We present a logic for stating properties such as, "after a request for service there is at least a 98\045 probability that the service will be carried out within 2 seconds". The logic extends the temporal logic CTL by Emerson, Clarke and Sistla with time and probabil- ities. Formulas are interpreted over discrete time Markov chains. We give algorithms for checking that a given Markov chain satis- fies a formula in the logic. The algorithms require a polynomial number of arithmetic operations, in size of both the formula and\003This research report is a revised and extended version of a paper that has appeared under the title "A Framework for Reasoning about Time and Reliability" in the Proceeding of the 10thIEEE Real-time Systems Symposium, Santa Monica CA, December 1989. This work was partially supported by the Swedish Board for Technical Development (STU) as part of Esprit BRA Project SPEC, and by the Swedish Telecommunication Administration.1the Markov chain. A simple example is included to illustrate the algorithms.

/pdf/a-logic-for-reasoning-about-time-and-reability-mtiha3bb6l.pdf

A logic for reasoning about time and reability

The paper presents exact schedulability analyses for real-time systems scheduled at runtime with a static priority pre-emptive dispatcher. The tasks to be scheduled are allowed to experience internal blocking (from other tasks with which they share resources) and (with certain restrictions) to release jitter, such as waiting for a message to arrive. The analysis presented is more general than that previously published and subsumes, for example, techniques based on the Rate Monotonic approach. In addition to presenting the relevant theory, an existing avionics case study is described and analysed. The predictions that follow from this analysis are seen to be in close agreement with the behaviour exhibited during simulation studies.

https://www.math.unipd.it/~tullio/RTS/2009/ABRTW-1993.pdf

Applying new scheduling theory to static priority pre-emptive scheduling

The most visible use of computers and software is processing information for human consumption. The vast majority of computers in use, however, are much less visible. They run the engine, brakes, seatbelts, airbag, and audio system in your car. They digitally encode your voice and construct a radio signal to send it from your cell phone to a base station. They command robots on a factory floor, power generation in a power plant, processes in a chemical plant, and traffic lights in a city. These less visible computers are called embedded systems, and the software they run is called embedded software. The principal challenges in designing and analyzing embedded systems stem from their interaction with physical processes. This book takes a cyber-physical approach to embedded systems, introducing the engineering concepts underlying embedded systems as a technology and as a subject of study. The focus is on modeling, design, and analysis of cyber-physical systems, which integrate computation, networking, and physical processes. The second edition offers two new chapters, several new exercises, and other improvements. The book can be used as a textbook at the advanced undergraduate or introductory graduate level and as a professional reference for practicing engineers and computer scientists. Readers should have some familiarity with machine structures, computer programming, basic discrete mathematics and algorithms, and signals and systems.

Introduction to Embedded Systems - A Cyber-Physical Systems Approach

We formalise the data race free (DRF) guarantee provided by Java, as captured by the semi-formal Java Memory Model (JMM) [1] and published in the Java Language Specification [2]. The DRF guarantee says that all programs which are correctly synchronised (i.e., free of data races) can only have sequentially consistent behaviours. Such programs can be understood intuitively by programmers. Formalisation has achieved three aims. First, we made definitions and proofs precise, leading to a better understanding; our analysis found several hidden inconsistencies and missing details. Second, the formalisation lets us explore variations and investigate their impact in the proof with the aim of simplifying the model; we found that not all of the anticipated conditions in the JMM definition were actually necessary for the DRF guarantee. This allows us to suggest a quick fix to a recently discovered serious bug [3] without invalidating the DRF guarantee. Finally, the formal definition provides a basis to test concrete examples, and opens the way for future work on JMM-aware logics for concurrent programs.

/pdf/formalising-java-s-data-race-free-guarantee-43kd5qhpmn.pdf

Formalising java's data race free guarantee

The high computational complexity required for performing an exact schedulability analysis of fixed priority systems has led the research community to investigate new feasibility tests which are less complex than exact tests, but still provide a reasonable performance in terms of acceptance ratio. The performance of a test is typically evaluated by generating a huge number of synthetic task sets and then computing the fraction of those that pass the test with respect to the total number of feasible ones. The resulting ratio, however, depends on the metrics used for evaluating the performance and on the method for generating random task parameters. In particular, an important factor that affects the overall result of the simulation is the probability density function of the random variables used to generate the task set parameters. In this paper we discuss and compare three different metrics that can be used for evaluating the performance of schedulability tests. Then, we investigate how the random generation procedure can bias the simulation results of some specific scheduling algorithm. Finally, we present an efficient method for generating task sets with uniform distribution in a given space, and show how some intuitive solutions typically used for task set generation can bias the simulation results.

/pdf/measuring-the-performance-of-schedulability-tests-yr1og35xbk.pdf

Measuring the Performance of Schedulability Tests

/pdf/finding-response-times-in-a-real-time-system-2sgvbc6afx.pdf

Finding Response Times in a Real-Time System

From the Publisher:
Real-time Systems: Specification, Verification and Analysis provides a detailed account of three major aspects of real-time systems: program structures for real-time, timing analysis using scheduling theory, and specification and verification in different formal frameworks.

/pdf/real-time-systems-specification-verification-and-analysis-2d54b32zyy.pdf

Real-Time Systems: Specification, Verification, and Analysis

It has been usual to consider that the steps of program refinement start with a program specification and end with the production of the text of an executable program. But for fault-tolerance, the program must be capable of taking account of the failure modes of the particular architecture on which it is to be executed. In this paper we shall describe how a program constructed for a fault-free system can be transformed into a fault-tolerant program for execution on a system which is susceptible to failures. We assume that the interference by a faulty environment F on the execution of a program P can be described as a fault-transformation F which transforms P into a program F(P) = P + F. A recovery transformation R transforms P into a program R(P) = P[]R by adding a set of recovery actions R, called a recovery program. If the system is fail stop and faults do not affect recovery actions, we have F(R(P)) = F(P)[]R = (P + F)[]R We illustrate this approach to fault-tolerant programming by considering the problem of designing a protocol that guarantees reliable communication from a sender to a receiver in spite of faults in the communication channel between them.

/pdf/transformation-of-programs-for-fault-tolerance-1u6r2aui5p.pdf

Transformation of programs for fault-tolerance

Fault-tolerance and timing have often been considered to be implementation issues of a program, quite distinct from the functional safety and liveness properties. Recent work has shown how these non-functional and functional properties can be verified in a similar way. However, the more practical question of determining whether a real-time program will meet its deadlines, i.e., showing that there is a feasible schedule, is usually done using scheduling theory, quite separately from the verification of other properties of the program. This makes it hard to use the results of scheduling analysis in the design, or redesign, of fault-tolerant and real-time programs. This article shows how fault-tolerance, timing, and schedulability can be specified and verified using a single notation and model. This allows a unified view to be taken of the functional and nonfunctional properties of programs and a simple transformational method to be usedto combine these properties. It also permits results from scheduling theory to be interpreted and used within a formal proof framework. The notation and model are illustrated using a simple example.

https://dl.acm.org/doi/pdf/10.1145/314602.314605

Specification and verification of fault-tolerance, timing, and scheduling

This paper describes a compositional proof system called P-A logic for establishing weak total correctness and weak divergence correctness of CSP-like distributed programs with synchronous and asynchronous communication Each process in a network is specified using logical assertions in terms of a presupposition Pre and an affirmation Aff as a triple {Pre}S{Aff} For purely sequential programs, these triples reduce to the familiar Hoare triples In distributed programs, P-A triples allow the behaviour of a process to be specified in the context of assumptions about its communications with the other processes in the network Safety properties of process communications, and progress properties such as finiteness and freedom from divergence can be proved An extension of P-A logic allowing proof of deadlock freedom is outlined Finally, proof rules for deriving some liveness properties of a program from its P-A logic specification are discussed; these properties have the form "Q until R", where Q, R are assertions over communication traces Other liveness properties may be derived from these properties using the rules of temporal logic

Mathai Joseph

Papers

Finding Response Times in a Real-Time System

Real-Time Systems: Specification, Verification, and Analysis

Transformation of programs for fault-tolerance

Specification and verification of fault-tolerance, timing, and scheduling

P-A logic: a compositional proof system for distributed programs