199 </TR> |
199 </TR> |
200 |
200 |
201 <TR> |
201 <TR> |
202 <TD BGCOLOR="#FFFFFF" WIDTH="75%"> |
202 <TD BGCOLOR="#FFFFFF" WIDTH="75%"> |
203 <B>Nominal Isabelle</B> |
203 <B>Nominal Isabelle</B> |
204 I currently work on Nominal |
204 I am the main developer of Nominal |
205 <A HREF="http://isabelle.in.tum.de">Isabelle</A> 2. This is joint work with |
205 <A HREF="http://isabelle.in.tum.de">Isabelle</A>. This is joint work with |
206 <A HREF="http://www21.in.tum.de/~berghofe/">Dr Stefan Berghofer</A>, |
206 <A HREF="http://www21.in.tum.de/~berghofe/">Dr Stefan Berghofer</A>, |
207 <A HREF="http://sketis.net/">Dr Markus Wenzel</A>, |
207 <A HREF="http://sketis.net/">Dr Markus Wenzel</A>, |
208 <A HREF="http://cl-informatik.uibk.ac.at/users/cek/">Dr Cezary Kaliszyk</A>, |
208 <A HREF="http://cl-informatik.uibk.ac.at/users/cek/">Dr Cezary Kaliszyk</A>, |
209 <A HREF="http://user.it.uu.se/~tjawe125/">Dr Tjark Weber</A> and |
209 <A HREF="http://user.it.uu.se/~tjawe125/">Dr Tjark Weber</A> and |
210 the Isabelle-team in Munich. |
210 the Isabelle-team in Munich. |
211 Many of the theoretical ideas originate from the nominal logic project - a wonderful project headed |
211 Many of the theoretical ideas originate from the nominal logic project - a wonderful project headed |
212 by <A HREF="http://www.cl.cam.ac.uk/~amp12/">Prof. Andrew Pitts</A>. |
212 by <A HREF="http://www.cl.cam.ac.uk/~amp12/">Prof. Andrew Pitts</A>. |
213 The aim of my work is to make formal reasoning involving binders as simple as |
213 The aim with this work is to make formal reasoning involving binders as simple as |
214 on paper and the hope is to lure |
214 on paper and the hope is to lure |
215 <A HREF="http://alliance.seas.upenn.edu/~plclub/cgi-bin/poplmark/index.php?title=The_POPLmark_Challenge#Vision">masses</A> to automated |
215 <A HREF="http://alliance.seas.upenn.edu/~plclub/cgi-bin/poplmark/index.php?title=The_POPLmark_Challenge#Vision">masses</A> to automated |
216 theorem proving. My funding for this work was provided in 2004 and 2005 by a research |
216 theorem proving. My funding for this work was provided in 2004 and 2005 by a research |
217 fellowship from the |
217 fellowship from the |
218 <A HREF="http://en.wikipedia.org/wiki/Alexander_von_Humboldt">Alexander-von-Humboldt</A> |
218 <A HREF="http://en.wikipedia.org/wiki/Alexander_von_Humboldt">Alexander-von-Humboldt</A> |
219 <A HREF="http://www.humboldt-foundation.de/web/home.html">foundation</A>. During this time I was a visitor in the group of |
219 <A HREF="http://www.humboldt-foundation.de/web/home.html">foundation</A>. During this time I was a visitor in the group of |
220 <A HREF="http://www.mathematik.uni-muenchen.de/~schwicht/">Prof. Helmut Schwichtenberg</A>. |
220 <A HREF="http://www.mathematik.uni-muenchen.de/~schwicht/">Prof. Helmut Schwichtenberg</A> in Munich. |
221 Since 2006 this work is supported by an |
221 Between 2006 and 2011 this work is supported by an |
222 <A HREF="http://en.wikipedia.org/wiki/Emmy_Noether">Emmy-Noether</A> |
222 <A HREF="http://en.wikipedia.org/wiki/Emmy_Noether">Emmy-Noether</A> |
223 <A HREF="https://www.dfg.de/en/research_funding/programmes/individual/emmy_noether/">fellowship</A>. |
223 <A HREF="https://www.dfg.de/en/research_funding/programmes/individual/emmy_noether/">fellowship</A> at the TUM. |
224 There is a <A HREF="https://nms.kcl.ac.uk/christian.urban/Nominal/">webpage</A> about Nominal |
224 There is a <A HREF="https://nms.kcl.ac.uk/christian.urban/Nominal/">webpage</A> about Nominal |
225 Isabelle, which also includes a list of projects that use Nominal Isabelle. |
225 Isabelle, which also includes a list of projects that use Nominal Isabelle. |
226 Users of Nominal Isabelle had their papers appearing at LICS, POPL, FOSSACS, SOS, TPHOLs, CPP, SEFM, |
226 Users of Nominal Isabelle had their papers appearing at LICS, POPL, FOSSACS, SOS, TPHOLs, CPP, SEFM, |
227 the Haskell Symposium and |
227 the Haskell Symposium and |
228 in the Journal of Automated Reasoning. |
228 in the Journal of Automated Reasoning. Nowadays, Nominal Isabelle 2 is part of the <A HREF="https://www.isa-afp.org">Archive of Formal Proofs</A>. |
|
229 </TD> |
|
230 </TR> |
|
231 |
|
232 <TR> |
|
233 <TD BGCOLOR="#FFFFFF" WIDTH="75%"> |
|
234 <B>Real-Time Scheduling and Priority Inheritance</B> |
|
235 In real-time operating systems with processes, resource locking and |
|
236 priority scheduling, one faces the problem of |
|
237 <A HREF="http://en.wikipedia.org/wiki/Priority_inversion">priority inversion</A> (processes |
|
238 with lower priority block processes with higher priority indefinitely). If you do not prevent this problem, |
|
239 then processes can behave erratically, as <A HREF="http://www.nasa.gov">NASA</A> found out the |
|
240 <A HREF="http://catless.ncl.ac.uk/Risks/19.54.html#subj6">hard</A> way with their first |
|
241 <A HREF="http://www.nasa.gov/mission_pages/mars-pathfinder/index.html">Mars Pathfinder mission</A>. |
|
242 The priority inheritance protocol is a widely used scheduling algorithm that prevents |
|
243 priority inversion. However, the <A HREF="http://dx.doi.org/10.1109/12.57058">original paper</A> |
|
244 describing this algorithm contains an incorrect algorithm and a bogus(!) correctness proof. |
|
245 |
|
246 We formalised our version of the priority inheritance protocol, including a generalisation |
|
247 of the original work (we allow overlapping critical sections) in the theorem prover |
|
248 <A HREF="http://isabelle.in.tum.de">Isabelle</A>. |
|
249 |
|
250 In our formalisation we use the inductive method we learned from |
|
251 <A HREF="https://www.cl.cam.ac.uk/~lp15/">Prof. Larry Paulson</A>. |
|
252 He used this method in order to prove the correctness of security |
|
253 protocols. We have implemented our algorithm on top of the |
|
254 the small <A HREF="https://en.wikipedia.org/wiki/Pintos">PINTOS</A> |
|
255 operating system used for teaching (we passed all their test cases and were |
|
256 faster than their reference implementation). |
|
257 |
|
258 |
|
259 While the problem with the original algorithm was already known for some time, the incorrect |
|
260 specification seems to be still widely in use and described in many textbooks on real-time operating systems, |
|
261 including famous and rather expensive |
|
262 ones. Feel free to decide whether they are worth your time and money. Task: Spot the problems in |
|
263 <A href="https://www.amazon.com/Real-Time-Systems-Design-Analysis-Practitioner-ebook/dp/B0062LNOCW">here</A>, |
|
264 <A href="https://www.amazon.co.uk/Real-Time-Concepts-Embedded-Systems-Qing/dp/1578201241">here</A>, |
|
265 <A href="https://www.amazon.co.uk/Real-Time-Systems-Jane-W-Liu/dp/0130996513">here</A>, |
|
266 <A href="https://www.springer.com/gp/book/9780792392118">here</A> and |
|
267 <A href="https://www.os-book.com/OS9/">here</A>! |
|
268 Alternatively, you can look at the quotes and pointers in our |
|
269 <A HREF="http://nms.kcl.ac.uk/christian.urban/Publications/pip.pdf">paper</A>. A notable |
|
270 exception is the <A HREF="https://www.springer.com/gp/book/9781461406754">textbook</A> |
|
271 by Buttazzo, who gives the correct specification. Unfortunately, his work did not |
|
272 help us with proving the correctness of the priority inheritance protocol. |
|
273 |
|
274 This is joint work with Prof. Xingyuan Zhang and his student Chunhan Wu from the |
|
275 <A HREF="http://www.ust.com.cn/">PLA University of Science and Technology</A> in Nanjing. |
229 </TD> |
276 </TD> |
230 </TR> |
277 </TR> |
231 |
278 |
232 <TR> |
279 <TR> |
233 <TD BGCOLOR="#FFFFFF" WIDTH="75%"> |
280 <TD BGCOLOR="#FFFFFF" WIDTH="75%"> |
259 My funding for this work came from the |
306 My funding for this work came from the |
260 <A HREF="http://sinogermanscience.dfg.nsfc.cn/de/index.html">Chinese-German Research Centre</A>. |
307 <A HREF="http://sinogermanscience.dfg.nsfc.cn/de/index.html">Chinese-German Research Centre</A>. |
261 </TD> |
308 </TD> |
262 </TR> |
309 </TR> |
263 |
310 |
264 <!-- |
|
265 <TR> |
|
266 <TD BGCOLOR="#FFFFFF" WIDTH="75%"> |
|
267 <B>Priority Inheritance</B> |
|
268 In real-time operating systems with processes, resource locking and |
|
269 priority scheduling, one faces the problem of indefinite |
|
270 <A HREF="http://en.wikipedia.org/wiki/Priority_inversion">priority inversion</A> (processes |
|
271 with lower priority block processes with higher priority). If you do not prevent this problem, |
|
272 then processes can behave quite erratically, as <A HREF="http://www.nasa.gov">NASA</A> found out the |
|
273 <A HREF="http://catless.ncl.ac.uk/Risks/19.54.html#subj6">hard</A> way with their |
|
274 <A HREF="http://www.nasa.gov/mission_pages/mars-pathfinder/index.html">Mars Pathfinder mission</A>. |
|
275 The priority inheritance protocol is a widely used scheduling algorithm that prevents |
|
276 priority inversion. However, the <A HREF="http://dx.doi.org/10.1109/12.57058">original paper</A> |
|
277 describing this algorithm contains an incorrect algorithm and a bogus correctness proof |
|
278 (this seems to be the only "proof" about priority inheritance in the literature). |
|
279 |
|
280 We formalised the priority inheritance protocol, including a generalisation |
|
281 of the original work. |
|
282 |
|
283 using the inductive method we learned from |
|
284 <A HREF="https://www.cl.cam.ac.uk/~lp15/">Prof. Larry Paulson</A>. |
|
285 While the problem with the original algorithm was already known, the incorrect |
|
286 specification seems to be still in use |
|
287 |
|
288 <A HREF="http://mcs.une.edu.au/%7Eiam/Data/threads/node15.html">here</A> |
|
289 <A HREF="http://ems2.be/Portals/6/course_docs/OS_pathfinder_failure.ppt"> |
|
290 |
|
291 This is joint work with Prof. Xingyuan Zhang and his student Chunhan Wu from the |
|
292 <A HREF="http://www.ust.com.cn/">PLA University of Science and Technology</A> in Nanjing. |
|
293 </TD> |
|
294 </TR> |
|
295 --> |
|
296 |
|
297 <TR> |
311 <TR> |
298 <TD BGCOLOR="#FFFFFF" WIDTH="75%"> |
312 <TD BGCOLOR="#FFFFFF" WIDTH="75%"> |
299 <B>Nominal Unification and Alpha-Prolog</B> |
313 <B>Nominal Unification and Alpha-Prolog</B> |
300 <A HREF="https://nms.kcl.ac.uk/christian.urban/Unification">Nominal unification</A> is one outcome of |
314 <A HREF="https://nms.kcl.ac.uk/christian.urban/Unification">Nominal unification</A> is one outcome of |
301 my involvement in the nominal logic project in Cambridge. Another is the logic programming language |
315 my involvement in the nominal logic project in Cambridge. Another is the logic programming language |