Claude Kaiser

Scheduling in real-time systems

Introduction. 1. Basic Concepts. Real--time applications. Basic notions for real--time task scheduling. 2. Scheduling of Independent Tasks. Basic on--line algorithms for periodic tasks. Hybrid task sets scheduling. 3. Scheduling of Dependent Tasks. Tasks for precedence relationships. Tasks sharing critical resources. 4. Scheduling Schemes for Handling Overload. Scheduling techniques in overload conditions. Handling real--time tasks with varying timing parameters. Handling overload conditions for hybrid task sets. 5. Multiprocessor Scheduling. Introduction. First results and comparison with uniprocessor scheduling. Multiprocessor scheduling anomalies. Schedulability conditions. Scheduling algorithms. 6. Joint Scheduling of Tasks and Messages in Distributed Systems. Overview of distributed real--time systems. Task allocation in real--time distributed systems. Real--time traffic. Message scheduling. Conclusion. 7. Packet Scheduling in Networks. Introduction. Network and traffic models. Service disciplines. Work--conserving service disciplines. Non--work--conserving service disciplines. 8. Software Environment. Real--time operating system and real--time kernel. Real--time languages. Real--time middleware. Summary of scheduling capabilities of standardized components. 9. Case Studies. Real--time acquisition and analysis of rolling mill signals. Embedded real--time application: Mars Pathfinder mission. Distributed automotive application.

Quasar: a new tool for concurrent Ada programs analysis

Concurrency introduces a high degree of combinatory which may be the source of subtle mistakes. We present a new tool, Quasar, which is based on ASIS and which uses fully the concept of patterns. The analysis of a concurrent Ada program by our tool proceeds in four steps: automatic extraction of the concurrent part of the program; translation of the simplified program into a formal model using predefined patterns that are combined by substitution and merging constructors; analysis of the model both by structural techniques and model-checking techniques; reporting deadlock or starvation results. We demonstrate the usefulness of Quasar by analyzing several variations of a non trivial concurrent program.

Chameneos, a concurrency game for Java, Ada and others

Summary form only given. We present a peer-to-peer cooperation paradigm and several implementations. The paradigm is expressed as a game. The implementations are done in three different languages largely available today (Ada, Java and C with the Posix standard). This allows comparing their programming style and their ability to provide secure programs. Java and Ada are high level languages which allow concurrent programming. Both use the concept of monitor, but their implementation choices make them differ greatly. Posix offers low level system API for concurrent programming. First we present the application contexts in which this concurrency paradigm may be useful, and we summarize the concurrent programming structures of Java, Ada and Posix and finally the coloured Petri nets formalism. The possible colour mutation of chameneos are described. Their concurrent behaviour is specified and analyzed. This leads to the three announced implementations. From this case study, we deduce the strong and weak points of each approach and an appraisal of the concurrent parts of the languages. We end with some possible extensions.

Process management and resource sharing in the multiaccess system "ESOPE"

This paper describes the main design principles of the multiaccess system ESOPE. Emphasis is placed on basic ideas underlying the design rather than on implementation details. The main features of the system include the ability given to any user to schedule his own parallel processes, using system primitive operations, and the allocation/scheduling policy, which dynamically takes into account recent information about user behaviour.

Comparing Java, C# and Ada monitors queuing policies: a case study and its Ada refinement

Learning concurrency paradigms is necessary but it is not sufficient since the choice of run-time semantics may introduce subtle programming errors. It is the aim of this paper to exemplify the importance of process queuing and awaking policies resulting from possible choices of the monitor concept implementation.The first part of the paper compares the behaviour of concurrent processes sharing a unique waiting queue for condition synchronization when implemented in Java or in Ada. A particular solution of the dining philosophers paradigm will be used to show how the difference in the monitor semantics may lead or not to deadlock. This comparison provides insight for deriving a correct Java implementation. The second part of the paper shows how the implementation can be refined when using Ada entry families and requeue with requeue once restriction. The result is elegant, safe and fair, and deterministic. This paper ends with quantitative comparisons of concurrency complexity and of concurrency effectiveness.We conclude that Java and C# multithreading need defensive concurrent programming while Ada allows more latitude for developing correct concurrent programs.

Verifying linear time temporal logic properties of concurrent Ada programs with quasar

In this paper we present an original and useful way for specifying and verifying temporal properties of concurrent programs with our tool named Quasar. Quasar is based on ASIS and uses formal methods (model checking). Properties that can be checked are either general, like deadlock or fairness, or more context specific, referring to tasks states or to value of variables; properties are then expressed in temporal logic. In order to simplify the expression of these properties, we define some templates that can be instantiated with specific items of the programs. We demonstrate the usefulness of these templates by verifying subtle variations of the Peterson algorithm. Thus, although Quasar uses up-to-date formal methods it remains accessible to a large class of practitioners.

Comparing the reliability provided by tasks or protected objects for implementing a resource allocation service: a case study

We compare two possible implementations of a resource allocation service, one using a task server, the other using a protected object. Both make use of the requeue statement, the count attribute, and also the abort statement in order to satisfy requests, depending on the parameters passed in by the calling task and on the internal state of the service. Because the schema of requeue and entries has an execution semantic based on state and transition, it can be coupled easily with a proof in terms of colored Petri nets. We consider the dining philosophers problem, which is a good illustration of the need for a resource allocation service and for which deadlockand starvation-free implementations have already been given in Ada95, though not formally proven and sometimes unfair. We give an almost forgotten solution where the dining philosophers problem is safely implemented with protected objects, whereas its implementation with a server task leads to deadlock. We provide two implementations, one of which completes a solution presented by Brosgol in Ada Europe 96 and makes it really fair. Informal proofs are given and are confirmed by Petri nets proofs. Through these examples, we show that the eggshell semantics of protected objects are basic for attaining a reliable implementation.

Dynamic tasks verification with QUASAR

The inclusion of dynamic tasks modelisation in QUASAR, a tool for automatic analysis of concurrent programs, extends its applicative usefulness. However this extension leads to large size models whose processing has to face combinatory explosion of modeling states. This paper presents briefly Ada dynamic tasks semantic and dependences and then it explains the choice of an efficient generic modeling pattern. This implies to consider the naming, the hierarchy, the master retrieval, the termination of dynamic tasks and their synchronization dependences successively. The adequacy of both this modeling and the QUASAR techniques is highlighted by the analysis of two non-trivial Ada programs. The large reduction factor between the initial and final state numbers of these program models shows that the state explosion can be limited, making automatic validation of dynamic concurrent programs feasible.

Weak Fairness Semantic Drawbacks in Java Multithreading

With the development of embedded and mobile systems, Java is being widely used for application programs and is also considered for implementing systems kernel or application platforms. It is the aim of this paper to exemplify some subtle programming errors that may result from the process queuing and awaking policy, which corresponds to a weak fairness semantic and which has been chosen for implementing the monitor concept in this language. Two examples show some subtle deadlocks resulting from this policy. The first example deals with process synchronization: processes seeking after partners for a peer-to-peer communication call a symmetrical rendezvous server. The second example concerns resource sharing according to a solution of the dining philosophers paradigm. In this example, several implementations are presented, the last ones aiming to provide deterministic process awakening. All these examples have been validated and simulated and this allows comparing their concurrency complexity and effectiveness. Our conclusion is, first, that the use of Java for multithreading programming necessitates sometimes additional shielding code for developing correct programs and, second, that a good acquaintance with several styles of concurrent programming helps designing more robust Java solutions, once the choice of the implementation language is irrevocable.

Petri nets based proofs of Ada 95 solution for preference control

This paper presents correctness proofs of Ada 95 preference control solution for the dining philosophers paradigm. Preference control is the ability to satisfy a request depending on the parameters passed in by the calling task and often also on the internal state of the server. In Ada 95, this schema is implemented with protected objects, entry families and requeue statements within the protected object. Our aim is to show that the preference control can be described in terms of states and transitions, similar to reactive automaton descriptions. This description, which can be done in terms of colored Petri nets, can lead jointly to validate the chosen implementation and to program it with protected objects and requeue statements of Ada 95. The paper is issued from an examination exercise for our students that have followed a course on Programming and Validation of Concurrent Applications and is presented in form of progressive steps for which the students were expected to give answer. The paper contains three programmed solutions and proofs of absence of deadlock and of starvation.