3 ms·

This framework claims it can generate a C code that is constant-time and constant-size (awesome!). However, in their manual [1], in section 4.1, it does not tak

This framework claims it can generate a C code that is constant-time and constant-size (awesome!). However, in their manual [1], in section 4.1, it does not take into account that low-level C functions `heaton` and `heatoff` may fail since both of them are returning `void`. Like if we should increase the temp, we can tolerate a couple of heaton fails before it reaches to some min limit. [1]: https://copilot-language.github.io/downloads/copilot_tutorial.pdf https://copilot-language.github.io/downloads/copilot_tutoria...

a-dub 4y ago
in this sort of scenario you would detect the error by a failure to see an increase in temperature over some interval. the trigger functions typically would just raise dio lines high which is not something that really fails unless you're completely crashed.
WJW 4y ago
Is it actually a given that these C functions could fail? It is certainly not apparent from their function signatures, as you already mention. :) If it just writes to some memory mapped I/O registers then it might well not be possible to fail that (unless writing memory in general has become impossible, but at that time no software will save you anymore). In any case let's not judge the writers too harshly for omitting some error checking in the very first complete example they provide in the manual. The typical introductory "hello world" program also doesn't contain error handling to check if writing to stdout succeeded or not. A real CoPilot program could (and should!) have a separate stream for checking `heaterStatus` and raise a separate alarm if the status of the heater does not update when it should.
- ducktective 4y ago
  >it just writes to some memory mapped I/O registers Yes but the heater is a mechanical device that behaves unexpectedly. I mean, should the "fault-tolerance" logic be handled in the copilot DSL itself?
  - LoganDark 4y ago
    Checking if the heater is working is a different task than telling the heater what to do. You can't fail to tell the heater what to do. However, it's your job as the programmer to make sure the heater is doing what it's supposed to.

a-dub 4y ago

in this sort of scenario you would detect the error by a failure to see an increase in temperature over some interval. the trigger functions typically would just raise dio lines high which is not something that really fails unless you're completely crashed.

WJW 4y ago

Is it actually a given that these C functions could fail? It is certainly not apparent from their function signatures, as you already mention. :) If it just writes to some memory mapped I/O registers then it might well not be possible to fail that (unless writing memory in general has become impossible, but at that time no software will save you anymore). In any case let's not judge the writers too harshly for omitting some error checking in the very first complete example they provide in the manual. The typical introductory "hello world" program also doesn't contain error handling to check if writing to stdout succeeded or not. A real CoPilot program could (and should!) have a separate stream for checking `heaterStatus` and raise a separate alarm if the status of the heater does not update when it should.

ducktective 4y ago
>it just writes to some memory mapped I/O registers Yes but the heater is a mechanical device that behaves unexpectedly. I mean, should the "fault-tolerance" logic be handled in the copilot DSL itself?
- LoganDark 4y ago
  Checking if the heater is working is a different task than telling the heater what to do. You can't fail to tell the heater what to do. However, it's your job as the programmer to make sure the heater is doing what it's supposed to.