid accuracy (responsibility is left to the model designer). Functional determinism (a.k.a. conflict-freeness in Petri Nets, monotonicity in Kahn PNs, confluence in Milner's CCS, latency-insensitivity and elasticity in circuit design) allows for reducing to some amount the problem to that of many schedules of a single self-timed behaviour, and time in many systems studies is partitioned into models of computation and communication (MoCCs). Multiple, multiform time(s) raises the question of combination, abstraction or refinement between distinct time bases. The question of combining continuous time with discrete logical time calls for proper discretisation in simulation and implementation. While timed reasoning takes multiple forms, there is no unified foundation to reasoning about multi-form time in system design.
The aim of project-team TEA is to develop formal calculi for reasoning about time in embedded system design. Equipped with these calculi, we will revisit typical problems and application in real-time system design, such as time determinism, memory ressources predictability, real-time scheduling, mixed-criticality and power management. Eventually, this will allow to prototype and deliver a tooled methodology for virtual prototyping embedded architectures.
System design based on the “synchronous paradigm” has focused the attention of many academic and industrial actors on abstracting non-functional implementation details from system design. This design abstraction focuses on the logic of interaction in reactive programs rather than their timed behaviour, allowing to secure functional correctness while remaining an intuitive programming model for embedded systems.
Maintaining the “synchronous hypothesis” on software at runtime, however, demands a quasi-synchronous model of execution (hardware or middleware) in order to be effectively implemented
By contrast with a synchronous hypothesis, the polychronous MoCC implemented in the specification language Signal, available in the Eclipse project POP
The Eclipse project POP provides a tooled infrastructure to refine high-level specifications into real-time streaming applications or locally synchronous and globally asynchronous systems, through a series of model analysis and synthesis libraries. These tool-supported refinement and transformation techniques can assist the system engineer from the earliest design stages of requirement specification to the latest stages of synthesis, scheduling and deployment. These characteristics make polychrony much closer to the required semantic for compositional, refinement-based, architecture-driven, system design.
The elegant abstraction offered by the "synchronous hypothesis"
Meanwhile, proposals and standards have appeared to push the technical boundaries of synchronous concurrency, in order to address a larger spectrum of concerns related to modern, heterogeneous, many-core architectures. The challenge becomes more largely about representing time in system design, alongside with many, so called, non-functional properties: cost, power, heat, speed, throughput.
One reference for the purpose of modelling timed hardware behaviour is PSL
A more recent reference of broader spectrum is CCSL
In the meantime, and from a totally different perspective, type theory has made considerable advances since the avent of effect systems
An architectural model represents components in a distributed system as boxes with well-defined interfaces, connections between ports on component interfaces, and specifies component properties that can be used in analytical reasoning about the model.
Models are hierarchically organised, so that each box can contain another system with its own set of boxes and connections between them. An architecture description language for embedded systems, for which timing and resource availability form an important part of the requirements, must in addition describe resources of the system platform, such as processors, memories, communication links, etc.
Several architectural modelling languages for embedded systems have emerged in recent years, including the SAE AADL
An architectural specification serves several important purposes. First, it breaks down a system model into manageable components to establish clear interfaces between components. In this way, complexity becomes manageable by hiding details that are not relevant at a given level of abstraction. Clear, formally defined, component interfaces allow us to avoid integration problems at the implementation phase. Connections between components, which specify how components affect each other, help propagate the effects of a change in one component to the linked components.
Most importantly, an architectural model is a repository to share knowledge about the system being designed. This knowledge can be represented as requirements, design artefacts, component implementations, held together by a structural backbone. Such a repository enables automatic generation of analytical models for different aspects of the system, such as timing, reliability, security, performance, energy, etc. Since all the models are generated from the same source, the consistency of assumptions w.r.t. guarantees, of abstractions w.r.t. refinements, used for different analyses becomes easier, and can be properly ensured in a design methodology based on formal verification and synthesis methods.
Related works in this aim, and closer in spirit to our approach (to focus on modelling time) are domain-specific languages such as Prelude
Cyber-physical systems are reactive systems whose correctness not only depends on a deterministic behavior but also on timing predictability. The timing parameters of a CPS are requirements that arise from the system’s specification (e.g. minimum throughput, maximum latency, deadlines) or timing properties of the physical and cyber-parts that restrict the CPS implementation. The design of a CPS must ensure that these timing requirements will be met, even in the worst-case scenario, through the different components and their timing properties.
Real-time scheduling theory provides tools for predicting the timing behaviour of a CPS which consists of many interacting software and hardware components. Expressing parallelism among software components is a crucial aspect of the design process of a CPS. It allows for efficient partition and exploitation of available resources. In the real-time scheduling theory literature, many models of computation have been proposed to express such parallelism, for instance:
Set of independent periodic, sporadic, or aperiodic tasks where each real-time task is generally characterised with some timing parameters: deadline, period, first start time, jitter, etc. The periodic and sporadic task models
Task graph models
Data-flow graph models such as synchronous data-flow (SDF
The literature about real-time scheduling of sets of independent real-time tasks
Scheduling of data-flow graphs has also been extensively studied in the past decades. Static-periodic scheduling is the main scheduling approach, which consists in infinitely repeating a firing sequence of actors. This problem has been addressed with respect to many performance criteria: throughput maximisation
Virtual Prototyping is the technology of developing realistic simulators from models of a system under design; that is, an emulated device that captures most, if not all, of the required properties of the real system, based on its specifications. A virtual prototype should be run and tested like the real device. Ideally, the real application software would be run on the virtual prototyping platform and produce the same results as the real device with the same sequence of outputs and reported performance measurements. This may be true to some extent only. Some trade-offs have often to be made between the accuracy of the virtual prototype, and time to develop accurate models.
A virtual prototyping platform must include operating system or hardware emulation technology since the hardware functions must be simulated at least to a minimum extent in order to run the software and evaluate the design alternatives. The hardware simulation engine is a key component of a virtual prototyping platform, which makes it possible to run the application software and produce output that can be analysed by other tools. Because electronic design tools (EDAs) simulate the hardware in every detail, it is possible to verify that the circuit operates properly and also to measure how many clock cycles will be required to achieve an operation. But because they simulate very low-level operations, simulation is much too slow to be usable for virtual prototyping. The authors of the FAST system
In order to speed-up simulation time, the virtual prototype must trade-off with something. Depending upon the application designers goals, one may be interested in trading some loss of accuracy in exchange for simulation speed, which leads to constructing simulation models that focus on some design aspects and provide abstraction of others. A simulation model can provide an abstraction of the simulated hardware in three directions:
Computation abstraction. A hardware component computes a high level function by carrying out a series of small steps executed by composing logical gates. In a virtual prototyping environment, it is often possible to compute the high level function directly by using the available computing resources on the simulation host machine, thus abstracting the hardware function.
Communication abstraction. Hardware components communicate together using some wiring, and some protocol to transmit the data. Simulation of the communication and the particular protocol may be irrelevant for the purpose of virtual prototyping: communication can be abstracted into higher level data transmission functions.
Timing Abstraction. In a cycle accurate simulator, there are multiple simulation tasks, and each task makes some progress on each clock cycle, but this is slowing down the simulation. In a virtual prototyping experiment, one may not need to so precise timing information: coarser time abstractions can be defined allowing for faster simulation.
The cornerstone of a virtual prototyping platform is the component that simulates the processor(s) of the platform, and its associated peripherals. Such simulation can be static or dynamic.
The challenges addressed by team TEA support the claim that sound Cyber-Physical System design (including embedded, reactive, and concurrent systems altogether) should consider (logical, formal) time modelling as a central aspect.
In this aim, architectural specifications found in software engineering are a natural focal point to start from. Architecture descriptions organise a system model into manageable components, establish clear interfaces between them, and help correct integration of these components during system design.
The definition of a formal design methodology to support the heterogeneous modelling of time in architecture descriptions demands the elaboration of sound mathematical foundations and the development of formal calculi methods to instrument them that constitute the research program of team TEA.
Time systems. To mitigate and generalise algebraic representations of time, we propose to introduce the paradigm of "time system" (type systems to represent time). Just as a type system abstracts data carried along operations in a program, a time system abstracts the causal interaction of that program module or hardware element with its environment, its pre and post conditions, its assumptions and guarantees, either logical or numerical. Instances of the concept of time system we envision are the clock calculi found in data-flow synchronous languages like Signal, Lustre and its different incarnations. All are bound to a particular model of time.
To gain generality and compositionality, we wish to proceed from recent developments on hybrid types
The principle of these type systems is to allow data-types inferred in the program with properties, possibly temporal, pertaining, for instance, to the algebraic domain on their value, or any algebraic property related to its computation: effect, memory usage
In the quest of an appropriate algebra for time, we are studying both the CCSL and PSL standards and, more generally, Kleene algebras
Being grounded on type and domain theories, a time system can naturally be equipped with program analysis techniques based on type inference (for data-type inference) or abstract interpretation (for program properties inference)
Relating time systems. Just as a time system formally represents the timed behaviour of a given component, timing relations (abstraction and refinement) represent interaction among components. Logically, their specification should be the role of a module system, and verifying their conformance that of a module checking algorithm.
Scalability and compositionality dictate the use of assume-guarantee reasoning, as found in interface automata and contract algebra, in order to facilitate composition by behavioural sub-typing, in the spirit of the (static) contract-based formalism proposed by Passerone et al.
To further elaborate a formal verification approach, we will additionally consider notions of refinement calculi based on temporal logic
Conformance of time relations. Verification problems encompassing heterogeneously timed specifications are common and of great variety: checking correctness between abstract and concrete time models relates to desynchronisation (from synchrony to asynchrony) and scheduling analysis (from synchrony to hardware). More generally, they can be perceived from heterogeneous timing viewpoints (e.g. mapping a synchronous-time software on a real-time middleware or hardware).
This perspective demands capabilities not only to inject time models one into the other (by abstract interpretation, using refinement calculi), to compare time abstractions one another (using simulation, refinement, bisimulation, equivalence relations) but also to prove more specific properties (synchronisation, determinism, endochrony).
In the spirit of our recent work developing an abstract scheduling theory, we want to develop a method of abstract interpretation
To check conformance between heterogeneously timed specifications, we will consider variants of the abstract interpretation framework proposed by Bertrane et al.
This will for instance enable the possibility of verifying cross-domain properties, e.g. cost v.s. power v.s. performance v.s. software mapping. This will allow to formalise intuitions such as that this typical inter-domain constraint: the cost of a system has an impact on the system's controlability; and allow to formally explain why: lower cost means hardware with lower performances, which means longer WCRTs, which means longer end-to-end latency, which may result in a response-time longer than controllability limits. This particular topic (which we could call cross-domain conformance checking) has not been studied in the related literature (on contract-based design, for instance), and could be based on both abstraction techniques, e.g. linear abstractions, or morphisms between domains or even discrete relations, e.g. a simple catalog or “price list” relating price and performance for a data-base of hardware components.
A second objective, to be developed in parallel and synergy to objective n. 1, is the definition of an architecture-specific specification formalism, that would serve as semantic foundation, structure and repository for tooling a component-based design methodology with semantic analysis, to synthesise component interfaces, and formal methods, to verify specified requirements.
In project TEA, it will take form by the definition and tooling of a time annex for the AADL standard, based on the theory developed in objective n. 1. The aim of the AADL time annex is to formalise the logical and physical timing properties of architecture models and represent them as constraints expressed using regular grammars (like in PSL), or using the process calculus of CCSL.
This is an objective reminiscent and in direct application of the principle of time system (objective n.1). We not only want to model time in the heterogeneous logical and physical constituents in an AADL specification, but relate them, and verify the correctness of their composition.
Our aim is to start from the modelling standards AADL and CCSL to define a standard for time in system design. Our contribution will be formalised by a timing annex for the AADL and tools collaboratively developed to support its use.
Our first milestone in this prospect is a report
Then, the specification of timing relations between AADL objects will be made explicit by contracts. Together with these contracts, we will then formally define abstraction and refinement relation in order to inject properties assumed by one component into the time model guaranteed by another, and vice versa. Lastly, conformance-checking abstracted contracts will be supported by state-of-the-art verification tools. This all will define a design methodology for time in the AADL, and our very last step will be to tool this methodology and provide a reference implementation.
As a prime application of formal methods for interacting time models, scheduling thousands of program blocks or modules found on modern embedded architecture poses a challenging problem. It simply defies known bounds of complexity theory in the field. It is an issue that requires a particular address, because it would find direct industrial impact in present collaborative projects in which we are involved.
One recent milestone in the prospect of large-scale scheduling is the development of abstract affine scheduling
To develop the underlying theory of this promising research topic, we first need to deepen the theoretical foundation to establish links between scheduling analysis and abstraction interpretation
The theory of time system developed in objective n.1 offers the ideal framework to pursue this development. It amounts to representing scheduling constraints, inferred from programs, as types. It allows to formalise the target time model of the scheduler (the architecture, its middle-ware, its real-time system) and defines the basic concepts to verify assumptions made in one with promises offered by the other: contract verification or, in this case, synthesis. Objective n.3 is hence defined as a direct application of objective n.1.
A solution usually adopted to handle time in virtual prototyping is to manage hierarchical time scales, use component abstractions where possible to gain performance, use refinement to gain accuracy where needed. Localised time abstraction may not only yield faster simulation, but facilitate also verification and synthesis (e.g. synchronous abstractions of physically distributed systems). Such an approach requires computations and communications to be harmoniously discretised and abstracted from originally heterogeneous viewpoints onto a structuring, articulating, pivot model, for concerted reasoning about time and scheduling of events in a way that ensures global system specification correctness.
Just as model checking usually employs goal-directed abstraction techniques, in order to approximate parts of the model that are not in the path of the property to check, we plan to equivalently define, possibly semi-automate, abstraction techniques to approximate the time model of system components that do not directly influence timing properties to evaluate.
In the short term these component models could be based on libraries of predefined models of different levels of abstractions. Such abstractions are common in large programming workbench for hardware modelling, such as SystemC, but less so, because of the engineering required, for virtual prototyping platforms. Additionally, the level of abstraction required to simulate components could simply (and best) be specified manually by annotating the architecture specification.
The approach of team TEA provides an additional ingredient in the form of rich component interfaces. It therefore dictates to further investigate the combined use of conventional virtual prototyping libraries, defined as executable abstractions of real hardware, with executable component simulators synthesised from rich interface specifications (using, e.g., conventional compiling techniques used for synchronous programs).
Just as virtual integration consists of synthesising the verification model of an architecture specification, virtual prototyping can be seen as synthesising an executable simulator from a model in, e.g., the spirit of the A-350 DMS case study that was realised by team ESPRESSO in the frame of Artemisia project CESAR
From our continuous collaboration with major academic and industrial partners through projects TOPCASED, OPENEMBEDD, SPACIFY, CESAR, OPEES, P and CORAIL, our experience has primarily focused on the aerospace domain. The topics of time and architecture of team TEA extend to both avionics and automotive, as demonstrated from this section to section 8. Yet, the research focus on time in team TEA is central in any aspect of, cyber-physical, embedded system design in automotive, music synthesis, signal processing, software radio, circuit and system on a chip design; many application domains which, should more collaborators join the team, would definitely be worth investigating.
Nonetheless, the application domains of our two direct collaborations with industry, avionics with Thales and automotive Toyota, are perfectly in line with the research objectives of team TEA and will allow us to quickly stream our theoretical results onto software and standards, which we will continue to distribute in open-source.
Multi-scale, multi-aspect time modelling, analysis and software synthesis will greatly contribute to architecture modelling in these domains, with applications to optimised (distributed, parallel, multi-core) code generation for avionics (our project with Thales avionics, section 8) as well as modelling standards, real-time simulation and virtual integration in automotive (our project with Toyota, section 8).
Together with the importance of open-source software, one of these project, the FUI Project P, demonstrated that a centralised model for system design could not just be a domain-specific programming language, such as discrete Simulink data-flows or a synchronous language. Synchronous languages implement a fixed model of time using logical clocks that are abstraction of time as sensed by software. They correspond to a fixed viewpoint in system design, and in a fixed hardware location in the system, which is not adequate to our purpose and must be extended.
In project P, we first tried to define a centralised model for importing discrete-continuous models onto a simplified implementation of SIMULINK: P models. Certified code generators would then be developed from that format. Because this does not encompass all aspects being translated to P, the P meta-model is now being extended to architecture description concepts (of the AADL) in order to become better suited for the purpose of system design. Another example is the development of System Modeller on top of SCADE, which uses the more model-engineering flavoured formalism SysML to try to unambiguously represent architectures around SCADE modules.
An abstract specification formalism, capable of representing time, timing relations, with which heterogeneous models can be abstracted, from which programs can be synthesised, naturally appears better suited for the purpose of virtual prototyping. RT-Builder, developed by TNI, was industrially proven and deployed for that purpose at Peugeot. It served to develop the virtual platform simulating all onboard electronics of PSA cars. This `hardware in the loop” simulator was used to test equipments supplied by other manufacturers with respect to virtual cars. In the avent of the related automotive standard, RT-Builder then became AUTOSAR-Builder.
RT-Builder is the commercial implementation of Signal, whose industrial transfer with TNI was realised in the 90s by Paul Le Guernic and Albert Benveniste. As its actual industry usage has demonstrated, it is clear that the synchronous multi-clocked, or polychronous MoCC of Signal is an appropriate semantic core for the design of embedded software architectures.
The distribution of project POP
Technically, project POP is composed of the Polychrony toolset, under GPL license, and its Eclipse framework, under EPL license.
The Polychrony toolset. The Polychrony toolset is an Open Source development environment for critical/embedded systems. It is based on Signal, a real-time polychronous dataflow language. It provides a unified model-driven environment to perform design exploration by using top-down and bottom-up design methodologies formally supported by design model transformations from specification to implementation and from synchrony to asynchrony. It can be included in heterogeneous design systems with various input formalisms and output languages.
The Polychrony toolset provides a formal framework:
to validate a design at different levels, by the way of formal verification and/or simulation,
to refine descriptions in a top-down approach,
to abstract properties needed for black-box composition,
to assemble heterogeneous predefined components (bottom-up with COTS),
to generate executable code for various architectures.
The Polychrony toolset contains three main components and an experimental interface to GNU Compiler Collection (GCC):
The Signal toolbox, a batch compiler for the Signal language, and a structured API that provides a set of program transformations. The Signal toolbox can be installed without other components. The Signal toolbox is distributed under GPL V2 license.
The Signal GUI, a Graphical User Interface to the Signal toolbox (editor + interactive access to compiling functionalities). The Signal GUI is distributed under GPL V2 license.
The SME/SSME platform, a front-end to the Signal toolbox in the Eclipse environment. The SME/SSME platform is distributed under EPL license.
GCCst, a back-end to GCC that generates Signal programs (not yet available for download).
In 2013, to be able to use the Signal GUI both as a specific tool and as a graphical view under Eclipse, the code of the Signal GUI has been restructured in three parts: a common part used by both tools (28 classes), a specific part for the Signal GUI (2 classes), a specific part for Eclipse (2 classes). Such a structuration facilitates the maintenance of the products.
The Polychrony toolset also provides:
libraries of Signal programs,
a set of Signal program examples,
user oriented and implementation documentations,
facilities to generate new versions.
Dassault Systèmes, supplies a commercial implementation of Polychrony, called RT-Builder, used for industrial scale projects.
As part of its open-source release, the Polychrony toolset not only comprises source code libraries but also an important corpus of structured documentation, whose aim is not only to document each functionality and service, but also to help a potential developer to package a subset of these functionalities and services, and adapt them to developing a new application-specific tool: a new language front-end, a new back-end compiler. This multi-scale, multi-purpose documentation aims to provide different views of the software, from a high-level structural view to low-level descriptions of basic modules. It supports a distribution of the software “by apartment” (a functionality or a set of functionalities) intended for developers who would only be interested by part of the services of the toolset.
The Eclipse POP Framework.
We have developed a meta-model and interactive editor of Polychrony in Eclipse. Signal-Meta is the meta-model of the Signal language implemented with Eclipse/Ecore. It describes all syntactic elements specified in
The meta-model primarily aims at making the language and services of the Polychrony environment available to inter-operation and composition with other components (e.g. AADL, Simulink, GeneAuto) within an Eclipse-based development toolchain. Polychrony now comprises the capability to directly import and export Ecore models instead of textual Signal programs, in order to facilitate interaction between components within such a toolchain.
It also provides a graphical modelling framework allowing to design applications using a component-based approach. Application architectures can be easily described by just selecting components via drag and drop, creating some connections between them and specifying their parameters as component attributes. Using the modelling facilities provided with the Topcased framework, we have created a graphical environment for Polychrony called SME (Signal-Meta under Eclipse). To highlight the different parts of the modelling in Signal, we split the modelling of a Signal process in three diagrams: one to model the interface of the process, one to model the computation (or dataflow) part, and one to model all explicit clock relations and dependences. The SME environment is available through the ESPRESSO update site
It should be noted that the Eclipse Foundation does not host code under GPL license. So, the Signal toolbox useful to compile Signal code from Eclipse is hosted on our web server. For this reason, the building of the Signal toolbox, previously managed under Eclipse, has now been exported. The interface of the Signal toolbox for Eclipse is now managed using the CMake tool like the Signal toolbox and the Signal GUI.
The Apex interface, defined in the ARINC standard
A partition is composed of processes which represent the executive units (an ARINC partition/process is akin to a Unix process/task). When a partition is activated, its owned processes run concurrently to perform the functions associated with the partition. The process scheduling policy is priority preemptive. Each partition is allocated to a processor for a fixed time window within a major time frame maintained by the operating system. Suitable mechanisms and devices are provided for communication and synchronization between processes (e.g. buffer, event, semaphore) and partitions (e.g. ports and channels). The specification of the ARINC 651-653 services in Signal is now part of the Polychrony distribution and offers a complete implementation of the Apex communication, synchronization, process management and partitioning services. Its Signal implementation consists of a library of generic, parameterizable Signal modules.
We have proposed a dataflow design model of SCJ/L1 applications
Through a model-to-text transformation, using Acceleo, the SCJ code for missions, interfaces of handlers, and the mission sequencer is automatically generated in addition to the annotations needed by the memory checker. Channels are implemented as cyclic arrays or cyclical asynchronous buffers; and a fixed amount of memory is hence reused to store the infinite streams of tokens. The user must provide the SCJ code of all the handleAsyncEvent() methods. We have integrated the SCJ memory checker
This year's effort has been mainly devoted to the successful creation of project-team TEA and the definition of its new research perspective on Time, Events and Architectures in CPS design.
The SAE committee on the AADL adopted our recommendations to implement a timed and synchronous behavioural annex , for standardisation . The specification and reference implementation of this revised behavioral annex will be the focus of most our attention next year.
Adnan Bouakaz published and implemented more of the original results from his PhD. work on abstract affine scheduling , .
Static dataflow graph models, such as SDF
Nowadays real-time streaming applications on MPSoCs are increasingly complex; and runtime systems are more needed to handle resource sharing, task priorities, etc. Therefore, recent works
Our work
Translation validation
In the case of the Signal compiler , , the preservation of the semantics can be decomposed into the preservation of clock semantics at the clock calculation phase and that of data dependencies at the static scheduling phase, and, finally, value-equivalence of variables at the code generation phase.
Translation Validation for Clock Transformations in a Synchronous Compiler. In this work, the clock semantics of the source and transformed programs are formally represented as clock models. A clock model is a first-order logic formula that characterizes the presence/absence status of all signals in a Signal program at a given instant. Given two clock models, a clock refinement between them is defined which expresses the semantic preservation of clock semantics. A method to check the existence of clock refinement is defined as a satisfiability problem which can be automatically and efficiently proved by a SMT solver.
Let
where
Precise Deadlock Detection for Polychronous Data-flow Specifications.
Dependency graphs are a commonly used data structure to encode the streams of values in data-flow programs and play a central role in scheduling instructions during auto-mated code generation from such specifications. In this work , we propose a precise and effective method that combines a structure of dependency graph and first order logic formulas to check whether multi-clocked data-flow specifications are deadlock free before generating code from them. We represent the flow of values in the source programs by means of a dependency graph and attach first-order logic formulas to condition these dependencies. We use an SMT solver
Evaluating SDVG translation validation: from Signal to C. This work focuses on proving that every output signal in the source program and the corresponding variable in the compiled program, the generated C program, have the same values. The computations of all signals and their compiled counterparts are represented by a shared value-graph, called Synchronous Data-flow Value-Graph (SDVG).
Given a SDVG, assume that we want to show that two variables have the same value. We simply need to check that they are represented by the same sub-graph, meaning that they point to the same graph node. If all output signals in the source program
Implementation and Experiments.
At a high level, our tool SigCert (https://
Current state of P. The FUI project P has been extended until September 2015. Partners in the project now focus on code generation aspects, leaving software architecture aspects aside. The qualifiable model-based code generator, previously known as P toolset, is now named QGen (QGen is developped mostly in Ada 2012 and Python).
Model transformation (P2S). We developped a transformation tool hereafter named P2S for expressing P system models as Signal processes. Our work is based on EMF (Eclipse Modelling Framework), taking advantage of the existing Ecore metamodels available for both P and SSME.
The P2S tool is written in Clojure, which is a dialect of Lisp running on the Java Virtual Machine. This approach allows to benefits from a terse and expressive language while remaining fully interoperable with existing Java libraries (including Eclipse plugins and especially Polychrony ones).
SSME abstraction layer.P2S uses an abstraction layer to simplify the creation of SSME elements, while taking into account EMF idioms. For example, the following expression creates a ProcessModel instance using the currently registered EMF factory:
(process "TestProcess"
:in '[boolean h integer x]
:out '[integer y]
:body (sigdef
(id 'y)
(when* (id 'x) (id 'h))))
The newly created object can be saved as an XMI file using EMF utilities (the XMI file is 40 lines long and not shown here).
This object and its children represent the following Signal process expression
process TestProcess =
(? boolean h; integer x;
! integer y; )
(| y := (x when h) |);
Transformation to P. Conversion from P to Signal relies on Clojure's multimethods. We defined a convert multimethod which dispatches on the type of its argument and possibly on additional modifiers. This mechanism allows to convert expressions differently depending on whether we want to produce a Signal declaration or an expression. For example, the following method specializer converts a P port as a signal declaration:
(defmethod convert [Port :declaration] [port & _]
(ssme/signal-declarations
(convert (.getDataType port))
(ssme/with-comment
[(readable-name port :declaration) :post]
(ssme/id (p-name port)))))
Since the specializer contains the :declaration keyword, the previous conversion is applied only when called with that keyword given as an extra argument, as follows:
(convert some-port :declaration)
The more general specializer, which is defined below, is meant to be used inside Signal expressions and, as such, only returns a Signal identifier:
(defmethod convert Port [port]
(ssme/id (p-name port)))
Note also that thanks to class inheritance, the above methods are sufficient to convert all kind of P ports (input/output, data/control).
The naming scheme for the resulting SSME elements is handled by the p-name multi-method and relies on XMI identifiers of the original P elements: XMI identifiers generated by QGen are string representations of positive integers. Moreover, those identifiers are guaranteed to be unique in a model. These two properties allows to generate valid Signal identifiers while ensuring traceability (e.g. signal P101 links to the unique port of the original model having 101 as a unique identifier).
Datatypes are currently converted as Signal predefineds types, which do not always match exactly the original types. Another partially implemented option consists in translating them as external types in Signal. Some types, like arrays, are converted the same way with both approaches:
(defmethod convert TArray [a]
(reduce (fn [base dim]
(ssme/array-type base (convert dim :signal)))
(convert (.getBaseType a))
(.getDimensions a)))
Conversion of arithmetic operations may also lead to predefined Signal operators (by default) or externally defined functions (incomplete). The current approach has been tested on QGen's test models and successfully translates 208 of the 227 models.
Partial block sequencing. The conversion from P models to Signal takes into account block dependencies as computed by QGen. Unfortunately, QGen's block sequencer produces a total order between blocks, with leads to over-constrained Signal models. We contributed to the model compiler by writing an alternative (Ada) package which provides: (i) a way to parameterize block sequencing, and (ii) partial ordering options.
Our implementation is not part of the qualified compiler, but available as a standalone (non-qualifiable) executable. However, during the development of this block sequencer, we were able to find and correct existing bugs in QGen's sequencer.
Perspectives. From a software development point of view, our current work needs to be packaged and better integrated with the build system of Polychrony. By the way, that existing build process itself could be slightly improved by using Maven configuration files instead of Eclipse manual plug-in management.
The use of a functional language on top of the Java Virtual Machine is an interesting aspect of our work. By allowing the abstraction layer, which currently works at the SSME level, to also access the existing Signal library, we could provide an API for writing and compiling Signal code using a domain-specific language expressed in Clojure (there already exist JNI bindings with the native library). This feature could help developpers hook into, or interact with, the existing Signal compiler in order to customize parts of the code generation strategies.
Regarding the P project, we still need to test code distribution strategies on industrial use-cases and determine how it can be exploited at the system-model level.
The SAE committee on the AADL adopted our recommendations to implement a timed and synchronous behavioural annex for the standard . The specification and reference implementation of this revised behavioral annex will be the focus of most our attention next year.
We propose a synchronous timing annex for the SAE standard AADL. Our approach consists of building a synchronous model of computation and communication that best fits the semantics and expressive capability of the AADL and its behavioral annex and yet requires little to know (syntactic) extension to it, i.e. to identify a synchronous core of the AADL (which prerequisites a formal definition of synchrony at hand) and define a formal design methodology to use the AADL in a way that supports formal analysis, verification and synthesis.
Our approach first identifies the core AADL concepts from which time events can be described. Then, is considers the behavior annex (BA) as the mean to model synchronous signals and traces through automata. Finally, we consider elements of the constraint annex to reason about abstractions of these signals and traces by clocks and relations among them. To support the formal presentation of these elements, we define a model of automata that comprises a transition system to express explicit transitions and constraints, in the form of a boolean formula on time, to implicitly constraint its behavior. The implementation of such an automaton amounts to composing its explicit transition system with that of the controller synthesised from its specified constraints.
Reduction of communications. We have developed, as a general functionality of the Signal toolbox, a means to reduce communications between two graphs, using assignment clocks and utility clocks.
For a given signal
Considering two graphs
Note that this reduction is not always possible because it may introduce cycles between signals and clocks.
Experiments have been made on programs intended to the distribution of Quartz applications, with a gain of up to 40on some of them .
Polychronous automata. We have defined a new model of polychronous constrained automata that has been provided as semantic model for our proposal of an extension of the AADL behavioural annex . An algebra of regular expressions is also defined to represent abstractions of constrained automata or, more specifically, their time constraints.
An experimental implementation of the semantic features of this “timing annex” will be provided through the Polychrony framework. For that purpose, representations of automata are introduced in the Signal toolbox of Polychrony. In a first step, we have decided to provide only a minimal extension of the Signal language itself. A new syntactic category of process model, which is an automaton model, has been introduced. States are described by the association of labels with subprocesses, as it is available in Signal, and transitions between states, at a given clock, are written as calls to intrinsic (predefined) processes. Constraints described as regular expressions on events should also be introduced using intrinsic processes.
Automata will be used in different ways related to stategies of compilation. In particular, they will serve as an alternative model for the code generation. For that purpose, polychronous programs are rewritten thanks to valuations of memorized boolean signals. The resulting partially valuated programs are the states of a control automaton.
Such techniques can be applied to implement endo-isochronous programs. Currently, code may be generated only for endochronous programs, for which clock hierarchy is a tree. Endo-isochronous programs are compositions of endochronous programs the “intersection” of which is also endochronous. For example, an automaton can be built to generate code when two signals are known to alternate.
We propose a distribution methodology for synchronous programs , applied in particular on programs written in the Quartz language
The presented methodology has been implemented within the integrated framework Quartz/Averest + Signal/Polychrony. To illustrate and validate this methodology, a series of examples served as case studies. Each of them has been written in the Quartz language and distributed over different processing locations using the presented optimization methodology. These case studies confirm that the optimization can bring in significant communication reduction. In the sequel, the efficient utilization of distributed systems is substantially updated.
The Synchronous language Quartz is well suited for modeling mono-clocked systems. However, as based on the model of computation (MoC) synchrony, its parallelism feature excessively strengthens the synchronization. Such synchronous parallelism in particular restricts independent component design. That is, the modeling of connected components should constantly refer to each other to guarantee the achievement of desired system behavior. Hence, Quartz cannot support well the component-based system design, in particular for the distributed systems that are generally deployed over desynchronized processing locations with multi-rate clocks.
In contrast to Quartz, the polychronous language Signal is based on the MoC polychrony. As its name suggests, a polychronous program makes use of multi-rate clocks to drive its execution. One can consider that each component in the program holds its own master clock, and there is no longer a master clock for the whole program. The resulted architecture is named globally asynchronous locally synchronous (GALS) architecture.
Through integrating Quartz with Signal, a component-based methodology is proposed for designing multi-rate systems: at first, components are modeled independently to achieve local behaviors; secondly, inter-component communications are adjusted using Signal to realize intermittent synchronization. In this way, the modeling approach for mono-clocked systems evolves into a component-based modeling methodology. Such significant progress not only facilitates the component coordination, but also enhances the component reusability, in particular for modeling large scale systems.
Title: Co-Modeling of Safety-Critical Multi-threaded Embedded Software for Multi-Core Embedded Platforms
Inria principal investigator: Jean-Pierre Talpin
International Partner (Institution - Laboratory - Researcher):
Virginia Tech Research Laboratories, Arlington (United States)
Embedded Systems Group, Teschnische Universität Kaiserslautern (Germany)
Duration: 2014 - 2016
Abstract: We started a new project in April 2014 funded by Toyota ITC, California, to work with Huafeng Yu (a former post-doctorate of team ESPRESSO) and with VTRL as US partner. The main topic of our project is the semantic-based model integration of automotive architectures, virtual integration, toward formal verification and automated code synthesis. This year, Toyota ITC is sponsoring our submission for the standardisation of a time annex in the SAE standard AADL.
In a second work-package, we aim at elaborating a standardised solution to virtually integrate and simulate a car based on heterogeneous models of its components. This year, it will be exemplified by the elaboration of a case study in collaboration with Virginia Tech. The second phase of the project will consist of delivering an open-source, reference implementation, of the proposed AADL standard and validate it with a real-scale model of the initial case-study.
Program: ANR
Project acronym: VeriSync
Project title: Vérification formelle d'un générateur de code pour un langage synchrone
Duration: Nov. 2010 - Oct. 2013
Coordinator: IRIT
Other partners: IRIT
Abstract:
The VeriSync project aims at improving the safety and reliability assessment of code produced for embedded software using synchronous programming environments developed under the paradigm of Model Driven Engineering. This is achieved by formally proving the correctness of essential transformations that a source model undergoes during its compilation into executable code.
Our contribution to VeriSync consists of revisiting the seminal work of Pnueli et al. on translation validation and equip the Polychrony environment with updated verification techniques to scale it to possibly large, sequential or distributed, C programs generated from the Signal compiler. Our study covers the definition of simulation and bisimulation equivalence relations capable of assessing the correspondence between a source Signal specification and the sequential or concurrent code generated from it, as well as both specific abstract model-checking techniques allowing to accelerate verification and counter-example search techniques, to filter spurious verification failures obtained from excessive abstracted exploration.
——
Program: ANR
Project acronym: Feever
Project title: Faust Environment Everyware
Duration: 2014-2016
Coordinator:
Other partners:
URL: http://
Abstract:
The aim of project FEEVER is to ready the Faust music synthesis language for the Web. In this context, we collaborate with Mines ParisTech to define a type system suitable to model music signals timed at multiple rates and to formally support playing music synthesised from different physical locations.
Program: FUI
Project acronym: P
Project title: Project P
Duration: March 2011 - Sept. 2015
Coordinator: Continental Automotive France
Other partners: 19 partners (Airbus, Astrium, Rockwell Collins, Safran, Thales Alenia Space, Thales Avionics...)
Abstract:
The aim of project P is 1/ to aid industrials to deploy model-driven engineering technology for the development of safety-critical embedded applications, 2/ to contribute on initiatives such as ITEA2 OPEES and Artemisia CESAR to develop support for tools inter-operability, and 3/ to provide state-of-the-art automated code generation techniques from multiple, heterogeneous, system-levels models. The focus of project P is the development of a code generation toolchain starting from domain-specific modeling languages for embedded software design and to deliver the outcome of this development as an open-source distribution, in the aim of gaining an impact similar to GCC for general-purpose programming, as well as a kit to aid with the qualification of that code generation toolchain.
The contribution of project-team TEA in project P is to bring the necessary open-source technology of the Polychrony environment to allow for the synthesis of symbolic schedulers for software architectures modeled with P in a manner ensuring global asynchronous deterministic execution..
Program: CORAC
Project acronym: CORAIL
Project title: Composants pour l'Avionique Modulaire Étendue
Duration: July 2013 - May 2017
Coordinator: Thales Avionics
Other partners: Airbus, Dassault Aviation, Eurocopter, Sagem...
Abstract:
The CORAIL project aims at defining components for Extended Modular Avionics. The contribution of project-team TEA is to define a specification method and to provide a generator of multi-task applications.
Title: Co-Modeling of Safety-Critical Multi-threaded Embedded Software for Multi-Core Embedded Platforms
Inria principal investigator: Jean-Pierre Talpin
International Partner (Institution - Laboratory - Researcher):
Virginia Tech Research Laboratories, Arlington (United States)
Embedded Systems Group, Teschnische Universität Kaiserslautern (Germany)
Duration: 2013 - 2016
See also: http://
Abstract: The aim of the USAF OSR Grant FA8655-13-1-3049 is to support collaborative research entitled “Co-Modeling of safety-critical multi-threaded embedded software for multi-core embedded platforms” between Inria project-team ESPRESSO, the VTRL Fermat Laboratory and the TUKL embedded system research group, under the program of the Polycore associate-project.
Title: Virtual Prototyping of embedded software architectures
International Partner (Institution - Laboratory - Researcher):
The University of Hong Kong (Hong ,Kong)
Duration: 2012 - now
We collaborate with John Koo at the University of Hong Kong (HKU) and the LIAMA since two years through visiting grants of the Chinese Academy of Science and of the University of Rennes on the topics of heterogeneous time modelling and virtual prototyping. We submitted an ANR project proposal on this topic.
An engineer of SIAT, Riu Li, has developed a pilot project to evaluate Polychrony in the context of virtual prototyping and real-time simulation of automotive systems (the controller of a V6 turbo-charged engine model in LMS
The partners submitted a PHC proposal and intend to resubmit a joint project proposal for the ANR-HK international program. A longer term goal of our collaboration is to setup, within the IET, a joint laboratory with Inria, in order to both disseminate formal methods for embedded system design on a specific Master program, and jointly contribute to an open-source system design platform with European and Asian industrial partners which are sponsoring the IET.
Title: Models of computation for embedded software design
International Partner (Institution - Laboratory - Researcher):
Virginia Tech Research Laboratories (USA)
Duration: 2003 - now
Team TEA collaborates with Sandeep Shukla, Virginia Tech, since 2002. First, in the frame of the NSF-Inria program with Rajesh Gupta, UCSD, until 2004; Inria's associated project BALBOA, until 2007; with the sabbatical of Sandeep Shukla at IRISA in 2008-2009 (funded by Inria-Rennes, the University of Rennes 1, Inria's scientific board); and, from 2011 to 2013, in the context of the associate-project POLYCORE, together with the ESG group at TU Kaiserslautern.
Following up Sandeep's sabbatical, the Fermat Laboratory was awarded a series of research grant by the US Air Force Research Laboratory (AFRL) to develop a modelling environment based on Polychrony. In this context, Virginia Tech hired a former PhD. of team ESPRESSO, Julien Ouy, to contribute and coordinate this project's work. Since 2013, the scope of our collaboration has extended with the three years grant awarded to team TEA by the USAF Office for Scientific Research (AFOSR).
To date, our fruitful and sustained collaboration has yield the creation of the ACM-IEEE MEMOCODE conference series
We collaborate with Klaus Schneider, leader of the ESG group at Uni. Kaiserslautern, since 2011 in the frame of the POLYCORE associate project. Our aim is to develop a joint, open-source, toolchain based on the Averest (ESG) and POP (TEA) environments. Our collaboration has been quite fruitful with several recent journal publications
Onyx mixes imperative Quartz modules and declarative Signal networks to specify multi-clocked systems. We intend to further its development by the submission of a joint ANR or European project. Our objective is to develop an environment capable of synthesising distributed, loosely synchronised executives from imperative Quartz modules whose schedules are specified by multi-clocked data-flow specifications. A new version of this front-end, developed by Sun Ke, will be integrated in the POP environment.
Jean-Pierre Talpin was awarded a visiting researcher grant by the US Air Force Research Laboratories for collaborative research with the Virginia Tech Research Laboratories. In this context, he visited the Arlington and Falls Church VT campuses in Spring, Summer and Fall 2014 for a duration of two and a half months.
Jean-Pierre Talpin is a member of the steering committee of the ACM-IEEE Conference on Methods and Models for System Design (MEMOCODE).
Jean-Pierre Talpin co-chaired the program committee of the 12th. ACM-IEEE MEMOCODE conference and the 5th. IEEE RTSS workshop AVICPS.
Jean-Pierre Talpin served the program committee of the 12th. ACM EMSOFT'14, ACM LCTES'14, and SCOPES'14 conferences, as well as the MODELS workshop ACVI'14.
Thierry Gautier served as program commitee member for the 2014 Electronic System Level Synthesis Conference, ESLsyn 2014 (http://
Jean-Pierre Talpin is Associate Editor with the ACM Transactions for Embedded Computing Systems (TECS); he is also Associate Editor with the Springer journal on Frontiers of Computer Science (FCS) and Associate Editor with EURASIP journal of embedded systems.
Jean-Pierre Talpin reviewed for Acta Informatica and Science of Computer Programming.
PhD advisory of Chan Ngo by Jean-Pierre Talpin, Paul Le Guernic and Thierry Gautier, entitled "Vérification formelle d'un générateur de code pour les spécifications polychrones", defended in December 2014.
PhD advisory of Sun Ke by Jean-Pierre Talpin, Paul Le Guernic and Thierry Gautier, entitled "Conception conjointe de modules synchrones et de réseaux flot-de-données polychrones", since 2011.
PhD co-advisory of Imré Frotier de la Messelière by Jean-Pierre Talpin and Pierre Jouvelot (Mines ParisTech), entitled "Conception et implémentation d'applications musicales innovantes pour les nouvelles technologies multimédia", since October 2013.
Jean-Pierre Talpin served as Referee at the Thesis Defence of Vincent Gaudel (UBO), entitled "Des patrons de conception pour assurer l'analyse d'architectures : un exemple avec l'analyse d'ordonnancement", December 2014.