1. Slide 1 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 EmBounded: Automatic Prediction of Resource Bounds for Embedded Systems EU Framework VI IST-510255, 2005-2008 A €1.3M STReP Funded by FET-Open Kevin Hammond University of St Andrews

2. Slide 2 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008

3. Slide 3 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Application Domain (1)

4. Slide 4 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Application Domain (2)

5. Slide 5 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Application Domain (3)

6. Slide 6 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 The Importance of Embedded Systems Some Facts – 98% of all processors are used in embedded systems –in 2003, there were 8 billion programmable devices in use –by 2010, conservative estimates anticipate 16 billion embedded systems »3 devices for every person on the planet! –by 2009, the spend on embedded systems R&D will be €122bn »out of a total ICT R&D spend of €202bn

7. Slide 7 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 State of the Art... Embedded Systems Engineering –big trend to high level software design (UML etc.) –80% of all embedded software is now written in C/C++ –75% of embedded software is delivered late –bugs can cost $14,000 each to fix! A Major Problem with C/C++ is Poor Memory Management –explicit allocation, deallocation –pointer following –etc. etc. No Accurate Method for Determining Memory Usage –profiling, guesswork(!!), approximation

8. Slide 8 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 A New Direction?

9. Slide 9 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 In the near future, we will view software without formal resource bounds in the same way as we regard untyped programs today Prof. Greg Morrissett, Harvard University

10. Slide 10 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Embounded Aims The project aims to identify, to quantify and to certify resource-bounded code targeting real-time embedded systems. We will: –develop static analyses for determining strong, provably correct, time and space bounds in the real-time embedded systems domain. –target important modern, but hard-to-cost, features, including automatic memory management and recursion. –advance the state-of-the-art in embedded systems software engineering by permitting the safe use of such features.

11. Slide 11 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Embounded Objectives 1.Produce formal models of resource consumption in real-time embedded systems for very high-level programming language constructs; 2.Develop static analyses of upper bounds for these resources based on the formal models of resource consumption; 3.Provide independently and cheaply verifiable automatically generated resource certificates for the space and time behaviour of software/firmware components that can be used to construct embedded software/firmware in a compositional manner; 4.Validate analyses against complex real-time embedded applications taken from computer vision systems for autonomous vehicle control; 5.investigate how these technologies can be applied in the short-to- medium term in more conventional language frameworks for embedded systems; 6.develop underpinning specification, implementation and support environment for the Hume language.

12. Slide 12 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Approach 1.Build Formal operational semantics –explicit program execution properties: time and space –captures low-level information 2.Build mathematical models of execution costs –relate programs to costs –formal models of complex program structures, real-time constructs –metrics: execution time, stack high watermarks memory allocations/deallocations –provable bounds on execution costs 3.Construct static analyses –based on mathematical models Tplus = 1 Tpush = 3 … 1. 2. findNewCentre centre dx old_dx nloops frame Qu = if dx== > || nloops>4 || addCoord dx old_dx == > then centre else findNewCentre (addCoord centre dx) (computeDisplacement (updateWeights (updateModel frame (addCoord centre dx) theKern) Qu frame (addCoord centre dx)) theDeriv) dx (nloops+1) frame Qu; Program Source T_init = Tcall + 5*Tpushvar + 3*Tmkint + Tmkvec(2) + … + Tcreateframe+Tmatchrule+… 3.

13. Slide 13 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Resource Models & Analysis

14. Slide 14 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 The EmBounded Vision Resource Usage Report Time: xx ms Heap: xx KB Stack: xx KB Analyse Compile and Build Formal Proof 001a00af fed234f5 000012ce 234581fa Source Program Binary Program Resource Certificate  ≥ 0   √ Embedded System proof carrying code techniques

15. Slide 15 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Research Methodology Hume: High-Level features, Low-Level target –Recursion, Exceptions, Concurrency, Automatic memory management, Polymorphic typing, … –Timing, Interrupts, FIFOs, Devices, Scheduling, … Hume Abstract Machine –High-level AM design, simplifies construction of semantics/models Formal semantics –Explain the operation of the program in terms of the underlying machine Cost Models –Allow AM-derived costs to be attached to language constructs Static analyses –Formally derived from cost models Formal Certification –Formally based on analyses, checking/verification possible Testbed Applications –Realistic, derived from autonomous vehicle domain

16. Slide 16 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Workpackages WP6: Certification WP2: Resource Modelling WP3: Real-Time Analysis WP4: Bounded Space Analysis WP5: ILP & Cache Analysis WP9: Application To Traditional Settings WP7: Languages & Systems WP8: Embedded Applications

17. Slide 17 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 The Embounded Consortium Vision Algorithms LASMEA, Heriot-Watt Embedded Applications LASMEA, AbsInt Language Design St Andrews, Heriot-Watt, Ludwig-Maximilians Compilation and Implementation Heriot-Watt, St Andrews, AbsInt, LASMEA Proof Theory and Resource Models Ludwig-Maximilians, St Andrews

18. Slide 18 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Main Y1 Technical Achievements Production of Formal Semantics, Cost Models and Translations for Hume/HAM Production of aiT tool specialised to M32C Construction of computer vision algorithms in Hume Production of HAM port for Renesas M32C

19. Slide 19 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Main Y2 Technical Achievements Production of Formal Analyses for Space and WCET Implementation of Time and Space Analyses Development of Generic Approach to Resource Costing Construction of computer vision algorithms in Hume Production of HAM port for Pioneer P3/AT

20. Slide 20 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Main Y3 Technical Achievements WCET Results for Hume Obtained and Validated –some good quality results obtained Improvement of Time and Space Analyses –coverage and quality Assertion Language for Certificates Construction of CyCab algorithm in Hume Development of robust Hume to C compiler Construction of Hume Model Checker Started to investigate application to traditional languages

21. Slide 21 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008

22. Slide 22 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008

23. Slide 23 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Project Web Site

24. Slide 24 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Publications on line

25. Slide 25 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Deliverables on line

26. Slide 26 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Tools on line

27. Slide 27 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Immediate Development Plans 3-year, £1M UK project to investigate use of Hume for MIMO applications 3-year £240K UK project to study use of Hume for automous vehicle applications Involvement in the EU CARA Network for Resource Analysis Pursue commercial and academic interest in –Hume for FPGAs –Hume and RTOSes –Component-based compositional analysis for box-based design approaches

28. Slide 28 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 “Finally someone has combined the critical features needed for successful development of embedded systems: [Hume has] exactly the features I have been looking for — I have actually designed a language myself to accomplish some of the goals, but I can scrap that now since you seem to get it all right (unlike me)” Industrial RTOS Developer “Finally someone has combined the critical features needed for successful development of embedded systems: [Hume has] exactly the features I have been looking for — I have actually designed a language myself to accomplish some of the goals, but I can scrap that now since you seem to get it all right (unlike me)” Industrial RTOS Developer

29. Slide 29 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 Long-Term Exploitation Routes Hume –user-focused research/development project: adaptivity, medical embedded systems, real-time operating systems, worst-case execution time analysis –commercial product Resource Modelling Technology –analyses for power consumption –more advanced memory/time analyses, e.g. real-time GC –adapted to conventional languages, e.g. C –incorporation into standalone tool suite General framework for specifying non-functional properties –security, resource usage,... –time, space, power consumption, reactivity, liveness,... –exploit dependent types to merge static/dynamic properties?

30. Slide 30 Kevin Hammond, University of St Andrews Workshop on Resource Analysis Hatfield, Sept. 9th 2008 http://www.embounded.org