Jens Palsberg

Avrora: scalable sensor network simulation with precise timing

Simulation can be an important step in the development of software for wireless sensor networks and has been the subject of intense research in the past decade. While most previous efforts in simulating wireless sensor networks have focused on protocol-level issues utilizing models of the software implementation, a significant challenge remains in precisely measuring time-dependent properties such as radio channel utilization. One promising approach, first demonstrated by ATEMU, is to simulate the behavior of sensor network programs at the machine code level with cycle-accuracy, but poor performance has so far limited its scalability. In this paper we present Avrora, a cycle-accurate instruction-level sensor network simulator which scales to networks of up to 10,000 nodes and performs as much as 20 times faster than previous simulators with equivalent accuracy, handling as many as 25 nodes in real-time. We show how an event queue can enable efficient instruction-level simulation of microcontroller programs and allow the hidden parallelism in finegrained sensor network simulations to be extracted, once two core synchronization problems are identified and solved. Avroras ability to measure detailed time-critical phenomena can shed new light on design Issues for large-scale sensor networks.

Object-oriented type inference

We present a new approach to inferring types in untyped object-oriented programs with inheritance, assignments, and late binding. It guarantees that all messages are understood, annotates the program with type information, allows polymorphic methods, and can be used as the basis of an optimizing compiler. Types are finite sets of classes and subtyping is set inclusion. Using a trace graph, our algorithm constructs a set of conditional type constraints and computes the least solution by least fixed-point derivation.

Scalable propagation-based call graph construction algorithms

Propagation-based call graph construction algorithms have been studied intensively in the 199Os, and differ primarily in the number of sets that are used to approximate run-time values of expressions. In practice, algorithms such as RTA that use a single set for the whole program scale well. The scalability of algorithms such as 0-CFA that use one set per expression remains doubtful.In this paper, we investigate the design space between RTA and 0-CFA. We have implemented various novel algorithms in the context of Jax, an application extractor for Java, and shown that they all scale to a 325,000-line program. A key property of these algorithms is that they do not analyze values on the run-time stack, which makes them efficient and easy to implement. Surprisingly, for detecting unreachable methods, the inexpensive RTA algorithm does almost as well as the seemingly more powerful algorithms. However, for determining call sites with a single target, one of our new algorithms obtains the current best tradeoff between speed and precision.

A denotational semantics of inheritance and its correctness

This paper presents a denotational model of inheritance. The model is based on an intuitive motivation of the purpose of inheritance. The correctness of the model is demonstrated by proving it equivalent to an operational semantics of inheritance based upon the method-lookup algorithm of object-oriented languages. Although it was originally developed to explain inheritance in object-oriented languages, the model shows that inheritance is a general mechanism that may be applied to any form of recursive definition.

The essence of the Visitor pattern

For object-oriented programming, the Visitor pattern enables the definition of a new operation on an object structure without changing the classes of the objects. The price has been that the set of classes must be fixed in advance, and they must each have a so-called accept method. In this paper we demonstrate how to program visitors without relying on accept methods and without knowing all classes of the objects in advance. The idea, derived from related work on shape polymorphism in functional programming, is to separate (1) accessing subobjects, and (2) acting on them. In the object-oriented setting, reflection techniques support access to sub-objects, as demonstrated in our Java class, Walkabout. It supports all visitors as subclasses, and they can be programmed without any further use of reflection. Thus a program using the Visitor pattern can now be understood as a specialized version of a program using the Walkabout class.

Experience with software watermarking

There are at least four US patents on software watermarking, and an idea for further advancing the state of the art was presented by C. Collberg and C. Thomborsen (1999). The new idea is to embed a watermark in dynamic data structures, thereby protecting against many program-transformation attacks. Until now there have been no reports on practical experience with this technique. We have implemented and experimented with a watermarking system for Java based on the ideas of Collberg and Thomborsen. Our experiments show that watermarking can be done efficiently with moderate increases in code size, execution times and heap-space usage, while making the watermarked code resilient to a variety of program-transformation attacks. For a particular representation of watermarks, the time to retrieve a watermark is on the order of one minute per megabyte of heap space. Our implementation is not designed to resists all possible attacks; to do that, it should be combined with other protection techniques, such as obfuscation and tamperproofing.

Concurrent Collections

We introduce the Concurrent Collections (CnC) programming model. CnC supports flexible combinations of task and data parallelism while retaining determinism. CnC is implicitly parallel, with the user providing high-level operations along with semantic ordering constraints that together form a CnC graph. We formally describe the execution semantics of CnC and prove that the model guarantees deterministic computation. We evaluate the performance of CnC implementations on several applications and show that CnC offers performance and scalability equivalent to or better than that offered by lower-level parallel programming models.

Complexity results for 1-safe nets

We study the complexity of several standard problems for 1-safe Petri nets and some of its subclasses. We prove that reachability, liveness, and deadlock are all PSPACE-complete for 1-safe nets. We also prove that deadlock is NP-complete for free-choice nets and for 1-safe free-choice nets. Finally, we prove that for arbitrary Petri nets, deadlock is equivalent to reachability and liveness.

Encapsulating objects with confined types

Object-oriented languages provide little support for encapsulating objects. Reference semantics allows objects to escape their defining scope. The pervasive aliasing that ensues remains a major source of software defects. This paper introduces Kacheck/J a tool for inferring object encapulation properties in large Java programs. Our goal is to develop practical tools to assist software engineers, thus we focus on simple and scalable techniques. Kacheck/J is able to infer confinement for Java classes. A class and its sublasses are confined if all of their instances are encapsulated in their defining package. This simple property can be used to identify accidental leaks of sensitive objects. The analysis is scalable and efficient; Kacheck/J is able t infer confinement on a corpus of 46,000 classes (115 MB) in 6 minutes

Static checking of interrupt-driven software

Resource-constrained devices are becoming ubiquitous. Examples include cell phones, Palm Pilots and digital thermostats. It can be difficult to fit the required functionality into such a device without sacrificing the simplicity and clarity of the software. Increasingly complex embedded systems require extensive brute-force testing, making development and maintenance costly. This is particularly true for system components that are written in assembly language. Static checking has the potential of alleviating these problems, but until now there has been little tool support for programming at the assembly level. In this paper, we present the design and implementation of a static checker for interrupt-driven Z86-based software with hard real-time requirements. For six commercial microcontrollers, our checker has produced upper bounds on interrupt latencies and stack sizes, as well as verified fundamental safety and liveness properties. Our approach is based on a known algorithm for the model checking of pushdown systems and produces a control-flow graph annotated with information about time, space, safety and liveness. Each benchmark is approximately 1000 lines of code, and the checking is done in a few seconds on a standard PC. Our tool is one of the first to give an efficient and useful static analysis of assembly code. It enables increased confidence in code correctness, significantly reduced testing requirements and support for maintenance throughout the system life-cycle.