ESTEREL: a formal method applied to avionic software development

Berry, Gérard; Bouali, Amar; Fornari, Xavier; Ledinot, Emmanuel; Nassor, Éric; Simone, Robert de

doi:10.1016/s0167-6423(99)00015-5

Cited by 41 publications

(13 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…7 This example illustrates the mixing of algorithmic and reactive parts in a ReactiveML program. It also serves to present the language syntax and intuitive semantics.…”

Section: A Complete Examplementioning

confidence: 99%

See 1 more Smart Citation

ReactiveML, ten years later

Mandel¹,

Pasteur

Pouzet

2015

Proceedings of the 17th International Symposium on Principles and Practice of Declarative Programming

View full text Add to dashboard Cite

Ten years ago we introduced ReactiveML, an extension of a strict ML language with synchronous parallelismà la Esterel to program reactive applications. Our purpose was to demonstrate that synchronous language principles, originally invented and used for critical real-time control software, would integrate well with ML and prove useful in a wider context: reactive applications with complex data structures and sequential algorithms, organized as a dynamically evolving set of tightly synchronized parallel tasks.While all ReactiveML programs presented at PPDP'05 still compile, the language has evolved continuously to incorporate novel programming constructs, compilation techniques and dedicated static analyses. ReactiveML has been used for applications that we never anticipated: the simulation of large-scale ad-hoc and sensor networks, an interactive debugger, and interactive mixed music. These applications were only possible due to the efficient compilation of ReactiveML into sequential code, which we present here for the first time. We also present a parallel implementation that uses work-stealing techniques through shared memory. Finally, we give a retrospective view on ReactiveML over the past ten years.

show abstract

“…7 This example illustrates the mixing of algorithmic and reactive parts in a ReactiveML program. It also serves to present the language syntax and intuitive semantics.…”

Section: A Complete Examplementioning

confidence: 99%

“…The concurrency model of ReactiveML is based on that of Esterel [5,8], a language designed for programming control in safety critical real-time systems (e.g., avionic software [7]). This model of concurrency is the synchronous model [3].…”

Section: Introductionmentioning

confidence: 99%

ReactiveML, ten years later

Mandel¹,

Pasteur

Pouzet

2015

Proceedings of the 17th International Symposium on Principles and Practice of Declarative Programming

View full text Add to dashboard Cite

show abstract

“…Synchronous programming languages, such as Esterel, Lustre and Signal, have been proposed as means for the design of real-time systems which react to the environment (see for example [1], [2], [3]). These synchronous languages rely on synchronous hypothesis that computation and communication are "zero-time", and a program can react to the external inputs instantaneously [4].…”

Section: Introductionmentioning

confidence: 99%

A simulation condition for correct asynchronous implementation of synchronous design

Kumar

Jiang

et al. 2008

2008 American Control Conference

View full text Add to dashboard Cite

We study the problem of "desynchronization", i.e., semantics-preserving "asynchronous implementation" of a "synchronous design". In a synchronous design, system components (which we model as input-output automata (I/Oautomata)) communicate over synchronous channels and their combined behavior can be described using synchronous composition, whereas in an asynchronous implementation, communication among components occurs over asynchronous channels (which we also model as I/O-automata) and the behavior of an asynchronous implementation can be described using asynchronous composition. The presence of asynchronous communication can result in additional behavior that is not present under synchronous communication and can thus cause the semantics of a synchronous design to be not preserved under asynchronous implementation. We formalize the notion of system response to an input sequence and by using it, define a criterion for correct desynchronization. We define the simulation of I/O-automata, and argue that the simulation of the asynchronous implementation by a synchronous design is sufficient to guarantee the correctness of desynchronization. This is a new way of characterizing the correctness of desynchronization (as compared to the "iso-/endo-chrony" type conditions proposed in previous works). Under the practical assumption that the communication delay is bounded, the proposed simulation condition is algorithmically verifiable.

show abstract

“…Current Integrated Modular Avionic (IMA) approaches to behaviour control and planning use finite-state deterministic reactive automata, by means of a formal specification [4]. While this approach does not differentiate planning from control or sensing functions, it does necessitate a perfect knowledge of the environment, and leads to a rigid specification of the system behaviour.…”

Section: Introductionmentioning

confidence: 99%

Towards automatic robust planning for the discrete commanding of aerospace equipment

Yorke-Smith

Guettier

2003

Proceedings of the 2003 IEEE International Symposium on Intelligent Control ISIC-03

View full text Add to dashboard Cite

Abstract-An increasing requirement for satellites, space probes and (unmanned) aircraft is that they exhibit robust behaviour without direct human intervention. Autonomous operation is required in spite of incomplete knowledge of an uncertain environment. In particular, embedded equipment that processes sensing data must consider uncertain input parameters while managing its own activities. We show how uncertainty may be addressed in constraint-based planning and scheduling functions for aerospace equipment, contrasting with some current practice in Integrated Modular Avionic (IMA) design. We produce a conditional plan that takes account of foreseeable contingencies, so guaranteeing system behaviour in the worst case. Executing a branch of the plan corresponds to synthesising a deterministic finite state automaton capable of discrete event commanding of an avionic sub-system. Experimental results show the feasibility of the approach for realistic aerospace equipment.

show abstract

ESTEREL: a formal method applied to avionic software development

Cited by 41 publications

References 25 publications

ReactiveML, ten years later

ReactiveML, ten years later

A simulation condition for correct asynchronous implementation of synchronous design

Towards automatic robust planning for the discrete commanding of aerospace equipment

Contact Info

Product

Resources

About