SYSTEM FOR FORMALLY SUPERVISING COMMUNICATIONS

Abstract

The present invention relates to a system for formally monitoring communications of a set of specific applications of a platform, comprising: an acquisition module (9) configured to acquire a formal model (13) of a data stream describing the behaviour of a group of participants modelling said set of specific applications, and a communication specification (15) describing software implementations implementing the applications modelled by said participants, said software implementations being configured to call up predetermined communication functions, and a monitoring module (11) configured to verify that a sequence for calling up said communication functions complies with the expected behaviour of said group of participants.

Claims

1. A system for formally supervising communications of a set of concrete applications of a platform, characterised in that it comprises: an acquisition module configured to acquire a formal model of a data stream comprising a set of actors exchanging quantifiable information with each other through unidirectional communication channels, said formal model describing the behaviour of said set of actors modelling said set of concrete applications, and a communication specification describing software implementations implementing the applications modelled by said actors, said software implementations being configured to make calls to predetermined communication functions relating to the programming interface of said platform, and a supervisory module configured to verify that a sequence of calls to said communication functions is in accordance with the expected behaviour of said set of actors.

2. The system according to claim 1, characterised in that the supervisory module is configured to construct an automaton for each software implementation corresponding to an actor, each automaton comprising a set of states whose transition from one state to another is triggered by a call from the software implementation to one of said communication functions, said automaton relying on the behaviour expected by the formal model to trace the valid call sequences to said communication functions.

3. The system according to claim 2, characterised in that each automaton comprises a first part associated with the initialisation of the software implementation and a second part associated with the operation of the software implementation, the transition from a final state of said first part to an initial state of said second part being triggered when a synchronisation signal is received by the software implementation, indicating the execution of a concrete application.

4. The system according to claim 2, characterised in that the supervisory module is configured to generate software elements configured to capture calls to communication functions and to make sure that the sequence of calls made upon executing a concrete application corresponds to the sequence defined by the automaton.

5. The system according to claim 4, characterised in that the software elements comprise an extended function for each of the communication functions, an input data deadline management function, and a current activation management function.

6. The system according to claim 1, characterised in that the communication specification is a specification of a service-oriented implementation.

7. The system according to claim 1, characterised in that the communication functions are service-oriented and comprise a service offering function, an interface publishing function, a published interface subscription function, an emitting function, a receiving function, a requesting function, and a processing function on an interface.

8. The system according to claim 1, characterised in that the formal model comprises a set of configuration data required for the implementation of said actors.

9. The system according to claim 8, characterised in that the configuration data comprises for each of the actors: budget, initial delay, initial deadline, input deadline, default input policy, persistent/ephemeral indicator, and strict/relaxed indicator data.

10. The system according to claim 1, characterised in that the communication specification comprises links between software implementations and actors in the formal model.

11. A real-time on-board equipment, designed using the supervisory system according to claim 1, characterised in that said on-board equipment is configured to receive measurements specific to its environment and to deliver results actuating functional operations.

12. The equipment according to claim 11, characterised in that said equipment is an autonomous or non-autonomous vehicle of the land, rail, aerospace or naval type.

13. A method for formally supervising communications of a set of concrete applications, characterised in that it comprises the following steps of: acquiring a formal model of a data stream comprising a set of actors exchanging quantifiable information with each other through unidirectional communication channels, said formal model describing the behaviour of a set of actors modelling said set of concrete applications, and a communication specification describing software implementations implementing the applications modelled by said actors, said software implementations being configured to make calls to predetermined communication functions relating to the programming interface of said platform, and verifying that a sequence of calls to said communication functions is in accordance with the expected behaviour of said set of actors.

Description

BRIEF DESCRIPTION OF THE FIGURES

[0030] Further features and advantages of the device and method according to the invention will become clearer upon reading the description given below, by way of indicating and in no way limiting purposes, with reference to the appended drawings in which:

[0031] FIG. 1 schematically illustrates a system for formally supervising communications of a set of concrete applications of a platform, according to one embodiment of the invention;

[0032] FIG. 2 schematically illustrates an example of a formal model defined by a graph according to one embodiment of the invention;

[0033] FIGS. 3A-3C schematically illustrate correspondence between actors of the formal model and description of service-oriented interfaces of the communication specification, according to one embodiment of the invention; and

[0034] FIGS. 4A and 4B schematically illustrate the construction of an automaton, according to one embodiment of the invention.

DETAILED DESCRIPTION OF THE INVENTION

[0035] The principle of the present invention is to supervise data exchanges between computational tasks implementing components specified in a formal methodology in order to observe data exchanges in accordance with the formal specification.

[0036] FIG. 1 schematically illustrates a system for formally supervising communications of a set of concrete applications of a platform, according to one embodiment of the invention.

[0037] The formal supervisory system 1 is implemented by hardware means comprising an information processing machine such as a calculator or computer 3 comprising a microprocessor 5 and memories 7. The microprocessor 5 is configured to execute one or more computer programs comprising program code instructions, stored in the memories 7 of the computer and designed to implement the system for formally supervising communications of a set of applications.

[0038] The supervisory system aims at performing formal supervision of communications of a set of concrete applications of a platform. In accordance with the invention, the supervisory system comprises an acquisition module 9 and a supervisory module 11.

[0039] The acquisition module is configured to acquire a formal model 13 of a data stream describing the behaviour of a set of actors modelling the set of concrete applications. Furthermore, the acquisition module 9 is configured to acquire a communication specification 15 describing software implementations implementing applications modelled by the actors. The software implementations are configured to make calls to predetermined communication functions.

[0040] The supervisory module 11 is configured to verify that a sequence of calls to the communication functions is in accordance with the expected behaviour of the set of actors.

[0041] The formal model 13 of a data stream comprises independent actors exchanging quantifiable information with each other through unidirectional communication channels. Actors can be software entities (for example applications) and/or hardware entities (for example sensors, cameras, probes, microprocessors, etc.). Each actor is configured to wait until it has received a statically specified amount of data on its input channels in order to consume that amount of data, to perform (or not) processing of that data, and to produce a statically specified amount of data on its output channels to new actors, and each repeating this behaviour indefinitely. The consumption/processing/emission process is commonly referred to as an activation.

[0042] Each activation takes place according to predefined reconfigurations, and for a given reconfiguration, the activation will either consume/process/produce (so-called execute) or do nothing (so-called pass), and the choice to change configuration is unpredictable.

[0043] Each actor activates according to the predefined reconfigurations in time (called real-time) windows with possible frequency constraints (or equivalently with period constraints).

[0044] Furthermore, the communication specification 15 includes information on the applications, the services they offer, the services they use, the type of data that will transit on the channels, information on interactions between the different applications, the link or correspondence between the applications of the platform and the actors of the formal model, etc.

[0045] The supervisory module 11 is a code generation tool that takes as input the configuration coming from the formal methodology (i.e. formal model 13) and the description of the applications of the communication specification 15, and automatically generates a supervision software layer in charge of observing the communications carried out by the implementations of the actors, and possibly correcting deviations from the formal specification.

[0046] The supervisory system 11 according to the invention thus provides means to automatically integrate actor implementations, written in any existing language, on a heterogeneous distributed platform.

[0047] The potential applications of this supervisory system are numerous, given that targeted architectures are used in many fields such as the Internet, automobile, aviation, meteorology, etc.

[0048] In particular, the invention applies to a heterogeneous distributed platform for an on-board system or device where the compliance to the expected behaviour is considered very important for the safety and proper functioning of the equipment provided with such a system.

[0049] Recent real-time on-board systems for autonomous vehicles are an example of such systems where entities provide generic interfaces to allow concrete applications to exchange data with each other, each application being independent and running on a computer of a distributed architecture. The connections between applications can be reconfigured according to the current operating mode of the vehicle, and/or the availability of services.

[0050] In the following, the invention will be described in detail by referring to a system modelled by a formal model comprised of a set of actors and by giving a description of the behaviour expected by the model.

[0051] Indeed, FIG. 2 schematically illustrates an example of a formal model defined by a graph according to one exemplary embodiment of the invention.

[0052] According to this example, the formal model 13 comprises an “Acquisition” actor acquiring data supplied by a sensor at 30 Hz and a “Command” actor sending a command to an actuator at 10 Hz. The command is determined according to the result of a reconfigurable processing chain consisting of a “Preprocess” actor carrying out a pre-processing of the data in all possible reconfigurations, and in one reconfiguration, a “Fast Process” actor carrying out a fast and low definition processing of the pre-processed data, and in the other reconfiguration, a “Hi-Quality Process” actor carrying out a slow and high definition processing. The choice of the current reconfiguration is made by a “Mode” actor which preferably uses high-definition processing when available.

[0053] The graph models a data stream with frequency constraints, different reconfiguration modes and initial data available for initial consumption. The circles a.sub.1-a.sub.5 represent so-called generic actors that perform processing on the data. These generic actors a.sub.1-a.sub.5 are thus adapted to consume data, perform calculations to transform the data and produce results. The triangles a.sub.6 and a.sub.7 represent actors called “Clock” a.sub.6 or “Deadline” a.sub.7 which produce and consume data with frequency constraints. The square a8 represents a “Mode” actor a.sub.8 in charge of signalling reconfigurations. The directed arcs c.sub.1-c.sub.10 are unidirectional channels each indicating a data stream between two actors and the associated numerical values giving the amount of data produced or consumed on the channel.

[0054] According to this example, the modelled system is comprised of five generic actors a.sub.1-a.sub.5 (Acquisition a.sub.1, Preprocess a.sub.2, Fast Process a.sub.3, Hi-Quality Process a.sub.4 and Command a.sub.5) two temporal actors a.sub.6 and a.sub.7 (Clock and Deadline) and one Mode actor a.sub.8. The “Acquisition” actor a.sub.1 acquires data provided by the clock actor a.sub.6 at 30 Hz. The Command actor a.sub.5 sends a command to the Deadline actuator actor a.sub.7 at 10 Hz. The command is determined according to the result of a reconfigurable processing chain consisting of another generic “Preprocess” actor a.sub.2 performing a preprocessing of the data produced by the acquisition actor a.sub.1 in all possible reconfigurations. In a first configuration (mode noted by λ.sub.1), the “Fast Process” actor a.sub.3 (fast actor) performs fast and low definition processing of the data preprocessed by the preprocessing actor a.sub.2. In the second reconfiguration (mode denoted by λ.sub.2), the “Hi-Quality Process” actor a.sub.4 (slow actor) performs slow but high definition processing. Thus, the data processing path of the first configuration λ.sub.1 is the path connecting the acquisition actor a.sub.1 to the preprocessing actor a.sub.2, to the fast processing actor a.sub.3 and then finally to the control actor a.sub.5. The second configuration λ.sub.2 is defined by the path connecting the acquisition actor a.sub.1 to the preprocessing actor a.sub.2, to the slow processing actor a.sub.4 and then finally to the control actor a.sub.5. Thus, the configuration propagates from one actor to another and therefore no centralized synchronisation on these reconfiguration modes is necessary. Each actor will communicate to its neighbour the configuration mode in which it should operate. The choice of the current configuration is made by the mode actor a.sub.3 which preferably uses high definition processing when available.

[0055] According to this example, the fast processing actor a3 consumes a piece of data on its input channel c.sub.3 (represented on channel c.sub.3 by a “1”) and produces a piece of data on its output channel c.sub.4 (represented on channel c.sub.4 by a “1”) each time it is activated. The same applies to the slow processing actor a.sub.4, which consumes a piece of data on its input channel c.sub.5 and produces a piece of data on its output channel c.sub.6. The control actor a.sub.5 consumes a piece of data on its first input channel c.sub.4 or on its second input channel c.sub.4 (depending on the configuration mode) and produces a piece of data on its output channel c.sub.2 each time it is activated. The pre-processing actor a.sub.2 consumes a piece of data on its first input channel c.sub.1 and a piece of data on its second input channel c.sub.9 each time it is activated, and produces a piece of data on its first output channel c.sub.3 or on its second output channel c.sub.5 (depending on the configuration mode).

[0056] On the other hand, the acquisition actor a.sub.1 consumes a rational number of data on its input channel c.sub.2 (represented on the input channel c.sub.2 by the value “⅓”) and produces a rational number of data on its output channel c.sub.1 (represented on the output channel c1 by the value “⅓”). This means that the acquisition actor a.sub.1 consumes or produces a piece of data every three activations. The example in FIG. 2 shows that in the initial state, there is a token T1 (i.e. a piece of data) available on channel c.sub.2 (between the control actor a5 and the acquisition actor a.sub.1). Then, the acquisition actor a.sub.1 will consume this existing piece of data on this channel c.sub.2 and will produce a piece of data on its output channel c.sub.1 (i.e. the channel c.sub.1 connecting the acquisition actor a.sub.1 to the pre-processing actor a.sub.2). Thus, the acquisition actor a.sub.1 has consumed a piece of data and produced a piece of data. However, on its next two activations, it will consume zero data and produce zero data. In other words, the acquisition actor a.sub.1 consumes a piece of data and produces a piece of data every three activations. This makes it possible to synchronise data between two actors operating at different frequencies without any loss of data. Indeed, according to this example, the acquisition appears three times for each command, thus allowing the transfer of data between the acquisition actor a.sub.1 operating at 30 Hz and the command actor a5 operating at 10 Hz without any loss of data.

[0057] In the following, the elements defining the formal model 13 are summarised with reference to the example in FIG. 2. According to this formalism, the specification of a data stream consists of the following elements F1-F9:

[0058] F1: The set of generic actors a.sub.1-a.sub.5 that process data, and the set of mode actors a.sub.6 and a7 that process data and/or select configuration modes are defined.

[0059] F2: The set of channels c.sub.1-c.sub.10 connecting the actors to each other is defined, each actor being associated with at least one input or output channel.

[0060] F3: The number of data produced or consumed by each actor for each of its input or output channels is defined, with the advantage that it is possible for a channel to have only one of these numbers be a rational number. These numbers are represented by the values on the arcs c.sub.1-c.sub.10 connecting the actors.

[0061] F4: For each mode actor a.sub.8 of a non-empty set of modes, the mode actor a.sub.8 being in charge of dynamically choosing one and only one of these modes for each of its activations (these modes are noted λ.sub.1 and λ.sub.2). The choice of the current configuration is advantageously made by a single a.sub.8 mode actor and this current configuration is propagated in a distributed manner from one actor to another.

[0062] F5: For each generic actor a1-a5, the set of modes in which it executes, and the implicit set of all other modes through which it passes are defined. It will be noted that the set of modes in which a generic actor executes is either a nominal mode common to the whole system, or a subset of the modes chosen by mode actors. In the example of FIG. 2, all actors except the preprocessing a.sub.2, fast processing a.sub.3 and slow processing a.sub.4 actors execute in the nominal mode insofar as the preprocessing actor a.sub.2 executes in modes λ.sub.1 and λ.sub.2, the fast processing actor a.sub.3 executes in mode λ.sub.1, and the slow processing actor a.sub.4 executes in mode λ.sub.2.

[0063] F6: Given the different modes, an implicit set of feedback channels is defined as the set of channels connecting two generic actors each executing in at least one of the modes chosen by the same mode actor, and such that there is a non-repeating path starting from the mode actor and ending with the producing actor on that channel, passing through a consuming actor.

[0064] F7: Maximum frequency constraints are defined for some generic or mode actors. One possible way of expressing them is by so-called clock actors a.sub.6 with which a frequency is associated. In the example in FIG. 2, the acquisition actor a.sub.1 has a maximum frequency constraint of 30 Hz, expressed by the clock actor a.sub.6 with a frequency of 30 Hz, and the arc c.sub.7 connecting them and the associated amounts of data.

[0065] F8: Minimum frequency constraints are defined for some generic or mode actors. One possible way of expressing them is by means of so-called deadline actors a.sub.7, to which we associate a frequency. In the example in FIG. 2, the control actor a2 has a minimum frequency constraint of 10 Hz, expressed by the deadline actor a.sub.7 with a frequency of 10 Hz, the arc c.sub.8 connecting them and the associated amounts of data. It will be noted that the same actor can be constrained to operate at a minimum and maximum frequency, in which case it is an exact frequency constraint. In other words, a frequency constraint is either maximum (no more than a number of times per second), minimum (at least a number of times per second) or exact (exactly a number of times per second).

[0066] F9: An initial state of the system comprised per channel of a rational number and a sequence of modes with a length equal to this rational number rounded down to the nearest whole number, and per generic actor of its initial mode. In the example of FIG. 2, all actors have the nominal mode as their initial mode, and the channels marked with a small circle T1 and T2 have an initial state of value “1”. Of course, the initial state can be expressed by any rational number (for example ⅖; 4/3; etc.) and this results from the fact that the production and consumption rates are rational according to one advantageous embodiment of the invention.

[0067] The following table Tab. 1 gives by way of example the configuration data required for an implementation of the formal model 13 of FIG. 2.

TABLE-US-00001 TABLE 1 Fast Hi-Quality Actor Acquisition Preprocess process Process Command Budget (ms) 10 30 30 40 20 Initial delay (ms) 0 0 0 0 0 Initial deadline (ms) 0 0 0 0 110 Input deadline (ms) 5 20 50 50 90 Default input policy Ignore Previous Ignore Ignore Previous Persistent/Ephemeral Persistent Persistent Persistent Persistent Persistent Strict/Relaxed Strict Strict Strict Strict Strict

[0068] The first row represents the five generic actors: Acquisition a.sub.1, Preprocess a.sub.2, Fast Process a.sub.4, Hi-Quality Process a.sub.4 and Command a.sub.5 actors.

[0069] The second, third, fourth, and fifth rows indicate values in ms, of a budget, an initial delay, an initial deadline, and an input deadline respectively. The sixth, seventh, and eighth lines indicate a default input policy, a persistent/ephemeral indicator, and a strict/relaxed indicator.

[0070] The values are usually imposed by the platform integrator and are given here as examples only. The budget designates the duration in ms allocated to each actor to do its different tasks. The initial delay and the initial deadline indicate the time needed for the communication and production of the samples in order to take the routing and processing of the different samples into account. An initial delay of zero means that there is no forced latency constraint and the actor starts as soon as it is ready. The input deadline designates the arrival deadline for data consumed by actor implementations and thus allows an actor to be allocated a waiting time to wait for its intended data before starting work.

[0071] The default input policy in this example refers to two types of policies. When there is no input data, the “Ignore” policy does not produce replacement data, and the “Previous” policy copies the last input received. Alternatively, a third “Default” policy can be set up which systematically produces a same default value.

[0072] Another input configuration piece of data can possibly relate to whether a lack of production is designated as a fault or not. In the example of FIG. 2, only the absence of output from the Command actor to the Acquisition actor is not considered as a fault, as the calibration request is not mandatory.

[0073] Furthermore, in the following description, a formal communication supervisory system in a service-oriented architecture will be more particularly discussed. In other words, the communication specification 15 is a specification of a service-oriented implementation and the communication functions are service-oriented functions.

[0074] As an example, it is considered that the service-oriented architecture is comprised of three services: AcquisitionService, PreprocessService, and ProcessService. Each service provides the following interfaces: [0075] AcquisitionService publishes an AcquisitionService::Samples interface producing sensor samples, and offers an AcquisitionService::Calibrate interface to process calibration requests; [0076] PreprocessService publishes an interface producing the pre-processed samples, and to implement reconfigurations, this interface is duplicated into PreprocessService::Samples1 and PreprocessService::Samples2 interfaces, which will be used according to the current reconfigurations; and [0077] ProcessService publishes a ProcessService::Samples interface producing the samples processed.

[0078] The implementations of each service are identified by a unique identifier. There is an implementation Acq1 of AcquisitionService, an implementation Pre1 of PreprocessService, and two implementations Proc1 and Proc2 of ProcessService. There is also a client-only implementation Com1. The link between these implementations and the actors in the model is given in the following Table 2.

TABLE-US-00002 TABLE 2 Software implementation Model actor Acq1 Acquisition Pre1 Preprocess Proc1 Fast Process Proc2 High-quality Process Com1 Command

[0079] The software implementing the five actors of the model can be made by different software providers. This software makes calls to communication functions to establish service-oriented communications.

[0080] As an example, the communication functions relating to the programming interface of the Adaptive automotive platform AutoSAR described in documents [4, 5] are described below. These communication functions include a service offering function (OfferService), an interface publishing function (PublishInterface), a published interface subscribing function (SubscribeInterface), an emission function (Emit), a receiving function (Receive), a request function (Request), and an interface processing function (Process).

[0081] The OfferService function (service identifier) enables the calling software to be identified as the implementation associated with the identifier.

[0082] The PublishInterface (interface identifier) function allows the calling software to give access to the interface associated with the identifier for other software.

[0083] The SubscribeInterface (service identifier, interface identifier) function allows the calling software to receive data emitted by the software associated with the service identifier through the interface associated with the interface identifier.

[0084] The Emit (interface identifier, piece of data) function allows the calling software to emit the provided piece of data through the interface associated with the interface identifier; this is equivalent to producing a token in the formal model 13 of data stream.

[0085] The Receive function (service identifier, interface identifier) allows the calling software to look up the data sent through the interface associated with the identifiers since the last call to Receive; this is equivalent to the consumption of as many tokens as data consulted in the formal model 13 of data stream.

[0086] The Request (service identifier, interface identifier, parameters) function allows the calling software to send a processing request associated with the interface identifier to the software associated with the service identifier, for processing the given parameters, and to retrieve a possible result once the request has been processed; this is equivalent to the production of a token in the formal model 13 of data stream, and the retrieval of the result is equivalent to the consumption of a token.

[0087] The function Process (interface identifier) allows the calling software to retrieve parameters of a request received on the identified interface, to perform the required processing, and eventually to emit a result to the software that sent the request; retrieving the request is equivalent to consuming a token in the formal model 13 of data stream, while emitting a result is equivalent to producing a token.

[0088] FIGS. 3A-3C schematically illustrate the correspondence between actors of the formal model and the description of the service-oriented interfaces of the communication specification, according to one embodiment of the invention.

[0089] More particularly, FIG. 3A shows the correspondence between the graph topology of the formal model 13 and the service-oriented interfaces for offering a service, publishing an interface, and subscribing to a published interface. For illustrative purposes, in this example only two actors Acquisition a1 and Preprocess a2 are considered. The software Acq1 which performs the behaviour of the Acquisition a1 actor will publish Publishinterface(Smples) interfaces corresponding to the acquisition service. More particularly, the software Acq1 will call the OfferService function and then it will call the PublishInterface function creating a connection port on which the data will be published. Then, the software Pre1 implementing the Preprocess actor a2 will call the SubscribeInterface function to subscribe to the interface of the software Acq1 in order to consume the produced samples. FIG. 3A thus makes the connection between these different elements and allows the data stream graph to be redrawn as the calls to the functions are done. It will be noted that FIG. 3A relates to an initialisation phase for verifying that the communications actually correspond to the graph of the formal model 13 of FIG. 2. Once the graph is constructed, a second operating phase described by FIG. 3B begins.

[0090] Indeed, FIG. 3B shows the correspondence between the production/consumption on a channel of the graph of the formal model 13 and the data emission/reception on a service-oriented interface. Software Acq1 will regularly call the Emit function on its interface and it will provide a concrete piece of data on this interface. The software Pre1 implementing the Preprocess actor will call the Receive function to consume this piece of data.

[0091] FIG. 3C shows the correspondence between production/consumption on a channel of the graph of the formal model 13 and sending a request and processing on a service-oriented interface. More particularly, the software Com1 implementing the Command actor sends a request with parameters and the request identifier, which corresponds to the production of a token in the graph of the formal model of FIG. 2. On the other hand, the software Acq1 of the Acquisition actor will call the Process function to process the request on its interface.

[0092] The expected behaviour for the actor implementations in the example of FIGS. 3A-3C is as follows: [0093] Acq1: with the configuration described above, the example formal model 13 in FIG. 2 determines that the Acquisition actor has three successive activations such that the first one has to take place between 0 ms and 20 ms, has to produce a token on its output channel and consume a token on its input channel. The next two activations do not communicate. Thus, the expected behaviour for the implementation is to call the Emit function on the AcquisitionService::Samples interface once and to call the Process function in order to process a request for the AcquisitionService::Calibrate interface between 0 ms and 20 ms. This behaviour has to be repeated between 100 ms and 120 ms, 200 ms and 220 ms, etc. [0094] Pre1: with the configuration described above, the example of formal model 13 in FIG. 2 determines that the Preprocess actor has an activation that has to take place between 0 ms and 50 ms, has to consume a token on its input channel and produce a token containing data on one of the output channels, and a token containing no data on the other channel. To take possible reconfigurations into account, this implementation verifies whether the implementation Proc2 has called the OfferService function. Thus, the expected behaviour for the implementation is to call the Receive function on the Samples interface of Acq1 in order to look up a piece of data, and to call the Send function once either on its Samples1 interface or on its Samples2 interface, between 0 and 50 ms. This behaviour has to be repeated between 100 ms and 150 ms, 200 ms and 250 ms, etc. [0095] Proc1: With the configuration described above, the example of formal model 13 in FIG. 2 determines that the Fast Process actor has an activation that has to consume a token on its input channel and produce a token on its output channel, this token containing either data or no data. Thus, the expected behaviour for this implementation is to call the Receive function on the Samples1 interface of Pre1 in order to look up one or zero piece of data, and to call the Emit function on its Samples interface once, and only if data has actually been received, and this between 0 and 90 ms. This behaviour has to be repeated between 100 ms and 190 ms, 200 ms and 290 ms, etc. [0096] Proc2: the expected behaviour is the same as Proc1 except that the interface for Receive is the Samples2 interface of Pre1. [0097] Com1: with the configuration described above, the example of formal model 13 in FIG. 2 determines that the Command actor has an activation that has to consume a token containing data on one of its input channels, and a token containing no data on the other, to produce a token on its output channel. Thus, the expected behaviour for this implementation is to call the Receive function on the Samples interface of Proc1 and Proc2, so as to look up a piece of data on either of them, and optionally to call the request function on the Calibrate interface once, between 0 ms and 110 ms. This behaviour has to be repeated between 100 ms and 210 ms, 200 ms and 310 ms, etc.

[0098] Once the description of an actor is defined, the supervisory module 11 takes this description as input and verifies that a call sequence to the service-oriented communication functions is in accordance with the expected behaviour of the actor.

[0099] It will be noted that the supervisory module 11 can be implemented according to different techniques using, for example, automata, trees, lists, code choices with nested conditions, regular expressions with a grammar, etc.

[0100] However, in the following description, a code generation technique based on automata is considered as an example. Thus, the supervisory module 11 constructs an automaton describing the expected behaviour for the implementation, in which the transitions correspond to a call to one of the communication functions described above.

[0101] More particularly, the supervisory module 11 is configured to construct an automaton for each software implementation corresponding to an actor, each automaton comprising a set of states whose transition from one state to another is triggered by a call from the software implementation to one of the communication functions. The automaton relies on the behaviour expected by the formal model to trace valid call sequences to the communication functions of the software implementation.

[0102] An example of the construction of such an automaton would be that of an automaton divided into two parts, one corresponding to the initialisation of the software implementation, the other to its operation once initialised, connected by a transition allowed only after the synchronised start of the platform.

[0103] Indeed, FIGS. 4A and 4B schematically illustrate the construction of the first and second parts of an automaton, according to one embodiment of the invention.

[0104] More particularly, FIG. 4A shows the construction of the first part of the automaton. This construction starts from an initial state and arrives at a final state through a number of intermediate states and transitions triggered when: [0105] the implementation calls the OfferService function with a service identifier associated with this implementation; [0106] the implementation calls the PublishInterface function with an interface identifier corresponding to the interface of a service for which a call to OfferService has brought to the current state; [0107] the implementation calls the SubscribeInterface function with an interface and service identifier corresponding to an expected connection to the software associated with that service identifier.

[0108] More particularly, the example in FIG. 4A represents the initialisation automaton generated for the implementation Pre 1 of the Preprocess actor a.sub.2 in the example in FIG. 2. In the initialisation phase, the implementation is in an initial state EI0 (referred to by a black circle). The automaton can call any function, but until it calls the OfferService function, it is not recognised as the implementation Pre 1 of the Preprocess actor. Once it is identified as the implementation Pre 1 of the Preprocess actor, it can publish either the Samples1 or Samples2 interface to the Ell state. If it started by publishing the Samples1 interface, it then publishes the Samples2 interface (state EI2). On the other hand, if it started by publishing the Samples2 interface, it then publishes the Samples1 interface (state EI3). Once it has published these interfaces, it can then subscribe to the interface Acq1 (state EI4) and finally, in state EI5, it is considered to have finished.

[0109] In this case, a transition from the final state of the first part of the automaton to the initial state of the second part is possible when a synchronisation signal is received by the implementation, indicating the execution of a concrete application on the platform (i.e. indicating a system start).

[0110] Furthermore, according to the example in FIG. 4B, the construction of the second part of the automaton starts from an initial state of the second part, and returns to this state through a number of intermediate states and transitions triggered when: [0111] the implementation calls the Emit function with a previously published interface identifier, and the amount of data already emitted does not exceed that expected for that interface; [0112] the implementation calls the Receive function with a previously subscribed interface identifier, and the amount of data already received does not exceed that expected for that interface; [0113] the implementation calls the Request function with a service and interface identifier corresponding to an output channel in the model, and the number of requests already sent does not exceed that expected for this interface; [0114] the implementation calls the Process function with an interface identifier corresponding to an input channel in the model, and the number of requests already processed does not exceed that expected for this interface; [0115] the deadline for the current activation has passed.

[0116] More particularly, the example in FIG. 4B represents the operating automaton generated for the implementation Pre 1 of the Preprocess actor.

[0117] In the initial operating state EF0 (represented by a black circle), the automaton can call the Receive function and as long as it does not receive a sample, it returns to the initial state EF0.

[0118] Once it calls the Receive function and receives a sample, the automaton will transition to the state EF1. In the state EF1, the automaton will either transmit a sample on the Samples1 interface or emit a sample on the Samples2 interface before returning to its initial state EF0. However, if in the state EF1, a deadline violation is detected, then the automaton returns directly to its initial state EF0.

[0119] On the other hand, if instead of starting with Receive, the automaton starts by calling the Emit function, the automaton will transition to the state EF2. In the state EF2, the automaton will either emit a sample on the Samples1 interface or emit a sample on the Samples2 interface before returning to its initial state EF0. Furthermore, as long as it does not receive a sample, it returns to the state EF2. As before, if in the state EF2 a deadline violation is detected, then the automaton returns directly to its initial state EF0.

[0120] Thus, the operating automaton created for the implementation Pre 1 describes sequences of valid communication functions corresponding to the behaviour of its Preprocess actor.

[0121] Once this automaton is constructed, the supervisory module generates software elements configured to capture the communication function calls and to make sure that the sequence of calls made upon executing a concrete application corresponds to the sequence defined by the automaton.

[0122] The software elements include the following software elements: [0123] An extended function for each of the communication functions described above. Each time a software call is made, each extended function queries the automaton to determine if there is an outgoing transition from the current state corresponding to that call. If there is such a transition, the extended function makes the call to the original function. If not, the extended function registers a fault if necessary, and returns immediately after fault handling if it allows it. A particular case relates to the Receive function, for which the number of accessed data is not known in advance. The extended version of this function makes sure that, at most, the specified amount of data is available to the application, any additional data is buffered waiting for the next activation when it is made available. Thus, multiple calls to Receive are possible for a single activation, but the number of data looked up never exceeds that specified. [0124] A function for managing the deadline of input data. At each passage through the initial state, the deadline for receiving input data for the next activation is computed and the function is programmed to be called on that date. If the function is called in this way, it records a fault if necessary and implements the fault handling policy. For example, in the case of the implementation Pre1, the value of the last sample received is made available as if it had been received. [0125] A function for managing the deadline of the current activation. At each passage through the initial state, the deadline for the next activation is computed and the function is programmed to be called on that date. If the function is called in this way, it updates the current state of the automaton to start a new activation and returns immediately after the fault management if it allows it.

[0126] The supervisory module is configured to also generate software in charge of allowing the transition from the initialisation phase to the operation phase of all implementations of the platform. As long as the supervisory module does not authorise the synchronised start-up, the actor implementation software cannot enter the operating phase. This code can, for example, wait for a subset of software to be ready to go into operation, or manage a time deadline. This code relies on existing technologies for time synchronisation between software, generally available on service-oriented software platforms.

[0127] Thus, the present invention allows, from a standard programming interface that makes calls to standard functions, to make sure that the calls are made in the correct order and in accordance with the expected behaviour without modifying the programming interface software. This allows an integrator to be supplied by standard software suppliers while using its own methodology.

[0128] The present invention is applicable to all data stream systems. A first application relates to real-time critical distributed systems. In particular, a real-time on-board system of equipment, configured to receive measurements specific to the equipment and its environment and to deliver results actuating operations for that equipment to properly operate. The equipment may be an autonomous or non-autonomous vehicle of the land, rail, aerospace or naval type.

[0129] In particular, within the scope of a vehicle data stream system, it is advantageous according to the invention to have sensors and processors operating at different frequencies and in different configurations. Furthermore, it can be considered as an example that for a car with a driver, the detection of pedestrians is interesting from a certain speed. Thus, different reconfiguration modes can be used so that the pedestrian detection processing takes place from a certain speed or over a certain range of speeds allowing the microprocessor not to unnecessarily consume execution resources outside this range.

[0130] A second application relates to FPGA systems for real-time criticality: an FPGA system is a data stream timed by clocks that trigger processing units, and in which the routing of data can change dynamically.

[0131] A third application relates to a system of an industrial process configured for the industrial manufacture of objects according to particular throughput constraints and according to a reconfigurable process. Indeed, an industrial manufacturing method can be seen as a data stream, with flow constraints for technical reasons.

BIBLIOGRAPHIC REFERENCES

[0132] 1. X. K. Do, S. Louise and A. Cohen, Transaction Parameterized Dataflow: A model for context-dependent streaming applications, 2016 Design, Automation & Test in Europe Conference & Exhibition (DATE), Dresden, 2016, pp. 960-965. [0133] 2. Haitao Wei, Stéphane Zuckerman, Xiaoming Li, Guang R. Gao, A Dataflow Programming Language and its Compiler for Streaming Systems, Procedia Computer Science, Volume 29, 2014, Pages 1289-1298, ISSN 1877-0509. [0134] 3. Gustav Cedersjö and Jörm W. Janneck. Software code generation for dynamic dataflow programs. In Proceedings of the 17th International Workshop on Software and Compilers for Embedded Systems (SCOPES '14). ACM, New York, N.Y., USA, 2014, 31-39. [0135] 4. Explanation of ara::com API, AUTOSAR AP Release 17-03. [0136] 5. Specification of Time Synchronization for Adaptive Platform, AutoSAR AP Release 17-10