04/19/23 COSC-4301-01, Lecture 13 1

Real-Time Systems, COSC-4301-01, Lecture 13

Stefan Andrei

04/19/23 COSC-4301-01, Lecture 13 2

Reminder of the last lecture

Faster Verification of RTL-Specified Systems via Decomposition

Constraint Extension

04/19/23 COSC-4301-01, Lecture 13 3

Overview of This Lecture

Verification, debugging and optimization of Linear RTL

04/19/23 COSC-4301-01, Lecture 13 4

Description a) Given SP and SA expressed in Linear RTL, determine

whether SPSA? b) Given SP and SA expressed in Linear RTL such that

the negation of SA is satisfiable and SP does not imply SA, determine new related SP’ and/or SA’ such that SP’SA’? The election of SP’ and SA’ should be done in conjunction with real-time system advisor or automatically.

c) Given SP and SA expressed in Linear RTL such that SPSA, determine SP’ and SA’ for which SPSP’, SP’SA’, SA’SA. The new SP’ and SA’ should be done using minimal changes by keeping the same set of constraints, but relaxing SP and/or tightening SA.

04/19/23 COSC-4301-01, Lecture 13 5

References Chapter 6 of [Che2002] Cheng, A.M.K.: Real-time

systems. Scheduling, Analysis, and Verification. Wiley-Interscience, 2002

[AnC07] Andrei, S., Cheng, A.: Verification of Linear RTL-Specifications. Proceedings of the 28-th IEEE Real-Time Systems Symposium, 2007

04/19/23 COSC-4301-01, Lecture 13 6

Description – part a)

a) Given SP and SA expressed in Linear RTL, determine whether SPSA?

04/19/23 COSC-4301-01, Lecture 13 7

Comparison with extended path-RTL class (Lecture 10)

The extended path RTL can only describe a timing constraint between two events.

A timing constraint involving three or more events together cannot be specified by any of these subclasses.

Example: The specification of a phased array radar system. A phased array is a group of antennas in which the relative

phases of the signals feeding the antennas are varied in such a way that the effective radiation is reinforced in a desired direction and suppressed in undesired directions.

04/19/23 COSC-4301-01, Lecture 13 8

The specification of a phased array radar system with four antennas1. The radar system is turned on at time 0.

2. In order to allow time for the initialization routine, the sum of times when all four antennas start radiating must be at least 10 seconds.

3. The sum of all radiating times for neighboring antennas (in this case, three) cannot exceed 1000 seconds in order to avoid overheating of the antenna elements and to reduce interference.

4. The time an antenna should continuously radiate is at least 300 seconds.

04/19/23 COSC-4301-01, Lecture 13 9

Translation to RTL The four antennas of the phased array radar system are

given in a cyclic order, denoted by A1, A2, A3, A4. @(↑A1, i) and @(↓A1, i) mean the ith occurrences when

antenna A1 begins and ends radiating: i ( @(↑A1, i)+ @(↑A2, i)+ @(↑A3, i)+ @(↑A4, i) ≥ 10) ( (@(↓A1, i) - @(↑A1, i)) + (@(↓A2, i) - @(↑A2, i)) +

(@(↓A3, i) - @(↑A3, i)) 1000 ) … ( (@(↓A4, i) - @(↑A4, i)) + (@(↓A1, i) - @(↑A1, i)) +

(@(↓A2, i) - @(↑A2, i)) 1000 ) (@(↓A1, i) - @(↑A1, i) ≥ 300) …

(@(↓A4, i) - @(↑A4, i) ≥ 300).

04/19/23 COSC-4301-01, Lecture 13 10

Our larger class - LRTL So, there is a need to find an RTL subclass able to

describe constrains with three or more events. We call it: Linear Real-Time Logic (LRTL). LRTL is based on a first-order logic with features able

to capture the linear timing requirements of real-time systems.

LRTL includes the existing subclasses of decidable and practical RTL formulas.

To the best of our knowledge, LRTL is a subclass of RTL, with decidable properties, not considered until now for the specification and verification of real-time and embedded systems.

04/19/23 COSC-4301-01, Lecture 13 11

Linear inequalities - an open problem In fact, the linear inequalities have been

unsolved for long time. For example, [Moller, Lichtenberg, Andersen,

and Hulgaard; 1999] formulates as future work the class of linear inequalities: “One path that could be taken when extending the

results of the paper would be to generalize the difference constraints to linear inequalities.”

04/19/23 COSC-4301-01, Lecture 13 12

Can we still re-use the constraint graph? The previous verification method for formulas expressed in extended path-RTL was the (extended) constraint graph:

A timing constraint @(e1, i) - @(e2, j) k corresponds to two nodes and an arc in the constraint graph.

A timing constraint ± @(e1, i) ± @(e2, j) k corresponds to two arcs between four nodes in the extended constraint graph.

No, a more powerful data structure is needed.

04/19/23 COSC-4301-01, Lecture 13 13

LRTL Compared with the constraint graph technique,

the correctness of a real-time system specified in LRTL can be achieved by solving a system of linear inequalities.

A general timing constraint in LRTL may have the form:

a1 · @(e1, i1) + … + an · @(en, in) «op» b

where «op» is one of the following arithmetic operators {, =, ≥}, and a1, ..., an, and b are integers.

04/19/23 COSC-4301-01, Lecture 13 14

The LRTL normal form

a1 · @(e1, i1) + … + an · @(en, in) b

Even if the normal form seems to restrict «op» only to “”, it has the same expressive power as the general form.

Our method for verification of SPSA expressed in LRTL has 6 basic steps.

04/19/23 COSC-4301-01, Lecture 13 15

The first 3 steps to prove SP SA1. consider F = (SP SA) ≡ SP SA;

2. convert it to a Presburger formula, FPresb , by replacing the time occurrences @(E, i) by a function fE(i);

3. construct the Skolem formula, FCNF , by removing the existential quantifiers and replacing the corresponding variables with constants.

04/19/23 COSC-4301-01, Lecture 13 16

Example SP: i j (@(e1, i) + @(e2, i) 2)

(@(e2, i) - @(e3, j) 1) (@(e1, i) - @(e3, j) 7).

SA: u v (@(e1, u) + @(e2, u) - @(e3, v) 5).

SA is u v (-@(e1, u) - @(e2, u) + @(e3, v) - 6)

Presburger formula: replace @(e1, i) by f1(i), @(e2, i) by f2(i), @(e3, i) by f3(i), etc.

Skolem formula: U and V are two integer constants to replace the variables u and v.

FCNF: i j (f1(i) + f2(i) 2) (f2(i) - f3(j) 1) (f1(i) - f3(j) 7) (-f1(U) - f2(U) + f3(V) - 6).

04/19/23 COSC-4301-01, Lecture 13 17

Step 4: Positive propositional clauses A set S = {f(t1), ..., f(tk)} is unifiable if there exists a substitution ψ such that f(t1)ψ = ... = f(tk)ψ.

Example: The set S = {f1(i), f1(U)} is unifiable due to the

substitution ψ = [i/U].

The method pos(FCNF) generates a new propositional variable for each new inequality after checking the unification.

The FCNF from the example has the following positive clauses: {A1}, {A2}, {A3}, and {A4}.

04/19/23 COSC-4301-01, Lecture 13 18

Step 5: Obtaining the negative propositional clauses FCNF is translated to a system of linear inequalities AX B.

Example: A = , X = , B = .

The column vector X has been obtained after applying the substitution {[i/U], [j/V]}.

111

101

110

011

67

1

2

)(

)(

)(

3

2

1

Vf

Uf

Uf

04/19/23 COSC-4301-01, Lecture 13 19

Definition: Negative linear dependencies Λ = (λi)1in from M1,n is a positive row vector if

λi + - {0} for all i {1, ..., n}.

Let B = (bi)1in be a column vector from Mn,1 such that bi for all i {1, ..., n}.

Λ is negative linear dependant of B if and only if ΛB < 0.

04/19/23 COSC-4301-01, Lecture 13 20

Theorem: Negative Linear Dependency Let Λ = (λi)1 i n be a positive row vector that is

a solution of the system of linear equations AtrΛtr =0, where A = (ai,j)mn is a matrix over .

If Λ is negative linear dependant of B, where B is a column vector, then the inequality AX B has no solution for X over , where X is a column vector.

04/19/23 COSC-4301-01, Lecture 13 21

Example

Considering AX B, we need to find the positive row vector Λ = (λ1 λ2 λ3 λ4) such that AtrΛtr =0.

This is: = 0.

The positive solution Λ = (1 1 1 2) leads to ΛB = -2. Therefore, AX B has no solution for X over .

04/19/23 COSC-4301-01, Lecture 13 22

Negative propositional clauses1. initially Fneg = ;2. identify the propositional variables v1, ... vk

corresponding to inequalities from FCNF ;3. identify matrices A and B from the inequality AX B

that represent FCNF;

4. let Ai A and Bi B be such that AiX Bi is a new subsystem of AX B;

5. find Λi a positive solution of Atri Λtr

i = 0;

6. if ΛiBi < 0 then add the negative clause {vi,1, ... vi,k} to Fneg;

7. if there is no new subsystem AiX Bi of AX B, then STOP; otherwise, go to 4.

04/19/23 COSC-4301-01, Lecture 13 23

Some remarks to choose the subsystem At step 4, we have chosen Ai A and Bi B be

such that AiX Bi is a new subsystem of AX B;

The idea is to choose Ai the sub-matrix of A that is a closure of the initial variable, that is: Initial step: add Xi to Ai

Inductive step: add all the variables from the inequalities that contains

variables from Ai; repeat this step until there are no more changes.

04/19/23 COSC-4301-01, Lecture 13 24

Step 6: The final step of our method Let PF be the set of positive and negative

clauses. If PF is unsatisfiable, then SPSA holds.

Example: PF = { {A1}, {A2}, {A3}, {A4}, {A1, A2, A3, A4} } is unsatisfiable, so SPSA holds.

04/19/23 COSC-4301-01, Lecture 13 25

Complexity considerations

Among the many different ways to solve systems of linear inequations, the traditional method is the Gaussian elimination.

It has an order of O(n3) time complexity, where n is the number of variables.

04/19/23 COSC-4301-01, Lecture 13 26

Step 6: Convert PF to a DIMACS file Suppose PF is expressed in Conjunctive Normal Form

and has n variables and l clauses. Then, the first line of the DIMACS file is:

p cnf n l Each positive literal L1, …, Ln corresponds to positive

integers 1, …, n Each negative literal L1, …, Ln corresponds to negative

integers -1, …, -n Any clause is translated to a line of text in the DIMACS

file by replacing each literal with the corresponding integer and each ‘’ is replaced by blank space (the end of clause is marked by a ‘0’): L1 L2 L3 L5 corresponds to 1 -2 3 -5 0

04/19/23 COSC-4301-01, Lecture 13 27

Step 6: Call a state-of-the-art SAT solver Siege - http://www.cs.sfu.ca/research/groups/CL/software/siege/ zChaff - http://www.princeton.edu/~chaff/software.html Cachet - http://www.cs.rochester.edu/u/kautz/Cachet/index.htm SharpSAT -

http://www2.informatik.hu-berlin.de/~thurley/sharpSAT/index.html

Others: http://www.satlive.org/bytype.jsp?reftypefrom=-2 If the answer provided by this SAT solver or #SAT

solver is ‘Unsatisfiable’, then PF is unsatisfiable, so SP SA is a theorem.

04/19/23 COSC-4301-01, Lecture 13 28

Description – part b)

b) Given SP and SA expressed in Linear RTL such that the negation of SA is satisfiable and SP does not imply SA, determine new related SP’ and/or SA’ such that SP’SA’? The election of SP’ and SA’ should be done in conjunction with real-time system designer or automatically.

04/19/23 COSC-4301-01, Lecture 13 29

The systematic debugging algorithm (Test & Print) test if PF is

unsatisfiable and if the designer agrees with the suggested constraint

(Incremental Computation) consider all the choices to change SP and SA into new SP’ and SA’.

desired is evaluated to false when the designer wishes to continue the systematic debugging and the timing constraints of the real-time system are fulfilled.

Algorithm Main:

Input: SP, SA and PF, SP SA

Output: SP’, SA’ s.t. SP’ SA’

Method:

desired = false; while (desired == false) {

(Test & Print)

if (desired == false) {

(Incremental Computation)

(Debugging Computation)

}

}

04/19/23 COSC-4301-01, Lecture 13 30

Addition of New Variables

While PF is satisfiable: Test whether each variable appears in at least two

inequalities; If variable Xi appears only once in the system AiX Bi

then we insert it in all inequalities and see whether it leads to unsatisfiability, namely ΛiBi < 0, where Λi a positive solution of Atr

i Λtri = 0.

04/19/23 COSC-4301-01, Lecture 13 31

Transforming a subsystem into one with negative dependencies Consider Λi a positive solution of Atr

i Λtri = 0;

If ΛiBi >= 0 then modify Bi such that ΛiBi < 0.

04/19/23 COSC-4301-01, Lecture 13 32

Make sure there are positive solutions Λi If there are no positive solutions Λi of Atr

i Λtri =

0, then modify Ai to get such a solution.

04/19/23 COSC-4301-01, Lecture 13 33

Automatic Debugging

The automatic approach is similar to the systematic approach, but it should work in the absence of the human beings.

Our solution was to consider in advance all the necessary information such as the designer's guidance: a set of constraints which cannot be modified the specific ranges for the constants which appear

in the constraints.

04/19/23 COSC-4301-01, Lecture 13 34

Automatic Debugging The input files for the automatic approach are

augmented with the lower and upper bounds for the constants.

04/19/23 COSC-4301-01, Lecture 13 35

Example: Systematic Debugging Step 1:

SP: i j (@(e1, i) + @(e2, i) 2)

(@(e2, i) - @(e3, j) 1) (@(e1, i) - @(e3, j) 7).

SA: u v (@(e1, u) + @(e2, u) - @(e3, v) 2).

Step 2: SP: i j (f1(i) + f2(i) 2) (f2(i) - f3(j) 1) (f1(i) - f3(j) 7)

SA: u v f1(u) + f2(u) - f3(v) 2 Step 3:

SP SA: i j (f1(i) + f2(i) 2) (f2(i) - f3(j) 1) (f1(i) - f3(j) 7) Λ (-f1(U) - f2(U) + f3(V) -3).

04/19/23 COSC-4301-01, Lecture 13 36

Example: Systematic Debugging -cont Step 4:

Consider the substitution ψ = {[i/U][j/V]}. The method pos(FCNF) generates a new propositional

variable for each new inequality after checking the unification.

A1 denotes the inequality f1(U)+f2(U) 2 A2 denotes the inequality f2(U)-f3(U) 1 A3 denotes the inequality f1(U)-f3(U) 7 A4 denotes the inequality -f1(U)-f2(U)+f3(V) -9 The FCNF leads to the following positive clauses for PF:

{A1}, {A2}, {A3}, and {A4}.

04/19/23 COSC-4301-01, Lecture 13 37

Example: Systematic Debugging -cont

Step 5: FCNF is translated to a system of linear inequalities AX B.

Example: A = , X = , B = .

111

101

110

011

37

1

2

)(

)(

)(

3

2

1

Vf

Uf

Uf

04/19/23 COSC-4301-01, Lecture 13 38

Example: Systematic Debugging -cont Considering AX B, we need to find the positive row

vector Λ = (λ1 λ2 λ3 λ4) such that AtrΛtr =0.

This is: = 0.

The positive generic solution Λ = (a a a 2a) cannot leads to ΛB <0, where a>0.

So, the set of negative clauses is empty.

04/19/23 COSC-4301-01, Lecture 13 39

Example: Systematic Debugging - cont Step 6: Convert PF to a DIMACS file

p cnf 4 4 1 0 2 0 3 0 4 0

Call Siege or zChaff The previous DIMACS file is input for Siege. The output of Siege will be: ‘satisfiable’ Since PF is satisfiable, then we need to do debugging

to make SP SA a theorem.

04/19/23 COSC-4301-01, Lecture 13 40

Example: Systematic Debugging - cont Step 7: All the lines have at least two non-zero

coefficients, so we don’t do debugging for this case (slide 39).

We need to change B to have ΛB <0. ΛB=(a a a 2a)(2 1 7 -3)tr=4a, where a>0:

Change b1=2 to b1=-3

Change b2=1 to b2=-4

Change b3=7 to b3=2

Change b4=-3 to b4=-6

04/19/23 COSC-4301-01, Lecture 13 41

Example: Systematic Debugging - cont

Step 8: The designer is asked which of the changes are the best: Changing @(e1, i) + @(e2, i) 2 to @(e1, i) + @(e2, i) -3.

Changing @(e2, i) - @(e3, j) 1 to @(e2, i) - @(e3, j) -4.

Changing @(e1, i) - @(e3, j) 7 to @(e1, i) - @(e3, j) 2.

Changing -f1(U) - f2(U) + f3(V) -3 to -f1(U) - f2(U) + f3(V) -6. This corresponds to @(e1, u) + @(e2, u) - @(e3, v) 5.

04/19/23 COSC-4301-01, Lecture 13 42

Example: Systematic Debugging - cont The tool will compute for each of these

changes the corresponding propositional formula PF, that is: PF = { {A1}, {A2}, {A3}, {A4}, {A1, A2, A3, A4} }

Then #SAT solver will compute the number of truth assignments of PF.

Since this number is 0, the algorithm terminates.

Otherwise, the algorithm would repeat from Step 7.

04/19/23 COSC-4301-01, Lecture 13 43

Example: Automatic Debugging - cont Consider a file showing intervals for the

constants in B: b1,-3,2,7 means -2 b1 7, where b1 implicit initial

value is 2. b2,-4,1,6 means -3 b2 6, where b2 implicit initial

value is 1. b3,2,7,12 means 3 b3 12, where b3 implicit initial

value is 7. b4,-6,-3,0 means -6 b4 0, where b4 implicit initial

value is -3.

04/19/23 COSC-4301-01, Lecture 13 44

Example: Automatic Debugging - cont As such, the automatic debugging tool will not

ask the designer, but it will check the file against the proposed specification.

In our case, the tool will choose -f1(U) - f2(U) + f3(V) -6

This leads to a negative dependency and its constant belongs to the interval [-6,0].

This corresponds to @(e1, u) + @(e2, u) - @(e3, v) 5.

04/19/23 COSC-4301-01, Lecture 13 45

Description – part c)

c) Given SP and SA expressed in Linear RTL such that SPSA, determine SP’ and SA’ for which SPSP’, SP’SA’, SA’SA. The new SP’ and SA’ should be done using minimal changes by keeping the same set of constraints, but relaxing SP and/or tightening SA.

04/19/23 COSC-4301-01, Lecture 13 46

The Optimization Problem

The previous approaches were focused on the verification and debugging of SP SA, and not the optimization of this tautology.

However, it may happen that SP contains overly strong timing constraints or SA can be improved by stronger timing constraints.

Can we provide the most relaxed specification SP and/or the most tight safety assertion SA such that SP SA is a theorem (without repeating the verification of SP SA)?

04/19/23 COSC-4301-01, Lecture 13 47

Refinement of the Optimization Algorithm Input: SP, SA such that SPSA holds, and A(1)XB(1) the

initial linear system; Output: SP’, SA’ such that SP’SA’ is an optimal

tautology. Method:

k=1; SP1=SP; SA1=SA; while (there exists Λ such that ΛB < -1) {

Identify the inequality ∑j=1n aij xjbi that does not occur in any

other subsystem Ai X Bi; Decrease bi such that ΛB=-1 and denote the new system

A(k+1)XB(k+1); Change SPk and SAk according to the new weight; k= k+1; }

SP’=SPk; SA’=SAk.

04/19/23 COSC-4301-01, Lecture 13 48

Example: Optimization Step 1:

SP: i j (@(e1, i) + @(e2, i) 2)

(@(e2, i) - @(e3, j) 1) (@(e1, i) - @(e3, j) 7).

SA: u v (@(e1, u) + @(e2, u) - @(e3, v) 8).

Step 2: SP: i j (f1(i) + f2(i) 2) (f2(i) - f3(j) 1) (f1(i) - f3(j) 7)

SA: u v f1(u) + f2(u) - f3(v) 8 Step 3:

SP SA: i j (f1(i) + f2(i) 2) (f2(i) - f3(j) 1) (f1(i) - f3(j) 7) Λ (-f1(U) - f2(U) + f3(V) -9).

04/19/23 COSC-4301-01, Lecture 13 49

Example: Optimization -cont Step 4: Consider the substitution ψ = {[i/U][j/V]}. The method pos(FCNF) generates a new propositional

variable for each new inequality after checking the unification.

A1 denotes the inequality f1(U)+f2(U) 2 A2 denotes the inequality f2(U)-f3(U) 1 A3 denotes the inequality f1(U)-f3(U) 7 A4 denotes the inequality -f1(U)-f2(U)+f3(V) -9 The FCNF leads to the following positive clauses for PF:

{A1}, {A2}, {A3}, and {A4}.

04/19/23 COSC-4301-01, Lecture 13 50

Example: Optimization -cont

Step 5: FCNF is translated to a system of linear inequalities AX B.

Example: A = , X = , B = .

111

101

110

011

97

1

2

)(

)(

)(

3

2

1

Vf

Uf

Uf

04/19/23 COSC-4301-01, Lecture 13 51

Example: Optimization -cont

Considering AX B, we need to find the positive row vector Λ = (λ1 λ2 λ3 λ4) such that AtrΛtr =0.

This is: = 0.

The positive solution Λ = (1 1 1 2) leads to ΛB =-8. Therefore, AX B has no solution for X over . PF={{A1}, {A2}, {A3}, {A4}, {A1, A2, A3, A4}}

04/19/23 COSC-4301-01, Lecture 13 52

Example: Optimization - cont Step 6: Convert PF to a DIMACS file

p cnf 4 5 1 0 2 0 3 0 4 0 -1 -2 -3 -4 0

Call Siege or zChaff The previous DIMACS file is input for Siege. The output of Siege will be: ‘satisfiable’ Since PF is satisfiable, then we need to do

debugging to make SP SA a theorem.

04/19/23 COSC-4301-01, Lecture 13 53

Example: Optimization - cont Step 7: ΛB=-8, so we’ll do some change to ΛB=-1. There are four ways to do that:

Change b1=2 to b1=9 Change b2=1 to b2=8 Change b3=7 to b3=14 Change b4=-9 to b4=-6

By doing any of these changes, ΛB=-1. SP1 SA1, SP2 SA2, SP3 SA3 and SP4

SA4 are optimal tautologies.

04/19/23 COSC-4301-01, Lecture 13 54

Summary

Verification, debugging and optimization of Linear RTL.

04/19/23 COSC-4301-01, Lecture 13 55

Reading suggestions

Chapter 6 of [Che2002] Cheng, A.M.K.: Real-time systems. Scheduling, Analysis, and Verification. Wiley-Interscience, 2002

[AnC07] Andrei, S., Cheng, A.: Verification of Linear RTL-Specifications. Proceedings of the 28-th IEEE Real-Time Systems Symposium, 2007

04/19/23 COSC-4301-01, Lecture 13 56

Coming up next

Decomposition technique of LRTL formulas

04/19/23 COSC-4301-01, Lecture 13 57

Thank you for your attention!

Questions?