Embedded Systems Development

Transcription

1 bedded Systes Developent Lecture 4 sterel Daniel Kästner AbsInt Angewandte Inforati GbH aestner@absint.co

2 2 Valued Signals vs. Variables Data expressions: references to constants or variables?s yields the current value of signal S pre?s) yields the value of signal S at the previous instant Assignent instantaneous): X : e where X is a variable and e is a data expression eit Se) : evaluates the data expression e eits S with that value and terinates instantaneously.

3 3 Valued Signals vs. Variables The value of a signal can be changed only if the status is present. Unlie the status the value is peranent: if it is unchanged in an instant its value is that of the previous instant. The value of a variable is written by an instantaneous assignent stateent. A valued signal has exactly one status and exactly one value at a tie per instant). Both the status and the value are broadcast. A variable can tae several successive values in an instant. Order in which the values are taen: constructive order. A signal is shared throughout its scope. A variable is local to a thread in case the thread writes it. If the thread fors on only two cases are legal: The variable is accessed in read-only ode in each subthread or if the variable is written by soe thread then it can neither be read nor be written by concurrent threads.

4 Valued Signals vs. Variables 4 X:X+1 X:1 eit S1) eit S2) forbidden allowed X:X+1 eit S?S+1) allowed forbidden

5 xaple 1) 5 odule Syste1: input A B R; output O; loop [await A await B] eit O each R end odule

6 xaple 2) 6 every S do p end awaits the first future occurence ie not at initialization tie) of S to start p. every iediate S do p end iediately starts p if I is present at the first instant. odule Count1: input I; output COUNT:0:integer; every I do eit COUNTpre?COUNT)+1); end every end odule odule Count2: input I; output COUNT; var Count:0:integer in every I do Count:Count+1; eitcountcount)) end every end var end odule

7 Abort Behavior of abort p when S: In the starting instant p is iediately started the initial presence or absence of S being ignored delayed abort). If p terinates before S occurs then the whole abort stateent terinates. If S occurs while p is not yet terinated the abort stateent iediately terinates and p does not receive control in the current instant strong abort). To ae abort sensitive to S in the first instant: abort p when iediate S To give p control a last tie when S occurs: wea abort p when S odule Speedoeter: input Second Meter; output Speed: integer in loop var distance:0: integer in abort every Meter do distance:distance+1 end every when Second do eit Speeddistance) end abort end var end loop end odule 7

8 Generic Behaviors and Modules 8 ach data object used by a odule ust be declared in that odule. A data object defined in different subodules ust be identically declared. Calling odules: run stateent. xplicit renaing by '/'. Renaing arguents are passed by nae and not by position! If a nae is ept unchanged in a substitution it need not be passed as a paraeter. odule TWO_STATS: input On Off; output IsOn IsOff; loop abort sustain IsOff when On abort sustain IsOn when Off end loop end odule... signal IsOff in end run TWO_STATS [signal RadioOn / On RadioOff / Off Playing / IsOn]

9 STRL xaple Progra 9 odule Speedoeter: input Second Meter; output Speed: integer in loop var distance:0: integer in wea abort every Meter do distance:distance+1 end every when Second do eit Speeddistance) end abort end var end loop end odule odule SpeedSupervisor: input Second Meter; output TooFast in signal Speed: integer in [ run Speedoeter every Speed do if?speed > MaxSpeed then eit TooFast end if end every ] end signal end odule

10 10 Causality Analysis Causality proble: the presence of a signal sees to depend on itself proble of cobinatorial loops in synchronous circuits). Goal: have one reactivity) and only one deterinis) consistent solution for each configuration of input signals. xaple situations: odule P1: output O; present O else eit O end present end odule odule P2: output O; present O then eit O end present end odule odule P3: input I; output O; signal S in present I then eit S end present S then eit O end end signal end odule inconsistent non-deterinistic logically correct

11 Causality Analysis 11 odule P4: output O1O2; present O1 then eit O1 end present O1 then present O2 else eit O2 end end present end odule Logically correct but rejected by Constructive Causality: no constructive explanation for solution.

12 Logical Correctness 12 Logical coherence law: A signal S is present in an instant if and only if an eit S stateent is executed in this instant. Logical correctness requires: there exists exactly one status for each signal that respects the coherence law. Let a progra P and an input I be given: P is logically reactive wrt I: at least one logically coherent global status. P is logically deterinistic wrt I: at ost one logically coherent global status. P is logically correct wrt I: logically reactive and deterinistic. P is logically correct: logically correct wrt all possible input events.

13 Logical Correctness 13 Pure sterel progras can be analyzed for logical correctness by exhaustive case analysis. Given the status of each input signal one can ae all possible assuptions about the global status and chece the individually. Logical correctness is decidable butnp coplete Logical correctness can be counter-intuitive other basis for language seantics needed.

14 Logical Correctness 14 odule P1: input I; output O; signal S1 S2 in present I then eit S1 end present S1 else eit S2 end present S2 then eit O end end signal end odule logically correct I present: Assuption S1 present S2 not present O not present Justification: The eit S1 stateent is executed justifying the assuption S1 present no eit S2 and eit O stateents are executed justifying the assuption S2 absent and O absent. I absent: Assuption S1 absent S2 present O present. Justification: The eit S1 stateent is not executed justifying the assuption S1 absent theeits2 stateentisexecutedjustifyingthe assuption S2 present and the eit O stateent is executed justifying the assuption O present. All other assuptions can be shown to be logically incoherent.

15 Logical Correctness 15 odule P2: output O; present O else eit O end present end odule non-reactive odule P3: output O; present O then eit O end present end odule reactive but non-deterinistic

16 Logical Correctness 16 odule P4: present O1 then eit O1 end present O1 then present O2 else eit O2 end end logically correct

17 17 Acyclicity and Constructiveness sterel progras can be required to be acyclic: No dependency cycles wrt signal dependences Basic idea: present S) then eit P else eit Q end: S P S Q Can be defined precisely and checed at copile tie. BUT: good progras will be rejected. Weaer property called constructiveness: Cyclic progras can be constructive Can be checed at copile tie More progras will be accepted but constructiveness is harder to chec than acyclicity.

18 xaples 18 odule P5: output O; present O else eit O end present end odule non-reactive odule P6: output O; present O then eit O end present end odule reactive but non-deterinistic Both are rejected by cyclicity test.

19 xaples 19 odule P7: input I; output O1O2; present I then present O2 then eit O1 end else present O1 then eit O2 end end present end odule rejected by acyclicity test reactive and deterinistic odule P7: output O; present O then nothing end eit O; end odule rejected by acyclicity test eit O and test in sae instant the test depending on the eit)

20 20 Which Seantics to Adopt? Logical correctness is not in accordance with the intention of the language ie with its intuitive seantics and with the intended sequential character of test stateents. xaple: odule P10: present O then nothing end; eit O is logically correct but the inforation that O is present flows bacwards across the sequencing operator ; contradicting the basic intuition about sequential execution. Aside fro the explicit concurrency all sterel stateents are sequential.

21 The Constructive Seantics 21 Idea: do not chec assuptions about signal statuses but propagate facts about control flow and signal statuses. Selfjustification is replaced by fact-to-fact propagation. Accounts for prograer's natural way of thining: in ters of cause and effect. Three-valued logic for signals: present + absent unnown. In each instant the statuses of the input signals are given by the environent and the statuses of the other signals are initially set to unnown.

22 22 The Constructive Seantics Three equivalent presentations: Constructive behavioral seantics Derived fro the logical behavioral seantics Constructive restrictions are added to the logical coherence rule Constructive operational seantics Based on ter rewriting rules defining icrostep sequences Siplest way of defining an efficient interpreter Circuit seantics Translation of progra into constructive circuits Core of the sterel v5 copiler.

23 23 Constructive Behavioral Seantics Logical coherence seantics augented by reasoning about what a progra ust or cannot do both predicates being disjoint and defined in a constructive way. The ust predicate deterines which signals are present and which stateents are executed. The cannot predicate deterines when signals are absent and it serves in pruning out false execution paths. A progra is accepted as constructive if and only if fact propagation using the ust and cannot predicates suffices in establishing presence or absence of all signals.

24 Constructive Behavioral Seantics 24 Logical Coherence Law: A signal S is present in an instant iff an eit S stateent is executed in this instant. Constructive Coherence Law: A signal S is present iff an eit S stateent ust be executed. A signal S is absent iff an eit S stateent cannot be executed. The cannot predicate can be derived fro the can predicate.

25 Constructive Behavioral Seantics 25 A signal can have three statuses: +: nown to be present : nown to be absent : yet unnown ust and cannot predicates are defined by structural induction on stateents. p ; q Must resp. can) execute q if p ust resp. can) terinate present S then p else q end S nown to be present -> Test behaves as p S nown to be absent -> Test behaves as q S yet unnown -> Test can do whatever p or q can do; there is nothing the test ust do.

26 26 xaple odule P1: input I; output O; signal S1 S2 in present I then eit S1 end i1) present S1 else eit S2 end i2) present S2 then eit O end i3) end signal end odule If I is present: i1 ust tae its then branch eit S1 and terinate S1 present i2 ust tae its epty) then branch and cannot tae its else branch eit S2 cannot be executed S2 cannot be eitted S2 absent i3 cannot tae its then branch O cannot be eitted and is absent. If I is absent: i1 cannot tae its then branch eit S1 cannot be executed S1 absent i2 ust tae its then branch eit S2 ust be executed S2 present. i3 ust tae its then branch eit O ust be executed O present.

27 xaple 2 Part 1 27 Analyze what signal S ust do with status for O. odule P2: output O; signal S in eit S; present O then present S then pause end; eit O end end signal Analyze body with status for O and S. S ust be eitted. Thus: redo the analysis with status for O and + for S. Status of O is unnown: there is nothing that the present stateent ust do. Progress can only be ade by analyzing what we cannot do in the branches of the test. The then branch contains a present S test. Since S is nown to be present we cannot tae the iplicit else branch. Since the then branch is a pause stateent it cannot terinate. Therefore the eit O stateent cannot be executed and O cannot be eitted. As a consequence O ust be set absent and the analysis ust be redone with status for O.

28 xaple 2 Part 2 28 odule P2: output O; signal S in eit S; present O then present S then pause end; eit O end end signal Analyze what signal S ust do with status for O. The iplicit else branch of the present O test that terinates execution ust be taen. The progra is constructive since we have fully deterined the signal statuses.

29 29 Constructive Behavioral Seantics signal S in p end Can: recursively analyze p with status for S Must: Assue we already now that we ust execute the declaration in soe signal context Must copute final status of S to deterine signal context of p First analyze p in augented by setting the unnown status for S If S ust be eitted: propagate this inforation by reanalyzing p in with S present This ay generate ore inforation about the other signals If S cannot be eitted: reanalyze p in with S absent

30 Constructive Behavioral Seantics Foral Definition 30 Let S be a set of signals. An event is a apping : S B {+ } which assigns a status fro B to all signals in S. Notation: s + : s) + s - : s) ': s + in s + in ' Singleton event {s + }: {s + }s ) + and {s + }s ') forall s ' s Let an event for a set S be given a signal s possibly not in S and a status b in B. Then * s b is an event for the set S {s } where *s b s ) b and *s b s ') s ') s ' s.

31 Constructive Behavioral Seantics 31 Foral Definition The stateents nothing pause and exit are represented by copletion codes 0: nothing is encoded by 0 pause is encoded by 1 exit T is encoded by 2 if the directly enclosing trap declaration is that of T and n +2 if n trap declarations have to be traversed before reaching that of T. ach control thread returns a copletion code 0 when it has copleted its execution in that instant. The copletion code is generated by executing a stateent ie a nothing pause or exit T ernel stateent.

32 Constructive Behavioral Seantics Foral Definition 32 Given a progra P with body p and an input event I. A reaction of the O progra is given by a behavioral transition of the for P P' where O is an output event and the resulting progra P ' is the new state reached by P after the reaction. P ' is called the derivative of P by the reaction. The stateent transition relation has the for where ' is an event that defines the status of all signals in the scope of p ' is an event coposed of all signals eitted by p in the reaction is the copletion code returned. The stateent p ' is called the derivative of p by the reaction. Given a progra P with body p and an input event I then: P I O P' p O I O p' p for soe p ' I

33 33 Trap Level Propagation Let τ: Var N be a function that aps trap naes to the trap nesting level of the trap definition. aes the trap level explicit. We will abbreviate... by n. n ties Let Ēτ) be the extended signal environent such that is an event and τ a trap nesting level function. The Must function deterines what ust be done in a reaction: Mustp Ē) S K where Ē is an extended signal environent such that initially τø S is the set of signals that p ust eit K is the set of copletion codes that p ust return. We write Mustp ) S K : Must s p ) Must p )

34 Constructive Behavioral Seantics 34 Foral Definition The function Cannot p Ē ) is used to prune out false paths. Cannot p Ē ) Cannot s p Ē ) Cannot p Ē ) SK Ē is an extended signal environent such that initially Ø S is the set of signals that p cannot eit K is the set of copletion codes that p cannot exit with when the input event is. {+ } indicates whether it is nown that the stateent p ust be executed in the event. The case will never occur since Cannot will only be called for potentially executable stateents. In the following we will use Can p Ē ) since it is easier to be defined forally; fro this Cannot p Ē ) can be deterined by coponentwise copleentation.

35 Constructive Behavioral Seantics Foral Definition Must and Can are defined by structural induction over the ernel stateents. Must Can { } Must eit S Can eit S { s}{0} Must p if s+ Must present s then p else q end Must q if s if s Can present s then p else q end Must suspend p when s Must p Can suspend p when s Can p Can p Can q Can p Can q if s+ if s if s 35

36 Constructive Behavioral Seantics Foral Definition 36 Must p; q Must p Must s p Must s q Must q if if {0} Must p {0} Must p We analyze q only if p ust terinate in which case the copletion code 0 of p is discarded.

37 Constructive Behavioral Seantics Foral Definition 37 Can p; q Can p if 0 Can p Can p Can ' q Can p \{0} Can ' q s s if 0 Can p with ' + if + and 0 Must p or ' otherwise We analyze q with arguent terinate with arguent ' ' + if + otherwise. and if p ust

38 Constructive Behavioral Seantics Foral Definition 38 Must loop p end Must p Can loop p end Can p Must p q Can p q Must s Can s p Must s p Can q Max Must p Must q q Max Can p Can q s Max K L) {ax{ l}} if K or L for K l L The Max operation e.g. ensures that cannot terinate if one of its branches cannot do so.

39 Trap Level Propagation Must trapt in p end Must{ + 1 Must{ q } T Must s q ') Must q Must s Must exit T Must Must exitt 2+ τ T) Must exit T p} T where ' τ ') and τ ' T) q Must q q ') 39 0 if 0 or 2 1 if 1 1 if > 2 if 0 or if 2 Intuitive copletion code rule: exit T is encoded by 2 if the directly enclosing trap declaration is that of T and n +2 if n trap declarations have to be traversed before reaching that of T. Must trapt in exit T end Must { exit T} T Must { } T Must {2} T 2 0

40 40 Trap Level Propagation + > 2 if or if 2 if 1 1 if or if 0 ) 2 ) ) ) ) ) ) ) ' ') ' ') ') ) } { ) } 1 { ) T exitt x Can T exit x Can T exit Can x q x Can q x S Can q Can x T and where q x Can q x S Can T q Can x T p Can x p end trapt in Can x τ τ τ + +

41 41 Constructive Behavioral Seantics Foral Definition ) ) ) ) ) ) } { }) { ) ) ) ) ) ) ) } { }) { ) q Can q s Can q Can q Can q s Can q Can p Can p end trapt in Can q Must q s Must q Must q Must q s Must q Must p Must p end trapt in Must > + > 1 if or if 2 if 1 1 if or if 0 Trap propagation:

42 Constructive Behavioral Seantics Foral Definition Must signal s in Can signal s in p p Must p s + ) \{ s} Must p s ) \{ s} Must p s ) \{ s} Can + p s + ) \{ s} Can p s ) \{ s} Can p s ) \{ s} We first analyze the body p with status for s with the sae arguent. if s Must s p s ) if s Can + p s s ) otherwise if + and s Must s p s ) if s Can + p s s ) otherwise If + and we find that the signal ust be eitted we reanalyze p with status + for s. For both + and if the signal cannot be eitted we reanalyze p with status and with the sae. Otherwise we return the result of the analysis of p with status for s. Note that the signal status can be set to + only if +. This is necessary to avoid speculative coputations. 42

43 Constructive Behavioral Seantics 43 The constructiveness analysis involves any recoputations: Once a signal status has been set the body of its declaration the whole progra for an output) has to be reanalyzed this way re-establishing any facts that are already nown. The goal of the operational and circuit seantics is to avoid recoputing nown facts.

44 xaple 44 odule P4: input I; output O; signal S1 S2 in present I then eit S1 end present S1 then eit S2 end present S2 then eit O end end odule accepted by constructiveness odule P3: input I; output O1O2; present I then present O2 then eit O1 end else present O1 then eit O2 end end present end odule rejected by acyclicity test reactive and deterinistic accepted by constructiveness

45 Advanced Constructiveness 45 Preeption stateents abort) behave as tests for the guard in each instant where the guard is active. Their constructiveness test is straightforward. Signal expressions: not e : straightforward e1 or e2 : evaluates to true as soon as one of e1 or e2 evaluates to true even if the other one is still unnown. e1 and e2 : analogous The coputation of values of valued signals cannot be lazy since the value is nown only when all eitters are either executed or discarded due to signal cobination). A stateent such as eit S2) is handled as eit S;?S:2; by the constructiveness test.