EN FR
EN FR

2024Activity reportProject-TeamSPADES

RNSR: 201321224T
  • Research center Inria Centre at Université Grenoble Alpes
  • In partnership with:Université de Grenoble Alpes
  • Team name: Sound Programming of Adaptive Dependable Embedded Systems
  • In collaboration with:Laboratoire d'Informatique de Grenoble (LIG)
  • Domain:Algorithmics, Programming, Software and Architecture
  • Theme:Embedded and Real-time Systems

Keywords

Computer Science and Digital Science

  • A1.1.1. Multicore, Manycore
  • A1.1.9. Fault tolerant systems
  • A1.3. Distributed Systems
  • A2.1.1. Semantics of programming languages
  • A2.1.6. Concurrent programming
  • A2.1.9. Synchronous languages
  • A2.3. Embedded and cyber-physical systems
  • A2.3.1. Embedded systems
  • A2.3.2. Cyber-physical systems
  • A2.3.3. Real-time systems
  • A2.4.1. Analysis
  • A2.4.3. Proofs

Other Research Topics and Application Domains

  • B3.1. Sustainable development
  • B4.5. Energy consumption
  • B6.3.3. Network Management
  • B6.6. Embedded systems
  • B9. Society and Knowledge
  • B9.9. Ethics

1 Team members, visitors, external collaborators

Research Scientists

  • Gregor Goessler [Team leader, INRIA, Senior Researcher]
  • Martin Bodin [INRIA, Researcher]
  • Pascal Fradet [INRIA, Researcher]
  • Alain Girault [INRIA, Senior Researcher]
  • Sophie Quinton [INRIA, Researcher]
  • Jean-Bernard Stefani [INRIA, Senior Researcher]

Faculty Member

  • Xavier Nicollin [GRENOBLE INP, Associate Professor]

Post-Doctoral Fellow

  • Alexandre Honorat [FLORALIS, Post-Doctoral Fellow]

PhD Students

  • Baptiste De Goer De Herve [INRIA]
  • Giovanni Fabbretti [INRIA, until Sep 2024]
  • Aurélie Kong Win Chang [INRIA]
  • Pietro Lami [INRIA]
  • Alexander Obeid Guzman [INRIA]

Interns and Apprentices

  • Tristan Mathon [INRIA, Intern, from Jul 2024 until Sep 2024]

Administrative Assistant

  • Julia Di Toro [INRIA]

2 Overall objectives

The Spades project-team aims at contributing to meet the challenge of designing and programming dependable embedded systems in an increasingly distributed and dynamic context. Specifically, by exploiting formal methods and techniques, Spades aims to answer three key questions:

  1. How to program open distributed embedded systems as dynamic adaptive modular structures?
  2. How to program reactive systems with real-time and resource constraints?
  3. How to program fault-tolerant and explainable embedded systems?

These questions above are not new, but answering them in the context of modern embedded systems, which are increasingly distributed, open and dynamic in nature  71, makes them more pressing and more difficult to address: the targeted system properties – dynamic modularity, time-predictability, energy efficiency, and fault-tolerance – are largely antagonistic (e.g., having a highly dynamic software structure is at variance with ensuring that resource and behavioral constraints are met). Tackling these questions together is crucial to address this antagonism, and constitutes a key point of the Spades research program.

A few remarks are in order:

  • We consider these questions to be central in the construction of future embedded systems, dealing as they are with, roughly, software architecture and the provision of real-time and fault-tolerance guarantees. Building a safety-critical embedded system cannot avoid dealing with these three concerns.
  • The three questions above are highly connected. For instance, composability along time, resource consumption and reliability dimensions are key to the success of a component-based approach to embedded systems construction.
  • For us, “Programming” means any constructive process to build a running system. It can encompass traditional programming as well as high-level design or “model-based engineering” activities, provided that the latter are supported by effective compiling tools to produce a running system.
  • We aim to provide semantically sound programming tools for embedded systems. This translates into an emphasis on formal methods and tools for the development of provably dependable systems.

3 Research program

The SPADES research program is organized around three main themes, Design and programming models, Certified real-time programming, and Causality and reversibility, that seek to answer the three key questions identified in Section 2. We plan to do so by developing and/or building on programming languages and techniques based on formal methods and formal semantics (hence the use of “sound programming” in the project-team title). In particular, we seek to support design where correctness is obtained by construction, relying on proven tools and verified constructs, with programming languages and programming abstractions designed with verification in mind.

3.1 Design and Programming Models

Work on this theme aims to develop models, languages and tools to support a “correct-by-construction” approach to the development of embedded systems.

On the programming side, we focus on the definition of domain specific programming models and languages supporting static analyses for the computation of precise resource bounds for program executions. We propose dataflow models supporting dynamicity while enjoying effective analyses. In particular, we study parametric extensions and dynamic reconfigurations where properties such as liveness and boundedness remain statically analyzable. We also study the memory consumption of dataflow graphs. We study new techniques to find optimal sequential schedules (optimal in the sense that their memory peak is minimal) of tasks graphs and SDF graphs. We use these techniques to find parallel schedules that satisfy memory constraints possibly the strongest ones.

On the design side, we focus on the definition of component-based models for software architectures combining distribution, dynamicity, real-time and fault-tolerant aspects. Component-based construction has long been advocated as a key approach to the “correct-by-construction” design of complex embedded systems 57. Witness component-based toolsets such as Ptolemy  45, BIP 38, or the modular architecture frameworks used, for instance, in the automotive industry (AUTOSAR) 35. For building large, complex systems, a key feature of component-based construction is the ability to associate with components a set of contracts, which can be understood as rich behavioral types that can be composed and verified to guarantee a component assemblage will meet desired properties.

Formal models for component-based design are an active area of research. However, we are still missing a comprehensive formal model and its associated behavioral theory able to deal at the same time with different forms of composition, dynamic component structures, and quantitative constraints (such as timing, fault-tolerance, or energy consumption).

We plan to develop our component theory by progressing on two fronts: a semantical framework and domain-specific programming models. The work on the semantical framework should, in the longer term, provide abstract mathematical models for the more operational and linguistic analysis afforded by component calculi. Our work on component theory will find its application in the development of a Coq-based toolchain for the certified design and construction of dependable embedded systems, which constitutes our first main objective for this axis.

3.2 Certified Real-Time Programming

Programming real-time systems (i.e., systems whose correct behavior depends on meeting timing constraints) requires appropriate languages (as exemplified by the family of synchronous languages 40), but also the support of efficient scheduling policies, execution time and schedulability analyses to guarantee real-time constraints (e.g., deadlines) while making the most effective use of available (processing, memory, or networking) resources. Schedulability analysis involves analyzing the worst-case behavior of real-time tasks under a given scheduling algorithm and is crucial to guarantee that time constraints are met in any possible execution of the system. Reactive programming and real-time scheduling and schedulability for multiprocessor systems are old subjects, but they are nowhere as mature as their uniprocessor counterparts, and still feature a number of open research questions 36, 44, in particular in relation with mixed criticality systems. The main goal in this theme is to address several of these open questions.

We focus on two issues: multicriteria scheduling on multiprocessors, and schedulability analysis for real-time multiprocessor systems. Beyond real-time aspects, multiprocessor environments, and multicore ones in particular, are subject to several constraints in conjunction, typically involving real-time, reliability and energy-efficiency constraints, making the scheduling problem more complex for both the offline and the online cases. Schedulability analysis for multiprocessor systems, in particular for systems with mixed criticality tasks, is still very much an open research area.

Distributed reactive programming is rightly singled out as a major open issue in the recent, but heavily biased (it essentially ignores recent research in synchronous and dataflow programming), survey by Bainomugisha et al. 36. For our part, we focus on devising synchronous programming languages for distributed systems and precision-timed architectures.

3.3 Causality and Reversibility

Managing faults is a clear and present necessity in networked embedded systems. At the hardware level, modern multicore architectures are manufactured using inherently unreliable technologies 41, 55. The evolution of embedded systems towards increasingly distributed architectures highlighted in the introductory section means that dealing with partial failures, as in Web-based distributed systems, becomes an important issue.

In this axis we intend to address the question of how to cope with faults and failures in embedded systems? We will tackle this question by exploiting reversible programming models and by developing techniques for fault ascription and explanation in component-based systems.

A common theme in this axis is the use and exploitation of causality information. Causality, i.e., the logical dependence of an effect on a cause, has long been studied in disciplines such as philosophy 65, natural sciences, law 66, and statistics 67, but it has only recently emerged as an important focus of research in computer science. The analysis of logical causality has applications in many areas of computer science. For instance, tracking and analyzing logical causality between events in the execution of a concurrent system is required to ensure reversibility 61, to allow the diagnosis of faults in a complex concurrent system 56, or to enforce accountability 60, that is, designing systems in such a way that it can be determined without ambiguity whether a required safety or security property has been violated, and why. More generally, the goal of fault-tolerance can be understood as being to prevent certain causal chains from occurring by designing systems such that each causal chain either has its premises outside of the fault model (e.g., by introducing redundancy 50), or is broken (e.g., by limiting fault propagation 70).

4 Application domains

4.1 Industrial Applications

Our applications are in the embedded system area, typically: transportation, energy production, robotics, telecommunications, the Internet of things (IoT), systems on chip (SoC). In some areas, safety is critical, and motivates the investment in formal methods and techniques for design. But even in less critical contexts, like telecommunications and multimedia, these techniques can be beneficial in improving the efficiency and the quality of designs, as well as the cost of the programming and the validation processes.

Industrial acceptance of formal techniques, as well as their deployment, goes necessarily through their usability by specialists of the application domain, rather than of the formal techniques themselves. Hence, we are looking to propose domain-specific (but generic) realistic models, validated through experience (e.g., control tasks systems), based on formal techniques with a high degree of automation (e.g., synchronous models), and tailored for concrete functionalities (e.g., code generation).

4.2 Current Industrial Cooperations

Regarding applications and case studies with industrial end-users of our techniques, we cooperate with Orange Labs on software architecture for cloud services. We also collaborate with RTaW regarding the integration of our CAN-bus analysis certifier (CertiCAN) in the RTaW-Pegase program suite.

5 Social and environmental responsibility

5.1 Footprint of research activities

With the help of the GES 1point5 tool we have estimated the direct carbon footprint of our research activities in 2024. Our estimation is based on data gathered in a non-automated manner, as no tool automating the data extraction is available yet.

Professional travels, including the coming of jury members, amount to a total of 5,6 t CO2e. Commute travels sum up to 1,8 t CO2e. We purchased new hardware (1 computer) for a total of 174 kg CO2e. We roughly estimate our share of INRIA services and building usage to 6 t CO2e. Based on the above estimations, our carbon footprint totals 13,6 t CO2e for the team, or an average of 1,0 t CO2e per team member.

5.2 Impact of research results

Our research on certification and fault-tolerance aims at making embedded systems safer. Certified systems tend also to be simpler, less depending on updates and therefore less prone to obsolescence. A potential major application of causality analysis is to help establish liability for accidents caused by software errors.

On the other hand, our research may contribute to make more acceptable or even to promote many problematic systems such as IoT, drones, avionics, autonomous vehicles, ... with a potential negative environmental impact.

Sophie Quinton and Éric Tannier (from the BEAGLE team in Lyon), with the help of many colleagues, including some in the SPADES team, have set up a series of one-day workshops called “Ateliers SEnS” (for Sciences-Environnements-Sociétés), which offer a venue for members of the research community (in particular, but not limited to, researchers) to reflect on the social and environmental implications of their research. More than 50 Ateliers SEnS have taken place so far, all across France and beyond INRIA and the computer science field. Participants to a workshop can replicate it, and quite a few have already done so. Sophie Quinton has facilitated 4 Ateliers SEnS in 2024.

Research into the connection between ICT (Information and Communication Technologies) and the environmental crisis has started in 2020 within the SPADES team, see Section 7.4.

6 New software, platforms, open data

6.1 New software

6.1.1 CESAn

  • Name:
    Core Erlang Semantics Analyzer
  • Keyword:
    Formal semantics
  • Functional Description:
    CESAn implements the semantics of a subset of Core Erlang. Given a Core Erlang program with finite semantics, it outputs its semantics in the form of a labeled transition system. The underlying small-step semantics faithfully represents message passing and signal handling in Erlang.
  • Publication:
  • Contact:
    Aurélie Kong Win Chang
  • Participants:
    Aurélie Kong Win Chang, Jerome Feret, Gregor Goessler

6.1.2 cloudnet

  • Name:
    Cloudnet
  • Keywords:
    Cloud configuration, Tosca, Docker Compose, Heat Orchestration Template, Alloy
  • Scientific Description:

    The multiplication of models, languages, APIs and tools for cloud and network configuration management raises heterogeneity issues that can be tackled by introducing a reference model. A reference model provides a common basis for interpretation for various models and languages, and for bridging different APIs and tools. The Cloudnet Computational Model formally specifies, in the Alloy specification language, a reference model for cloud configuration management. The Cloudnet software formally interprets several configuration languages in it, including the TOSCA configuration language, the OpenStack Heat Orchestration Template and the Docker Compose configuration language.

    The use of the software shoes, for examples, how the Alloy formalization allowed us to discover several classes of errors in the OpenStack HOT specification.

  • Functional Description:

    Application of the Cloudnet model developed by Inria to software network deployment and reconfiguration description languages.

    The Cloudnet model allows syntax and type checking for cloud configuration templates as well as their visualization (network diagram, UML deployment diagram). Four languages are addressed for the moment: The OASIS's TOSCA specification, the ETSI's NFV SOL001 specification, OpenStack's HOT (Heat Orchestration Template), and Docker Compose.

    We can use directly the software from an Orange web portal: https://toscatoolbox.orange.com

  • URL:
  • Publication:
  • Contact:
    Philippe Merle
  • Participants:
    Philippe Merle, Jean-Bernard Stefani, Roger Pissard-Gibollet, Souha Ben Rayana, Karine Guillouard, Meryem Ouzzif, Frédéric Klamm, Jean-Luc Coulin
  • Partner:
    Orange Labs

6.1.3 MASTAG

  • Name:
    Memory Analyzer and Scheduler for Task Graphs
  • Keyword:
    Task scheduling
  • Functional Description:

    The MASTAG software computes sequential schedules of a task graph or an SDF graph in order to minimize its memory peak.

    MASTAG is made of several components: (1) a set of local transformations that compress a task graph while preserving its optimal memory peak, (2) an optimized branch and bound algorithm able to find optimal schedules for medium sized (30-50 nodes) task graphs, (3) support to accommodate SDF graphs in particular, their conversion into task graphs and a suboptimal technique to reduce their size.

    MASTAG finds optimal sequential schedules in polynomial time for a wide range of directed acyclic task graphs (DAG), including trees and series-parallel DAG. On classic benchmarks, MASTAG always outperforms the state-of-the-art.

    From an optimal sequential schedule, MASTAG can derive a dynamic parallel schedule satisfying any practical memory constraints and achieving good speedups. MASTAG is efficient and always succeeds in finding a parallel schedule that respects the required memory constraints, unlike alternative tools.

  • URL:
  • Contact:
    Alexandre Honorat

6.1.4 Tabvar

  • Keywords:
    Coq, GUI (Graphical User Interface), Teaching
  • Functional Description:
    This is a prototype of a graphical interface for the Coq proof assistant that includes graphical elements (here, curve sketching tabs). These elements are meant to interact with the usual textual proof of Coq, and help students learning how what a mathematical proof is expected to be.
  • URL:
  • Publication:
  • Contact:
    Martin Bodin
  • Partner:
    LIG

7 New results

7.1 Dataflow models of computation

Participants: Pascal Fradet, Alain Girault, Alexandre Honorat.

7.1.1 Dynamicity in dataflow models

Dataflow Models of Computation (MoCs) are widely used in embedded systems, including multimedia processing, digital signal processing, telecommunications, and automatic control. One of the first and most popular dataflow MoCs, Synchronous Dataflow (SDF), provides static analyses to guarantee boundedness and liveness, which are key properties for embedded systems. However, SDF and most of its variants lack the capability to express the dynamism needed by modern streaming applications.

For many years, the Spades team has been working on more expressive and dynamic models that nevertheless allow the static analyses of boundedness and liveness. We have proposed several parametric dataflow models of computation (MoCs) (SPDF 49 and BPDF 39), we have written a survey providing a comprehensive description of the existing parametric dataflow MoCs 42, we have studied symbolic analyses of dataflow graphs 43 and an original method to deal with lossy communication channels in dataflow graphs 48. We have also proposed the RDF (Reconfigurable Dataflow) MoC 4 which allows dynamic reconfigurations of the topology of the dataflow graphs. RDF extends SDF with transformation rules that specify how the topology and actors of the graph may be dynamically reconfigured. The major feature and advantage of RDF is that it can be statically analyzed to guarantee that all possible graphs generated at runtime will be connected, consistent, and live, which in turn guarantees that they can be executed in bounded time and bounded memory. To the best of our knowledge, RDF is the only dataflow MoC allowing an arbitrary number of topological reconfigurations while remaining statically analyzable.

In 2022, we started focusing on optimizing the memory consumption of dataflow graphs. This objective is critical for embedded systems and neural networks which can be implemented in a dataflow fashion. We have first proposed new techniques to find optimal sequential schedules (optimal in the sense that their memory peak is minimal) of tasks graphs and SDF graphs. Then, we have studied how to find parallel schedules that satisfy memory constraints possibly the strongest ones.

We have proposed graph transformations that compress a task graph while preserving its optimal memory peak 14, 29. These transformations compress a large class of graphs into a single node representing their optimal schedule. In particular, we have formally proved that this is the case for all Series-Parallel Directed Acyclic Graphs (SP-DAGs). In addition, our graph transformations provides a simple characterization of optimal schedules for sets of independent tasks and allowed us to design an optimal compositional analysis dealing with single-source single-sink subgraphs (called S-T subgraphs). These S-T subgraphs can be analyzed separately and replaced by their best schedule. These results (correctness of the transformation rules, the compositional analysis, etc.) were formally proved. For graphs that cannot be compressed to a single node, we have designed an optimized branch and bound algorithm able to find optimal schedules for medium sized task graphs, between 30 and 50 nodes.

Our approach also applies to SDF graphs after converting them to task graphs. However, since that conversion may produce very large graphs, we also propose a new suboptimal method, similar to Partial Expansion Graphs, to reduce the problem size. We evaluated our approach on classic benchmarks, on which we always outperform the state-of-the-art.

A natural extension of this work was to consider parallel schedules with shared memory. The optimal memory peak found for a sequential execution provides a lower bound for all its parallel versions. Using a list scheduling scheduling algorithm adapted to take into account memory requirements, we were able to derive dynamic parallel schedules from the optimal sequential schedules 22. We produce parallel schedules that always meet the memory constraints (even the harshest ones) and enjoy relatively good speedups. As expected, the more relaxed the memory constraints, the better the speedups are. When memory constraints are close to their minimum, our approach always succeeds in finding a parallel schedule meeting the given constraints, whereas the previous state-of-the-art approaches mostly fail. Furthermore, our approach is faster and can deal with very large task graphs.

Finally, we have applied the Affine DataFlow Graph (ADFG) theory to the domain of reconfigurable processors (FPGA) 16. With the help of a few new equations, the theory of ADFG is adapted to minimize the buffer sizes of dataflow applications modeled by SDF graphs and executed on FPGA. This is particularly important for FPGAs which have a limited embedded memory. The corresponding open-source software PREESM is developped at INSA Rennes.

7.2 Real-Time Scheduling

Participants: Alain Girault.

7.2.1 A Markov Decision Process approach for energy minimization policies

Since 2017 we have been working on a very general model of real-time systems, made of a single-core processor equipped with DVFS1 and an infinite sequence of preemptive real-time jobs. Each job Ji is characterized by the triplet (τi,wi,di), where τi is the inter-arrival time between Ji and Ji+1, wi is the actual size of Ji, upper-bounded by the maximal size W, and di is the relative deadline of Ji, upper-bounded by Δ. The key point is that the system is non-clairvoyant, meaning that, at release time, wi is not known until the job Ji actually terminates. The only information available to the processor are the statistical information on the jobs' characteristics: release time, average execution time (AET), and relative deadline. In this context, we have proposed a Markov Decision Process (MDP) solution to compute the optimal online speed policy guaranteeing that each job completes before its deadline and minimizing the energy consumption 15. To the best of our knowledge, our MDP solution is the first to be optimal. We have also provided counter examples to prove that the two previous state of the art algorithms, namely OA  37 and PACE  62, 63, are both sub-optimal. Finally, we have proposed a new heuristic online speed policy called Expected Load (EL) that incorporates an aggregated term representing the future expected jobs into a speed equation similar to that of OA. Simulations show that our MDP solution outperforms the existing online solutions (OA, PACE, and EL), and can be very attractive in particular when the mean value of the execution time distribution is far from the worst-case execution time (WCET). This was the topic of Stéphan Plassart's PhD  53, 5251, who defended his PhD in June 2020 68.

7.3 Causality and Reversibility

Participants: Gregor Goessler, Jean-Bernard Stefani, Giovanni Fabbretti, Aurélie Kong Win Chang, Pietro Lami, Alexander Obeid Guzmán.

7.3.1 Causal Explanations for Embedded and Concurrent Systems

In order to pinpoint the root causes of system failures and explain why an observed outcome occurred, we have been developing techniques based on counterfactual analysis. Counterfactual analyses determine causal dependencies beyond those captured by classical causal semantics for concurrent systems. Given a system model, our goal is to extract the part of a failing execution trace that is causally relevant for the failure. We have been continuing our work on this topic in two directions.

Following up on Thomas Mari's PhD thesis 64, we are currently working on a symbolic construction of robustness functions for real-time systems, allowing us to effectively generate explanations.

As part of the DCore project on causal debugging of concurrent programs, the goal of Aurélie Kong Win Chang's PhD thesis is to investigate the construction of causal explanations for Erlang programs. In 59 we have formalized a small step semantics for a subset of Core Erlang that models, in particular, its monitoring and signal systems. We have implemented this semantics in the Core Erlang Semantics Analizer (CESAn, 6.1.1). We are currently developing a tool that, based on this semantics, explains the causes of a program execution violating an expected safety property.

So far we assumed a system model to be known in order to assess causality. However, for many applications a faithful system model is not available. The goal of Alexander Obeid Guzman's PhD thesis is to leverage a measure of conditional algorithmic complexity in order to infer causal dependencies from the single observation of an execution trace of a telecommunications network.

7.3.2 Reversibility for concurrent and distributed debugging

Concurrent and distributed debugging is a promising application of the notion of reversible computation 54. As part of the ANR DCore project we contribute to the theory behind, and the developoment of the CauDEr reversible debugger for the Erlang programming language and system.

We have continued this year our work on two main themes: studying reversibility for distributed programs in presence of node and link failures with recovery, and studying reversibility for concurrent programs using a shared memory concurrency model.

Concerning reversibility for distributed programs, even though the Erlang programming language was the main application target for the DCore project, Erlang is a real-world language with a fair number of features to handle. For this reason, we decided to develop a small process calculus conceived as an abstraction of the behaviour of distributed Erlang systems, featuring crash failures for nodes running Erlang systems, and for communication links between Erlang nodes, as well as recoveries for nodes and links. Node recovery in Erlang has a fairly weak semantics, namely, a node that recovers from a crash failure restarts with no memory from its past execution. Furthermore, as we discovered from experiments with Erlang, Erlang makes use of incarnation numbers to distinguish between the different instances of a node across failures (an incarnation number tells the number of failures a node has had in the past), and maintains for each node a (possibly erroneuous) view of the current status of nodes it is linked to. Unfortunately we did not find in the litterature any process calculus analysis of distributed systems with crash failures and recoveries with a weak recovery semantics, incarnation numbers and imperfect node views. Our first achievement in this area thus concerned the development of a new process calculus with the preceding features, called DπFR (for distributed π-calculus with crash failures and recoveries), and the study of its behavioral theory, with a result of full abstraction, namely the characterization of contextual equivalence in DπFR by means of a bisimilarity relation. This work has been accepted to LMCS with minor revisions 46. Our second achievement is the development of two reversible semantics for DπFR, that constitutes two interesting design points in a range of possible reversible semantics for DπFR, depending on various assumptions pertaining e.g. to persistency of information across failures or the degree of cooperation between nodes. The first semantics, called non-cooperative, assumes that local causal dependency information is totally lost during a node crash and that nodes do not cooperate to exchange causal information during execution. The second semantics, called cooperative, still assumes that local causal dependecy information is lost during a node crash but that nodes cooperate during execution to exchange causal information, in a manner similar to causal logging checkpoint/rollback recovery schemes in the distributed algorithms literature. This work is reported in Giovanni Fabbretti's PhD thesis, which was successfully defended in October 2024.

Concerning reversibility for shared memory concurrency, we first considered imperative primitives from the Erlang environment providing access to a shared dictionary 17. A shared dictionary is a form of shared memory and this work demonstrated the complexities involved in defining from scratch a causally consistent reversible semantics for a concurrent programming language. We thus decided to first concentrate on developing a modular operational framework for the definition of shared memory models. In our framework, a concurrent language with a shared memory model takes the form of a synchronous product of three components: a set of concurrent threads of execution that cooperate by means of a memory whose concurrent access is governed by a scheduler. We have shown that our framework is expressive and general enough to faithfully capture diverse memory models, including a sequentially consistent memory model, weak memory models with memory access buffering and reordering, as well as strong and weak transactional memory models. We have then developed a theory for the causally consistent reversing of synchronous products of labelled transition systems with independence. We show that the causal consistent reversibility of a synchronous product of LTSs meeting a set of conditions (square property, independence of backward transitions, well-foundedness, and unambiguity of transitions), can be obtained by the same synchronous product of the reversible variants of the composed LTSs. This provides us with a general recipe for reversing memory models described with our framework. Devising LTSs with independence meeting the required conditions can itself be automated using the approach we have developed 47 for generating a reversible semantics from an operational one defined as a reduction relation formalized in Maude (a logical framework for conditional rewriting logic). These results on reversing concurrent memory models are documented in PIetro Lami's PhD thesis, which was successfully defended in December 2024.

7.4 Transversal activity: ICT and the Anthropocene

Participants: Martin Bodin, Baptiste De Goer De Herve, Pascal Fradet, Alain Girault, Gregor Goessler, Xavier Nicollin, Roger Pissard, Sophie Quinton, Aina Rasoldier, Jean-Bernard Stefani.

Digital technologies are often presented as a powerful ally in the fight against climate change (see e.g., the discourse around the “convergence of the digital and the ecological transitions”), so we started research in this axis by investigating the potential of ICT for supporting the ecological transition. More generally, we are interested in the role played by ICT in the Anthropocene as well as new approaches to their design. This raises many complex challenges: For example, how do local measures meant to reduce the environmental impact of ICT relate (or not) to global effects? What can we learn from, and what are the limits of, current quantitative approaches for environmental impact assessment and their use for public debate and policy making? Which criteria could/should we take into account to design more responsible computer systems (other than efficiency, which is already well covered and subject to huge rebound effects in the case of digital technologies)? These questions require a systemic approach, and at least some basic knowledge of the state of the art in many scientific disciplines, in particular in STS (Science and Technology Studies).

The PhD of Aina Rasoldier (defended in 2024 28) addressed the following question: can ICT significantly contribute to reducing the environmental footprint of other activity sectors? As a first contribution, the PhD detailed limitations of state of the art assessments of the claims stated in the previous paragraph. This is an important problem because it may lead to overestimating the current or potential benefits of digital solutions. The PhD then focused on estimating the potential of ridesharing as a solution for reducing the GHG emissions of commuting. Ridesharing is one of the solutions put forward by local authorities to reduce the carbon footprint of individual travel. Our evaluation of the ridesharing potential indicates that it is far from granted that this solution can achieve the long term objectives stated by the French government in its “Stratégie Nationale Bas Carbone”, and declined locally in the “Plan de Déplacements Urbains” of the Grenoble metropolitan area. It is based on a synthetic travel demand computed using the existing software from Hörl et al.  58 that we ran on the public data for the Grenoble metropolitan area. Based on this population synthesis, we have developed an original matching algorithm, tailored to our problem, in order to evaluate the maximum potential offered by ridesharing 69. The analysis tool, called MEPCEL, is now publicly available.

The internship of Ludmila Courtillat--Piazza in 2022, and now the SIA project, explore the broader issue of how to choose a research topic in computer science given the ecological emergency, and taking into account the complex relations between computer science, the ICT it helps design, society (that both shapes and is shaped by its digital tools) and the environment. As a first step, the PhD thesis of Baptiste de Goër approaches this question by focusing on how ICT related sustainability issues are and could be taught in computer classes, which raises similar questions regarding the relation between ICT and sustainability 23, 32. Specifically, one reason teaching ICT related sustainability issues is difficult is that the state of the art in academia is still incomplete, and there are many disagreements and even controversies in the research community regarding what scientific knowledge in computer science is relevant to tackle sustainability issues. New teaching approaches (typically inspired by the way earth science and biology classes teach socially acute questions such as GMOs), but also new research at the intersection of computer science and STS are needed. In complement, we study how to make explicit (and discuss) the social values that influence both computer science and IT design. We have in particular started investigating how Illich's notion of conviviality could offer a framework for rethinking ICT based on values consistent with a strong sustainability view 26.

A third line of research on this topic relates to society's dependance on ICT, and focuses on the relation between the resilience of ICT infrastructures and the resilience of our societies in a future more and more constrained by the destabilization of planetary boundaries and its consequences on our social organisations. There has been so far no research on the potential consequences on the network performance of possible long term and continuous disruptions such as semiconductor shortages, for example due to shortages of raw material or environmental policy constraints. In a paper currently under submission, we study the resilience of mobile networks in the face of hardware aging and approach mobile network resilience using the stochastic geometry framework, propose a network model including multiple dependent techno-bands (TB) and derive approximate closed-form expressions for new resilience metrics. Numerical experiments show the influence of parameters such as load, base station density and the number of TB on network resilience.

7.5 Tooling up the teaching of proofs

Participants: Martin Bodin.

Proof is a key concept in early licence degree in mathematics. It is known to be difficult to teach, due to its level of abstraction, but also due to the various roles it is meant to fulfill: it serves first to certify the mathematical statements themselves, but it also has a communication role and it intervenes within the search process (exploring the consequences of hypotheses, coming up with conjectures, etc.). Each of these roles requires different skills, and the licence's year comes with an increase of the required formalism. This makes it difficult but key to teach at this level.

The Spades team has long been working with the Coq proof assistant, which provides a strong logical base for understanding proofs. It was thus natural to us to try to tool up licence's classes with Coq. Mathematical classes have long been tooled up with computer software (like computer algebra systems or programming languages) to help providing intuitions or building conjectures: we want here to test whether a proof assistant can help into teaching proof writing. This is the goal of the LiberAbaci project within Inria (which includes various other project-teams).

Within this project in Spades, we approached the IREMI institute, which brings together researchers and teachers to do research on mathematical teaching. We focused in reducing the entry cost of using Coq, especially through its interface. Indeed, Coq has originally been designed by and for experts and not for non-computer science students. We study how to incorporate graphical aspects into Coq proofs, as mathematical proofs in licence tend to include non-textual elements: in order to fit as much as possible the expected mindset for the student, we work in making the interface accepts such non-textual elements.

In order to understand what an interface for Coq should look like, we assisted mathematical courses in the university and studied the kind of reasoning that teachers and students made in practice: all such arguments should have a corresponding element within the interface. This helped us understand the constraints that apply to an interface for teaching proofs in this setting, and by studying the program taught in mathematics in licence we were able to identify a suitable target subject: curve sketching2.

We asked about 50 students who got their licence to solve a proof sketching problem, and took their draft. These students were chosen as they already had the abilities that we aim to teach at the licence's level. We studied all the arguments they used within their draft and categorised them on whether they were textual or non-textual, as well as the role each argument had in the overall proof they were (implicitly) building. The results were unexpectedly diverse in both their arguments and method, showing that although apparently simple curve sketching can support a wide variety of reasoning. This constitutes a precious dataset that will later be used to validate our interface for Coq: students should be able to somehow express all these arguments within our interface. We published our approach on building and validating such an interface  33.

We developed a web interface (see Tabvar in Section 6.1.4) to manipulate curve sketching charts in association to a more usual textual-based interaction with a tool similar to Coq. The goal of this software is to help students getting connexions between textual and non-textual proofs, and help them understanding what is expected in their proof. We have shown this interface to both Coq experts and math teachers, but are still in the process of integrating their feedbacks.

In parallel, we designed non-textual activities to teach logic to high school students, in the form of a small board game  34 featuring pirate maps. We hope to eventually integrate such activities into our interface to provide alternative views of logical objects.

8 Bilateral contracts and grants with industry

Participants: Jean-Bernard Stefani.

8.1 Bilateral contracts with industry

  • Inria and Orange Labs have established in 2015 a joint virtual research laboratory, called I/O Lab. We have been heavily involved in the creation of the laboratory and are actively involved in its operation (Jean-Bernard Stefani was one of the two co-directors of the lab, till Feb. 2020). I/O Lab focuses on the network virtualization and cloudification. As part of the work of I/O Lab, we have cooperated with Orange Lab, as part of a cooperative research contract funded by Orange, on the verification of system configurations in cloud computing environments and software-defined networks.

9 Partnerships and cooperations

9.1 National initiatives

9.1.1 ANR

DCore

Participants: Gregor Goessler, Jean-Bernard Stefani, Giovanni Fabbretti, Aurélie Kong Win Chang, Pietro Lami.

DCore has been an ANR project between Inria project teams Antique, Focus and Spades, and the Irif lab, running from 2019 to 2024.

The overall objective of the project was to develop a semantically well-founded, novel form of concurrent debugging, which we call causal debugging, that aims to alleviate the deficiencies of current debugging techniques for large concurrent software systems. The causal debugging technology developed by DCore encompasses two main novel engines:

  1. a reversible execution engine that allows programmers to backtrack and replay a concurrent or distributed program execution, in a way that is both precise and efficient (only the exact threads involved by a return to a target anterior or posterior program state are impacted);
  2. a causal analysis engine that allows programmers to analyze concurrent executions, by asking questions of the form “what caused the violation of this program property?”, and that allows for the precise and efficient investigation of past and potential program executions.

9.1.2 Défi Inria

LiberAbaci

Participants: Martin Bodin.

LiberAbaci is a project between Inria project teams Cambium, Camus, Gallinette, πr2, Spades, Stamp, Toccata, and the Laboratoire d'Informatique de Paris-Nord. The overall objective is to study how one could use the Coq proof assistant in a Mathematical course in the University to help teaching proofs. At Spades, Martin Bodin is working with the IREMI de Grenoble to involve math teachers and didactic researchers to the project.

SmartNet

Participants: Gregor Goessler, Alexander Obeid Guzman.

The SmartNet project, kicked off in 2024, aims to develop network management techniques to handle the increasing complexity of networks. In particular, SmartNet seeks to provide comprehensive insights of the network and its subsystems by identifying cause-effect relationships, enabling strategic interventions for malfunction prevention. We collaborate in this project with the APTIKAL team from LIG, and Nokia Research.

9.2 Exploratory Actions

SIA

Participants: Baptiste de Goër, Sophie Quinton.

The SIA Exploratory Research project, supported by INRIA’s DGDS, funds the PhD work of Baptiste de Goër and provides funding for an upcoming postdoctoral fellow in Sciences and Technology Studies. The goal of the project is to provide interdisciplinary foundations for studying the complex relation- ship between computer science, information and communication technologies (ICT), society and the environment. We approach the problem from three complementary perspectives: 1) by contributing to an interdisciplinary overview of the state of knowledge on the environmental impacts of ICT; 2) by studying the complex connection between computer science and the Anthropocene through the way it is and could be taught in secondary schools; 3) by exploring, at a local scale, the possibility to deploy frugal or low tech alternatives to existing digital systems, following a participatory approach.

10 Dissemination

Participants: Martin Bodin, Pascal Fradet, Alain Girault, Gregor Goessler, Xavier Nicollin, Sophie Quinton, Jean-Bernard Stefani.

10.1 Promoting scientific activities

10.1.1 Scientific events: organisation

General chair, scientific chair
  • Alain Girault served as general chair of the International conference ESWEEK'2024.
Member of the organizing committees
  • Sophie Quinton was a member of the program committee of the JSI 2024, for which she organized the session on the (non)neutrality of science.
  • Martin Bodin was a member of the program committee of VSTTE’24.

10.1.2 Scientific events: selection

Member of the conference program committees
  • Alain Girault was TPC member of the international conferences FDL'2024 and CPSAT'2024.
  • Sophie Quinton was TPC member of the Undone Computer Science conference 2024.

10.1.3 Journal

Member of the editorial boards
  • Alain Girault has served as guest editor of ACM TECS for a special issue on the best papers from FDL'2020 and FDL'2021.
  • Alain Girault is associated editor of Real-Time Systems Journal.
  • Gregor Goessler has served as a guest editor of the Elsevier IST special issue on ”Application of causal modeling and inference in software engineering”.
Reviewer - reviewing activities
  • Alain Girault has reviewed articles for ACM TECS.
  • Gregor Goessler has reviewed articles for the European Journal of Control and IEEE Trans. on Industrial Informatics.

10.1.4 Invited talks

  • Alain Girault gave a talk titled “Synchronous programming of reactive systems (cyber-physical, real-time,embedded)” during the Orange Dev Days, Grenoble, France, December 2024.
  • Sophie Quinton gave talks related to her SIA research project in Rennes (Séminaire d'éthique des mathématiques), Paris (Étudiant.es en lutte de Sorbonne Université) and Lyon (AG du CITI), and presented the Ateliers SEnS to Labos1point5's GT réflexion.

10.1.5 Leadership within the scientific community

  • Sophie Quinton co-chairs a working group of the GDR CIS associated with the Center for Internet and Society focused on environmental issues. She also co-chairs the “ICT and sustainability” Persyval-lab axis.

10.1.6 Scientific expertise

  • Sophie Quinton is a member of the scientific board of Grenoble Métropole and the Agence d'urbanisme de la région grenobloise.

10.1.7 Research administration

  • Since October 2013, Pascal Fradet has been head of the committee for doctoral studies (“Responsable du comité des études doctorale”) of the Inria Grenoble research center. He is also the local correspondent for the young researchers Inria mission (“Mission jeunes chercheurs”) and serves as the substitute of the director of the Inria Grenoble research center at the doctoral school council (MSTII).
  • In 2024, Pascal Fradet was member of the Inria Grenoble hiring committee for junior researchers (CRCN).
  • Since January 2019, Alain Girault has been Deputy Scientific Director at INRIA, in charge of the “Algorithmics, Programming, Software and Architecture” research domain, which encompasses 46 research teams. In 2024, he launched two Inria research challenges (LLM4Code and CocoRISCo), organized a scientific workshop on RISC-V, and supported/audited the creation of four new Inria research teams. He was also one of the three Inria sherpas for the “Hardware Components of AI” French program, which will kick-off in 2025.
  • Alain Girault was member of the INRIA Junior Researcher Admission jury in 2024.
  • Gregor Goessler is member of the scientific jobs committee at Inria Grenoble.
  • Sophie Quinton facilitates the SEnS-GRA group which hosts discussions and proposes actions regarding the environmental and societal impact of our research at Inria Grenoble.
  • Sophie Quinton was a member of a hiring committee for 2 McF positions in Rennes.

10.2 Teaching - Supervision - Juries

10.2.1 Teaching

  • Licence : Pascal Fradet, Théorie des Langages 1, 18 HeqTD, niveau L3, Grenoble INP (Ensimag), France
  • Licence : Pascal Fradet, Modèles de Calcul : λ-calcul, CM & TD, 30 HeqTD, niveau L3, Univ. Grenoble Alpes, France
  • Licence : Xavier Nicollin, Théorie des Langages 1, 40,5 HeqTD, niveau L3. Grenoble INP (Ensimag), France
  • Licence : Xavier Nicollin, Théorie des Langages 2, 37,5 HeqTD, niveau L3, Grenoble INP (Ensimag), France
  • Licence : Xavier Nicollin, Modèles de Calcul : Machines de Turing, 30 HeqTD, niveau L3, Univ. Grenoble Alpes, France
  • Master : Xavier Nicollin, Analyse de Code pour la Sûreté et la Sécurité, 45 HeqTD, niveau M1, Grenoble INP (Ensimag), France
  • Master : Xavier Nicollin, Algorithimque et Optimisation Discrète, 18 HeqTD, niveau M1, Grenoble INP (Ensimag), France
  • Master : Xavier Nicollin, Fondements Logiques pour l'Informatique, 19,5 HeqTD, niveau M1, Grenoble INP (Ensimag), France
  • Licence : Alain Girault, Modèles de Calcul : λ-calcul, 12 HeqTD, niveau L3, Univ. Grenoble Alpes, France
  • Master : Sophie Quinton, Numérique responsable, 15 HeqTD, niveau M1, Grenoble INP (Ensimag), France
  • Master : Sophie Quinton, Kaléidoscope, 3 HeqTD, niveau M1, Grenoble INP, France
  • École doctorale: Sophie Quinton gave a 3h course "Sciences, environnements, sociétés" at the College des Écoles Doctorales.
  • Master : Martin Bodin, Kaléidoscope, 1 HeqTD, niveau M1, Grenoble INP, France
  • Licence : Martin Bodin, Modèles de Calcul : λ-calcul, 12 HeqTD, niveau L3, Univ. Grenoble Alpes, France
  • Master : Martin Bodin, LTPF, 27 HeqTD, niveau M1, Polytech (UGA), France

10.2.2 Supervision

  • Gregor Goessler: PhD in progress: Aurélie Kong Win Chang, "Causal explanations for concurrent programs in Erlang"; since January 2021; co-advised by Gregor Goessler and Jérôme Feret.
  • Gregor Goessler: PhD in progress: Alexander Obeid Guzman, "Inference of causal models for networks from single observations"; since January 2024.
  • Sophie Quinton et Alain Girault: PhD completed: Aina Rasoldier, "Comment évaluer le potentiel d'une solution numérique face à l'urgence écologique ? Application aux plateformes de covoiturage régulier à l'échelle locale".
  • Sophie Quinton: PhD in progress: Baptiste de Goër, “Teaching ICT-related sustainability issues in computer science courses”.
  • Sophie Quinton: PhD in progress: Ludmila Courtillat--Piazza, “Dépendance au numérique et vulnérabilités dans un contexte d'urgence écologique, abordées sous l'angle de la résilience des réseaux mobiles”.
  • Jean-Bernard Stefani: PhD completed: Giovanni Fabbretti on reversibility for distributed programs (UGA), Pietro Lami on reversibility for shared memory concurrent programs (UGA and U. Bologna).
  • Jean-Bernard Stefani: PhD in progress: Boubacar Diarra on verification of Kubernetes configurations (U. Lille).

10.2.3 Juries

  • Gregor Goessler, president of the PhD jury of Lei Zan, UGA.
  • Sophie Quinton, member of the PhD committee of Vincent Giraud, ENS.

10.3 Popularization

10.3.1 Specific official responsibilities in science outreach structures

  • Martin Bodin is local referent for Chiche!, a nationwide program to raise awareness of digital science and technology among second-grade students.

10.3.2 Productions (articles, videos, podcasts, serious games, ...)

  • Sophie Quinton contributed to the serious game PhoneImpact.
  • Sophie Quinton co-authored an article about water related issues of the cloud 13.

10.3.3 Participation in Live events

  • Alain Girault gave an outreach talk titled “Régulateur Intelligent/Adaptatif de Vitesse” at the Conférence Sociéte Numérique en Question, Grenoble, March 2024.
  • Sophie Quinton gave a conference on the social and environmental implications of ICT at the MathC2+ event and co-organized a workshop on ICT and water at the Fête de la science.
  • Martin Bodin gave a talk at the MathC2+ event with Alain Girault.
  • Martin Bodin animated an activity for high school students during the MathC2+ event.

11 Scientific production

11.1 Major publications

  • 1 articleA.Athena Abdi, A.Alain Girault and H.Hamid Zarandi. ERPOT: A Quad-Criteria Scheduling Heuristic to Optimize Execution Time, Reliability, Power Consumption and Temperature in Multicores.IEEE Transactions on Parallel and Distributed Systems3010October 2019, 2193-2210HALDOI
  • 2 articleS.S. Andalam, P. S.Partha S. Roop, A.A. Girault and C.C. Traulsen. A Predictable Framework for Safety-Critical Embedded Systems.TC637The complete PRET-C reference.July 2014, 1600--1612
  • 3 articleP.Pascal Fradet, A.Alain Girault and A.Alexandre Honorat. Graph Transformations for Memory Peak Minimization by Scheduling.ACM Transactions on Embedded Computing Systems (TECS)2024, 1-36In press. HAL
  • 4 articleP.Pascal Fradet, A.Alain Girault, R.Ruby Krishnaswamy, X.Xavier Nicollin and A.Arash Shafiei. RDF: A Reconfigurable Dataflow Model of Computation.ACM Transactions on Embedded Computing Systems (TECS)December 2022HALDOIback to text
  • 5 articleP.Pascal Fradet, X.Xiaojie Guo and S.Sophie Quinton. CertiCAN : Certifying CAN Analyses and Their Results.Real-Time Systems592March 2023, 160-198HALDOI
  • 6 inproceedingsG.Goran Frehse, A.Arne Hamann, S.Sophie Quinton and M.Matthias Wöhrle. Formal Analysis of Timing Effects on Closed-loop Properties of Control Software.35th IEEE Real-Time Systems Symposium 2014 (RTSS)Rome, ItalyDecember 2014HAL
  • 7 articleA.Antoine Girard, G.Gregor Gössler and S.Sebti Mouelhi. Safety Controller Synthesis for Incrementally Stable Switched Systems Using Multiscale Symbolic Models.IEEE Transactions on Automatic Control6162016, 1537-1549HALDOI
  • 8 articleG.Gregor Gössler and J.-B.Jean-Bernard Stefani. Causality analysis and fault ascription in component-based systems.Theoretical Computer Science8372020, 158-180HALDOI
  • 9 articleI.Ivan Lanese, C. A.Claudio Antares Mezzina and J.-B.Jean-Bernard Stefani. Reversibility in the higher-order -calculus.Theoretical Computer Science6252016, 25-84HALDOI
  • 10 inproceedingsS.Sophie Quinton, M.Matthias Hanke and R.Rolf Ernst. Formal analysis of sporadic overload in real-time systems.2012 Design, Automation & Test in Europe Conference & Exhibition, DATE 2012, Dresden, Germany, March, 20122012, 515--520URL: http://dx.doi.org/10.1109/DATE.2012.6176523DOI
  • 11 inproceedings A.Aina Rasoldier, J.Jacques Combaz, A.Alain Girault, K.Kevin Marquet and S.Sophie Quinton. How realistic are claims about the benefits of using digital technologies for GHG emissions mitigation? LIMITS 2022 - Eighth Workshop on Computing within Limits Virtual, France June 2022 HAL
  • 12 inproceedingsP.Pierre Roux, S.Sophie Quinton and M.Marc Boyer. A Formal Link Between Response Time Analysis and Network Calculus.ECRTS 2022 - 34th Euromicro Conference on Real-Time SystemsModene, ItalyJuly 2022HALDOI

11.2 Publications of the year

International journals

National journals

  • 18 articleE.Emmanuel Beffara and M.Martin Bodin. Un jeu de plateau pour comprendre la dualité en logique.Adjectif : analyses et recherches sur les TICE20241April 2024, 1-5HAL

Invited conferences

  • 19 inproceedingsI.Ivan Lanese and G.Gregor Gössler. Causal Debugging for Concurrent Systems.RC 2024 - 16th International Conference on Reversible ComputationLNCS-14680Reversible Computation : 16th International Conference, RC 2024, Toruń, Poland, July 4–5, 2024, ProceedingsTorun, PolandSpringer Nature SwitzerlandMay 2024, 3-9HALDOI

International peer-reviewed conferences

Conferences without proceedings

Edition (books, proceedings, special issue of a journal)

  • 27 periodicalIntroduction to the Special Issue on Specification and Design Languages (FDL 2021).ACM Transactions on Embedded Computing Systems (TECS)235August 2024, 1-4HALDOI

Doctoral dissertations and habilitation theses

  • 28 thesisA.Aina Rasoldier. Assessing the potential of a digital Solution in the context of ecological urgency : application to regular carpooling platforms at local scale.Université Grenoble Alpes [2020-....]February 2024HALback to text

Reports & preprints

Scientific popularization

11.3 Cited publications

  • 33 inproceedingsE.Emmanuel Beffara, M.Martin Bodin, N.Nadine Mandran and R.Rémi Molinier. Instrumentation de l’association de registres sémiotiques dans un assistant de preuve.Conférence sur les Environnements Informatiques pour l'Apprentissage Humain (EIAH)2023back to text
  • 34 inproceedingsE.Emmanuel Beffara and M.Martin Bodin. Un jeu de plateau pour comprendre la dualité en logique.Adjectif : analyses et recherches sur les TICE (Adjectif)2024back to text
  • 35 miscAutomotive Open System Architecture.2003, URL: http://www.autosar.orgback to text
  • 36 articleE.E. Bainomugisha, A.A.L. Carreton, T. V.T. Van Cutsem, S.S. Mostinckx and W. D.W. De Meuter. A Survey on Reactive Programming.ACM Computing Surveys4542013back to textback to text
  • 37 articleN.Nikhil Bansal, T.Tracy Kimbrel and K.Kirk Pruhs. Speed Scaling to Manage Energy and Temperature.Journal of the ACM5412007back to text
  • 38 articleA.A. Basu, S.S. Bensalem, M.M. Bozga, J.J. Combaz, M.M. Jaber, T.-H.T.-H. Nguyen and J.J. Sifakis. Rigorous Component-Based System Design Using the BIP Framework.IEEE Software2832011back to text
  • 39 inproceedingsV.V. Bebelis, P.P. Fradet, A.A. Girault and B.B. Lavigueur. BPDF: A Statically Analyzable Dataflow Model with Integer and Boolean Parameters.International Conference on Embedded Software, EMSOFT'13Montreal, CanadaACMSeptember 2013back to text
  • 40 articleA.Albert Benveniste, P.Paul Caspi, S. A.Stephen A. Edwards, N.Nicolas Halbwachs, P. L.Paul Le Guernic and R.Robert de Simone. The synchronous languages 12 years later.Proceedings of the IEEE9112003back to text
  • 41 articleS.S. Borkar. Designing Reliable Systems from Unreliable Components: The Challenges of Transistor Variability and Degradation.IEEE Micro2562005back to text
  • 42 articleA.Adnan Bouakaz, P.Pascal Fradet and A.Alain Girault. A Survey of Parametric Dataflow Models of Computation.ACM Transactions on Design Automation of Electronic Systems (TODAES)January 2017HALback to text
  • 43 articleA.Adnan Bouakaz, P.Pascal Fradet and A.Alain Girault. Symbolic Analyses of Dataflow Graphs.ACM Transactions on Design Automation of Electronic Systems (TODAES)January 2017HALback to text
  • 44 articleR.Rob Davis and A.Alan Burns. A Survey of Hard Real-Time Scheduling for Multiprocessor Systems.ACM Computing Surveys4342011back to text
  • 45 articleJ.J. Eker, J. W.J. W. Janneck, E. A.E. A. Lee, J.J. Liu, X.X. Liu, J.J. Ludvig, S.S. Neuendorffer, S.S. Sachs and Y.Y. Xiong. Taming heterogeneity - the Ptolemy approach.Proceedings of the IEEE9112003back to text
  • 46 miscG.Giovanni Fabbretti, I.Ivan Lanese and J.-B.Jean-Bernard Stefani. A Behavioral Theory for Distributed Systems with Weak Recovery.2024, URL: https://arxiv.org/abs/2406.12574back to text
  • 47 inproceedingsG.Giovanni Fabbretti, I.Ivan Lanese and J.-B.Jean-Bernard Stefani. Generation of a Reversible Semantics for Erlang in Maude.ICFEM 2022 - 23rd International Conference on Formal Engineering MethodsLNCS13478Lecture Notes in Computer Science.Madrid, SpainSpringer International PublishingOctober 2022, 106-122HALDOIback to text
  • 48 inproceedingsP.Pascal Fradet, A.Alain Girault, L.Leila Jamshidian, X.Xavier Nicollin and A.Arash Shafiei. Lossy channels in a dataflow model of computation.Principles of Modeling, Festschrift in Honor of Edward A. LeeBerkeley, United StatesLecture Notes in Computer Science, SpringerOctober 2017HALback to text
  • 49 inproceedingsP.P. Fradet, A.A. Girault and P.P. Polpavko. SPDF: A schedulable parametric data-flow MoC.Design, Automation and Test in Europe, DATE'12IEEE2012back to text
  • 50 articleF. C.F. C. Gärtner. Fundamentals of Fault-Tolerant Distributed Computing in Asynchronous Environments.ACM Computing Surveys3111999back to text
  • 51 articleB.Bruno Gaujal, A.Alain Girault and S.Stéphan Plassart. A Pseudo-Linear Time Algorithm for the Optimal Discrete Speed Minimizing Energy Consumption.Discrete Event Dynamic Systems312021, 163--184HALDOIback to text
  • 52 articleB.Bruno Gaujal, A.Alain Girault and S.Stéphan Plassart. Dynamic Speed Scaling Minimizing Expected Energy Consumption for Real-Time Tasks.Journal of SchedulingJuly 2020, 1-25HALDOIback to text
  • 53 articleB.Bruno Gaujal, A.Alain Girault and S.Stéphan Plassart. Feasibility of on-line speed policies in real-time systems.Real-Time SystemsApril 2020HALDOIback to text
  • 54 inproceedingsE.E. Giachino, I.I. Lanese and C. A.C. A. Mezzina. Causal-Consistent Reversible Debugging.17th International Conference Fundamental Approaches to Software Engineering (FASE)8411Lecture Notes in Computer Science2014, 370-384back to text
  • 55 inproceedingsD.D. Gizopoulos, M.M. Psarakis, S. V.S. V. Adve, P.P. Ramachandran, S. K.S. K. S. Hari, D.D. Sorin, A.A. Meixner, A.A. Biswas and X.X. Vera. Architectures for Online Error Detection and Recovery in Multicore Processors.Design Automation and Test in Europe (DATE)2011back to text
  • 56 incollectionS.S. Haar and E.E. Fabre. Diagnosis with Petri Net Unfoldings.Control of Discrete-Event Systems433Lecture Notes in Control and Information SciencesSpringer2013, 15back to text
  • 57 inproceedingsT.T.A. Henzinger and J.J. Sifakis. The Embedded Systems Design Challenge.Formal Methods 20064085Lecture Notes in Computer ScienceSpringer2006back to text
  • 58 articleS.S. Hörl and M.M. Balac. Open Synthetic Travel Demand for Paris and Île-de-France: Inputs and Output Data.Data in Brief39December 2021, 107622HALDOIback to text
  • 59 inproceedingsA.Aurélie Kong Win Chang, J.Jerome Feret and G.Gregor Gössler. A Semantics of Core Erlang with Handling of Signals.Erlang 2023 - 22nd ACM SIGPLAN International Workshop on ErlangSeattle WA, United StatesACMSeptember 2023, 31-38HALDOIback to text
  • 60 inproceedingsR.R. Küsters, T.T. Truderung and A.A. Vogt. Accountability: definition and relationship to verifiability.ACM Conference on Computer and Communications Security2010, 526-535back to text
  • 61 inproceedingsI.I. Lanese, C. A.C. A. Mezzina and J.-B.J.-B. Stefani. Reversing Higher-Order Pi.21th International Conference on Concurrency Theory (CONCUR)6269Lecture Notes in Computer ScienceSpringer2010back to text
  • 62 inproceedingsJ.J.R. Lorch and A.A.J. Smith. Improving Dynamic Voltage Scaling Algorithms with PACE.Joint International Conference on Measurements and Modeling of Computer Systems, SIGMETRICS'01Cambridge (MA), USAACMJune 2001, 50--61back to text
  • 63 articleJ.J.R. Lorch and A.A.J. Smith. PACE: A New Approach to Dynamic Voltage Scaling.IEEE Trans. on Computers537Extended version of .2004, 856--869back to text
  • 64 phdthesisT.Thomas Mari. Causal explanations for reactive real-time systems.Université Grenoble - AlpesNovember 2023HALback to text
  • 65 incollectionP.P. Menzies. Counterfactual Theories of Causation.Stanford Encyclopedia of PhilosophyStanford University2009, URL: http://plato.stanford.edu/entries/causation-counterfactualback to text
  • 66 bookM.M.S. Moore. Causation and Responsibility.Oxford1999back to text
  • 67 articleJ.J. Pearl. Causal inference in statistics: An overview.Statistics Surveys32009, 96-146back to text
  • 68 phdthesisS.Stephan Plassart. Online optimization in dynamic real-time systems.Université Grenoble Alpes [2020-....]June 2020HALback to text
  • 69 inproceedingsA.Aina Rasoldier, A.Alain Girault, S.Sophie Quinton, J.Jacques Combaz and K.Kevin Marquet. Assessing the Potential of Carpooling for Reducing Vehicle Kilometers Traveled.International Conference on Information and Communications Technology for Sustainability, ICT4S'23Rennes, FranceIEEEJune 2023, 120--131HALDOIback to text
  • 70 techreportJ.J. Rushby. Partitioning for Safety and Security: Requirements, Mechanisms, and Assurance.CR-1999-209347NASA Langley Research Center1999back to text
  • 71 miscA. J.ARTEMIS Joint Undertaking. ARTEMIS Strategic Research Agenda.2011back to text
  1. 1DVFS=Dynamic Voltage and Frequency Scaling. This is a feature commonly found on modern processors, which allows to decrease the (frequency,voltage) operating point in order to decrease the energy consumption.
  2. 2In French, `Tableaux de variations', which is a particular kind of curve sketching thoroughly taught in France. It doesn't seem to be taught as thoroughly in English-speaking countries, hence the lack of a good translation. We shall use curve sketching in the following for this particular notion.