Beyond the LET and back to Synchronous Models

1. Beyond the LET and back to Synchronous Models Marco Di Natale Scuola Superiore Sant’Anna, Pisa* marco@sssup.it

2. Back to Synchronous models? • Motivations for LET • Time determinism • Knowing at what time outputs are produced, knowing end-to-end latencies • Causality and flow preservation (when moving to multicores) • Not only knowing what is the time latency (and that it is always the same), but also which outputs (from what instance) are propagated • Time composability • Additional benefits of LET • Reducing buffering for under- or oversampling communication (from #2) You get all of this with SR models No need to be concerned about the ZET assumption (or logical time execution) and cycles Beyond the LET and back to Synchronous Models M. Di Natale

3. Synchronous languages - benefits Time determinism – if necessary by adding output delays Data determinism – causality – flow preservation Could be decoupled(!) The execution of a LET program f is time-deterministic since for all sequences I of input values and times, the program produces the same sequences f(I) of output values and times The execution of an SR program f is time-deterministic since for all sequences I of input values and times, the program produces the same sequences f(I) of output values and times (*note on actuation outputs) Beyond the LET and back to Synchronous Models M. Di Natale

4. Models for predictable execution Discrete Time – Logical clocks (Synchronous reactive languages) Discrete Event PTIDES (E. Lee’s group) LUSTRE (SCADE) SIMULINK PRELUDE LET (a restriction? Or define a restriction) Also (most important) an implementation (scheduling) model and framework (GIOTTO) Beyond the LET and back to Synchronous Models M. Di Natale

5. LET as a restriction of SR Languages This is not only to recall the LET model (C. Kirsch), but also to highlight causal dependencies and synchronous execution (even if not strictly included in the original model) A B (as LET tasks) This output is not needed Beyond the LET and back to Synchronous Models M. Di Natale

6. LET as a restriction of SR Languages Rules: A and B need to be activated with the correct rate, executed with their causal order (takes care of I/O dependencies) and executed before the next event in the system A B (as SR actors) A A B A A B The execution is deterministic More difficult to schedule but less latency Beyond the LET and back to Synchronous Models M. Di Natale

7. LET as a restriction of SR Languages A delay block A D1 B D2 (LET as SR actors) A D1 B D2 A D1 A D1 A D1 B D2 Beyond the LET and back to Synchronous Models M. Di Natale

8. LET as a restriction of SR Languages A B D2 D1 (LET as SR actors) A D1 B D2 A D1 A D1 B D2 A D1 A D1 B D2 Beyond the LET and back to Synchronous Models M. Di Natale

9. You get more flexibility SR model: place delay when needed D D D D D D D D D D D Remove unnecessary delays when possible/needed LET model: always unit delay Optimization problem, very close to the problem of optimizing the LET window size Beyond the LET and back to Synchronous Models M. Di Natale

10. Concerned about the implementation of the “ZET”? • No need: problem has been already faced (and solved) for all of the above languages… • LUSTRE • PRELUDE • SIMULINK • They also already faced (and solved) the communications/buffering problems • See for example… • C. Sofronis, S. Tripakis, and P. Caspi. “A memory-optimal buffering protocol for preservation of synchronous semantics under preemptive scheduling.” In Proc. 6th ACM International Conference on Embedded Software, 2006. Beyond the LET and back to Synchronous Models M. Di Natale

11. Simulink RT blocks: High rate/priority to low rate/priority Low rate/ priority High rate/ priority pri=1 T=1 pri=1 T=2 pri=2 T=2 Consistency here is guaranteed by proving there is no preemption Output update only

12. Simulink RT blocks: Low rate/priority to high rate/priority High rate/ priority Low rate/ priority pri=2 T=2 pri=2 T=2 pri=1 T=2 pri=1 T=1 RT-equivalent Consistency here is guaranteed by proving there is no preemption State update Output update Output update

13. Back to yesterday’s example A A B B C C Yes, multicore execution fails What happens in this case is that causality between A and B was enforced by priority order of execution Now the LET delayed output is enforcing the causality (LET as a way to enforce causality!) Isn’t it better to recognize causality as a fundamental constraint and let the implementation deal with it? Beyond the LET and back to Synchronous Models M. Di Natale

14. Bibliography • D. Potop-Butucaru, R. De Simone, J. P. Talpin, “The Synchronous Hypothesis and Synchronous Languages,” in R. Zurawski, ed., The Embedded Systems Handbook, CRC Press, 2005. • A. Benveniste, P. Caspi, S. Edwards, N. Halbwachs, P. Guernic, and R. de Simone. “The synchronous languages 12 years later,” in Proceedings of the IEEE, 91, January 2003. • G. Berry and G. Gonthier, “The Esterel synchronous programming language: Design, semantics, implementation,” in Sci. Comput. Program, vol. 19, pp. 87–152, Nov. 1992. • F. Boussinot and R. de Simone, “The Esterel language,” in Proceedings of the IEEE, vol. 79, pp. 1293–1304, Sept. 1991. • P. Caspi, D. Pilaud, N. Halbwachs, and J. A. Plaice, “LUSTRE: A declarative language for programming synchronous systems,” in ACM Symp. Principles Program. Lang. (POPL), Munich, Germany, 1987, pp. 178–188. Beyond the LET and back to Synchronous Models M. Di Natale

15. Bibliography • P. Caspi, N. Scaife, C. Sofronis, and S. Tripakis. “Semantics-preserving multitask implementation of synchronous programs,” in ACM Trans. Embed. Comput. Syst., 7(2):1–40, January 2008. • J. Forget, F. Boniol, D. Lesens, and C. Pagetti. “A multiperiodic synchronous data-flow language”. In 11th IEEE High Assurance Systems Engineering Symposium (HASE’08), Nanjing, China, Dec. 2008. • J. Forget, “A Synchronous Language for Critical Embedded Systems with Multiple Real-Time Constraints”, Ph.D. Thesis, University of Toulouse, 2009. • Stavros Tripakis, Christos Sofronis, Norman Scaife, and Paul Caspi. Semantics-preserving and memory-efficient implementation of inter-task communication on static-priority or edf schedulers. Proceedings of the 5th ACM EMSOFT conference, 2005. • C. Sofronis, S. Tripakis, and P. Caspi. “A memory-optimal buffering protocol for preservation of synchronous semantics under preemptive scheduling.” In Proc. 6th ACM International Conference on Embedded Software, 2006. Beyond the LET and back to Synchronous Models M. Di Natale

16. Bibliography • Guoqiang Wang, Marco Di Natale, and Alberto L. Sangiovanni-Vincentelli. “Optimal synthesis of communication procedures in real-time synchronous reactive models.” in IEEE Trans. Industrial Informatics, 6(4): 729–743,2010. • Guoqiang Wang, Marco Di Natale, and Alberto L. Sangiovanni-Vincentelli. Improving the size of communication buffers in synchronous models with time constraints, in IEEE Trans. Industrial Informatics, , Volume 5, Number 3, August 2009. • Haibo Zeng and Marco Di Natale. “Mechanisms for Guaranteeing Data Consistency and Time Determinism in AUTOSAR Software on Multi-core Platforms.” In Proceedings of the 6th IEEE Symposium on Industrial Embedded Systems (SIES), June 2011. • Marco Di Natale, Guoqiang Wang, and Alberto Sangiovanni- Vincentelli. “Improving the size of communication buffers in synchronous models with time constraints.” in IEEE Trans. Industrial Informatics, 5(3): 229-240, 2009 Beyond the LET and back to Synchronous Models M. Di Natale

17. Q & (hopefully) A Thank you ! Beyond the LET and back to Synchronous Models M. Di Natale