Sheep in wolf's Clothing: Implementation Models for Dataflow Multi-Threaded Software

Threads are a wildly non-deterministic model of computation, difficult to analyze in the general case (the wolf of our title). But when system specification is a deterministic dataflow program written in Lustre, Scade or Simulink, the implementation process should build not just multi-threaded C code, but (first and foremost) a richer model exposing the easy-to-analyze dataflow, race-free organization of the computations performed by the implementation (the titular sheep). We propose a language for such implementation models. It allows the formulation of functional correctness properties the multi-threaded implementation must satisfy for an avionics use case running on a commercial many-core.