Search

SystemJ is a programming language based on the Globally Asynchronous Locally Synchronous (GALS) Model of Computation (MoC) used to design safety critical hard real-time systems. SystemJ uses the Java programming language as the “host” language, for carrying out data computations, because Java provides clearly defined operational semantics, type and memory safety in the form of the Garbage Collector(GC), which help with formal functional verification. The same GC, which helps in functional verification, makes Worst Case Reaction Time (WCRT) 1 analysis challenging. Any WCRT analysis framework for GALS programs needs to consider the operations performed by the host language. It has been shown that the worst case time estimates for garbage collection cycles are in seconds, whereas the program’s WCRT itself is in micro-seconds. These pessimistic estimates render the WCRT analysis framework ineffective. In order to overcome this problem, we develop a compiler assisted memory management technique for applications written in SystemJ. The SystemJ MoC plays the central role in the proposed technique. The SystemJ MoC allows clearly demarcating the state boundaries of the program, which in turn allows us to partition the heap, at compile time, into two distinct areas: (1) the memory area called the permanent heap, which holds objects that are alive throughout the life time of the application, and (2) the memory area used to hold all other objects, called the transient heap. The size of these memory areas are bounded statically. Furthermore, the memory allocation and reclaim procedures are simple load and pointer reset operations, respectively, which are guaranteed to complete within a bounded number of clock-cycles, thereby alleviating the need for large pessimistic WCRT bounds obtained due to the GC. Experimental results also show that the proposed approach is approximately three times faster, in terms of memory allocation times as compared to standard real-time GC approaches.

In recent years, the digital twin has been one of the active research areas in modern Cyber-Physical Systems (CPS). Both the digital twin and its physical counterpart, called a plant, are highly intertwined such that they continuously exchange data to reveal useful information about the overall system. Such class of CPSs need to be robust to various types of disturbances, such as faulty sensors and model discrepancies, since the interplay between the physical plant's operation and digital twin's simulation may lead to undesirable or even destructive effect. To address this problem, this paper introduces a flexible anomaly detection framework for monitoring anomalous behaviours in digital twin based CPSs. In particular, our approach integrates both the digital twin and data-driven techniques that detect and classify anomalous behaviours due to modelling errors (e.g. incomplete models) and sensor and physical system's faults. The framework can be deployed to any general CPSs without the full knowledge of the digital twin's internal model. Therefore, our method is amenable to various types of digital twin implementations that enhance the traditional data-driven anomaly detection mechanism. We demonstrate the performance of our approach using the Tennessee Eastman Process model. The experimental result shows our approach is able to effectively detect and classify anomaly sources from the physical plant, sensor and digital twin, even in the situation when a certain combination of multiple anomalies occur simultaneously.

In the fields of co-simulation and component-based modelling, designers import models as building blocks to create a composite model that provides more complex functionalities. Modelling tools perform instantaneous cycle detection (ICD) on the composite models having feedback loops to reject the models if the loops are mathematically unsound and to improve simulation performance. In this case, the analysis relies heavily on the availability of dependency information from the imported models. However, the cycle detection problem becomes harder when the model's input to output dependencies are mode-dependent, i.e. changes for certain events generated internally or externally as inputs. The number of possible modes created by composing such models increases significantly and unknown factors such as environmental inputs make the offline (statical) ICD a difficult task. In this paper, an online ICD method is introduced to address this issue for the models used in cyber-physical systems. The method utilises an oracle as a central source of information that can answer whether the individual models can make mode transition without creating instantaneous cycles. The oracle utilises three types of data-structures created offline that are adaptively chosen during online (runtime) depending on the frequency as well as the number of models that make mode transitions. During the analysis, the models used online are stalled from running, resulting in the discrepancy with the physical system. The objective is to detect an absence of the instantaneous cycle while minimising the stall time of the model simulation that is induced from the analysis. The benchmark results show that our method is an adequate alternative to the offline analysis methods and significantly reduces the analysis time., \c{opyright} 2021. This manuscript version is made available under the CC-BY-NC-ND 4.0 license http://creativecommons.org/licenses/by-nc-nd/4.0/

The increasing adoption of solar photovoltaic panels and electric vehicles is creating more challenges to the traditional electricity grid. The impact is commonly seen in local residential networks where peak demands during early evenings are increasing while net power demands during daytime are getting lower. This trend leads to a worsening system load factor where costly infrastructure upgrades are necessary despite the decreasing average utilization of distribution assets. Such a scenario translates to a higher cost of delivering power to the end-users and longer return of investments for utility companies. This study proposes a solution to this issue using Localized Demand Control. In this system, flexible loads are enabled to adjust their status automatically and flatten out the aggregated demand at the transformer level. Simulation results show that the system load factor can be increased by 75% on average when the proposed technology is adopted. The system can keep the load factor above 0.44, even with a 100% penetration of solar panels and electric vehicles. Also, system overloads, over-voltage, under-voltage, and reverse power flow scenarios can be avoided.

Digital twin is a virtual replica of a real-world object that lives simultaneously with its physical counterpart. Since its first introduction in 2003 by Grieves, digital twin has gained momentum in a wide range of applications such as industrial manufacturing, automotive and artificial intelligence. However, many digital-twin-related approaches, found in industries as well as literature, mainly focus on modelling individual physical things with high-fidelity methods with limited scalability. In this paper, we introduce a digital-twin architecture called TiLA (Twin-in-the-Loop Architecture). TiLA employs heterogeneous models and online data to create a digital twin, which follows a Globally Asynchronous Locally Synchronous (GALS) model of computation. It facilitates the creation of a scalable digital twin with different levels of modelling abstraction as well as giving GALS formalism for execution strategy. Furthermore, TiLA provides facilities to develop applications around the twin as well as an interface to synchronise the twin with the physical system through an industrial communication protocol. A digital twin for a manufacturing line has been developed as a case study using TiLA. It demonstrates the use of digital twin models together with online data for monitoring and analysing failures in the physical system.

Scalability and performance in multicore processors for embedded and real-time systems usually don't go well each with the other. Networks on Chip (NoCs) provide scalable execution platforms suitable for such kind of embedded systems. This article presents a NoC-based Heterogeneous Multi-Processor system, called NoC-HMP, which is a scalable platform for embedded systems developed in the GALS language SystemJ. NoC-HMP uses a time-predictable TDMA-MIN NoC to guarantee latencies and communication time between the two types of time-predictable cores and can be customized for a specific performance goal through the execution strategy and scheduling of SystemJ program deployed across multiple cores. Examples of different execution strategies are introduced, explored and analyzed via measurements. The number of used cores can be minimized to achieve the target performance of the application. TDMA-MIN allows easy extensions of NoC-HMP with other cores or IP blocks. Experiments show a significant improvement of performance over a single core system and demonstrate how the addition of cores affects the performance of the designed system.

The synchronous model of computation is well suited for real-time systems, because it allows static analysis in order to find and guarantee their reaction times. Todays multi-core systems are becoming the predominant computing platforms. Synchronous programs are typically compiled into single threaded code, which makes them unsuitable for exploiting parallelism of the multi-core platforms. Moreover, static timing analysis becomes highly intractable for multi-core systems. This article proposes a novel methodology that aims at finding the mapping and schedule of synchronous programs that guarantees, statically, reaction times when mapped onto a multi-core system consisting of two types of time-predictable cores. The proposed methodology combines design space exploration based on evolutionary algorithm and scheduling of parts of synchronous programs. It allows minimizing the resource usage in terms of number of cores by finding the mapping and schedule with the guaranteed reaction time for architectures with different number of cores. In particular, we: (a) transform a synchronous program written in synchronous SystemJ to a graph-based model represented with two types of computation nodes suitable for execution on two types of time-predictable cores, (b) perform mapping of computation nodes on a customizable multi-core platform using genetic operations, and (c) generate a resulting static schedule of computation nodes for each mapping as part of the design space exploration. The design flow, from program specification and node mapping to the design space exploration and multi-core scheduling is completely automated.

The recent advancement of information and communication technology makes digitalisation of an entire manufacturing shop-floor possible where physical processes are tightly intertwined with their cyber counterparts. This led to an emergence of a concept of digital twin, which is a realistic virtual copy of a physical object. Digital twin will be the key technology in Cyber-Physical Production Systems (CPPS) and its market is expected to grow significantly in the coming years. Nevertheless, digital twin is still relatively a new concept that people have different perspectives on its requirements, capabilities, and limitations. To better understand an effect of digital twin's operations, mitigate complexity of capturing dynamics of physical phenomena, and improve analysis and predictability, it is important to have a development tool with a strong semantic foundation that can accurately model, simulate, and synthesise the digital twin. This paper reviews current state-of-art on tools and developments of digital twin in manufacturing and discusses potential design challenges.

Most of today's embedded systems are very complex. These systems, controlled by computer programs, continuously interact with their physical environments through network of sensory input and output devices. Consequently, the operations of such embedded systems are highly reactive and concurrent. Since embedded systems are deployed in many safety-critical applications, where failures can lead to catastrophic events, an approach that combines mathematical logic and formal verification is employed in order to ensure correct behavior of the control algorithm. This paper presents What You Prove Is What You Execute (WYPIWYE) compilation strategy for a Globally Asynchronous Locally Synchronous (GALS) programming language called Safey-Critical SystemJ. SC-SystemJ is a safety-critical subset of the SystemJ language. A formal big-step transition semantics of SC-SystemJ is developed for compiling SC-SystemJ programs into propositional Linear Temporal Logic formulas. These LTL formulas are then converted into a network of Mealy automata using a novel and efficient compilation algorithm. The resultant Mealy automata have a straightforward syntactic translation into Promela code. The resultant Promela models can be used for verifying correctness properties via the SPIN model-checker. Finally there is a single translation procedure to compile both: Promela and C/Java code for execution, which satisfies the De-Bruijn index, i.e. this final translation step is simple enough that is can be manually verified. HighlightsIntroduction of safety-critical subset of the SystemJ language called Safety-Critical (SC) SystemJ.Automata-based compilation approach for the SC-SystemJ language.A tool-chain for verifying correctness properties (e.g. liveness and safety) of the SC-SystemJ programs and generating executable from the verified code for deployment.The new compiler generates both faster and smaller executable compared to the original SystemJ compiler.

An especially daunting challenge of scheduling real-time applications on multiprocessor system on chip (MPSoC) is to incorporate timing anomalies due to access contention to shared resources. Time division multiplex arbitration (TDMA) provides static timing guarantees at the cost of significant loss in the average case performance of the application. This paper presents a shared resource contention arbitration approach allowing high bus utilization while guaranteeing WCET values for all tasks in the real-time application. The paper includes performance results obtained by executing hard real-time applications on a MPSoC with shared memory connected to the processors via a shared bus, implemented on a FPGA. The results show that the proposed approach provides: ① bus bandwidth utilization close to static priority based arbitration, ② a fairer bandwidth distribution compared to round robin arbitration, and ③ latency guarantees identical to TDMA.

Safety-critical software systems need to guarantee functional correctness and bounded response times to external input events. Programs designed using reactive programming languages, based on formal mathematical semantics, can be automatically verified for functional correctness guarantees. Real-time guarantees on the other hand are much harder to achieve. In this article we provide a static analysis framework for guaranteeing response times for reactive programs developed using the Globally Asynchronous Locally Synchronous (GALS) model of computation. The proposed approach is applicable to scheduling of GALS programs for different target architectures with single or multiple processors or cores. A Satisfiability Modulo Theory (SMT) formulation in the quantifier free linear real arithmetic (QF_LRA) logic is used for scheduling. A novel technique to encode rendezvous used in synchronization of globally asynchronous processes in the presence of locally synchronous parallelism and arbitrary preemption into QF_LRA logic is presented. Finally, our SMT formulation is shown to produce schedules in reasonable time.

In this paper we introduce exact and non-exact real-time waits in the reactive Globally Asynchronous Locally Synchronous (GALS) programming languages and synchronous languages as their subset. The language constructs that allow use of real-time waits are illustrated on the SystemJ GALS language. They allow system designers to explicitly use, at the specification level, not only logical time but also real-time in order to control program execution. We transform the real-time constructs into a logical model of time, and statically bound the amount of delay introduced by these constructs. In addition, the introduced concepts utilize execution platforms that allow finding best and worst reaction time of a GALS or synchronous program.

In this paper, we propose using an approach based on the system-level programming language SystemJ extended with service oriented features, called SOSJ, to design dynamic interoperable software systems. The approach abstracts and integrates the worlds of automation and robotics systems by using a simple service interface based on abstract objects within SOSJ. We demonstrate our approach in a real-life automated bottling system scenario that uses multiple FESTO modular stations operating in SOSJ and integrating them with two Baxter robots operating in ROS without the need for any modification of the underlying mechatronics or robotics systems.

Wireless sensor and actuator networks (WSANs) have become pervasive and are used in many embedded and intelligent systems. However, the complexity of applications based on these networks is limited due to lack of tools for designing distributed systems on top of WSANs. In this paper, we present how a system-level programming language, SystemJ, is used to develop a middleware-free Ambient Intelligence (AmI) system. The system consists of a combination of Internet-enabled stationary and mobile WSAN nodes, which resembles an Internet of Things scenario. A distributed warehouse monitoring and control scenario with collaborating stationary and mobile WSAN nodes is used as a motivating example designed and implemented in SystemJ. This example demonstrates the capabilities of SystemJ for designing distributed AmI systems with inherent support for reactivity and composition of concurrent behaviors based on a formal model of computation, without the need for any additional middleware. The approach is compared with existing software agent, robotic and WSAN middleware approaches in designing the same type of systems.

The Time-Predictable Heterogeneous Multicore Processor (TP-HMP) is based on a NoC and fully implemented in a standard FPGA chip. The NoC uses TDMA-MIN interconnect with bounded latency, high throughput and low implementation cost. TP-HMP is used for execution of programs written in concurrent GALS language SystemJ suited for both soft and hard real-time systems. It uses two types of cores in different configurations and is suitable for static analysis of schedules that implement the program control flow and concurrency. The configuration and number of cores of both types used to achieve specific performance measures can be tailored/optimized for a given application. In this paper we focus on optimization of latency of TDMA-MIN NoC, which also results in mapping of processor cores on physical ports of NoC and optimal TDMA round. We also analyze the performance of TP-HMP execution of the benchmark program used in industrial automation case study.

This paper presents an extensible and adaptable platform for distributed applications with mixed criticality based on using state of the art FPGA technology. Although capable of executing programs written in different languages, the platform specifically targets the execution of programs written in Globally Asynchronous Locally Synchronous language SystemJ used in the context of Internet of Industrial Things. The key properties of the prototype platform are accommodation of mixed-criticality processing as well as provision of Internet addressable services. Mixed-criticality execution platform (MCEP) uses multiple processor cores and network interfaces: (1) a dual-core ARM processor with Ethernet for Internet access and processing of non-real -- time application parts and (2) TP-JOP reactive hard real-time processor with customized Controller Area Network (CAN) for real-time and time-critical response processing. This platform has been successfully developed and used in an industrial automation system within the Internet of Industrial Things context.

A cardiac pacemaker example is used to compare and contrast the Synchronous Reactive (SR) programming model of SystemJ with the SCJ programming model. Our pacemaker is implemented in the synchronous subset of the Globally Asynchronous Locally Synchronous (GALS) SystemJ, which extends the Java language with reactivity, concurrency and real-time constructs based on a formal mathematical framework. The use of different programming models results in different design choices and implementations. The SR programming model is driven by a logical clock, which clearly demarcates the state boundaries and is ideal for formal verification of functional and real-time properties. Unlike the preemptive scheduling model prescribed by the SCJ specification, the SystemJ program execution model is atomic and non-preemptive between two logical ticks, and as such it is statically schedulable without the need for a runtime scheduler. To check the effectiveness of the SystemJ approach, we implemented the cardiac pacemaker on three different execution platforms that demonstrate feasibility of guaranteed real-time of the pacemaker execution with a fraction of the used processor's resources.

We present a novel approach for design of manufacturing automation systems with formal verification of selected properties based on the use of Globally Asynchronous Locally Synchronous programming language SystemJ and industrial-proof verification tools. By being able to prove properties of the automation control logic that consists of multiple concurrent controllers, represented by FSMs that correspond to asynchronous processes of SystemJ program, using Spin model checker, we demonstrate that the program features can be formally verified. Moreover, by also guaranteeing preservation of features and GALS model of the SystemJ program after compilation (correct by construction specification), we actually close the design process within What You Prove Is What You Execute (WYPIWYE) Paradigm.

We face a glut of languages for programming distributed software today. However, only a few languages have proven their potential with wider practical use in different domains of computing. We picked two such languages, meant for different domains, to see if they could cross-pollinate and enrich one another. Specifically, we chose SystemJ, a language to program distributed embedded systems, and IEC61499, the next generation standard for distributed industrial automation control software. Unsurprisingly, we found similar structures and artifacts between the two. We also found significant differences mainly due to differing domain-specific requirements. This comparison leads to observations and guidelines for improving both languages, and we discuss directions towards an “ideal” distributed software programming language.

Modern ubiquitous computing systems are created with large number of embedded sensing and actuation devices, which together form complex distributed collaborative systems. While the advancements in underlying embedded sensing, actuation and control technologies are tremendous, the system designers still lack proper software approach that can handle systems with complex and concurrent control flow on distributed networked infrastructure. In this paper, a system-level design language, SystemJ, which is based on a formal Model of Computation, is used to provide a new design paradigm for ambient intelligence systems. SystemJ has a set of kernel statements for modeling reactivity, preemptions and concurrency, which allow intuitive handling and composition of complex systems based on concurrent software behaviors. It also provides high level objects called signals and channels, to abstract away the underlying hardware devices and communication mechanisms. The run-time support of the language provides functionalities similar to middleware. An access and environment control system demonstrates the use of SystemJ in implementing typical reactive behaviors in ambient intelligence applications.

In this paper we present a novel multi-processor architecture for concurrent execution of programs that follow the Globally Asynchronous Locally Synchronous (GALS) formal model of computation. Programs are specified using the SystemJ concurrent programming language, suitable for modeling heterogeneous embedded applications that contain reactive and control driven parts and interact with the external environment. The proposed architecture is based on separating the control-driven and data-driven operations and executing them on distinct cores that support both types of operations, implemented as two modes within the single processor core. Each core can switch between two modes without any overhead. The core as the basic building block of the multiprocessor extends Java Optimized Processor (JOP), suitable for data-driven transformational operations, with control-oriented constructs that implement concurrency, reactivity, and control flow in SystemJ. Experimental evaluation over a range of benchmarks shows significant performance improvements over the existing platforms developed for the execution of the SystemJ program.