Desynchronization and distributed deployment of synchronous systems Albert Benveniste – Inria 2002

The problem Ensure a smooth migration throughout the different phases of embedded systems design As analysis reveals, the diversity of communication/concurrency paradigms, throughout the design process, is a serious difficulty

System From Components System on Chip Control engineering Matlab/Simulink… Domain specific Functional aspects Model engineering UML System architecture Performance, timeliness Fault-tolerance Non-functional aspects Deployment architecture Middleware Bus, protocols Tasks : Operator : Device start( ) stop( ) Class diagramSequence diagram StatechartsImplementation diagram

System From Components Model engineering UML System architecture Performance, timeliness Fault-tolerance Non-functional aspects Control engineering Matlab/Simulink… Domain specific Functional aspects System on Chip Deployment architecture Middleware Bus, protocols Tasks Multiform Model of communication Model engineering Componentsloose timeliness Non-functional aspectstimed Functional models Equations + statessynchronous Code generation Globally Asynchronous Locally Synchronous TasksSchedulingTime-triggered

Zooming on Synchrony & Asynchrony

Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end

Synchrony loop % unique non terminating while loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end

Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| % perfectly synchronous parallel composition [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end

Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end

Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end ?X ?Y2153 !Z*368

Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end

Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end ?X ?Z*368 !V

Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| % synchronizes the two blocks by unification [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end

Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| % synchronizes the two blocks by unification [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end ?X ?Y2153 !Z*368 ?X ?Z*368 !V

V : set of typed variables; v can take value “ absent” State : valuation of V ; Transition : pair of states I : initial condition (set of states) R : transition relation relating successive states Run : sequence of R-consistent transitions Formalizing synchrony S = (V,I,R) S ||| S’ = (V U V’,I&I’,R&R’) synch

Formalizing synchrony S = (V,I,R) S ||| S’ = (V U V’,I&I’,R&R’) Alike systems of dynamical equations in maths, but with multiple time-indices Perfectly synchronous parallel composition amounts to combining two systems of equations No recursion, no dynamical creation, only a single non terminating while loop; body with nested “when” Much simpler than Milner’s CCS or Hoare’s CSP

From Synchrony to… X Y V

Asynchrony X Y V

X Y V

X Y V

X Y V Assumes non synchronized, point to point, reliable channels

Formalizing Asynchrony A = (V,  ) V : set of typed variables; “ absent” meaningless Flow : sequence of values, for a given variable Run : tuple of flows  : set of runs A || A’ = (V U V’,  &  ’) asynch

Formalizing Asynchrony A = (V,  ) A || A’ = (V U V’,  &  ’) AA’ Point to point, non synchronized, channels

Synchrony/Asynchrony X Y V X Y V ? OK

Some synchronous systems are robust against Asynchronous environment (a property on infinite runs) synchronous asynchronous

For these synchronous systems, desynchronization is injective X Y V X Y V OK

They can be characterized: endochrony (a property on finite objects) synchronous asynchronous

Endochrony: example, counterexample loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end ?X ?Y2153 !Z*368

Endochrony: example, counterexample loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end ?X ?Z*368 !V

Formalizing endochrony For W,W’ subsets of V : W  W’ iff knowing the value of variables belonging to W determines the status present/absent for all variables of W’ Empty = W0  W1  W2  …  Wmax S is endochronous iff Wmax = V holds S = (V,I,R)

Endochrony is model-checkable, and can be synthesized Synchronous exochronous wrapper

A wrapper to enforce endochrony loop [ when C=1 then present(X,Z) else when C=2 then present(X)] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end

Some pairs of systems are robust against Asynchronous communications (a property on infinite runs) synchronous asynchronous

They can be characterized: isochrony (a property on finite objects) synchronous asynchronous

Formalizing isochrony S = (V,I,R), S ||| S’ = (V U V’,I&I’,R&R’) R & R’ unify pairs of transitions which agree on the values of their common variables (including status present/absent) R & w R’ unify pairs of transitions which agree on the values of their common present variables Isochrony : R & R’ coincides with R & w R’

Synchronous Pairs can be given a wrapper which makes them isochronous ( alike protocol generation) Synchronous wrapper enforce isochrony

GALS architectures as endo/isochronous networks isoendo

Isochrony is compositional iso endo

This theory is useful for: Generating code, from a synchronous functional architecture, to a GALS architecture Handling hybrid synchro/asynchro models at design exploration phase, by performing virtual prototyping

Further issues The assumed model of asynchronous communication requires blocking communication: not always acceptable Bus infrastructures for distributed control systems are typically non- blocking and time-triggered

Bus for distributed control: loosely synchronized clocks A small protocol can emulate our previous model of asynchrony In use, e.g., at Airbus

CONCLUSION

Most of the work presented is due to: The community on Synchronous Languages ESTEREL (G. Berry,…) LUSTRE (P. Caspi, N. Halbwachs,…) SIGNAL (P. Le Guernic, A. Benveniste,…) The Berkeley community PTOLEMY (Ed Lee,…) The METROPOLIS project at Cadence (Sangiovanni-Vincentelli,…) Supported by vendors (Esterel-Technologies, TNI-Valiosys, and others)

Distributed computing can be non-high performance Distributed by the physics; made from components Correctness is a major issue Study models of computation & communication This is relevant and modern research !!