# On-the-Fly Repairing of Atomicity Violations in ARINC 653 Software
## 5 Experiments
### Functional Evaluation  
This section evaluates the function of RAV when it is operating normally. The functions to be evaluated in RAV are instrumentation, collection of correct interleaving, diagnosis and treatment. Instrumentation examines the binary code to ensure that the algorithm's functions are properly inserted before and after the lines of the shared variable. RAV uses _ai_trace_memory_access() to trace memory access in the test phase. _ai_pre_diagnosis_atomocity_violations() and _ai_post_diagnosis_atomocity_violations() are instrumented for diagnosis and treatment in the operation phase. _ai_pre_diagnosis_atomocity_violations() is a function for wait when an error is reported after diagnosis and _ai_post_diagnosis_atomocity_violations() is a function for signal when no errors are reported after diagnosis. Additionally, RAV instruments functions for initialization, destroy and experiment results. If these functions are not instrumented in the intended position of the code, the functions of RAV do not work properly. Figure 7 is the intermediate code showing the instrumented function of the code. As shown in the figure, the code was correctly instrumented before and after the shared variable sv. Since correct interleaving is used for diagnosis in the operation phase, incorrect interleaving is not collected in the test phase. We examined the collected interleaving by performing training 100 times. Table 3 represents the training results. There were seven incorrect interleaving types for \(T_{1}^{[R-R]}\parallel T_{2}^{W}\), none for \(T_{1}^{[W-W]}\parallel T_{2}^{R}\), one for \(T_{1}^{[W-R]}\parallel T_{2}^{W}\), fifteen for \(T_{1}^{[R-W]}\parallel T_{2}^{R-W}\) and fourteen for \(T_{1}^{[R-R-W]}\parallel T_{2}^{R-R-W}\). It was confirmed that the more complex the interleaving of the synthetic program was, such as \(T_{1}^{[R-W]}\parallel T_{2}^{R-W}\) and \(T_{1}^{[R-R-W]}\parallel T_{2}^{R-R-W}\), the more incorrect interleaving was collected. In the case of complex interleaving, incorrect interleaving occurred at about 15%, so correct interleaving could be obtained by performing sufficient training at least ten times. However, since the single execution of the training process may take a long time depending on the program's size, the  
Figure 6: An example of execution order of \(T_{i}^{[W-R]}\parallel T_{j}^{W}\) in the synthetic program. (**a**) Source code. (**b**) Result. number of training was reduced with respect to the complexity of interleaving of shared variables. The state machine used for diagnosis and the condition variable used for treatment must work correctly for accurate repair. We performed a functional evaluation of diagnosis  
Figure 7: Result of instrumentation. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Synthetic Program** & **Interleaving** & **Correctness** & **Number** \\ \hline \multirow{3}{*}{\(T_{1}^{[R-R]}\parallel T_{2}^{\text{W}}\)} & \(T_{1}^{R}\to T_{1}^{R}\to T_{1}^{R}\) & Yes & 51 \\ \cline{2-4}  & \(T_{  
and treatment and the results are shown in Figure 8, which is a part of the log of the repairing process of \(T_{1}^{W}\parallel T_{2}^{[W-R]}\). thread 1 on the left and thread 2 on the right are executed in order. thread 1 repeatedly executes the write operation. thread 2 executes the read and write operations atomically. After the read operation in thread 2 (id: 6448), the write operation is not executed and the write operation of thread 1 (id: 6449) tries to run. At this point, the diagnosis engine reports an atomicity violation. Moreover, before accessing write, the treatment engine executes wait to stop thread 1. Then, the write operation in thread 2 (id: 6448) executes normally and the treatment engine executes signal and resumes the halted thread 1 to repair atomicity violations. Post-repair runs appeared to execute with normal interleaving. We created a synthetic program with a loop which repeated for a hundred times. Table 4 shows the result of running RAV on the created program.