@article{2996, abstract = {Plants, compared to animals, exhibit an amazing adaptability and plasticity in their development. This is largely dependent on the ability of plants to form new organs, such as lateral roots, leaves, and flowers during postembryonic development. Organ primordia develop from founder cell populations into organs by coordinated cell division and differentiation. Here, we show that organ formation in Arabidopsis involves dynamic gradients of the signaling molecule auxin with maxima at the primordia tips. These gradients are mediated by cellular efflux requiring asymmetrically localized PIN proteins, which represent a functionally redundant network for auxin distribution in both aerial and underground organs. PIN1 polar localization undergoes a dynamic rearrangement, which correlates with establishment of auxin gradients and primordium development. Our results suggest that PIN-dependent, local auxin gradients represent a common module for formation of all plant organs, regardless of their mature morphology or developmental origin. }, author = {Benková, Eva and Michniewicz, Marta and Sauer, Michael and Teichmann, Thomas and Seifertová, Daniela and Jürgens, Gerd and Friml, Jirí}, issn = {1097-4172}, journal = {Cell}, number = {5}, pages = {591 -- 602}, publisher = {Cell Press}, title = {{Local, efflux-dependent auxin gradients as a common module for plant organ formation}}, doi = {10.1016/S0092-8674(03)00924-3}, volume = {115}, year = {2003}, } @article{13436, abstract = {Cross-metathesis reactions of α,β-unsaturated sulfones and sulfoxides in the presence of molybdenum and ruthenium pre-catalysts were tested. A selective metahesis reaction was achieved between functionalized terminal olefins and vinyl sulfones by using the ‘second generation’ ruthenium catalysts 1c–h while the highly active Schrock catalyst 1b was found to be functional group incompatible with vinyl sulfones. The cross-metathesis products were isolated in good yields with an excellent (E)-selectivity. Both the molybdenum and ruthenium-based complexes were, however, incompatible with α,β- and β,γ-unsaturated sulfoxides.}, author = {Michrowska, Anna and Bieniek, Michał and Kim, Mikhail and Klajn, Rafal and Grela, Karol}, issn = {1464-5416}, journal = {Tetrahedron}, keywords = {Organic Chemistry, Drug Discovery, Biochemistry}, number = {25}, pages = {4525--4531}, publisher = {Elsevier}, title = {{Cross-metathesis reaction of vinyl sulfones and sulfoxides}}, doi = {10.1016/s0040-4020(03)00682-3}, volume = {59}, year = {2003}, } @article{1457, abstract = {Among the major mathematical approaches to mirror symmetry are those of Batyrev-Borisov and Stromdnger-Yau-Zaslow (SYZ). The first is explicit and amenable to computation but is not clearly related to the physical motivation; the second is the opposite. Furthermore, it is far from obvious that mirror partners in one sense will also be mirror partners in the other. This paper concerns a class of examples that can be shown to satisfy the requirements of SYZ, but whose Hodge numbers are also equal. This provides significant evidence in support of SYZ. Moreover, the examples are of great interest in their own right: they are spaces of flat SLr-connections on a smooth curve. The mirror is the corresponding space for the Langlands dual group PGLr. These examples therefore throw a bridge from mirror symmetry to the duality theory of Lie groups and, more broadly, to the geometric Langlands program.}, author = {Hausel, Tamas and Thaddeus, Michael}, issn = {1432-1297}, journal = {Inventiones Mathematicae}, pages = {197 -- 229}, publisher = {Springer Nature}, title = {{Mirror symmetry, langlands duality, and the Hitchin system}}, doi = {10.1007/s00222-003-0286-7}, volume = {153}, year = {2003}, } @article{1459, abstract = {In this paper we explicitly calculate the analogue of the 't Hooft SU (2) Yang-Mills instantons on Gibbons-Hawking multi-centered gravitational instantons, which come in two parallel families: the multi-Eguchi-Hanson, or Ak ALE gravitational instantons and the multi-Taub-NUT spaces, or Ak ALF gravitational instantons. We calculate their energy and find the reducible ones. Following Kronheimer we also exploit the U(1) invariance of our solutions and study the corresponding explicit singular SU (2) magnetic monopole solutions of the Bogomolny equations on flat ℝ3.}, author = {Etesi, Gábor and Hausel, Tamas}, issn = {1432-0916}, journal = {Communications in Mathematical Physics}, pages = {275 -- 288}, publisher = {Springer Nature}, title = {{On Yang-Mills instantons over multi-centered gravitational instantons}}, doi = {10.1007/s00220-003-0806-8}, volume = {235}, year = {2003}, } @article{166, abstract = {For any number field k, upper bounds are established for the number of k-rational points of bounded height on non-singular del Pezzo surfaces defined over k, which are equipped with suitable conic bundle structures over k.}, author = {Browning, Timothy D and Swarbick Jones, M}, journal = {Proceedings of the Bonn session in analytic number theory and diophantine equations}, publisher = {Mathematisches Institut der Universität Bonn}, title = {{Counting rational points on del Pezzo surfaces of degree 5}}, volume = {360}, year = {2003}, } @article{1959, abstract = {The molecular organization of bacterial NADH: ubiquinone oxidoreductase (complex I or NDH-1) is not established, apart from a rough separation into dehydrogenase, connecting and membrane domains. In this work, complex I was purified from Escherichia coli and fragmented by replacing dodecylmaltoside with other detergents. Exchange into decyl maltoside led to the removal of the hydrophobic subunit NuoL from the otherwise intact complex. Diheptanoyl phosphocholine led to the loss of NuoL and NuoM subunits, whereas other subunits remained in the complex. The presence of N,N-dimethyldodecylamine N-oxide or Triton X-100 led to further disruption of the membrane domain into fragments containing NuoL/M/N, NuoA/K/N, and NuoH/J subunits. Among the hydrophilic subunits, NuoCD was most readily dissociated from the complex, whereas NuoB was partially dissociated from the peripheral arm assembly in N,N-dimethyldodecylamine N-oxide. A model of subunit arrangement in bacterial complex I based on these data is proposed. Subunits NuoL and NuoM, which are homologous to antiporters and are implicated in proton pumping, are located at the distal end of the membrane arm, spatially separated from the redox centers of the peripheral arm. This is consistent with proposals that the mechanism of proton pumping by complex I is likely to involve long range conformational changes.}, author = {Holt, Peter and Morgan, David and Sazanov, Leonid A}, issn = {1083-351X}, journal = {Journal of Biological Chemistry}, number = {44}, pages = {43114 -- 43120}, publisher = {American Society for Biochemistry and Molecular Biology}, title = {{The location of NuoL and NuoM subunits in the membrane domain of the Escherichia coli Complex I: implications for the mechanism of proton pumping}}, doi = {10.1074/jbc.M308247200}, volume = {278}, year = {2003}, } @article{1960, abstract = {NADH-ubiquinone oxidoreductase (complex I or NDH-1) was purified from the BL21 strain of Escherichia coli using an improved procedure. The complex was effectively stabilized by addition of divalent cations and lipids, making the preparation suitable for structural studies. The ubiquinone reductase activity of the enzyme was fully restored by addition of native E. coli lipids. Two different two-dimensional crystal forms, with p2 and p3 symmetry, were obtained using lipids containing native E. coli extracts. Analysis of the crystals showed that they are formed by fully intact complex I in an L-shaped conformation. Activity assays and single particle analysis indicated that complex I maintains this structure in detergent solution and does not adopt a different conformation in the active state. Thus, we provide the first experimental evidence that complex I from E. coli has an L-shape in a lipid bilayer and confirm that this is also the case for the active enzyme in solution. This suggests strongly that bacterial complex I exists in an L-shaped conformation in vivo. Our results also indicate that native lipids play an important role in the activation, stabilization and, as a consequence, crystallization of purified complex I from E. coli.}, author = {Sazanov, Leonid A and Carroll, Joe and Holt, Peter and Toime, Laurence and Fearnley, Ian}, issn = {1083-351X}, journal = {Journal of Biological Chemistry}, number = {21}, pages = {19483 -- 19491}, publisher = {American Society for Biochemistry and Molecular Biology}, title = {{A role for native lipids in the stabilization and two dimensional crystallization of the Escherichia coli NADH ubiquinone oxidoreductase (complex I)}}, doi = {10.1074/jbc.M208959200}, volume = {278}, year = {2003}, } @article{4348, abstract = {Many questions in evolutionary biology are best addressed by comparing traits in different species. Often such studies involve mapping characters on phylogenetic trees. Mapping characters on trees allows the nature, number, and timing of the transformations to be identified. The parsimony method is the only method available for mapping morphological characters on phylogenies. Although the parsimony method often makes reasonable reconstructions of the history of a character, it has a number of limitations. These limitations include the inability to consider more than a single change along a branch on a tree and the uncoupling of evolutionary time from amount of character change. We extended a method described by Nielsen (2002, Syst. Biol. 51:729-739) to the mapping of morphological characters under continuous-time Markov models and demonstrate here the utility of the method for mapping characters on trees and for identifying character correlation.}, author = {Huelsenbeck, John and Nielsen, Rasmus and Bollback, Jonathan P}, issn = {0039-7989 }, journal = {Systematic Biology}, number = {2}, pages = {131 -- 158}, publisher = {Oxford University Press}, title = {{Stochastic mapping of morphological characters}}, doi = {10.1080/10635150390192780}, volume = {52}, year = {2003}, } @article{4350, abstract = {The phylogeny of Crocodylia offers an unusual twist on the usual molecules versus morphology story. The true gharial (Gavialis gangeticus) and the false gharial (Tomistoma schlegelii), as their common names imply, have appeared in all cladistic morphological analyses as distantly related species, convergent upon a similar morphology. In contrast, all previous molecular studies have shown them to be sister taxa. We present the first phylogenetic study of Crocodylia using a nuclear gene. We cloned and sequenced the c-myc proto-oncogene from Alligator mississippiensis to facilitate primer design and then sequenced an 1,100-base pair fragment that includes both coding and noncoding regions and informative indels for one species in each extant crocodylian genus and six avian outgroups. Phylogenetic analyses using parsimony, maximum likelihood, and Bayesian inference all strongly agreed on the same tree, which is identical to the tree found in previous molecular analyses: Gavialis and Tomistoma are sister taxa and together are the sister group of Crocodylidae. Kishino-Hasegawa tests rejected the morphological tree in favor of the molecular tree. We excluded long-branch attraction and variation in base composition among taxa as explanations for this topology. To explore the causes of discrepancy between molecular and morphological estimates of crocodylian phylogeny, we examined puzzling features of the morphological data using a priori partitions of the data based on anatomical regions and investigated the effects of different coding schemes for two obvious morphological similarities of the two gharials.}, author = {Harshman, John and Huddleston, Christopher and Bollback, Jonathan P and Parsons, Thomas and Braun, Michael}, issn = {0039-7989 }, journal = {Systematic Biology}, number = {3}, pages = {386 -- 402}, publisher = {Oxford University Press}, title = {{True and false gharials: A nuclear gene phylogeny of crocodylia}}, doi = {10.1080/10635150390197028}, volume = {52}, year = {2003}, } @phdthesis{4416, abstract = {Methods for the formal specification and verification of systems are indispensible for the development of complex yet correct systems. In formal verification, the designer describes the system in a modeling language with a well-defined semantics, and this system description is analyzed against a set of correctness requirements. Model checking is an algorithmic technique to check that a system description indeed satisfies correctness requirements given as logical specifications. While successful in hardware verification, the potential for model checking for software and embedded systems has not yet been realized. This is because traditional model checking focuses on systems modeled as finite state-transition graphs. While a natural model for hardware (especially synchronous hardware), state-transition graphs often do not capture software and embedded systems at an appropriate level of granularity. This dissertation considers two orthogonal extensions to finite state-transition graphs making model checking techniques applicable to both a wider class of systems and a wider class of properties. The first direction is an extension to infinite-state structures finitely represented using constraints and operations on constraints. Infinite state arises when we wish to model variables with unbounded range (e.g., integers), or data structures, or real time. We provide a uniform framework of symbolic region algebras to study model checking of infinite-state systems. We also provide sufficient language-independent termination conditions for symbolic model checking algorithms on infinite state systems. The second direction supplements verification with game theoretic reasoning. Games are natural models for interactions between components. We study game theoretic behavior with winning conditions given by temporal logic objectives both in the deterministic and in the probabilistic context. For deterministic games, we provide an extremal model characterization of fixpoint algorithms that link solutions of verification problems to solutions for games. For probabilistic games we study fixpoint characterization of winning probabilities for games with omega-regular winning objectives, and construct (epsilon-)optimal winning strategies.}, author = {Majumdar, Ritankar}, pages = {1 -- 201}, publisher = {University of California, Berkeley}, title = {{Symbolic algorithms for verification and control}}, year = {2003}, } @phdthesis{4425, abstract = {Giotto provides a time-triggered programmer’s model for the implementation of embedded control systems with hard real-time constraints. Giotto’s precise semantics and predictabil- ity make it suitable for safety-critical applications. Giotto is based around the idea that time-triggered task invocation together with time-triggered mode switching can form a useful programming model for real-time systems. To substantiate this claim, we describe the use of Giotto to refactor the software of a small, autonomous helicopter. The ease with which Giotto expresses the existing software provides evidence that Giotto is an appropriate programming language for control systems. Since Giotto is a real-time programming language, ensuring that Giotto programs meet their deadlines is crucial. To study precedence-constrained Giotto scheduling, we first examine single-mode, single-processor scheduling. We extend to an infinite, periodic setting the classical problem of meeting deadlines for a set of tasks with release times, deadlines, precedence constraints, and preemption. We then develop an algorithm for scheduling Giotto programs on a single processor by representing Giotto programs as instances of the extended scheduling problem. Next, we study multi-mode, single-processor Giotto scheduling. This problem is different from classical scheduling problems, since in our precedence-constrained approach, the deadlines of tasks may vary depending on the mode switching behavior of the program. We present conditional scheduling models which capture this varying-deadline behavior. We develop polynomial-time algorithms for some conditional scheduling models, and prove oth- ers to be computationally hard. We show how to represent multi-mode Giotto programs as instances of the model, resulting in an algorithm for scheduling multi-mode Giotto programs on a single processor. Finally, we show that the problem of scheduling Giotto programs for multiple net- worked processors is strongly NP-hard.}, author = {Horowitz, Benjamin}, pages = {1 -- 237}, publisher = {University of California, Berkeley}, title = {{Giotto: A time-triggered language for embedded programming}}, year = {2003}, } @article{4460, abstract = {Symbolic model checking, which enables the automatic verification of large systems, proceeds by calculating expressions that represent state sets. Traditionally, symbolic model-checking tools are based on back- ward state traversal; their basic operation is the function pre, which, given a set of states, returns the set of all predecessor states. This is because specifiers usually employ formalisms with future-time modalities, which are naturally evaluated by iterating applications of pre. It has been shown experimentally that symbolic model checking can perform significantly better if it is based, instead, on forward state traversal; in this case, the basic operation is the function post, which, given a set of states, returns the set of all successor states. This is because forward state traversal can ensure that only parts of the state space that are reachable from an initial state and relevant for the satisfaction or violation of the specification are explored; that is, errors can be detected as soon as possible. In this paper, we investigate which specifications can be checked by symbolic forward state traversal. We formulate the problems of symbolic backward and forward model checking by means of two μ-calculi. The pre-μ calculus is based on the pre operation, and the post-μ calculus is based on the post operation. These two μ-calculi induce query logics, which augment fixpoint expressions with a boolean emptiness query. Using query logics, we are able to relate and compare the symbolic backward and forward approaches. In particular, we prove that all ω-regular (linear-time) specifications can be expressed as post-μ queries, and therefore checked using symbolic forward state traversal. On the other hand, we show that there are simple branching-time specifications that cannot be checked in this way.}, author = {Henzinger, Thomas A and Kupferman, Orna and Qadeer, Shaz}, issn = {0925-9856}, journal = {Formal Methods in System Design}, number = {3}, pages = {303 -- 327}, publisher = {Springer}, title = {{From pre-historic to post-modern symbolic model checking}}, doi = {10.1023/A:1026228213080}, volume = {23}, year = {2003}, } @inproceedings{4462, abstract = {A major hurdle in the algorithmic verification and control of systems is the need to find suitable abstract models, which omit enough details to overcome the state-explosion problem, but retain enough details to exhibit satisfaction or controllability with respect to the specification. The paradigm of counterexample-guided abstraction refinement suggests a fully automatic way of finding suitable abstract models: one starts with a coarse abstraction, attempts to verify or control the abstract model, and if this attempt fails and the abstract counterexample does not correspond to a concrete counterexample, then one uses the spurious counterexample to guide the refinement of the abstract model. We present a counterexample-guided refinement algorithm for solving ω-regular control objectives. The main difficulty is that in control, unlike in verification, counterexamples are strategies in a game between system and controller. In the case that the controller has no choices, our scheme subsumes known counterexample-guided refinement algorithms for the verification of ω-regular specifications. Our algorithm is useful in all situations where ω-regular games need to be solved, such as supervisory control, sequential and program synthesis, and modular verification. The algorithm is fully symbolic, and therefore applicable also to infinite-state systems.}, author = {Henzinger, Thomas A and Jhala, Ranjit and Majumdar, Ritankar}, booktitle = {Proceedings of the 30th International Colloquium on Automata, Languages and Programming}, isbn = {9783540404934}, location = {Eindhoven, The Netherlands}, pages = {886 -- 902}, publisher = {Springer}, title = {{Counterexample-guided control}}, doi = {10.1007/3-540-45061-0_69}, volume = {2719}, year = {2003}, } @inproceedings{4463, abstract = {We present an algorithm called TAR (“Thread-modular Abstraction Refinement”) for model checking safety properties of concurrent software. The TAR algorithm uses thread-modular assume-guarantee reasoning to overcome the exponential complexity in the control state of multithreaded programs. Thread modularity means that TAR explores the state space of one thread at a time, making assumptions about how the environment can interfere. The TAR algorithm uses counterexample-guided predicate-abstraction refinement to overcome the usually infinite complexity in the data state of C programs. A successive approximation scheme automatically infers the necessary precision on data variables as well as suitable environment assumptions. The scheme is novel in that transition relations are approximated from above, while at the same time environment assumptions are approximated from below. In our software verification tool BLAST we have implemented a fully automatic race checker for multithreaded C programs which is based on the TAR algorithm. This tool has verified a wide variety of commonly used locking idioms, including locking schemes that are not amenable to existing dynamic and static race checkers such as ERASER or WARLOCK.}, author = {Henzinger, Thomas A and Jhala, Ranjit and Majumdar, Ritankar and Qadeer, Shaz}, booktitle = {Proceedings of the 15th International Conference on Computer Aided Verification}, isbn = {9783540405245}, location = {Boulder, CO, USA}, pages = {262 -- 274}, publisher = {Springer}, title = {{Thread-modular abstraction refinement}}, doi = {10.1007/978-3-540-45069-6_27}, volume = {2725}, year = {2003}, } @inproceedings{4464, abstract = {We introduce the paradigm of schedule-carrying code (SCC). A hard real-time program can be executed on a given platform only if there exists a feasible schedule for the real-time tasks of the program. Traditionally, a scheduler determines the existence of a feasible schedule according to some scheduling strategy. With SCC, a compiler proves the existence of a feasible schedule by generating executable code that is attached to the program and represents its schedule. An SCC executable is a real-time program that carries its schedule as code, which is produced once and can be revalidated and executed with each use. We evaluate SCC both in theory and practice. In theory, we give two scenarios, of nonpreemptive and distributed scheduling for Giotto programs, where the generation of a feasible schedule is hard, while the validation of scheduling instructions that are attached to the programs is easy. In practice, we implement SCC and show that explicit scheduling instructions can reduce the scheduling overhead up to 35% and can provide an efficient, flexible, and verifiable means for compiling Giotto programs on complex architectures, such as the TTA.}, author = {Henzinger, Thomas A and Kirsch, Christoph and Matic, Slobodan}, booktitle = {Proceedings of the 3rd International Conference on Embedded Software}, isbn = {9783540202233}, location = {Philadelphia, PA, USA}, pages = {241 -- 256}, publisher = {ACM}, title = {{Schedule-carrying code}}, doi = {10.1007/978-3-540-45212-6_16}, volume = {2855}, year = {2003}, } @inbook{4465, abstract = {Giotto is a principled, tool-supported design methodology for implementing embedded control systems on platforms of possibly distributed sensors, actuators, CPUs, and networks. Giotto is based on the principle that time-triggered task invocations plus time-triggered mode switches can form the abstract essence of programming real-time control systems. Giotto consists of a programming language with a formal semantics, and a retargetable compiler and runtime library. Giotto supports the automation of control system design by strictly separating platform-independent functionality and timing concerns from platform-dependent scheduling and communication issues. The time-triggered predictability of Giotto makes it particularly suitable for safety-critical applications with hard real-time constraints. We illustrate the platform independence and time-triggered execution of Giotto by coordinating a heterogeneous flock of Intel x86 robots and Lego Mindstorms robots.}, author = {Henzinger, Thomas A and Horowitz, Benjamin and Kirsch, Christoph}, booktitle = {Software-Enabled Control: Information Technology for Dynamical Systems}, isbn = {9780471234364 }, pages = {123 -- 146}, publisher = {Wiley-Blackwell}, title = {{Embedded control systems development with Giotto}}, doi = {10.1002/047172288X.ch8}, year = {2003}, } @inproceedings{4466, abstract = {One source of complexity in the μ-calculus is its ability to specify an unbounded number of switches between universal (AX) and existential (EX) branching modes. We therefore study the problems of satisfiability, validity, model checking, and implication for the universal and existential fragments of the μ-calculus, in which only one branching mode is allowed. The universal fragment is rich enough to express most specifications of interest, and therefore improved algorithms are of practical importance. We show that while the satisfiability and validity problems become indeed simpler for the existential and universal fragments, this is, unfortunately, not the case for model checking and implication. We also show the corresponding results for the alternationfree fragment of the μ-calculus, where no alternations between least and greatest fixed points are allowed. Our results imply that efforts to find a polynomial-time model-checking algorithm for the μ-calculus can be replaced by efforts to find such an algorithm for the universal or existential fragment.}, author = {Henzinger, Thomas A and Kupferman, Orna and Majumdar, Ritankar}, booktitle = {Proceedings of the 9th International Conference on Tools and Algorithms for the Construction and Analysis of Systems }, isbn = {9783540008989}, location = {Warsaw, Poland}, pages = {49 -- 64}, publisher = {Springer}, title = {{On the universal and existential fragments of the mu-calculus}}, doi = {10.1007/3-540-36577-X_5}, volume = {2619}, year = {2003}, } @inproceedings{4467, abstract = {BLAST (the Berkeley Lazy Abstraction Software verification Tool) is a verification system for checking safety properties of C programs using automatic property-driven construction and model checking of software abstractions. Blast implements an abstract-model check-refine loop to check for reachability of a specified label in the program. The abstract model is built on the fly using predicate abstraction. This model is then checked for reachability. If there is no (abstract) path to the specified error label, Blast reports that the system is safe and produces a succinct proof. Otherwise, it checks if the path is feasible using symbolic execution of the program. If the path is feasible, Blast outputs the path as an error trace, otherwise, it uses the infeasibility of the path to refine the abstract model. Blast short-circuits the loop from abstraction to verification to refinement, integrating the three steps tightly through “lazy abstraction” [5]. This integration can offer significant advantages in performance by avoiding the repetition of work from one iteration of the loop to the next. }, author = {Henzinger, Thomas A and Jhala, Ranjit and Majumdar, Ritankar and Sutre, Grégoire}, booktitle = {Proceedings of the 10th International SPIN Workshop }, isbn = {9783540401179}, location = {Portland, OR, USA}, pages = {235 -- 239}, publisher = {Springer}, title = {{Software verification with BLAST}}, doi = {10.1007/3-540-44829-2_17}, volume = {2648}, year = {2003}, } @article{4468, abstract = {Giotto is a high-level programming language for time-triggered control applications. The authors begin with a conceptual overview of its methodology, discuss the Giotto helicopter project, and summarize available Giotto implementations.}, author = {Henzinger, Thomas A and Kirsch, Christoph and Sanvido, Marco and Pree, Wolfgang}, issn = {1066-033X }, journal = {IEEE Control Systems Magazine}, number = {1}, pages = {50 -- 64}, publisher = {IEEE}, title = {{From control models to real-time code using Giotto}}, doi = {10.1109/MCS.2003.1172829}, volume = {23}, year = {2003}, } @article{4469, abstract = {Giotto provides an abstract programmer's model for the implementation of embedded control systems with hard real-time constraints. A typical control application consists of periodic software tasks together with a mode-switching logic for enabling and disabling tasks. Giotto specifies time-triggered sensor readings, task invocations, actuator updates, and mode switches independent of any implementation platform. Giotto can be annotated with platform constraints such as task-to-host mappings, and task and communication schedules. The annotations are directives for the Giotto compiler, but they do not alter the functionality and timing of a Giotto program. By separating the platform-independent from the platform-dependent concerns, Giotto enables a great deal of flexibility in choosing control platforms as well as a great deal of automation in the validation and synthesis of control software. The time-triggered nature of Giotto achieves timing predictability, which makes Giotto particularly suitable for safety-critical applications.}, author = {Henzinger, Thomas A and Horowitz, Benjamin and Kirsch, Christoph}, issn = {0018-9219 }, journal = {Proceedings of the IEEE}, number = {1}, pages = {84 -- 99}, publisher = {IEEE}, title = {{Giotto: A time-triggered language for embedded programming}}, doi = {10.1109/JPROC.2002.805825}, volume = {91}, year = {2003}, }