1. Desynchronization and distributed deployment of synchronous systems Albert Benveniste – Inria 2002

2. The problem Ensure a smooth migration throughout the different phases of embedded systems design As analysis reveals, the diversity of communication/concurrency paradigms, throughout the design process, is a serious difficulty

3. System From Components System on Chip Control engineering Matlab/Simulink… Domain specific Functional aspects Model engineering UML System architecture Performance, timeliness Fault-tolerance Non-functional aspects Deployment architecture Middleware Bus, protocols Tasks : Operator : Device start( ) stop( ) Class diagramSequence diagram StatechartsImplementation diagram

4. System From Components Model engineering UML System architecture Performance, timeliness Fault-tolerance Non-functional aspects Control engineering Matlab/Simulink… Domain specific Functional aspects System on Chip Deployment architecture Middleware Bus, protocols Tasks Multiform Model of communication Model engineering Componentsloose timeliness Non-functional aspectstimed Functional models Equations + statessynchronous Code generation Globally Asynchronous Locally Synchronous TasksSchedulingTime-triggered

5. Zooming on Synchrony & Asynchrony

6. Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end

7. Synchrony loop % unique non terminating while loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end

8. Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| % perfectly synchronous parallel composition [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end

9. Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end

10. Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end ?X3-250-321 ?Y2153 !Z*368

11. Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end

12. Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end ?X3-250-321 ?Z*368 !V-40-2-6

13. Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| % synchronizes the two blocks by unification [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end

14. Synchrony loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| % synchronizes the two blocks by unification [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end ?X3-250-321 ?Y2153 !Z*368 ?X3-250-321 ?Z*368 !V-40-2-6

15. V : set of typed variables; v can take value “ absent” State : valuation of V ; Transition : pair of states I : initial condition (set of states) R : transition relation relating successive states Run : sequence of R-consistent transitions Formalizing synchrony S = (V,I,R) S ||| S’ = (V U V’,I&I’,R&R’) synch

16. Formalizing synchrony S = (V,I,R) S ||| S’ = (V U V’,I&I’,R&R’) Alike systems of dynamical equations in maths, but with multiple time-indices Perfectly synchronous parallel composition amounts to combining two systems of equations No recursion, no dynamical creation, only a single non terminating while loop; body with nested “when” Much simpler than Milner’s CCS or Hoare’s CSP

17. From Synchrony to… X Y V

18. Asynchrony X Y V

19. X Y V

20. X Y V

21. X Y V Assumes non synchronized, point to point, reliable channels

22. Formalizing Asynchrony A = (V,  ) V : set of typed variables; “ absent” meaningless Flow : sequence of values, for a given variable Run : tuple of flows  : set of runs A || A’ = (V U V’,  &  ’) asynch

23. Formalizing Asynchrony A = (V,  ) A || A’ = (V U V’,  &  ’) AA’ Point to point, non synchronized, channels

24. Synchrony/Asynchrony X Y V X Y V ? OK

25. Some synchronous systems are robust against Asynchronous environment (a property on infinite runs) synchronous asynchronous

26. For these synchronous systems, desynchronization is injective X Y V X Y V OK

27. They can be characterized: endochrony (a property on finite objects) synchronous asynchronous

28. Endochrony: example, counterexample loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end ?X3-250-321 ?Y2153 !Z*368

29. Endochrony: example, counterexample loop [ when X>0 then [get Y ; emit Z=Y+pre(Y)] ] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end ?X3-250-321 ?Z*368 !V-40-2-6

30. Formalizing endochrony For W,W’ subsets of V : W  W’ iff knowing the value of variables belonging to W determines the status present/absent for all variables of W’ Empty = W0  W1  W2  …  Wmax S is endochronous iff Wmax = V holds S = (V,I,R)

31. Endochrony is model-checkable, and can be synthesized Synchronous exochronous wrapper

32. A wrapper to enforce endochrony loop [ when C=1 then present(X,Z) else when C=2 then present(X)] ||| [ present X then [ present Z then emit U=X+Z else emit V=2X ] ] end

33. Some pairs of systems are robust against Asynchronous communications (a property on infinite runs) synchronous asynchronous

34. They can be characterized: isochrony (a property on finite objects) synchronous asynchronous

35. Formalizing isochrony S = (V,I,R), S ||| S’ = (V U V’,I&I’,R&R’) R & R’ unify pairs of transitions which agree on the values of their common variables (including status present/absent) R & w R’ unify pairs of transitions which agree on the values of their common present variables Isochrony : R & R’ coincides with R & w R’

36. Synchronous Pairs can be given a wrapper which makes them isochronous ( alike protocol generation) Synchronous wrapper enforce isochrony

37. GALS architectures as endo/isochronous networks isoendo

38. Isochrony is compositional iso endo

39. This theory is useful for: Generating code, from a synchronous functional architecture, to a GALS architecture Handling hybrid synchro/asynchro models at design exploration phase, by performing virtual prototyping

40. Further issues The assumed model of asynchronous communication requires blocking communication: not always acceptable Bus infrastructures for distributed control systems are typically non- blocking and time-triggered

41. Bus for distributed control: loosely synchronized clocks A small protocol can emulate our previous model of asynchrony In use, e.g., at Airbus

42. CONCLUSION

43. Most of the work presented is due to: The community on Synchronous Languages ESTEREL (G. Berry,…) LUSTRE (P. Caspi, N. Halbwachs,…) SIGNAL (P. Le Guernic, A. Benveniste,…) The Berkeley community PTOLEMY (Ed Lee,…) The METROPOLIS project at Cadence (Sangiovanni-Vincentelli,…) Supported by vendors (Esterel-Technologies, TNI-Valiosys, and others)

44. Distributed computing can be non-high performance Distributed by the physics; made from components Correctness is a major issue Study models of computation & communication This is relevant and modern research !!