![](bg8.png)
meta-constraints over the fresh variables that model
the possible firing orders.
Here is a bundle that is incompatible with the But-
tonLock: both cannot be loaded into the same DoP.
To explain this, first we must mention that we have
not fully implemented the re-hydration stage yet, and
so hardcoded identifiers, such as the IP address of
the other bundle’s platform are currently hardcoded
in the source files. The button variable was originally
free to change at any time but becomes constrained
by the second bundle to only change while the un-
locked variable holds. The system cannot be unlocked
without the button being pressed, and hence the live
assertion in the Button listing fails. This will in fu-
ture be spotted by the DoP manager, but currently can
only be spotted by the compiler checking against pre-
compiled bundles that are to hand.
def bundle B2() {
pebble r = tup://128.232.1.45/v;
input d#q : bool;
r#keys#button := r#locks#unlocked && d#q;
}
5 CONCLUSION
This work was carried out under the CMI
Goals/Pebbles project (Umar Saif, 2003). It has
produced a strawman application scripting language
that supports code reflection. The current interpreter
runs on unix, bare PC motherboard, our embedded
CPU cards and linux. A native-compiler that gener-
ates PIC assembler code and operates over the CAN
bus (instead of Ethernet) is also being implemented.
This will be less RAM hungry. We have completely
implemented the top-level application code for
several simple consumer devices (e.g. the alarm
clock, DVD player, and so on). Work is ongoing
on larger programs, such as TiVo PVR and voice
mail, and in other areas, such as drinks machine,
automotive (using CAN) and elevators. Our language
has a number of novel features, including idempotent
execution and the mechanism concept, where reverse
execution is used to help handle network errors or
device self-reset. Arrays and RPC are shortly to be
tested out.
Future work is needed to analyse temporary er-
ror states during network races and to provide break-
before-make form guarantees where Pushlogic is used
to disable one server or device while enabling another.
The domain checker concept is well developed, but
practical implementation is only just starting. We
also plan to work on federation of DoPs based on
known obligations and constraints of adjacent do-
mains (Lupu E, 1997).
Our assertions currently do not contain quantifiers
that range over devices or possible values of fields.
As new devices and new versions of devices with ex-
tended variable domains can be inserted into a live
DoP, certain negated existential forms will have to be
restricted in order to preserve monotonicity.
Finally, we are seeking collaboration with an in-
dustrial partner where we can evaluate our ideas in
practice and combine them with conventional safety-
critical approaches, such as coverage testing.
REFERENCES
Chessell, M., Griffin, C., Vines, D., Butler, M., Ferreira, C.,
and Henderson, P. (2002). Extending the concept of
transaction compensation. IBM Syst. J., 41(4):743–
758.
David Dill, S. B. (2004). CVC lite. Technical report, Stan-
ford University.
Gl
¨
asser, U. (1995). Systems level specification and model-
ing of reactive systems: Concepts, methods, and tools.
In EUROCAST, pages 375–385.
Kaiser, J. and Mock, M. (1999). Implementing the real-time
publisher/subscriber model on the controller area net-
work (can). In ISORC ’99: Proceedings of the 2nd
IEEE International Symposium on Object-Oriented
Real-Time Distributed Computing, page 172, Wash-
ington, DC, USA. IEEE Computer Society.
Lupu E, S. M. (1997). Conflict analysis for management
policies. In 5th Int Symp Integrated Network Manage-
ment IM’97. Chapman Hall.
McMillan, K. (2000). The smv language manual. Technical
report, Carnegie-Mellon University.
Microsoft (2000). Universal plug and play device architec-
ture, version 1.0. Technical report, Microsoft.
Monika Solanki, e. a. (2003). Introducing composition-
ality in webservice descriptions. In Proceedings of
3rd ANWIRE workshop on adaptable services, DAIS-
FMOODS.
Pearson, J. (2005). Embedding systems at a higher level.
Electronic System Design.
Presburger, M. (1929). Ober die vollstndigkeit eines gewis-
sen systems der arithmetik ganzer zahlen, in welchem
die addition als einzige operation hervortritt. Comptes
Rendus du I congrs de Mathmaticiens des Pays Slaves,
pages 92–101.
ReactiveSystems (2003). Model-based testing and valida-
tion of control software with reactis. Technical Report
2003-1, Reactive Systems.
Schlingloff, B.-H., Martens, A., and Schmidt, K. (2005).
Modeling and model checking web services. Elec-
tronic Notes in Theoretical Computer Science: Issue
on Logic and Communication in Multi-Agent Systems,
126:3–26.
Umar Saif, S. W. e. a. (2003). A case for goal-oriented pro-
gramming semantics. In UbiComp 03, System Support
for Ubiquitous Computing Workshop at the Fifth An-
nual Conference on Ubiquitous Computing.
WEBIST 2006 - INTERNET TECHNOLOGY
108