James J. Hunt

Renaming detection

Finding changed identifiers is important for understanding the difference between two versions of a program and for detecting and resolving conflicts while merging variants of a program together. Standard practice for differencing and merging relies on line based techniques that do not recognize renamed identifiers. The design and implementation of a tool to automatically detect renamed identifiers between two versions of a program is presented. The system uses an abstract representation of language constructs to enable language awareness without introducing language dependence. Modules for Java and Scheme have been written. The detector works with multiple file pairs, taking into account renamings that span several files. A case study is presented that demonstrates proof of concept. The detector is part of a suite of intelligent differencing and merging programs that exploit the static semantics of programming languages.

Implicit ownership types for memory management

The Real-time Specification for Java (RTSJ) introduced a range of language features for explicit memory management. While the RTSJ gives programmers fine control over memory use and allows linear allocation and constant-time deallocation, the RTSJ relies upon dynamic runtime checks for safety, making it unsuitable for safety critical applications. We introduce ScopeJ, a statically-typed, multi-threaded, object calculus in which scopes are first class constructs. Scopes reify allocation contexts and provide a safe alternative to automatic memory management. Safety follows from the use of an ownership type system that enforces a topology on run-time patterns of references. ScopeJs type system is novel in that ownership annotations are implicit. This substantially reduces the burden for developers and increases the likelihood of adoption. The notion of implicit ownership is particularly appealing when combined with pluggable type systems, as one can apply different type constraints to different components of an application depending on the requirements without changing the source language. In related work we have demonstrated the usefulness of our approach in the context of highly-responsive systems and stream processing.

HIDOORS - a high integrity distributed deterministic Java environment

This paper presents the design of HIDOORS, an integrated development environment suitable for embedded distributed real-time systems, based on the Java programming language. HIDOORS will cover all the life-cycle of real-time software development with extensions to existing tools (UML modeling, Java compiler Java Virtual Machine, and a worst case execution time analysis tool) that will all be integrated into a single integrated development environment. The system will also assist the developer in distributing the application, by providing faster RMI and a distributed event manager that provides strict timing guarantees. This paper is written at the beginning of HIDOORS development, and as such, it presents only, the defined objectives and the early, architecture of the system; further developments will be the Subject of future works.

Provably correct loops bounds for realtime Java programs

Determining concrete bounds for loops is one of the more vexing problems of resource analysis of realtime programs. Current mechanisms are limited in scope and require considerable user input that can not be verified. The authors present a methodology for providing more general loop bounds where the correctness can be demonstrated with formal techniques. The methodology combines data flow analysis and deductive formal verification to attain this goal.

A case study of specification and verification using JML in an avionics application

The literature for deductive formal verification is quite rich; however, very few case studies have been done. The authors present a case study of using deductive formal verification of a navigation system from the avionics domain. Both writing the specifications and their verification with a runtime assertion checker and KEY, a tool using automatic theorem proving techniques for verifying JAVA programs, are covered.

Using global data flow analysis on bytecode to aid worst case execution time analysis for real-time Java programs

Though real-time Java offers significant advantages over other programming languages for safe programming, the analysis of worst case execution of real-time Java programs is considerably more difficult. The extra complexity can be addressed using a minimal set of parameterized annotations and data flow analysis to provide a standard worst case execution time analysis tool with the additional information necessary to determine the worst case execution time analysis of real-time Java programms. This methodology has the advantage over existing methods in that it is equally applicable to general purpose library code as to application specific implementation code.

Issues in building an ANRTS platform

The HIJA initiative is currently working on creating the technology conditions to achieve architecture neutrality for real-time systems. To this end it has developed a number of profiles based on RTSJ and developed a number of proofs of concept. In doing so, HIJA came across a number of integration issues which are not specific to the chosen technologies, and therefore need to be addressed by the embedded systems technology community in the large. This paper reports on the following issues: (1) integration in the software engineering process, (2) integration of an architecture neutral platform with an underlying RTOS, and (3) provision of QoS for multiple independent applications.

Safety-Critical Java: The Mission Approach

Safety-Critical Java is designed to simplify the runtime environment and code generation model for safety-critical applications compared with conventional Java, as well as improve the reuse and modular composability of independently developed software components and their corresponding certification artifacts. While the conventional object-oriented abstractions provided by the Java language already enable strong separation of concerns for passive components such as subroutines and data structures, safety-critical Java’s Mission abstraction generalizes these encapsulation benefits to the domain of active software components.Example active components that can be built as a Mission include device drivers, network communication stacks, plotting of RADAR and SONAR data, track management of RADAR and SONAR plots, and implementation of graphic user interfaces. These various active software components will likely be reused, reconfigured, and combined in different ways for different applications. Each safety-critical mission is comprised of one or more logical threads of execution which are generally structured as a set of periodic event handlers, asynchronous event handlers, and no-heap realtime threads.The Safety-Critical Java specification enforces strong separation of concerns between independently developed missions. And outer-nested missions are never allowed to access the data contained within inner-nested missions. A safety-critical Java application consists of one or more missions running in sequence or concurrently. This chapter introduces the concept of Safety-Critical Java Missions and motivates their use as a tool for software engineering abstraction.

Graph transforming java data

This paper introduces an approach for adding graph transformation-based functionality to existing Java programs. The approach relies on a set of annotations to identify the intended graph structure, as well as on user methods to manipulate that structure, within the users own Java class declarations. Other ingredients are a custom transformation language, called Chart, and a compiler from Chart to Java. The generated Java code runs against the pre-existing, annotated code. The advantage of the approach is that it allows any Java program to be enhanced, non invasively, with declarative graph rules, improving clarity, conciseness and verifiability.

Programming Embedded Systems: Interacting with the Embedded Platform

Interacting with the underlying platform and its environment is one of the key activities for embedded programs. This chapter focuses on how real-time Java programs can access the platform’s physical memory so that it can maximize performance, and how it can interface with external devices. The revised physical and raw memory frameworks of Version 1.1. of the Real-Time Specification for Java are introduced along with the revised happening model. The latter now includes facilities to program first-level interrupt handlers. An extended example illustrates how many of the facilities can be used.