Monitoring for Deadlock and Blocking in Ada Tasking

An Ada tasking kernel is implemented as a layer beneath the Linux operating system. This provides low overhead and precise control of execution timing for real-time Ada tasks, which execute within the Linux kernel address space, while allowing the Linux operating system to execute non-real-time tasks in the background. The Ada tasking kernel is derived from Yodaiken's Real-Time Linux kernel, with new scheduling and synchronization primitives specifically to support the GNAT Ada runtime system. Implementing the Ada tasking primitives directly on the hardware does not just lower execution overhead and improve control over execution timing; it also opens the door for a simple restricted-tasking runtime system that could be certified for safety-critical applications.

This paper reports on the development of benchmarks and performance measures for parallel Ada tasking. The focus is on the macroscopic behavior of the benchmarks across a set of load parameters because parallel processing of Ada tasks involves complex ...

An Ada tasking kernel is implemented as a layer beneath the Linux operating system on a PC-compatible machine. This implementation is derived from Yodaiken's Real-Time Linux kernel, with new scheduling and synchronization primitives introduced specifically to support the GNAT Ada runtime system. Primitive operations for real-time Ada tasks are directly implemented on top of the underlying hardware in the form of a loadable Linux kernel module. This design not only reduces execution overhead and improves control over execution timing for tasks, but also opens the door for a simple restricted-tasking runtime system that could be certified for safety-critical applications.

This paper describes the application of behavior specifications to the testing of tasking supervisors, an important component of an implementation of a concurrent programming language. The goal of such testing is to determine whether or not a tasking supervisor correctly implements the semantics of its associated language. We have tested a distributed tasking supervisor for the Ada programming language by monitoring the execution behavior of Ada tasking programs that have been compiled and linked with the supervisor. This behavior is checked for consistency with an event-based formalization of the Ada tasking semantics expressed in the TSL specification language. The TSL Runtime System automatically performs all monitoring and consistency checking at runtime. Our approach improves upon other approaches to testing tasking supervisors, particularly the Ada Compiler Validation Capability (ACVC), and also an approach described by Klarund. In contrast with these other approaches, in our approach (1) we test only the behavior of the tasking supervisor, not the behavior of the test programs; and (2) any Ada tasking program may be employed as test data, because the TSL specifications we construct describe the semantics of Ada language statements, not the semantics of application programs.

A useless variable is one whose value contributes nothing to the final outcome of a computation. Such variables are unlikely to occur in human-produced code, but may be introduced by various program transformations. We would like to eliminate useless parameters from procedures and eliminate the corresponding actual parameters from their call sites. This transformation is the extension to higher-order programming of a variety of dead-code elimination optimizations that are important in compilers for first-order imperative languages.Shivers has presented such a transformation. We reformulate the transformation and prove its correctness. We believe that this correctness proof can be a model for proofs of other analysis-based transformations. We proceed as follows: We reformulate Shivers' analysis as a set of constraints; since the constraints are conditional inclusions, they can be solved using standard algorithms.We prove that any solution to the constraints is sound: that two computations that differ only on variables marked as useless give the same answer up to useless variables, and hence the same answer when the answer is a constant.We observe that this notion of soundness is too weak to support the transformation of the analyzed program. We add additional closure conditions to the analysis and show that any solution to the new set of constraints justifies the transformation. The proof is by tree surgery: we show that from any computation of the original program, we can construct a computation of the transformed program that yields an answer related to the original, and the same answer when the original answer is a constant.

In the article, we consider verification of programs with mutual recursion in the data driven functional parallel language Pifagor. In this language the program could be represented as a data flow graph, that has no control connections, and only has data relations. Under these conditions it is possible to simplify the process of formal verification, since there is no need to analyse resource conflicts, which are present in the systems with ordinary architectures. The proof of programs correctness is based on the elimination of mutual recursions by program transformation. The universal method of mutual recursion of an arbitrary number of functions elimination consists in constructing the universal recursive function that simulates all the functions in mutual recursion. A natural number is assigned to each function in mutual recursion. The universal recursive function takes as its argument the number of a function to be simulated and the arguments of this function. In some cases of the indirect recursion it is possible to use a simpler method of program transformation, namely, the merging of the functions code into a single function. To remove mutual recursion of an arbitrary number of functions, it is suggested to construct a graph of all connected functions and transform this graph by removing functions that are not connected with the target function, then by merging functions with indirect recursion and finally by constructing the universal recursive function. It is proved that in the Pifagor language such transformations of functions as code merging and universal recursive function construction do not change the correctness of the initial program. The example of partial correctness proof is given for the program that parses a simple arithmetic expression. We construct the graph of all connected functions and demonstrate two methods of proofs: by means of code merging and by means of the universal recursive function.

This paper describes a simple and efficient approach to implementing the Ada operations of entry calls, conditional and timed entry calls, accept statements, selective wait statements and delay statements. This is accomplished by describing the tasking supervisor -- a collection of programs which control the tasking operations. Ada definitions of the data structures and the supervisor procedures are given. The semantics of the Ada tasking operations are related to the supervisor by following the description of tasking in chapter 9 of the Reference Manual for the Ada Programming Language (1983). The structure of the object code for various Ada source language constructs is given. The interaction between the Ada object code and the run-time supervisor is described in detail. The remaining tasking opertions are described in Part 1 of this report (Riccardi and Baker 1984).

: This study investigated distributed applications written in the Ada programming language, in particular, the applications that are implemented on systems dissimilar in underlying hardware architecture and operating systems that require the exchange of data and control. The approach presented in this report rejects the suggestion of modifying both the Ada runtime environment and the Ada language itself to achieve distribution of real-time applications. Distribution can be achieved in the spirit of Ada without use of Ada's tasking features, through use of well-defined standard network or backplane interfaces through other Ada features such as packages and subprograms. The Ada programming language is mandated as the single high-order language used in implementing systems currently being delivered to the Department of Defense (DoD). Many of these systems are presently under development and are distributed in nature. The Ada programming language contains an abstract feature known as a task, which could lend itself to distribution.

This paper revisits the fundamental problem of monitoring the linearizability of concurrent stacks, queues, sets, and multisets. Given a history of a library implementing one of these abstract data types, the monitoring problem is to answer whether the given history is linearizable. For stacks, queues, and (multi)sets, we present monitoring algorithms with complexities ( n 2 ), ( n log n ), and ( n ), respectively, where n is the number of operations in the input history. For stacks and queues, our results hold under the standard assumption of data-independence , i.e., the behavior of the library is not sensitive to the actual values stored in the data structure. Past works to solve the same problems have cubic time complexity and (more seriously) have correctness issues: they either (i) lack correctness proofs or (ii) have unsound correctness proofs (we present counter-examples of the correctness proofs), or (iii) have unsound algorithms. Our improved complexity results rely on substantially different algorithms for which we provide detailed proofs of correctness. We have implemented our stack and queue algorithms in LiMo (Linearizability Monitor). We evaluate LiMo and compare it with the state-of-the-art tool Violin – whose correctness proofs we have found errors in – which checks for linearizability violations. Our experimental evaluation confirms that LiMo outperforms Violin regarding both efficiency and scalability.

Bottom-up evaluation and query optimization of well-founded models

This paper seeks to broaden the view of what programming is, who programs, and how programming fits in to larger systems. With growing frequency, people are approaching programming from unlikely backgrounds such as the arts. Often these new programmers bring with them ways of working which are incompatible with mainstream programming practices, but which allow for new possibilities in programming interfaces. This paper makes suggestions for the design of these new programming interfaces. It presents as a case study and demonstration Recursive Drawing. Recursive Drawing is a reimplementation of the textual programming language Context Free as a graphical, directly manipulable interface. Instead of a compiler or interpreter, Recursive Drawing's programming interface is modeled as a constraint solver. This allows the programmer to modify the program's source code by manipulating the program's output. Additionally, the design of the interface focuses on program transformation, rather than program construction.

Hardware Trojan detection via rewriting logic

Dataflow languages allow the specification of reactive systems by mutually recursive stream equations, functions, and boolean activation conditions called clocks. Lustre and Scade are dataflow languages for programming embedded systems. Dataflow programs are compiled by a succession of passes. This article focuses on the normalization pass which rewrites programs into the simpler form required for code generation. Vélus is a compiler from a normalized form of Lustre to CompCert’s Clight language. Its specification in the Coq interactive theorem prover includes an end-to-end correctness proof that the values prescribed by the dataflow semantics of source programs are produced by executions of generated assembly code. We describe how to extend Vélus with a normalization pass and to allow subsampled node inputs and outputs. We propose semantic definitions for the unrestricted language, divide normalization into three steps to facilitate proofs, adapt the clock type system to handle richer node definitions, and extend the end-to-end correctness theorem to incorporate the new features. The proofs require reasoning about the relation between static clock annotations and the presence and absence of values in the dynamic semantics. The generalization of node inputs requires adding a compiler pass to ensure the initialization of variables passed in function calls.

The advantages of tabled evaluation regarding program termination and reduction of complexity are well known —as are the significant implementation, portability, and maintenance efforts that some proposals (especially those based on suspension) require. This implementation effort is reduced by program transformation-based continuation call techniques, at some efficiency cost. However, the traditional formulation of this proposal [1] limits the interleaving of tabled and non-tabled predicates and thus cannot be used as-is for arbitrary programs. In this paper we present a complete translation for the continuation call technique which, while requiring the same runtime support as the traditional approach, solves these problems and makes it possible to execute arbitrary tabled programs. We also present performance results which show that the resulting CCall approach offers a useful tradeoff that can be competitive with other state-of-the-art implementations.KeywordsTabled logic programmingContinuation-call tablingImplementationPerformanceProgram transformation

An implementation of translators between Ada and Pascal is described. The method used is to define subsets of each language between which there is a straightforward translation and to translate each source program to its respective sublanguage by program transformations. A common internal tree representation is used. The underlying organization of the translators is described, and some of the difficulties we have confronted and solves are discussed.