This work is licensed under Creative Commons Attribution-NonCommercial-NoDerivatives International.

High Performance Computing (HPC) systems are subject to dynamical variations occurring in, e.g., jobs execution duration, I/O quantity, network consumption. Adapting to these unpredictable variations requires using autonomic management in an online feedback loop. The introduction of control theory methods allows for the design of well-founded autonomic managers. Choosing the relevant approach is daunting due to the variety of existing controllers. The criteria are of different natures, involving performance and efficiency, but also required expertise in control theory, and reusability or portability between sub-systems. Therefore, there is a need for comparative studies to assist designers choices. We consider the problem of resource harvesting in HPC systems, where scheduling often leaves resources idle. Our approach controls—through a feedback loop—the injection of small jobs in order to maximize the resources’ usage. The control problem is to manage the tradeoff between harvesting and performance, in a reusable manner. We study how reusability relates to the adaptivity and robustness properties in control. We illustrate our approach with the classic Proportional-Integral-Derivative (PID) control, its upgrade as adaptive control, and Model-Free Control (MFC). We target CiGri , a system harvesting idle resources in a computing grid. We perform experimental evaluation and compare performance and reusability. Tradeoffs are found on different criteria: While adaptive control is largely portable, its design complexity is significant for non-experts; PID control has good nominal performance, yet its portability is limited; MFC requires few competences to be used, but cannot provide strong guarantees.

As the historically isolated industrial control systems become increasingly connected, the threat posed by cyberattacks soars. To remedy this issue, industrial standards dedicated to the cybersecurity of ICS have been developed in the last twenty years, namely the IEC 62443 series. These standards provide guidelines to the creation and maintenance of a secure ICS, from the concept phase to its eventual disposal. This standard notably assume a specific Zone/Conduit model for systems, as a basis for building the security program. This model currently lacks computer-aided design tools, which are essential to the adoption of a standard. In this paper, we will present a domain specific modeling language, able to describe IEC 62443 compliant systems. Our main contributions are the DSL’s syntax, which tries to formalize the informal model found in the standard, and the validation rules applied to it that ensure the described installations are secure by design, according to a set of hypotheses.

As industrial control systems become increasingly connected, the threat of cyberattacks grows in turn. Classical IT reactions that prioritize confidentiality, like network isolation, cannot be applied as they lead to a loss of availability, hence an issue of safety criticality. This work proposes a reconfiguration-based reaction to attacks, migrating control programs away from compromised components. This reconfiguration is carried out by a controller which solves a constraint programming (CP) problem whenever a compromised device is detected. This controller is automatically generated based on a model of IEC 62443 compliant systems. This approach is tested both on generated models of arbitrary size and to control a set of real Programmable Logic Controller (PLC) overseeing a small-scale training factory.

The design of Cyber Physical Systems (CPS) is becoming increasingly complex due to the dynamic changes in their environments and infrastructures, requiring them to be self-adaptive. An important class of CPS is Industrial Control Systems (ICS), where a major trend is to upgrade from historically specific hardware and technologies towards more software-defined, virtual approaches involving the Could-Fog-Edge continuum. In this work, we propose a model-based approach for the design of the self-adaptation in ICS, inspired by, and applied to an industrial case study in Smart Grids, more particularly an electrical substation from RTE (the French Energy Transmission company). The problem is to allocate and reallocate dynamically a set of control functions upon a distributed computing infrastructure, with self-adaptation to variations and perturbations. We define and implement the model-based autonomic management feedback loop using constraint programming, to describe the space of possible configurations, as well as the constraints and objectives formalizing the operators strategies. This model is used in simulation, calling the constraints solver at each cycle of the loop.

In the context of IoT (Internet of Things), Device Management (DM), i.e., remote administration of IoT devices, becomes essential to keep them connected, updated and secure, thus increasing their lifespan through firmware and configuration updates and security patches.Legacy DM solutions are adequate when dealing with home devices (such as Television set-top boxes) but need to be extended to adapt to new IoT requirements.Indeed, their manual operation by system administrators requires advanced knowledge and skills.Further, the static DM platform -a component above IoT platforms that offers advanced features such as campaign updates / massive operation management -is unable to scale and adapt to IoT dynamicity.To cope with this, this work, performed in an industrial context at Orange, proposes a self-adaptive architecture with runtime horizontal scaling of DM servers, with an autonomic Auto-Scaling Manager, integrating in the loop constraint programming for decisionmaking, validated with a meaningful industrial use-case.

With the expansion of Internet of Things (IoT) that relies on heterogeneous, dynamic, and massively deployed devices, device management (DM) (i.e., remote administration such as firmware update, configuration, troubleshooting and tracking) is required for proper quality of service and user experience, deployment of new functions, bug corrections and security patches distribution.Existing industrial DM platforms and approaches do not suit IoT devices and are already showing their limits with a few static home devices (e.g., routers, TV Decoders).Indeed, undetected buggy firmware deployment and manual target device identification are common issues in existing systems.Besides, these platforms are manually operated by experts (e.g., system administrators) and require extensive knowledge and skills.Such approaches cannot be applied on massive and diverse devices forming the IoT.To tackle these issues, our work in an industrial research context proposes to apply autonomic computing to DM platforms operation and impact tracking.Specifically, our contribution relies on automated device targeting (i.e., aiming only suitable devices) and impact-aware DM (i.e., error and anomalies detection preceding patch generalization on all suitable devices of a given fleet).Our solution is composed of three coordinated autonomic loops and allows more accurate and faster irregularity diagnosis, vertical scaling along with simpler IoT DM platform administration.For experimental validation, we developed a prototype that demonstrates encouraging results compared to simulated legacy telecommunication operator approaches (namely Orange).

Summary A parallel program needs to manage the trade‐off between the time spent in synchronisation and computation. This trade‐off is significantly affected by its parallelism degree. A high parallelism degree may decrease computing time while increasing synchronisation cost. Furthermore, thread placement on processor cores may impact program performance, as the data access time can vary from one core to another due to intricacies of the underlying memory architecture. Alas, there is no universal rule to decide thread parallelism and its mapping to cores from an offline view, especially for a program with online behaviour variation. Moreover, offline tuning is less precise. We present our work on dynamic control of thread parallelism and mapping. We address concurrency issues via Software Transactional Memory (STM). STM bypasses locks to tackle synchronisation through transactions. Autonomic computing offers designers a framework of methods and techniques to build autonomic systems with well‐mastered behaviours. Its key idea is to implement feedback control loops to design safe, efficient, and predictable controllers, which enable monitoring and adjusting controlled systems dynamically while keeping overhead low. We implement feedback control loops to automate management of threads and diminish program execution time.

Abstract Correctness of the behavior of an adaptive system during dynamic adaptation is an important challenge to realize correct adaptive systems. Dynamic adaptation refers to changes to both the functionality of the computational entities that comprise a composite system, as well as the structure of their interconnections, in response to variations in the environment, e.g., the load of requests on a server system. In this research, we view the problem of correct structural adaptation as a supervisory control problem and synthesize a reconfiguration controller that guides the behavior of a system during adaptation. The reconfiguration controller observes the system behavior during an adaptation and controls the system behavior by allowing/disallowing actions in a way to ensure that a given property is satisfied and a deadlock is avoided. The system during adaptation is modeled using a graph transition system and properties to be enforced are specified using a graph automaton. We adapt a classical theory of supervisory control for synthesizing a controller for controlling the behavior of a system modeled using graph transition systems. This theory is used to synthesize a controller that can impose both behavioral and structural constraints on the system during an adaptation. We apply a tool that we have implemented to support our approach on a case study involving https servers.

Dynamically reconfigurable hardware has been identified as a promising solution for the design of energy-efficient embedded systems. However, its adoption is limited by costly design effort, including verification and validation, which is even more complex than for nondynamically reconfigurable systems. In this article, we propose a tool-supported formal method to automatically design a correct-by-construction control of the reconfiguration. By representing system behaviors with automata, we exploit automated algorithms to synthesize controllers that safely enforce reconfiguration strategies formulated as properties to be satisfied by control. We design generic modeling patterns for a class of reconfigurable architectures, taking into account both hardware architecture and applications, as well as relevant control objectives. We validate our approach on two case studies implemented on FPGAs.

The ever growing complexity of software systems has led to the emergence of automated solutions for their management. The software assigned to this work is usually called an Autonomic Management System (AMS). It is ordinarily designed as a composition of several managers, which are pieces of software evaluating the dynamics of the system under management through measurements (e.g., workload, memory usage), taking decisions, and acting upon it so that it stays in a set of acceptable operating states. However, careless combination of managers may lead to inconsistencies in the taken decisions, and classical approaches dealing with these coordination problems often rely on intricate and ad hoc solutions. To tackle this problem, we take a global view and underscore that AMSs are intrinsically reactive, as they react to flows of monitoring data by emitting flows of reconfiguration actions. Therefore we propose a new approach for the design of AMSs, based on synchronous programming and discrete controller synthesis techniques. They provide us with high-level languages for modeling the system to manage, as well as means for statically guaranteeing the absence of logical coordination problems. Hence, they suit our main contribution, which is to obtain guarantees at design time about the absence of logical inconsistencies in the taken decisions. We detail our approach, illustrate it by designing an AMS for a realistic multi-tier application, and evaluate its practicality with an implementation.

This article presents a co-design methodology based on RecoMARTE, an extension to the well-known UML MARTE profile, which is used for the specification and automatic generation of Dynamic and Partially Reconfigurable Systems-on-Chip (DRSoC). This endeavor is part of a larger framework in which Model-Driven Engineering (MDE) techniques are extensively used for modeling and via model transformations, generating executable models, which are exploited by implementation tools to create reconfigurable systems. More specifically, the methodological aspects presented in this article are concerned with expediting the conception and implementation of the hardware platform and the integration of correct by construction reconfiguration controller. This article builds upon previous research by integrating previously separated endeavors to obtain a complete PR system generation chain, which aims at shielding the designer of many of the burdensome technological and tool-specific requirements. The methodology permits for the verification of the platform description at different stages in the development process (i.e., HDL for simulation, static FPGA implementation, controller simulation and verification). Furthermore, automation capabilities embedded in the flow enable the generation of the platform description and the integration of the reconfiguration controller executive seamlessly. In order to demonstrate the benefits of the proposed approach, we present a case study in which we target the creation of an image-processing application to be deployed onto an FPGA board. We present the required modeling strategies and we discuss how the generation chains are integrated with the back-end Xilinx tools (the most mature version of PR technology) to produce the necessary executable artifacts: VHDL for the platform description and a C description of the reconfiguration controller to be executed by an embedded processor.

This article presents the first framework to design and synthesize a formal controller managing dynamic reconfiguration, using a model-driven engineering methodology based on an extension of UML/MARTE. The implementation technique highlights the combination of hard configuration constraints using weights ( control part )—ensured statically and fulfilled by the system at runtime—and soft constraints ( decision part ) that, given a set of correct and accessible configurations, choose one of them. An application model of an image processing application is presented, then transformed and synthesized to be executed on a Xilinx platform to show how the controller, executed on a Microblaze, manages the hardware reconfigurations.

This paper presents a framework to integrate the formal synthesis of a reconfiguration controller into a Model Driven Engineering methodology used for reliable design of reconfigurable architectures. This methodology is based on an extension of UML/MARTE, GASPARD, and the aforementioned controller is obtained as a C code through a formal technique named Discrete Controller Synthesis. Taking advantage of using both modeling and synthesis techniques, the approach demonstrates an effective reduction of complexity in the specification of such reconfigurable systems. An application model of an image processing application is presented as a case study.

In the context of component-based embedded systems, the management of dynamic reconfiuration in adaptive systems is an increasingly important feature. The Fractal component-based framework, and its industrial instantiation MIND, provide for support for control operations in the lifecycle of components. Nevertheless, the use of complex and integrated architectures make the management of this reconfiguration operations difficult to handle by programmers. To address this issue, we propose to use synchronous languages, which are a complete approach to the design of reactive systems, based on behavior models in the form of transition systems. Furthermore, the design of closed-loop reactive managers of reconfigurations can benefit from formal tools like Discrete Controller Synthesis. In this paper we describe an approach to concretely integrate synchronous reconfiguration managers in Fractal component-based systems. We describe how to model the state space of the control problem, and how to specify the control objectives. We describe the implementation of the resulting manager with the Fractal/Cecilia programming environment, taking advantage of the Comete distributed middleware. We illustrate and validate it with the case study of the Comanche HTTP server on a multi-core execution platform.

This paper presents an operational semantics of the repetitive model of computation, which is the basis for the repetitive structure modeling (RSM) package defined in the standard UML Marte profile. It also deals with the semantics of an RSM extension for control-oriented design. The goal of this semantics is to serve as a formal support for i) reasoning about the behavioral properties of models specified in Marte with RSM, and ii) defining correct-by-construction model transformations for the production of executable code in a model-driven engineering framework.

We describe the extension of a reactive programming language with a behavioral contract construct. It is dedicated to the programming of reactive control of applications in embedded systems, and involves principles of the supervisory control of discrete event systems. Our contribution is in a language approach where modular discrete controller synthesis (DCS) is integrated, and it is concretized in the encapsulation of DCS into a compilation process. From transition system specifications of possible behaviors, DCS automatically produces controllers that make the controlled system satisfy the property given as objective. Our language features and compiling technique provide correctness-by-construction in that sense, and enhance reliability and verifiability. Our application domain is adaptive and reconfigurable systems: closed-loop adaptation mechanisms enable flexible execution of functionalities w.r.t. changing resource and environment conditions. Our language can serve programming such adaption controllers. This paper particularly describes the compilation of the language. We present a method for the modular application of discrete controller synthesis on synchronous programs, and its integration in the BZR language. We consider structured programs, as a composition of nodes, and first apply DCS on particular nodes of the program, in order to reduce the complexity of the controller computation; then, we allow the abstraction of parts of the program for this computation; and finally, we show how to recompose the different controllers computed from different abstractions for their correct co-execution with the initial program. Our work is illustrated with examples, and we present quantitative results about its implementation.

This paper presents an approach for the modeling and formalvalidation of high-performance systems. The approach relies on the repetitive model of computation used to express the parallelism of such systems within the Gaspard framework, which is dedicated to the codesign of high-performance system-on-chip. The system descriptions obtained with this model are then projected on the synchronous model of computation. The result of this projectionconsists of an equational model that allows one to formally analyze clock synchronizability issues so as to guarantee the reliable deployment of systems on platforms.

In this paper we study the application of a safe design methodology in the case of an automotive system. This methodology is based on a clear separation between control and data parts. It allows to facilitate the specification and to have a better readability. We present the advantages of this methodology on a GPS cruise control system.

Real-time control systems are complex to design, and automation support is important. We are interested in systems with multiple tasks, each with multiple modes, implementing a functionality with different levels of quality (e.g., computation approximation), and cost (e.g., computation time, energy). It is complex to control the switching of modes in order to insure properties like bounding cost while maximizing quality. We outline a technique for the automatic generation of such controllers involving an automaton-based formal model, and using optimal discrete control synthesis.

Robotic and control systems are ever more complex to design, program, as well as to operate. Existing theoretical work and tool support in discrete control synthesis can be applied to improve task-level robot programming. This requires to determine patterns of tasks and objectives, which are at once domain-specific to robotics, and generic enough to cover a broad class of control systems. We illustrate such a framework by a case study concerning the interactive discrete control of tasks in an excavating system.

Control systems for industrial automation feature real-time programs embedded in a variety of machines and processes, showing complexity and safety criticality. Standardization has led to the definition of the IEC 61131 design standard for Programmable Logic Controllers (PLCs). Its formalization for purposes of analysis and design tool support is an active research topic. The synchronous approach to real-time and reactive systems has resulted in formalisms and effective tools for the compilation, analysis and verification of specifications. With the motivation to give access to the latter; this paper presents a synchronous model of the PLC programming languages ST (Structured Text) and FBD (Function Block Diagrams), based on the language SIGNAL.

Robotic systems are of a growing size and complexity, hence their programming and execution architectures require more abstraction and tool support. Especially in safety-critical robotic systems (e.g., space robotics, robotic surgery) formal methods can be useful, when made useable by domain-specialists. We are particularly interested in discrete control synthesis. We propose a framework for integrating it in a robot programming environment, and consider its application to safe discrete teleoperation.

The languages for modeling reactive systems are of different styles, like the imperative, state-based ones and the declarative, data-flow ones. They are adapted to different application domains. This paper, through the example of the languages Statecharts and Signal, shows a way to give a model of an imperative specification (Statecharts) in a declarative, equational one (Signal). This model constitutes a formal model of the Statemate semantics of Statecharts, upon which formal analysis techniques can be applied. Being a transformation from an imperative to a declarative structure, it involves the definition of generic models for the explicit management of state (in the case of control as well as of data). In order to obtain a structural construction of the model, a hierarchical and modular organization is proposed, including proper management and propagation of control along the hierarchy. The results presented here cover the essential features of Statecharts as well as of another language of Statemate: Activitycharts. As a translation, it makes multiformalism specification possible, and provides support for the integrated operation of the languages. The motivation lies also in the perspective of gaining access to the various formal analysis and implementation tools of the synchronous technology, using the DC1 exchange format, as in the Sacres programming environment.

This paper presents an experiment with the synchronous approach to reactive systems programming, and particularly the Signal language, applied to a significant problem in robot vision: active visual reconstruction. This application consists of the specification of a system dealing with various domains such as robot control, computer vision and transitions between different modes of control. It illustrates the adequacy in such domains of Signal, a data flow programming language and environment. The programming environment features tools for formal specification, analysis, consistency checking and code generation. Signal and its language-level extension for task preemption SignalGTi are used at the different levels of the application: data-flow function for the camera motion control (visual servoing), reconstruction method (in parallel to visual servoing, involving the dynamical processes), and reconstruction of complex scenes (with transitions between several robotics tasks). The combination of these levels constitutes a hybrid behavior with (sampled) continuous control and discrete transitions. These techniques are validated experimentally by an implementation on a robotic cell. © 1997 by John Wiley & Sons, Ltd.

In this paper, we apply the synchronous approach to real time active visual reconstruction. It illustrates the adequateness of SIGNAL, a synchronous data flow programming language, for the specification of a system dealing with various domains such as robot control, computer vision and the programming of hierarchical parallel automata. More precisely, our application consists in the 3D structure estimation of a set of geometrical primitives using a camera mounted on the end effector of a six dof robot. At the level of camera motion control, the visual servoing approach is specified and implemented in SIGNAL as a function from sensor inputs to control outputs. The 3D reconstruction method is based on the "structure from controlled motion" approach. Its specification is made in parallel to visual servoing. We also present a perception strategy for connecting up several estimations, using time intervals and hierarchical structures for task preemption in SIGNAL. The integration of these techniques is validated experimentally by their implementation on a robotic cell.

A robotic application is defined by a set of scheduled actions, each action being modeled as a robot-task with functional and behavioral aspects. The authors propose a programming approach located at an intermediary level between objective and object levels, called the task-level. The basic feature consists of using a synchronous language (Esterel) as the target language of an application programming language that is able to express in a natural way the logical and temporal dependencies of the actions. The synchrony assumption induces the need for the design of a synchronous/asynchronous interface to be associated with the computer system. This aspect is considered. The proposed language is presented, and an example of a robotic application is given.>