36796993
From Implicit Specifications to Explicit Designs in Reactive System Development
In this paper we describe how the RSDS method can be used as a bridge between implicit Z-style specifications of reactive systems, and explicit B AMN designs of these systems. We define the translation from RSDS to B and verify its correctness. We also define controller decomposition techniques, and a translation to SMV.
19812651
A Lattice of Abstract Graphs
This paper concerns the abstract interpretation of Term Graph Rewriting systems. We introduce a new lattice of abstract graphs; this improves over previous work in that the ordering is defined directly on the graph structure rather than via unravelling into trees. We use the lattice in sketching the correctness of Nocker's abstract reduction algorithm; an efficient strictness analysis used in the Concurrent Clean system.
15573543
Invariant-Based Synthesis of Fault-Tolerant Systems
Statecharts are a very widely used formalism for reactive system development, however there are problems in using them as a fully formal specification notation because of the conflicting variants of statechart semantics which exist. In this paper a modular subset of statechart notation is defined which has a simple semantics, and permits compositional development and verification. Techniques for decomposing specifications in this notation, design strategies for incorporating fault tolerance, and translation to the B formal language, are also described, and illustrated with extracts from a case study of a fault tolerant system.
14082519
Structuring and Design of Reactive Systems Using RSDS and B
With the advent of comprehensive safety standards for software intensive safety related systems, such as IEC 61508 and its speciali-sations for particular industry sectors (medical, machinery, process, etc), there is a need to establish combinations of techniques which can be used by industry to demonstrate conformance to these standards for particular developments. In this paper we describe one such combination of techniques, involving statecharts and B, which is aimed at reactive control system development. 
 
We define strategies for controller decomposition which allow safety invariants to be distributed into subcontroller requirements, and define techniques for the automatic synthesis of controllers from invariants. A case study of a train control system is used to illustrate the ideas.
2534703
Event Structures and Non-Orthogonal Term Graph Rewriting
Received 1. Abstract We show that for every term graph in a left-linear but non-orthogonal term graph rewrite system, one can construct an event structure which represents all the possible reductions which can occur in reduction sequences starting from that term graph. Every nite reduction sequence from that graph corresponds to a connguration of the event structure, and L evy-equivalent sequences correspond to the same connguration. Garbage collection is modelled in the event structure by an \erases" relation. The asymmetric connicts which arise in non-orthogonal rewrite systems are modelled by introducing a \prevents" relation. The conngurations of the event structure then form the state space of an event automaton. Taking the directed completion of this space yields a prime algebraic domain. 2. Introduction By term graph rewriting we have in mind the operational style of rewriting described in (BvEG + 87). A more elegant, algebraic approach to the semantics may be found in (Ken91). Since the arguments in the proofs in this paper are almost exclusively operational in nature we have assumed the semantics in the former. We will occasionally use notation that assumes redexes and sequences are morphisms in the category described in (KKSdV93) (as they are). This done as anotational convenience and does not assume any category theory on the part of the reader. Following the approach of the work on event structures for orthogonal term graph rewriting systems in (KKSdV93) we assume that garbage collection is not delayed and is implicit in a rewrite step. We require the left-hand sides of rules in the rewriting systems to be representations of left-linear terms and do not allow them to contain cycles; crucially we allow non-orthogonal rules. This class of term graph rewriting systems is quite general, suuciently general to be able to describe not only the functional language Clean but also languages without a functional strategy, including the abstract reduction used to do strictness analysis in Clean (see (ENP91), (Noc94)), and non-deterministic term graph rewriting. In point of fact the class we consider is more general than necessary to describe any of these since none of
16641025
Quantified Interference for a While Language
We show how information theory can be used to give a quantitative definition of interference between variables in imperative programming languages. In this paper we focus on a particular case of this definition of interference: leakage of information from private variables to public ones in While language programs. The major result of the paper is a quantitative analysis for this language that employs a use-definition graph to calculate bounds on the leakage into each variable.
5170042
Building and Using A Scalable Display Wall System
Princeton's scalable display wall project explores building and using a large-format display with commodity components. The prototype system has been operational since March 1998. Our goal is to construct a collaborative space that fully exploits a large-format display system with immersive sound and natural user interfaces. Our prototype system is built with low-cost commodity components: a cluster of PCs, PC graphics accelerators, consumer video and sound equipment, and portable presentation projectors. This approach has the advantages of low cost and of tracking technology well, as high-volume commodity components typically have better price-performance ratios and improve at faster rates than special-purpose hardware. We report our early experiences in building and using the display wall system. In particular, we describe our approach to research challenges in several specific research areas, including seamless tiling, parallel rendering, parallel data visualization, parallel MPEG decoding, layered multiresolution video input, multichannel immersive sound, user interfaces, application tools, and content creation.
14927180
Improving prediction for procedure returns with return-address-stack repair mechanisms
This paper evaluates several mechanisms for repairing the return-address stack after branch mispredictions. The return-address stack is a small but important structure for achieving better control-flow prediction accuracy and therefore better performance. But wrong-path execution after mispredictions frequently corrupts the return-address stack, making repair mechanisms necessary. If the processor implements multipath execution-simultaneously executing both sides of a branch-the contention among different paths makes the problem more severe. For conventional, single-path processors, this paper proposes saving both the top-of-stack pointer and the top-of-stack contents for later restoration in case of a misprediction. This simple technique achieves nearly 100% hit rates and improves performance by up to 8.7% compared to a stack with no repair mechanism. For multipath processors, providing each path with its own return-address stack completely eliminates contention, improving performance by over 25%.
6156615
The design philosophy of the DARPA internet protocols
The Internet protocol suite, TCP/IP, was first proposed fifteen years ago. It was developed by the Defense Advanced Research Projects Agency (DARPA), and has been used widely in military and commercial systems. While there have been papers and specifications that describe how the protocols work, it is sometimes difficult to deduce from these why the protocol is as it is. For example, the Internet protocol is based on a connectionless or datagram mode of service. The motivation for this has been greatly misunderstood. This paper attempts to capture some of the early reasoning which shaped the Internet protocols.
10720036
Evaluating multi-port frame buffer designs for a mesh-connected multicomputer
Multicomputers can be effectively used for interactive graphics rendering only if there are mechanisms available to rapidly composite and transfer images to an external display device. One method for achieving the necessary bandwidth for this operation is to provide multiple high-bandwidth ports into a frame buffer. In this paper, we evaluate the design space of a multiport frame buffer design for the Intel Paragon mesh routing network. We use an instrumented rendering system to capture the graphics operations needed for rendering a number of three-dimensional scenes; we then use those workloads as input to test programs running on the Paragon to estimate the performance of our hardware. Our experiments consider three major design questions: how many network ports the frame buffer needs, whether Z-buffering should be done in hardware on the frame buffer or in software on the computing nodes, and whether the design alternatives are scalable.
61690467
The performance impact of incomplete bypassing in processor pipelines
Pipelined processors employ hardware bypassing to eliminate certain pipeline hazards. By passing is logically simple but can be costly, especially in wide issue and deeply pipelined machines. In this paper bypassing is studied in detail, with an emphasis on designs in which the bypassing network is not complete. Cycle-level simulations of a model of integer and floating-point pipelines running some of the SPEC92 benchmarks show that at least half of the instructions executed used a bypassed register result from a previous instruction. Missing bypasses induce interlock stalls. The paper reports measurements of the performance impact of a number of pipeline configurations with incomplete bypassing networks. This impact ranges from a slowdown of just a few percent for a configuration with one late bypass missing to a slowdown of almost a factor of two for the integer pipe with no bypassing at all. Two types of code alterations reduce the new interlock stalls. A simple code transformation, the interchange of operands in instructions that perform commutative operations, cuts the performance loss from interlock stalls in certain configurations between about 20 and 50 percent. The second transformation is to reschedule code within basic blocks to avoid any missing bypasses. In five individual experiments with a small number of configurations and two benchmarks, this rescheduling saved 25 to 50 percent of the interlock stalls. In certain configurations both transformations can be applied.