1. 9/17/2015COSC-4301-01, Lecture 131 Real-Time Systems, COSC-4301-01, Lecture 13 Stefan Andrei

2. 9/17/2015 COSC-4301-01, Lecture 13 2 Reminder of the last lecture Faster Verification of RTL-Specified Systems via Decomposition Constraint Extension

3. 9/17/2015 COSC-4301-01, Lecture 13 3 Overview of This Lecture Verification, debugging and optimization of Linear RTL

4. 9/17/2015 COSC-4301-01, Lecture 13 4 Description a) Given SP and SA expressed in Linear RTL, determine whether SP  SA? b) Given SP and SA expressed in Linear RTL such that the negation of SA is satisfiable and SP does not imply SA, determine new related SP’ and/or SA’ such that SP’  SA’? The election of SP’ and SA’ should be done in conjunction with real-time system advisor or automatically. c) Given SP and SA expressed in Linear RTL such that SP  SA, determine SP’ and SA’ for which SP  SP’, SP’  SA’, SA’  SA. The new SP’ and SA’ should be done using minimal changes by keeping the same set of constraints, but relaxing SP and/or tightening SA.

5. 9/17/2015 COSC-4301-01, Lecture 13 5 References Chapter 6 of [Che2002] Cheng, A.M.K.: Real-time systems. Scheduling, Analysis, and Verification. Wiley- Interscience, 2002 [AnC07] Andrei, S., Cheng, A.: Verification of Linear RTL-Specifications. Proceedings of the 28-th IEEE Real-Time Systems Symposium, 2007

6. 9/17/2015 COSC-4301-01, Lecture 13 6 Description – part a) a) Given SP and SA expressed in Linear RTL, determine whether SP  SA?

7. 9/17/2015 COSC-4301-01, Lecture 13 7 Comparison with extended path-RTL class (Lecture 10) The extended path RTL can only describe a timing constraint between two events. A timing constraint involving three or more events together cannot be specified by any of these subclasses. Example: The specification of a phased array radar system.  A phased array is a group of antennas in which the relative phases of the signals feeding the antennas are varied in such a way that the effective radiation is reinforced in a desired direction and suppressed in undesired directions.

8. 9/17/2015 COSC-4301-01, Lecture 13 8 The specification of a phased array radar system with four antennas 1. The radar system is turned on at time 0. 2. In order to allow time for the initialization routine, the sum of times when all four antennas start radiating must be at least 10 seconds. 3. The sum of all radiating times for neighboring antennas (in this case, three) cannot exceed 1000 seconds in order to avoid overheating of the antenna elements and to reduce interference. 4. The time an antenna should continuously radiate is at least 300 seconds.

9. 9/17/2015 COSC-4301-01, Lecture 13 9 Translation to RTL The four antennas of the phased array radar system are given in a cyclic order, denoted by A1, A2, A3, A4. @(↑A1, i) and @(↓A1, i) mean the i th occurrences when antenna A1 begins and ends radiating:   i ( @(↑A1, i)+ @(↑A2, i)+ @(↑A3, i)+ @(↑A4, i) ≥ 10 )    ( (@(↓A1, i) - @(↑A1, i)) + (@(↓A2, i) - @(↑A2, i)) + (@(↓A3, i) - @(↑A3, i))  1000 )  …   ( ( @(↓A4, i) - @(↑A4, i) ) + ( @(↓A1, i) - @(↑A1, i) ) + ( @(↓A2, i) - @(↑A2, i) )  1000 )    ( @(↓A1, i) - @(↑A1, i) ≥ 300 )  …  ( @(↓A4, i) - @(↑A4, i) ≥ 300 ).

10. 9/17/2015 COSC-4301-01, Lecture 13 10 Our larger class - LRTL So, there is a need to find an RTL subclass able to describe constrains with three or more events. We call it: Linear Real-Time Logic (LRTL). LRTL is based on a first-order logic with features able to capture the linear timing requirements of real-time systems. LRTL includes the existing subclasses of decidable and practical RTL formulas. To the best of our knowledge, LRTL is a subclass of RTL, with decidable properties, not considered until now for the specification and verification of real-time and embedded systems.

11. 9/17/2015 COSC-4301-01, Lecture 13 11 Linear inequalities - an open problem In fact, the linear inequalities have been unsolved for long time. For example, [Moller, Lichtenberg, Andersen, and Hulgaard; 1999] formulates as future work the class of linear inequalities:  “One path that could be taken when extending the results of the paper would be to generalize the difference constraints to linear inequalities.”

12. 9/17/2015 COSC-4301-01, Lecture 13 12 Can we still re-use the constraint graph? The previous verification method for formulas expressed in extended path-RTL was the (extended) constraint graph:  A timing constraint @(e1, i) - @(e2, j)  k corresponds to two nodes and an arc in the constraint graph.  A timing constraint ± @(e1, i) ± @(e2, j)  k corresponds to two arcs between four nodes in the extended constraint graph. No, a more powerful data structure is needed.

13. 9/17/2015 COSC-4301-01, Lecture 13 13 LRTL Compared with the constraint graph technique, the correctness of a real-time system specified in LRTL can be achieved by solving a system of linear inequalities. A general timing constraint in LRTL may have the form: a 1 · @(e 1, i 1 ) + … + a n · @(e n, i n ) «op» b where «op» is one of the following arithmetic operators { , =, ≥}, and a 1,..., a n, and b are integers.

14. 9/17/2015 COSC-4301-01, Lecture 13 14 The LRTL normal form a 1 · @(e 1, i 1 ) + … + a n · @(e n, i n )  b Even if the normal form seems to restrict «op» only to “  ”, it has the same expressive power as the general form. Our method for verification of SP  SA expressed in LRTL has 6 basic steps.

15. 9/17/2015 COSC-4301-01, Lecture 13 15 The first 3 steps to prove SP  SA 1. consider F =  (SP  SA) ≡ SP   SA; 2. convert it to a Presburger formula, F Presb, by replacing the time occurrences @(E, i) by a function f E (i); 3. construct the Skolem formula, F CNF, by removing the existential quantifiers and replacing the corresponding variables with constants.

16. 9/17/2015 COSC-4301-01, Lecture 13 16 Example SP:  i  j (@(e 1, i) + @(e 2, i)  2)  (@(e 2, i) - @(e 3, j)  1)  (@(e 1, i) - @(e 3, j)  7). SA:  u  v (@(e 1, u) + @(e 2, u) - @(e 3, v)  5).  SA is  u  v (-@(e 1, u) - @(e 2, u) + @(e 3, v)  - 6) Presburger formula: replace @(e 1, i) by f 1 (i), @(e 2, i) by f 2 (i), @(e 3, i) by f 3 (i), etc. Skolem formula: U and V are two integer constants to replace the variables u and v. F CNF :  i  j (f 1 (i) + f 2 (i)  2)  (f 2 (i) - f 3 (j)  1)  (f 1 (i) - f 3 (j)  7)  (-f 1 (U) - f 2 (U) + f 3 (V)  - 6).

17. 9/17/2015 COSC-4301-01, Lecture 13 17 Step 4: Positive propositional clauses A set S = {f(t 1 ),..., f(t k )} is unifiable if there exists a substitution ψ such that f(t 1 )ψ =... = f(t k )ψ. Example:  The set S = {f 1 (i), f 1 (U)} is unifiable due to the substitution ψ = [i/U]. The method pos(F CNF ) generates a new propositional variable for each new inequality after checking the unification. The F CNF from the example has the following positive clauses: {A 1 }, {A 2 }, {A 3 }, and {A 4 }.

18. 9/17/2015 COSC-4301-01, Lecture 13 18 Step 5: Obtaining the negative propositional clauses F CNF is translated to a system of linear inequalities AX  B. Example: A =, X =, B =. The column vector X has been obtained after applying the substitution {[i/U], [j/V]}.

19. 9/17/2015 COSC-4301-01, Lecture 13 19 Definition: Negative linear dependencies Λ = (λ i ) 1  i  n from M 1,n is a positive row vector if λ i   + - {0} for all i  {1,..., n}. Let B = (b i ) 1  i  n be a column vector from M n,1 such that b i   for all i  {1,..., n}. Λ is negative linear dependant of B if and only if ΛB < 0.

20. 9/17/2015 COSC-4301-01, Lecture 13 20 Theorem: Negative Linear Dependency Let Λ = (λ i ) 1  i  n be a positive row vector that is a solution of the system of linear equations A tr Λ tr =0, where A = (a i,j ) m  n is a matrix over . If Λ is negative linear dependant of B, where B is a column vector, then the inequality AX  B has no solution for X over , where X is a column vector.

21. 9/17/2015 COSC-4301-01, Lecture 13 21 Example Considering AX  B, we need to find the positive row vector Λ = (λ 1 λ 2 λ 3 λ 4 ) such that A tr Λ tr =0. This is: = 0. The positive solution Λ = (1 1 1 2) leads to ΛB = -2. Therefore, AX  B has no solution for X over .

22. 9/17/2015 COSC-4301-01, Lecture 13 22 Negative propositional clauses 1. initially F neg =  ; 2. identify the propositional variables v 1,... v k corresponding to inequalities from F CNF ; 3. identify matrices A and B from the inequality AX  B that represent F CNF ; 4. let A i  A and B i  B be such that A i X  B i is a new subsystem of AX  B; 5. find Λ i a positive solution of A tr i Λ tr i = 0; 6. if Λ i B i < 0 then add the negative clause {  v i,1,...  v i,k } to F neg ; 7. if there is no new subsystem A i X  B i of AX  B, then STOP; otherwise, go to 4.

23. 9/17/2015 COSC-4301-01, Lecture 13 23 Some remarks to choose the subsystem At step 4, we have chosen A i  A and B i  B be such that A i X  B i is a new subsystem of AX  B; The idea is to choose A i the sub-matrix of A that is a closure of the initial variable, that is:  Initial step: add X i to A i  Inductive step: add all the variables from the inequalities that contains variables from A i ; repeat this step until there are no more changes.

24. 9/17/2015 COSC-4301-01, Lecture 13 24 Step 6: The final step of our method Let PF be the set of positive and negative clauses. If PF is unsatisfiable, then SP  SA holds. Example: PF = { {A 1 }, {A 2 }, {A 3 }, {A 4 }, {  A 1,  A 2,  A 3,  A 4 } } is unsatisfiable, so SP  SA holds.

25. 9/17/2015 COSC-4301-01, Lecture 13 25 Complexity considerations Among the many different ways to solve systems of linear inequations, the traditional method is the Gaussian elimination. It has an order of O(n 3 ) time complexity, where n is the number of variables.

26. 9/17/2015 COSC-4301-01, Lecture 13 26 Step 6: Convert PF to a DIMACS file Suppose PF is expressed in Conjunctive Normal Form and has n variables and l clauses. Then, the first line of the DIMACS file is:  p cnf n l Each positive literal L 1, …, L n corresponds to positive integers 1, …, n Each negative literal  L 1, …,  L n corresponds to negative integers -1, …, -n Any clause is translated to a line of text in the DIMACS file by replacing each literal with the corresponding integer and each ‘  ’ is replaced by blank space (the end of clause is marked by a ‘0’):  L 1   L 2  L 3   L 5 corresponds to 1 -2 3 -5 0

27. 9/17/2015 COSC-4301-01, Lecture 13 27 Step 6: Call a state-of-the-art SAT solver Siege - http://www.cs.sfu.ca/research/groups/CL/software/siege/http://www.cs.sfu.ca/research/groups/CL/software/siege/ zChaff - http://www.princeton.edu/~chaff/software.htmlhttp://www.princeton.edu/~chaff/software.html Cachet - http://www.cs.rochester.edu/u/kautz/Cachet/index.htmhttp://www.cs.rochester.edu/u/kautz/Cachet/index.htm SharpSAT - http://www2.informatik.hu- berlin.de/~thurley/sharpSAT/index.htmlhttp://www2.informatik.hu- berlin.de/~thurley/sharpSAT/index.html Others: http://www.satlive.org/bytype.jsp?reftypefrom=-2http://www.satlive.org/bytype.jsp?reftypefrom=-2 If the answer provided by this SAT solver or #SAT solver is ‘Unsatisfiable’, then PF is unsatisfiable, so SP  SA is a theorem.

28. 9/17/2015 COSC-4301-01, Lecture 13 28 Description – part b) b) Given SP and SA expressed in Linear RTL such that the negation of SA is satisfiable and SP does not imply SA, determine new related SP’ and/or SA’ such that SP’  SA’? The election of SP’ and SA’ should be done in conjunction with real-time system designer or automatically.

29. 9/17/2015 COSC-4301-01, Lecture 13 29 The systematic debugging algorithm (Test & Print) test if PF is unsatisfiable and if the designer agrees with the suggested constraint (Incremental Computation) consider all the choices to change SP and SA into new SP’ and SA’. desired is evaluated to false when the designer wishes to continue the systematic debugging and the timing constraints of the real-time system are fulfilled. Algorithm Main: Input: SP, SA and PF, SP  SA Output: SP’, SA’ s.t. SP’  SA’ Method: desired = false; while (desired == false) { (Test & Print) if (desired == false) { (Incremental Computation) (Debugging Computation) }

30. 9/17/2015 COSC-4301-01, Lecture 13 30 Addition of New Variables While PF is satisfiable:  Test whether each variable appears in at least two inequalities;  If variable X i appears only once in the system A i X  B i then we insert it in all inequalities and see whether it leads to unsatisfiability, namely Λ i B i < 0, where Λ i a positive solution of A tr i Λ tr i = 0.

31. 9/17/2015 COSC-4301-01, Lecture 13 31 Transforming a subsystem into one with negative dependencies Consider Λ i a positive solution of A tr i Λ tr i = 0; If Λ i B i >= 0 then modify B i such that Λ i B i < 0.

32. 9/17/2015 COSC-4301-01, Lecture 13 32 Make sure there are positive solutions Λ i If there are no positive solutions Λ i of A tr i Λ tr i = 0, then modify A i to get such a solution.

33. 9/17/2015 COSC-4301-01, Lecture 13 33 Automatic Debugging The automatic approach is similar to the systematic approach, but it should work in the absence of the human beings. Our solution was to consider in advance all the necessary information such as the designer's guidance:  a set of constraints which cannot be modified  the specific ranges for the constants which appear in the constraints.

34. 9/17/2015 COSC-4301-01, Lecture 13 34 Automatic Debugging The input files for the automatic approach are augmented with the lower and upper bounds for the constants.

35. 9/17/2015 COSC-4301-01, Lecture 13 35 Example: Systematic Debugging Step 1:  SP:  i  j (@(e 1, i) + @(e 2, i)  2)  (@(e 2, i) - @(e 3, j)  1)  (@(e 1, i) - @(e 3, j)  7).  SA:  u  v (@(e 1, u) + @(e 2, u) - @(e 3, v)  2). Step 2:  SP:  i  j (f 1 (i) + f 2 (i)  2)  (f 2 (i) - f 3 (j)  1)  (f 1 (i) - f 3 (j)  7)  SA:  u  v f 1 (u) + f 2 (u) - f 3 (v)  2 Step 3:  SP    SA:  i  j (f 1 (i) + f 2 (i)  2)  (f 2 (i) - f 3 (j)  1)  (f 1 (i) - f 3 (j)  7) Λ (-f 1 (U) - f 2 (U) + f 3 (V)  -3).

36. 9/17/2015 COSC-4301-01, Lecture 13 36 Example: Systematic Debugging -cont Step 4: Consider the substitution ψ = {[i/U][j/V]}. The method pos(F CNF ) generates a new propositional variable for each new inequality after checking the unification. A1 denotes the inequality f 1 (U)+f 2 (U)  2 A2 denotes the inequality f 2 (U)-f 3 (U)  1 A3 denotes the inequality f 1 (U)-f 3 (U)  7 A4 denotes the inequality -f 1 (U)-f 2 (U)+f 3 (V)  -9 The F CNF leads to the following positive clauses for PF: {A 1 }, {A 2 }, {A 3 }, and {A 4 }.

37. 9/17/2015 COSC-4301-01, Lecture 13 37 Example: Systematic Debugging -cont Step 5: F CNF is translated to a system of linear inequalities AX  B. Example: A =, X =, B =.

38. 9/17/2015 COSC-4301-01, Lecture 13 38 Example: Systematic Debugging -cont Considering AX  B, we need to find the positive row vector Λ = (λ 1 λ 2 λ 3 λ 4 ) such that A tr Λ tr =0. This is: = 0. The positive generic solution Λ = (a a a 2a) cannot leads to ΛB 0. So, the set of negative clauses is empty.

39. 9/17/2015 COSC-4301-01, Lecture 13 39 Example: Systematic Debugging - cont Step 6: Convert PF to a DIMACS file  p cnf 4 4  1 0  2 0  3 0  4 0 Call Siege or zChaff The previous DIMACS file is input for Siege. The output of Siege will be: ‘satisfiable’ Since PF is satisfiable, then we need to do debugging to make SP  SA a theorem.

40. 9/17/2015 COSC-4301-01, Lecture 13 40 Example: Systematic Debugging - cont Step 7: All the lines have at least two non-zero coefficients, so we don’t do debugging for this case (slide 39). We need to change B to have ΛB <0. ΛB=(a a a 2a)(2 1 7 -3) tr =4a, where a>0:  Change b 1 =2 to b 1 =-3  Change b 2 =1 to b 2 =-4  Change b 3 =7 to b 3 =2  Change b 4 =-3 to b 4 =-6

41. 9/17/2015 COSC-4301-01, Lecture 13 41 Example: Systematic Debugging - cont Step 8: The designer is asked which of the changes are the best:  Changing @(e 1, i) + @(e 2, i)  2 to @(e 1, i) + @(e 2, i)  -3.  Changing @(e 2, i) - @(e 3, j)  1 to @(e 2, i) - @(e 3, j)  -4.  Changing @(e 1, i) - @(e 3, j)  7 to @(e 1, i) - @(e 3, j)  2.  Changing -f 1 (U) - f 2 (U) + f 3 (V)  -3 to -f 1 (U) - f 2 (U) + f 3 (V)  -6. This corresponds to @(e 1, u) + @(e 2, u) - @(e 3, v)  5.

42. 9/17/2015 COSC-4301-01, Lecture 13 42 Example: Systematic Debugging - cont The tool will compute for each of these changes the corresponding propositional formula PF, that is:  PF = { {A 1 }, {A 2 }, {A 3 }, {A 4 }, {  A 1,  A 2,  A 3,  A 4 } } Then #SAT solver will compute the number of truth assignments of PF. Since this number is 0, the algorithm terminates. Otherwise, the algorithm would repeat from Step 7.

43. 9/17/2015 COSC-4301-01, Lecture 13 43 Example: Automatic Debugging - cont Consider a file showing intervals for the constants in B:  b1,-3,2,7 means -2  b 1  7, where b 1 implicit initial value is 2.  b2,-4,1,6 means -3  b 2  6, where b 2 implicit initial value is 1.  b3,2,7,12 means 3  b 3  12, where b 3 implicit initial value is 7.  b4,-6,-3,0 means -6  b 4  0, where b 4 implicit initial value is -3.

44. 9/17/2015 COSC-4301-01, Lecture 13 44 Example: Automatic Debugging - cont As such, the automatic debugging tool will not ask the designer, but it will check the file against the proposed specification. In our case, the tool will choose  -f 1 (U) - f 2 (U) + f 3 (V)  -6  This leads to a negative dependency and its constant belongs to the interval [-6,0].  This corresponds to @(e 1, u) + @(e 2, u) - @(e 3, v)  5.

45. 9/17/2015 COSC-4301-01, Lecture 13 45 Description – part c) c) Given SP and SA expressed in Linear RTL such that SP  SA, determine SP’ and SA’ for which SP  SP’, SP’  SA’, SA’  SA. The new SP’ and SA’ should be done using minimal changes by keeping the same set of constraints, but relaxing SP and/or tightening SA.

46. 9/17/2015 COSC-4301-01, Lecture 13 46 The Optimization Problem The previous approaches were focused on the verification and debugging of SP  SA, and not the optimization of this tautology. However, it may happen that SP contains overly strong timing constraints or SA can be improved by stronger timing constraints. Can we provide the most relaxed specification SP and/or the most tight safety assertion SA such that SP  SA is a theorem (without repeating the verification of SP  SA)?

47. 9/17/2015 COSC-4301-01, Lecture 13 47 Refinement of the Optimization Algorithm Input: SP, SA such that SP  SA holds, and A (1) X  B (1) the initial linear system; Output: SP’, SA’ such that SP’  SA’ is an optimal tautology. Method:  k=1; SP 1 =SP; SA 1 =SA;  while (there exists Λ such that ΛB < -1) { Identify the inequality ∑ j=1 n a ij x j  b i that does not occur in any other subsystem A i X  B i ; Decrease b i such that ΛB=-1 and denote the new system A (k+1) X  B (k+1) ; Change SP k and SA k according to the new weight; k= k+1; }  SP’=SP k ; SA’=SA k.

48. 9/17/2015 COSC-4301-01, Lecture 13 48 Example: Optimization Step 1:  SP:  i  j (@(e 1, i) + @(e 2, i)  2)  (@(e 2, i) - @(e 3, j)  1)  (@(e 1, i) - @(e 3, j)  7).  SA:  u  v (@(e 1, u) + @(e 2, u) - @(e 3, v)  8). Step 2:  SP:  i  j (f 1 (i) + f 2 (i)  2)  (f 2 (i) - f 3 (j)  1)  (f 1 (i) - f 3 (j)  7)  SA:  u  v f 1 (u) + f 2 (u) - f 3 (v)  8 Step 3:  SP    SA:  i  j (f 1 (i) + f 2 (i)  2)  (f 2 (i) - f 3 (j)  1)  (f 1 (i) - f 3 (j)  7) Λ (-f 1 (U) - f 2 (U) + f 3 (V)  -9).

49. 9/17/2015 COSC-4301-01, Lecture 13 49 Example: Optimization -cont Step 4: Consider the substitution ψ = {[i/U][j/V]}. The method pos(F CNF ) generates a new propositional variable for each new inequality after checking the unification. A1 denotes the inequality f 1 (U)+f 2 (U)  2 A2 denotes the inequality f 2 (U)-f 3 (U)  1 A3 denotes the inequality f 1 (U)-f 3 (U)  7 A4 denotes the inequality -f 1 (U)-f 2 (U)+f 3 (V)  -9 The F CNF leads to the following positive clauses for PF: {A 1 }, {A 2 }, {A 3 }, and {A 4 }.

50. 9/17/2015 COSC-4301-01, Lecture 13 50 Example: Optimization -cont Step 5: F CNF is translated to a system of linear inequalities AX  B. Example: A =, X =, B =.

51. 9/17/2015 COSC-4301-01, Lecture 13 51 Example: Optimization -cont Considering AX  B, we need to find the positive row vector Λ = (λ 1 λ 2 λ 3 λ 4 ) such that A tr Λ tr =0. This is: = 0. The positive solution Λ = (1 1 1 2) leads to ΛB =-8. Therefore, AX  B has no solution for X over . PF={{A1}, {A2}, {A3}, {A4}, {  A 1,  A 2,  A 3,  A 4 }}

52. 9/17/2015 COSC-4301-01, Lecture 13 52 Example: Optimization - cont Step 6: Convert PF to a DIMACS file  p cnf 4 5  1 0  2 0  3 0  4 0  -1 -2 -3 -4 0 Call Siege or zChaff The previous DIMACS file is input for Siege. The output of Siege will be: ‘satisfiable’ Since PF is satisfiable, then we need to do debugging to make SP  SA a theorem.

53. 9/17/2015 COSC-4301-01, Lecture 13 53 Example: Optimization - cont Step 7: ΛB=-8, so we’ll do some change to ΛB=-1. There are four ways to do that:  Change b 1 =2 to b 1 =9  Change b 2 =1 to b 2 =8  Change b 3 =7 to b 3 =14  Change b 4 =-9 to b 4 =-6 By doing any of these changes, ΛB=-1. SP 1  SA 1, SP 2  SA 2, SP 3  SA 3 and SP 4  SA 4 are optimal tautologies.

54. 9/17/2015 COSC-4301-01, Lecture 13 54 Summary Verification, debugging and optimization of Linear RTL.

55. 9/17/2015 COSC-4301-01, Lecture 13 55 Reading suggestions Chapter 6 of [Che2002] Cheng, A.M.K.: Real-time systems. Scheduling, Analysis, and Verification. Wiley-Interscience, 2002 [AnC07] Andrei, S., Cheng, A.: Verification of Linear RTL-Specifications. Proceedings of the 28-th IEEE Real-Time Systems Symposium, 2007

56. 9/17/2015 COSC-4301-01, Lecture 13 56 Coming up next Decomposition technique of LRTL formulas

57. 9/17/2015 COSC-4301-01, Lecture 13 57 Thank you for your attention! Questions?