We present HVM TP , a time predictable and portable Java Virtual Machine (JVM) implementation wit... more We present HVM TP , a time predictable and portable Java Virtual Machine (JVM) implementation with applications in resource-constrained, hard real-time embedded systems, which implements all levels of the Safety Critical Java (SCJ) specification. Time predictability is achieved by a combination of time predictable algorithms, exploiting the programming model of the SCJ profile, and harnessing static knowledge of the hosted SCJ system. This paper presents HVM TP in terms of its design and capabilities, and demonstrates how a complete timing model of the JVM represented as a Network of Timed Automata can be obtained using the tool TetaSARTS JVM. The timing model readily integrates with the rest of the TetaSARTS tool-set for temporal verification of SCJ systems. We will also show how a complete timing scheme in terms of safe worst case execution times and best case execution times of the Java bytecodes can be derived from the model. Furthermore, we take a first look at how to support the new Java 8 language feature of Lambda expressions in a SCJ context-we look in particular at how the invokedynamic bytecode can be implemented in a time predictable way and integrated in HVM TP .
Fig. 4: Resulting NTA. TetaSARTS is a fully automated tool for conduct- ing timing analyses of SC... more Fig. 4: Resulting NTA. TetaSARTS is a fully automated tool for conduct- ing timing analyses of SCJ Java Bytecode pro- grams taking into account the execution environ- ment (see Fig. 3 for an overview). It accommo- dates hardware implementations of the JVM, and traditional execution environments with a software implementation of the JVM including the hosting hardware. It supports both periodic and sporadic real-time tasks, and from these, it generates Timed Automata simulating their control flow. The struc- ture of the model and the communication between the Timed Automata using synchronisation actions is shown in Fig. 4. The analyses are performed us- ing the Uppaal model checker.
We give an operational semantics for the evaluation of spreadsheets, including sheet-defined and ... more We give an operational semantics for the evaluation of spreadsheets, including sheet-defined and built-in numeric functions in the Funcalc spreadsheet platform. The semantics allows for different implementations and we discuss sheet-defined functions implemented using both interpretation and run-time code generation. The semantics specifies the expected result of a computation, also considering non-deterministic functions, independently of an evaluation mechanism. It can be extended to include the cost of formula evaluation for a cost analysis e.g. for use in parallelization of computations. An interesting future direction is to investigate experimentally how close our semantics is to that of major spreadsheet implementations. in cell A1 and formula =A2*A3 in cell A4. The sumproduct function
The emergence of agent based systems is signalling the beginning of one of the most important par... more The emergence of agent based systems is signalling the beginning of one of the most important paradigm shifts in computing since object oriented methods and client/server based distributed systems. This paradigm shift will obviously require technology development, but of equal importance, or perhaps of even more importance, it will also require substantial education and methodology development. It is not hard to predict that agent technology is an important emerging technology, since it is already beginning to send shock waves through the computer industry. In the current hype, however, it is particularly difficult to distinguish publicity from reality and to get a clear impression of what agents are all about. In this paper we will try to give a comprehensive overview of what mobile agents are, what they may be used for and what the technical issues are.
Firm Deadline Checking of Safety-Critical Java Applications with Statistical Model Checking
In cyber-physical applications many programs have hard real-time constraints that have to be stri... more In cyber-physical applications many programs have hard real-time constraints that have to be stringently validated. In some applications, there are programs that have hard deadlines, which must not be violated. Other programs have soft deadlines where the value of the response decreases when the deadline is passed although it is still a valid response. In between, there are programs with firm deadlines. Here the response may be occasionally delayed; but this should not happen too often or with too large an overshoot. This paper presents an extension to an existing approach and tool for checking hard deadline constraints to the case of firm deadlines for application programs written in Safety-Critical Java (SCJ). The existing approach uses models and model checking with the Uppaal toolset; the extension uses the statistical model checking features of Uppaal-smc to provide a hold on firm deadlines and performance in the case of soft deadlines. The extended approach is illustrated with...
In this paper we briefly report on work in the Popular Parallel Programming (P3) project where we... more In this paper we briefly report on work in the Popular Parallel Programming (P3) project where we follow in the footsteps of Bernhard Steffen using the idea of program analysis via model checking and abstract interpretation. The programs we analyze are spreadsheet programs, which for long have been identified as an ideal programming model for parallel execution. We translate spreadsheet programs into Timed Automata Models, which may be analyzed by the Uppaal model checker and its derivatives, with the purpose of finding schedules for parallel execution. In this paper we mainly focus on the techniques and scalability issues of various variants of Uppaal, but also report briefly on the performance results achieved through the parallelization.
We give a simple but precise operational semantics for the evaluation of extended spreadsheet for... more We give a simple but precise operational semantics for the evaluation of extended spreadsheet formulas, with array formulas, sheet-defined functions and closures, as found in the Funcalc spreadsheet platform [1]. We build on this to give a simple cost semantics, inspired by [2], for evaluation of a spreadsheet formula and for full and minimal recalculation of a spreadsheet. Following the ideas presented by Schmidt [3] we provide a big-step trace-based abstract interpretation for the cost semantics. We then present a set of functions which can be used to calculate the cost of executing an evaluation of a spreadsheet expression following Gomez et al. [4], inspired by Rosendahl [5]. These functions are related to the above operational semantics, cost semantics and abstract interpretation. The above semantic presentations all form the formal foundations for various cost calculations implemented in the Funcalc spreadsheet platform. These calculations are evaluated experimentally.
SummIT'06 27 March 2006 RJD 2 Ravenscar-Java Development • The purpose of the project – imple... more SummIT'06 27 March 2006 RJD 2 Ravenscar-Java Development • The purpose of the project – implement the Ravenscar-Java Profile on the aJ-100 processor – find out to what extent Real-Time UML with advantage can be applied when designing embedded real-time systems – investigate through development of an industrial case how useful the Ravenscar-Java Profile is for design and development of industrial embedded systems with real-time requirements – compare the Ravenscar-Java solution with a C++ solution.
Page 1. Syntax and Semantics of Pi in the Sky Calculus John ... replication. Milner shows that co... more Page 1. Syntax and Semantics of Pi in the Sky Calculus John ... replication. Milner shows that conditional computation may be modelled without a match operation and that parametric definitions can be (weakly) simulated by replication. ...
Programming Languages with Applications to Biology and Security, 2015
The idea of analysing real programs by process algebraic methods probably goes back to the Occam ... more The idea of analysing real programs by process algebraic methods probably goes back to the Occam language using the CSP process algebra [43]. In [16, 24] Degano et. al. followed in that tradition by analysing Mobile Agent Programs written in the Higher Order Functional, Concurrent and Distributed, programming language Facile [47], by equipping Facile with a process algebraic semantics based on true concurrency. This semantics facilitated analysis of programs revealing subtle bugs that would otherwise be very hard to find. Inspired by the idea of translating real programs into process algebraic frameworks, we have in recent years pursued an agenda of translating hard-real-time embedded safety critical programs written in the Safety Critical Java Profile [33] into networks of timed automata [4] and subjecting those to automated analysis using the UPPAAL model checker [10]. Several tools have been built and the tools have been used to analyse a number of systems for properties such as worst case execution time, schedulability and energy optimization [14, 12, 13, 19, 38, 36, 34]. In this paper we will elaborate on the theoretical underpinning of the translation from Java programs to timed automata models and briefly summarize some of the results based on this translation. Furthermore, we discuss future work, especially relations to the work in [16, 24] as Java recently has adopted first class higher order functions in the form of lambda abstractions.
This paper presents the implementation of novel seamless indoor/outdoor positioning service for m... more This paper presents the implementation of novel seamless indoor/outdoor positioning service for mobile users. When users are not within GPS range, the service exploits the wifi access point infrastructure for positioning. A central server stores wifi radio maps and map images that are then sent to user terminals based on the mac addresses of nearby access points. The positioning services is available in Streamspin (www.streamspin.com), which is an open and scalable plat-form for the creation and delivery of location-based services. With this new service, the system enables the easy creation and deployment of mobile services that rely on seamless in-door/outdoor positioning. 1.
We describe an experimental object-oriented programming language, ASL2, that supports program dev... more We describe an experimental object-oriented programming language, ASL2, that supports program development by means of a series of abstraction steps. The language allows immediate object construction, and it is possible to use the constructed objects for concrete problem solving tasks. Classes and class hierarchies can be derived from the objects- via gradual abstraction steps. We introduce two levels of object classification, called weak and strong object classification. Strong object classification relies on conventional classes, whereas weak object classification is looser, and less restrictive. As a central mechanism, weakly classified objects are allowed to borrow methods from each other. ASL2 supports class generalization, as a counterpart to class specialization and inheritance in mainstream object-oriented programming languages. The final abstraction step discussed in this paper is a syntactical abstraction step that derives a source file with a syntactical class form.
We explore the (dynamic) semantics of a simply typedcalculus enriched with parallel composition, ... more We explore the (dynamic) semantics of a simply typedcalculus enriched with parallel composition, dynamic channel generation, and input-output communication primitives. The calculus, called the kcalculus, can be regarded as the kernel of concurrent-functional languages such as LCS, CML and Facile, and it can be taken as a basis for the definition of abstract machines, the transformation of programs, and the development of modal speci cation languages. The main technical contribution of this paper is the proof of adequacy of a compact translation of the k-calculus into the-calculus.
Mobile agents, i.e. pieces of programs that can be sent around networks of computers, are startin... more Mobile agents, i.e. pieces of programs that can be sent around networks of computers, are starting to appear on the Internet. Such programs may be seen as an enrichment of traditional distributed computing. Since mobile agents may carry communication links with them as they move across the network, they create very dynamic interconnection structures that can be extremely complex to analyse. In this paper we study an example of a system based on the mobile agent principle written in the Facile programming language. We propose a Structural Operational Semantics (SOS) for Facile, giving a proved transition system that records encodings of the derivation trees of transitions in their labels. This information allows us to easily recover noninterleaving semantics for Facile by looking only at the labels of transitions. We use the new Facile semantics to debug an agent based system. This example is a scaled down version of a system demonstrated at the European IT Conference Exhibition in B...
The Java programming language has recently received much attention in the real-time systems commu... more The Java programming language has recently received much attention in the real-time systems community as evidenced by the wide variety of initiatives, including the Real-Time Specification for Java[8], and related real-time profiles such as Safety-Critical Java[6], and Predictable Java[3]. All of these focus on establishing a programming model appropriate for real-time systems development. The motivation for the profiles has been to further tightening the semantics, for accommodating static analyses, such as Worst Case Execution Time (WCET) analysis that serves an integral role in proving temporal correctness. Evidently, the presence of the Java Virtual Machine (JVM) adds to the complexity of performing WCET analysis. To reduce the complexity, a direction of research has focused on implementing the JVM directly in hardware[9]. To further extend the applicability of real-time Java, we want to allow software implementations of the JVM executed on common embedded hardware, such as ARM ...
We present HVM TP , a time predictable and portable Java Virtual Machine (JVM) implementation wit... more We present HVM TP , a time predictable and portable Java Virtual Machine (JVM) implementation with applications in resource-constrained, hard real-time embedded systems, which implements all levels of the Safety Critical Java (SCJ) specification. Time predictability is achieved by a combination of time predictable algorithms, exploiting the programming model of the SCJ profile, and harnessing static knowledge of the hosted SCJ system. This paper presents HVM TP in terms of its design and capabilities, and demonstrates how a complete timing model of the JVM represented as a Network of Timed Automata can be obtained using the tool TetaSARTS JVM. The timing model readily integrates with the rest of the TetaSARTS tool-set for temporal verification of SCJ systems. We will also show how a complete timing scheme in terms of safe worst case execution times and best case execution times of the Java bytecodes can be derived from the model. Furthermore, we take a first look at how to support the new Java 8 language feature of Lambda expressions in a SCJ context-we look in particular at how the invokedynamic bytecode can be implemented in a time predictable way and integrated in HVM TP .
Fig. 4: Resulting NTA. TetaSARTS is a fully automated tool for conduct- ing timing analyses of SC... more Fig. 4: Resulting NTA. TetaSARTS is a fully automated tool for conduct- ing timing analyses of SCJ Java Bytecode pro- grams taking into account the execution environ- ment (see Fig. 3 for an overview). It accommo- dates hardware implementations of the JVM, and traditional execution environments with a software implementation of the JVM including the hosting hardware. It supports both periodic and sporadic real-time tasks, and from these, it generates Timed Automata simulating their control flow. The struc- ture of the model and the communication between the Timed Automata using synchronisation actions is shown in Fig. 4. The analyses are performed us- ing the Uppaal model checker.
We give an operational semantics for the evaluation of spreadsheets, including sheet-defined and ... more We give an operational semantics for the evaluation of spreadsheets, including sheet-defined and built-in numeric functions in the Funcalc spreadsheet platform. The semantics allows for different implementations and we discuss sheet-defined functions implemented using both interpretation and run-time code generation. The semantics specifies the expected result of a computation, also considering non-deterministic functions, independently of an evaluation mechanism. It can be extended to include the cost of formula evaluation for a cost analysis e.g. for use in parallelization of computations. An interesting future direction is to investigate experimentally how close our semantics is to that of major spreadsheet implementations. in cell A1 and formula =A2*A3 in cell A4. The sumproduct function
The emergence of agent based systems is signalling the beginning of one of the most important par... more The emergence of agent based systems is signalling the beginning of one of the most important paradigm shifts in computing since object oriented methods and client/server based distributed systems. This paradigm shift will obviously require technology development, but of equal importance, or perhaps of even more importance, it will also require substantial education and methodology development. It is not hard to predict that agent technology is an important emerging technology, since it is already beginning to send shock waves through the computer industry. In the current hype, however, it is particularly difficult to distinguish publicity from reality and to get a clear impression of what agents are all about. In this paper we will try to give a comprehensive overview of what mobile agents are, what they may be used for and what the technical issues are.
Firm Deadline Checking of Safety-Critical Java Applications with Statistical Model Checking
In cyber-physical applications many programs have hard real-time constraints that have to be stri... more In cyber-physical applications many programs have hard real-time constraints that have to be stringently validated. In some applications, there are programs that have hard deadlines, which must not be violated. Other programs have soft deadlines where the value of the response decreases when the deadline is passed although it is still a valid response. In between, there are programs with firm deadlines. Here the response may be occasionally delayed; but this should not happen too often or with too large an overshoot. This paper presents an extension to an existing approach and tool for checking hard deadline constraints to the case of firm deadlines for application programs written in Safety-Critical Java (SCJ). The existing approach uses models and model checking with the Uppaal toolset; the extension uses the statistical model checking features of Uppaal-smc to provide a hold on firm deadlines and performance in the case of soft deadlines. The extended approach is illustrated with...
In this paper we briefly report on work in the Popular Parallel Programming (P3) project where we... more In this paper we briefly report on work in the Popular Parallel Programming (P3) project where we follow in the footsteps of Bernhard Steffen using the idea of program analysis via model checking and abstract interpretation. The programs we analyze are spreadsheet programs, which for long have been identified as an ideal programming model for parallel execution. We translate spreadsheet programs into Timed Automata Models, which may be analyzed by the Uppaal model checker and its derivatives, with the purpose of finding schedules for parallel execution. In this paper we mainly focus on the techniques and scalability issues of various variants of Uppaal, but also report briefly on the performance results achieved through the parallelization.
We give a simple but precise operational semantics for the evaluation of extended spreadsheet for... more We give a simple but precise operational semantics for the evaluation of extended spreadsheet formulas, with array formulas, sheet-defined functions and closures, as found in the Funcalc spreadsheet platform [1]. We build on this to give a simple cost semantics, inspired by [2], for evaluation of a spreadsheet formula and for full and minimal recalculation of a spreadsheet. Following the ideas presented by Schmidt [3] we provide a big-step trace-based abstract interpretation for the cost semantics. We then present a set of functions which can be used to calculate the cost of executing an evaluation of a spreadsheet expression following Gomez et al. [4], inspired by Rosendahl [5]. These functions are related to the above operational semantics, cost semantics and abstract interpretation. The above semantic presentations all form the formal foundations for various cost calculations implemented in the Funcalc spreadsheet platform. These calculations are evaluated experimentally.
SummIT'06 27 March 2006 RJD 2 Ravenscar-Java Development • The purpose of the project – imple... more SummIT'06 27 March 2006 RJD 2 Ravenscar-Java Development • The purpose of the project – implement the Ravenscar-Java Profile on the aJ-100 processor – find out to what extent Real-Time UML with advantage can be applied when designing embedded real-time systems – investigate through development of an industrial case how useful the Ravenscar-Java Profile is for design and development of industrial embedded systems with real-time requirements – compare the Ravenscar-Java solution with a C++ solution.
Page 1. Syntax and Semantics of Pi in the Sky Calculus John ... replication. Milner shows that co... more Page 1. Syntax and Semantics of Pi in the Sky Calculus John ... replication. Milner shows that conditional computation may be modelled without a match operation and that parametric definitions can be (weakly) simulated by replication. ...
Programming Languages with Applications to Biology and Security, 2015
The idea of analysing real programs by process algebraic methods probably goes back to the Occam ... more The idea of analysing real programs by process algebraic methods probably goes back to the Occam language using the CSP process algebra [43]. In [16, 24] Degano et. al. followed in that tradition by analysing Mobile Agent Programs written in the Higher Order Functional, Concurrent and Distributed, programming language Facile [47], by equipping Facile with a process algebraic semantics based on true concurrency. This semantics facilitated analysis of programs revealing subtle bugs that would otherwise be very hard to find. Inspired by the idea of translating real programs into process algebraic frameworks, we have in recent years pursued an agenda of translating hard-real-time embedded safety critical programs written in the Safety Critical Java Profile [33] into networks of timed automata [4] and subjecting those to automated analysis using the UPPAAL model checker [10]. Several tools have been built and the tools have been used to analyse a number of systems for properties such as worst case execution time, schedulability and energy optimization [14, 12, 13, 19, 38, 36, 34]. In this paper we will elaborate on the theoretical underpinning of the translation from Java programs to timed automata models and briefly summarize some of the results based on this translation. Furthermore, we discuss future work, especially relations to the work in [16, 24] as Java recently has adopted first class higher order functions in the form of lambda abstractions.
This paper presents the implementation of novel seamless indoor/outdoor positioning service for m... more This paper presents the implementation of novel seamless indoor/outdoor positioning service for mobile users. When users are not within GPS range, the service exploits the wifi access point infrastructure for positioning. A central server stores wifi radio maps and map images that are then sent to user terminals based on the mac addresses of nearby access points. The positioning services is available in Streamspin (www.streamspin.com), which is an open and scalable plat-form for the creation and delivery of location-based services. With this new service, the system enables the easy creation and deployment of mobile services that rely on seamless in-door/outdoor positioning. 1.
We describe an experimental object-oriented programming language, ASL2, that supports program dev... more We describe an experimental object-oriented programming language, ASL2, that supports program development by means of a series of abstraction steps. The language allows immediate object construction, and it is possible to use the constructed objects for concrete problem solving tasks. Classes and class hierarchies can be derived from the objects- via gradual abstraction steps. We introduce two levels of object classification, called weak and strong object classification. Strong object classification relies on conventional classes, whereas weak object classification is looser, and less restrictive. As a central mechanism, weakly classified objects are allowed to borrow methods from each other. ASL2 supports class generalization, as a counterpart to class specialization and inheritance in mainstream object-oriented programming languages. The final abstraction step discussed in this paper is a syntactical abstraction step that derives a source file with a syntactical class form.
We explore the (dynamic) semantics of a simply typedcalculus enriched with parallel composition, ... more We explore the (dynamic) semantics of a simply typedcalculus enriched with parallel composition, dynamic channel generation, and input-output communication primitives. The calculus, called the kcalculus, can be regarded as the kernel of concurrent-functional languages such as LCS, CML and Facile, and it can be taken as a basis for the definition of abstract machines, the transformation of programs, and the development of modal speci cation languages. The main technical contribution of this paper is the proof of adequacy of a compact translation of the k-calculus into the-calculus.
Mobile agents, i.e. pieces of programs that can be sent around networks of computers, are startin... more Mobile agents, i.e. pieces of programs that can be sent around networks of computers, are starting to appear on the Internet. Such programs may be seen as an enrichment of traditional distributed computing. Since mobile agents may carry communication links with them as they move across the network, they create very dynamic interconnection structures that can be extremely complex to analyse. In this paper we study an example of a system based on the mobile agent principle written in the Facile programming language. We propose a Structural Operational Semantics (SOS) for Facile, giving a proved transition system that records encodings of the derivation trees of transitions in their labels. This information allows us to easily recover noninterleaving semantics for Facile by looking only at the labels of transitions. We use the new Facile semantics to debug an agent based system. This example is a scaled down version of a system demonstrated at the European IT Conference Exhibition in B...
The Java programming language has recently received much attention in the real-time systems commu... more The Java programming language has recently received much attention in the real-time systems community as evidenced by the wide variety of initiatives, including the Real-Time Specification for Java[8], and related real-time profiles such as Safety-Critical Java[6], and Predictable Java[3]. All of these focus on establishing a programming model appropriate for real-time systems development. The motivation for the profiles has been to further tightening the semantics, for accommodating static analyses, such as Worst Case Execution Time (WCET) analysis that serves an integral role in proving temporal correctness. Evidently, the presence of the Java Virtual Machine (JVM) adds to the complexity of performing WCET analysis. To reduce the complexity, a direction of research has focused on implementing the JVM directly in hardware[9]. To further extend the applicability of real-time Java, we want to allow software implementations of the JVM executed on common embedded hardware, such as ARM ...
Uploads
Papers by Bent Thomsen