A Brute-Force Schedulability Analysis for Formal Model under Logical Execution Time Assumption

Transcription

1 A Brute-Force Schedulablty Analyss for Formal Model under Logcal Executon Tme Assumpton Perre-Emmanuel Hladk To cte ths verson: Perre-Emmanuel Hladk. A Brute-Force Schedulablty Analyss for Formal Model under Logcal Executon Tme Assumpton. The 33rd ACM/SIGAPP Symposum On Appled Computng (SAC), Apr 2018, Pau, France. 13p., <hal > HAL Id: hal Submtted on 26 Feb 2018 HAL s a mult-dscplnary open access archve for the depost and dssemnaton of scentfc research documents, whether they are publshed or not. The documents may come from teachng and research nsttutons n France or abroad, or from publc or prvate research centers. L archve ouverte plurdscplnare HAL, est destnée au dépôt et à la dffuson de documents scentfques de nveau recherche, publés ou non, émanant des établssements d ensegnement et de recherche franças ou étrangers, des laboratores publcs ou prvés.

2 A Brute-Force Schedulablty Analyss for Formal Model under Logcal Executon Tme Assumpton PIERRE-EMMANUEL HLADIK, LAAS-CNRS, Unversté de Toulouse, CNRS, INSA, Toulouse, France Ths artcle presents a schedulablty analyss for real-tme systems desgned under the Logcal Executon Tme (LET) assumpton. Ths assumpton ncreases the predctablty of real-tme systems by separatng tme events from schedulng events. A toolchan based on the formal language Facre combned wth the LET assumpton s desgned to organze a set of tools to model, verfy, and generate code. In ths context, an exact brute-force schedulablty analyss based on a smulaton s proposed. The tools and algorthms to manage the computaton are descrbed and a speedup s proposed. An experment on a synthetc system shows the effcency of ths approach. CCS Concepts: Computer systems organzaton Embedded systems; Real-tme system archtecture; Software and ts engneerng Schedulng; Theory of computaton Verfcaton by model checkng; Addtonal Key Words and Phrases: Embedded Systems, Formal Verfcaton, Real-Tme, Schedulng ACM Reference Format: Perre-Emmanuel Hladk A Brute-Force Schedulablty Analyss for Formal Model under Logcal Executon Tme Assumpton. 1, 1 (February 2018), 13 pages. 1 INTRODUCTION The desgn of embedded real-tme systems requres specfc toolchans to guarantee tme constrants. These tools need to be managed n a coherent way va the desgn process and need to deal wth the system modelng, verfcaton, and code generaton. Ths paper presents such an ntegrated toolchan and focuses especally on the schedulablty analyss. The toolchan follows the Logcal Executon Tme (LET) assumpton. Ths assumpton, frst ntroduced by Henznger et al. [8], ncreases the predctablty of a real-tme system by separatng tme events from schedulng events. An ndrect advantage s the possblty of also model-checkng the behavor of such a system wthout consderng the schedulng, whch reduces the rsk of a state exploson. The schedulablty analyss presented n ths paper makes full use of the LET assumpton. The problem s reduced to a schedulablty analyss of a concrete system,.e., a system of perodc tasks wth a known offset wth multple actvaton schemes. The problem s then to compute all the actvaton scenaros and to effcently analyze them. To acheve ths, the approach ntroduced n Ref. [7] s followed and a schedulng smulaton s used to produce an exact schedulng analyss. The remander of ths document s structured as follows. Secton 2 descrbes the context, the toolchan, and the LET assumpton used for ths study. Secton 3 presents work relevant to the schedulng analyss. The followng secton presents the model and assumptons used. Secton 5 ntroduces a process to analyze the schedulablty and descrbes the Author s address: Perre-Emmanuel Hladk, LAAS-CNRS, Unversté de Toulouse, CNRS, INSA, Toulouse, France, pehladk@laas.fr. ACM acknowledges that ths contrbuton was authored or co-authored by an employee, contractor or afflate of a natonal government. As such, the Government retans a nonexclusve, royalty-free rght to publsh or reproduce ths artcle, or to allow others to do so, for Government purposes only Assocaton for Computng Machnery. Manuscrpt submtted to ACM Manuscrpt submtted to ACM 1

3 2 Perre-Emmanuel Hladk prncpal algorthms. Secton 6 shows an evaluaton of the schedulablty analyss on a synthetc example, and fnally Secton 7 addresses the conclusons and future work. 2 CONTEXT The schedulablty analyss presented n ths paper s part of a larger project developng a toolchan called Hppo [9]. Ths toolchan ams to provde tools to desgn, verfy, and generate code for embedded real-tme applcatons to enforce ther temporal safety. The Hppo toolchan s based on a desgn methodology called MCSE (Méthodologe pour la Concepton de Systèmes Électronques), whch was proposed by Calvez [4] durng the 1990s. Ths methodology provdes a framework to desgn embedded systems. It s a straghtforward method, dealng wth a full development cycle and proposng a doman-specfc language wth a narrow but nevertheless meanngful syntax. Fgure 1 outlnes the man steps of the Hppo toolchan. The verfcaton process of Hppo s based on the toolbox Tna [3] and the formal language Facre [2]. Tna s a toolbox to desgn and analyze Tme Transton Systems (TTS), whch are tme Petr nets wth data handlng. It ncludes varous tools to construct reachablty graphs and to model-check lnear temporal logc (LTL) or computatonal tree logc (CTL) formulas. Facre s a formally defned language for modelng the behavoral and tmng aspects of embedded and dstrbuted systems for formal verfcaton and smulaton purposes. A dedcated compler, called frac, s avaled to transform a Facre model nto a TTS model. Both Tna and Facre are documented and can be downloaded from and respectvely. The man problem addressed by Hppo concerns the generaton of an executable that guarantees that the tmng constrants are respected. One dffculty s to avod a semantc gap between the model produced by the desgner, the model used by the model-checker, and the executable [11]. For the Hppo toolchan, we chose to generate a code as close as possble to the TTS formal model. Therefore, durng the generaton step, a runtme system s used to produce C code that guarantees a control flow that s dentcal n every detal to the behavor of the TTS model. Ths approach s smlar to the BIP toolset [1]. A second dffculty concerns the control of the tme behavor and ts verfcaton. Tradtonally, two approaches are dstngushed (a tme-trggered approach versus an event-trggered approach [10]) by the tme representaton and the nstants at whch events are consdered. However, an ntermedate approach, based on the Logcal Executon Tme (LET) assumpton, was ntroduced wth Gotto [8]. Usng LET, the system desgner specfes the logcal executon tme of each task, that s, the duraton between the nstant at whch the task s actvated and the nstant at whch the task provdes ts outputs. When the LET expres, the outputs are made vsble for other tasks. Ths bufferng of outputs acheves determnacy n both tmng (no jtter) and functonalty (no race condtons). LET programmng trades code effcency n favor of code predctablty compared Manuscrpt submtted to ACM System Desgn MCSE IDE MCSE2FIACRE MCSE Facre Functonnal Model () Model () () Schedulablty Analyser Frac TTS Model Hppo (v) Tna Fg. 1. Man steps of the Hppo toolchan. (v) Executable Analyse

4 A Brute-Force Schedulablty Analyss for Formal Model under Logcal Executon Tme Assumpton task A task B task C LET for task A LET for task C LET for task B (a) LET vew task actvaton and nput readng output data wrtng task A task B task C (b) Schedulng EDF vew Fg. 2. Tmng dagram for three tasks under the LET assumpton. nput readng output wrtng task executon to tradtonal task schedulng, whch makes all outputs vsble as soon as they become avalable. Fgure 2(a) shows examples of LET for three tasks. To respect the LET assumpton, the code generator needs to make sure that, on a specfed platform, all the outputs are computed n tme. Ths can be handled by a code composed of multple tasks to ensure concurrent executon and a real-tme operatng system thereby leveragng the strengths of real-tme schedulng durng executon. Fgure 2(b) shows an example where an EDF scheduler s used to guarantee that the outputs are computed n tme. Under the LET assumpton, the schedulng can be gnored to model-check the behavor of the applcaton. However, durng the code generaton step, the compler needs to check the schedulablty of the task. Ths paper addresses ths problem. The transformaton from an MCSE Model to a Facre Model s not the focus of ths paper and s therefore omtted n the followng sectons. A prototype for the TTS Executon Engne s mplemented on Xenoma ( 3 RELATED WORK Numerous methods to analyze the schedulablty have been developed snce the ntal work of Lu and Layland [13]. A large porton of these methods uses analytcal expressons to produce a schedulablty test. The advantages of these approaches are ther ablty to deal wth varous behavor task models and ther often low computatonal complexty. However, t may be dffcult to extend these tests to non-usual behavor and they are often non-optmal for multprocessor archtectures. Other studes use formal methods to verfy the schedulablty of a system. For example, Lme et al. [12] modeled a preemptve scheduler wth a schedulng tme Petr net, and Peres et al. [14] proposed a formal language to model a scheduled system. These approaches have the advantage of drectly modelng the schedulng algorthm wth a behavor model; however, a serous ssue wth these methods s the state space exploson, whch drastcally lmts the number of tasks that can be consdered. Moreover, the preempton nduces undecdablty. To overcome these dffcultes, some researchers, such as Cordovlla et al. [6], propose modelng the task behavor wth a formal model and the scheduler wth an ad-hoc code. Goossens et al. [7] proposed another approach to analyze the schedulablty of a multprocessor system. They show that, under certan hypotheses, t s possble to use a smulator to conduct an exact schedulablty test. Our paper s a contnuaton of ths work. There are several tools dedcated to the smulaton of real-tme systems such as Cheddar, YASA, TORSCHE, MAST, Storm, and SmSo. Most of these tools are desgned to valdate, test, and analyze systems. SmSo [5] s the most advanced and modular tool focusng on the study of the scheduler tself. In ths paper, we chose to use a formal method to model-check the behavor of a system wthout consderng the schedulablty and to analyze the schedulablty wth a dedcated algorthm combned wth a smulator. The am of ths Manuscrpt submtted to ACM

5 4 Perre-Emmanuel Hladk Facre model Model of operatons frac tna -F1 loll Dscret State tts () () Graph (v) () Transtons of nterest Mnmal Dscret Graph hppo Sched Paths of actvatons Fg. 3. Toolchan for the schedulablty analyss. (v) SmSo (v) Trace of smulatons approach s to avod a state space exploson wth formal methods whle mantanng an exhaustve verfcaton of the system s behavor. 4 MODEL AND HYPOTHESIS The toolchan used to conduct the schedulablty analyss s sketched n Fgure 3. The man steps are: () the Facre model s compled to a TTS Model va the compler frac; () () the state space s generated by the tool Tna (as explaned n the next secton, the state graph s obtaned by frng nteger unt delay transtons and dscrete transtons); () the elements formally descrbed n the TTS are lnked wth schedulng tme parameters of tasks such as the executon tme and deadlne; (v) the tool loll reduces the state space graph to a mnmal determnst automaton wth only transtons that represent a unt delay or a task actvaton; (v) all sequences of task actvatons are computed for a feasblty nterval; and (v) each sequence s run wth a schedulng smulator and each deadlne s checked. The next subsectons descrbe each step n detal, especally step (v). The tools that support steps (), (), and (v) are avalable wth the toolbox Tna; therefore, only the nput and output models wll be presented below. An alternatve toolchan s also proposed n Secton 5.4 va embeddng the schedulng smulaton nto the search for the sequences of actvatons,.e., steps (v) and (v) are merged. The smulator used s SmSo [5]. It s a dscrete event smulator used to evaluate real-tme schedulng algorthms (mono or multprocessor). It s only used n ths study to generate the schedulng of a sequence of task actvatons and to check the deadlnes. From a general perspectve, ths approach follows the dea ntroduced by Goossens et al. [7] to produce an exact schedulablty test based on smulatons. The hypotheses of the schedulng algorthm used to conduct ths test are exposed n the followng. The purpose of ths paper s to propose a practcal soluton to proceed any behavoral model of the executon descrbed n the specalzed Facre for MCSE. Facre model. The Facre [3] language s used to model the behavor and tmng aspects of systems. Ths language s composed of parallel processes communcatng va ports and shared varables. A process descrbes the behavor of sequental components and s defned by a set of control states, each assocated wth a program segment bult from classcal determnstc constructs (assgnments, f-then-else condtonals, whle loops, and sequental compostons), communcaton data-events on ports, and jumps to the next state. To consder MCSE behavor and the LET assumpton, a specalzaton of Facre s performed. Manuscrpt submtted to ACM

6 A Brute-Force Schedulablty Analyss for Formal Model under Logcal Executon Tme Assumpton process pexample s [...] 3 argop := arg ; /* read data */ wat [0,0] /* trgger operaton */ 5 to BegnOp from BegnOp 7 res := Op ( argop );/* operaton */ wat [12,12]; /* LET */ 9 to EndOp from EndOp 11 [...] pexample Lstng 1. Pattern to model the operaton Op wth a logcal executon tme From a temporal perspectve, we assume that all nstructons and transtons n a Facre model take zero executon tme. The tmng s modeled va the wat statement, whch represents a delay. Ths statement s assocated wth an nterval [a,b] and sgnfes that the control state needs to wat a duraton between a and b before forwardng. For our purpose, only punctual ntervals wth nteger numbers are permtted,.e., wat[a, a] wth a N. Ths restrcton ensures that the behavor of the system s determnstc and nduces a dscrete tme. The LET assumpton s assocated wth the functonal treatments, whch are embedded nto functons called operatons. An operaton s bascally a C functon wth nput and output data. These operatons are executed n Hppo va tasks. Each operaton has ts own task and s scheduled by the operatng system. Lstng 1 shows the pattern used n Facre to model an operaton under LET. The nput data are read at lne 3, and actvaton s trggered at lne 4. The usage of the statement wat [0,0] forces the transton to occur mmedately,.e., the nputs are mmedately read. The call of the operaton Op s represented n lne 7. Ths functon s the treatment realzed by the operaton. The LET assumpton s modeled by the value of the wat statement n lne 8. In Facre, a value s only updated durng a transton, so that the value of res s made vsble,.e., the outputs are provded, only when the delay (lne 8) s expred. The Facre model offers the possblty of wrtng any type of actvaton pattern for the operatons: the perodcty can be modeled wth a smple delay or a precedence relaton wth synchronzaton va a port or condton. The Lstng 2 gves an example of a perodc behavor. Thanks to the wat statement lne 7, the process clock1 s perodc. The process p1 s synchronzed wth ths perodc clock through the label (ı.e. port n Facre termnology) tck1. It means that the transton start from the process clock1 s synchronzed wth the transton watperodc of p1. The composton s done wth the component cexample (lne 17) where the par statement s used to synchronzed ports of dfferent processes. The task behavor does not need to be characterzed; t s mplctly descrbed by the model. TTS Model. The Facre model s compled to a TTS Model wth the frac compler. A TTS model s a tme Petr net wth data handlng and guards descrbed n a C fle. We do not need to consder data n the schedulablty analyss; therefore, we do not present how to manage them here. Ths s done by the compler durng the code generaton at the runtme. Temporal characterstcs of an operaton. Two temporal characterstcs are assocated wth an operaton: ts executon tme and ts deadlne. These are descrbed n an xml fle. It s possble to extend these characterstcs to add nformaton for the scheduler, for example, a prorty level. The schedulng algorthm s also descrbed by the name of the schedulng polcy n SmSo. Manuscrpt submtted to ACM

7 6 Perre-Emmanuel Hladk process clock1 [ tck1 : none ] s states start, order 3 from start tck1 ; 5 to order from order 7 wat [perod, perod ]; to start process p1 [ tck1 : none ] s 11 states watperodc, from watperodc tck1 ; 14 [...] to watperodc component cexample s 18 port tck1 : none n [0,0], par * n clock1 [ tck1 ] 22 p1 [ tck1 ] end Lstng 2. Pattern of a perodc actvaton. Schedulng polcy. The schedulng polcy used by the operatng system to execute tasks s not stated n the behavor model. The scheduler polcy only needs to be known durng the smulaton and s therefore drectly mplemented n SmSo. There are no restrctons on the scheduler (e.g., unprocessor, multprocessor, global, or parttoned); however, as Goossens et al. [7] show, only determnstc and memoryless schedulers need to be consdered. A memoryless scheduler s a scheduler for whch the scheduler decson depends only on the state of the system at the current nstant (see Defnton 1 n Ref.[7] for a more formal defnton). Moreover, n the same artcle [7], the authors specfy that smulaton-based schedulablty tests can only be used when the context s such that the smulaton s C-sustanable. A schedulabtlty test s C-sustanable s a system deemed schedulable when tasks are usng ther WCET s schedulable even f some tasks do not use up to ther WCET. In practce, the Hppo runtme s based on ndustral operatng systems and, therefore, only the Fxed Prorty scheduler and Earlest Deadlne Frst have been used (wth the global verson for the multprocessor platform). These two schedulers are determnstc, memoryless, and C-sustanable when the tasks are ndependent. In the case of a multprocessor archtecture, only dentcal multprocessor platforms are consdered. Moreover, to conduct the schedulablty analyss, t s necessary to know the smulaton nterval. Ths nterval s related to the noton of the feasblty nterval,.e., a fnte nterval [a,b] such that f all the deadlnes of jobs released n the nterval are met, then the system s schedulable. Readers are nvted to refer to the comprehensve overvew on smulaton ntervals n Ref. [7]. 5 SCHEDULABILITY ANALYSIS 5.1 Computaton of the Dscrete State Graph The tool Tna (step () n Fg. 3) s used wth opton -F1 on the TTS model to buld a subgraph of the state graph obtaned by frng nteger unt delay transtons and dscrete transtons. Ths graph preserves the reachablty and lnear tme temporal propertes. Fgure 4(a) shows an example of part of a graph computed usng ths tool. The edges labeled wth "" represent a unt tme, and other edges are nternal events n the model. Note that all tmed values (delays) are ntegers; therefore, a graph wth dscrete transtons has the same behavor as the ntal model. Manuscrpt submtted to ACM

8 A Brute-Force Schedulablty Analyss for Formal Model under Logcal Executon Tme Assumpton t t t + 1 t + 1 t + 2 t + 3 t t0 t a 0 a 1 a 2 a a 1 a 0 a 1 a a 3 t t t (a) Dscrete State Graph t t t + 1 t + 2 t + 3 t + 4 t t... 1 t + 1 t + 2 t + 3 t + 4 a 0,a 1 a 1,a a (c) Reduced State Graph... 1 a 0 a 1 a a 1 a 0 a 2 a a (b) State Graph of nterest Fg. 4. Examples of graph refnement. fct h flter_1_t0_clock 100 hz_1_t0 25 clock 100 hz_1_t1 clock 200 hz_1_t1 fct engne_1_t1 fct engne_1_t0_clock 200 hz_1_t0 clock 200 hz_1_t1 clock 200 hz_1_t1 clock 100 hz_1_t1 clock 100 hz_1_t1 fct engne_1_t0_clock 200 hz_1_t0 fct engne_1_t0_clock 200 hz_1_t0 clock 200 hz_1_t1 fct h flter_1_t0_clock 100 hz_1_t0 fct h flter_1_t0_clock 100 hz_1_t0 fct engne_1_t0_clock 200 hz_1_t0 fct va control_1_t1 fct vz control_1_t1 fct engne_1_t1 fct vz control_1_t1 fct h flter_1_t1 fct va control_1_t1 fct h flter_1_t1 fct engne_1_t1 fct vz control_1_t0_fct va control_1_t0_clock 50 hz_1_t1 fct engne_1_t1 fct h flter_1_t1 fct engne_1_t0_clock 200 hz_1_t0 fct h flter_1_t0_clock 100 hz_1_t0 Fg. 5. Example of a state graph obtaned wth loll. For the schedulablty analyss, only events lnked to the actvaton of an operaton need to be consdered and other non-tmed transtons can be consdered to be slent transtons (the set of events lnked to an actvaton can be automatcally found usng the Facre model). For example, a transton not-related to an actvaton can be a transton used to model a condtonal statement n a process. By consderng the state space graph to be an automaton, t can be reduced to the set of transtons lnked to the actvaton of an operaton. To acheve ths, the tool loll was developed by Bernard Berthomeu at LAAS-CNRS. It replaces transtons that are not n the set of nterest wth ϵ-transtons and determnes and reduces ths new graph. In other words, the graph produced by loll represents all tmed sequences of actvatons that can occur n the system and gnores other events. Fgure 4(b) shows the result for the graph presented n Fgure 4(a), where only a 1, a 2, and a 3 clock 50 hz_1_t fct h flter_1_t1 fct engne_1_t1 fct h flter_1_t0_clock 100 hz_1_t0 fct engne_1_t0_clock 200 hz_1_t0 clock 50 hz_1_t2 fct engne_1_t1 clock 200 hz_1_t1 fct h flter_1_t1 fct engne_1_t0_clock 200 hz_1_t0 fct h flter_1_t1 fct engne_1_t1 Manuscrpt submtted to ACM fct engne_1_t1 fct h flter_1_t0_clock 100 hz_1_t0 clock 100 hz_1_t1 fct engne_1_t0_clock 200 hz_1_t0 fct engne_1_t0_clock 200 hz_1_t0 fct engne_1_t0_clock 200 hz_1_t0 clock 100 hz_1_t1 clock 200 hz_1_t1 clock 200 hz_1_t1 fct h flter_1_t0_clock 100 hz_1_t0 fct h flter_1_t0_clock 100 hz_1_t0 49 clock 100 hz_1_t1 clock 200 hz_1_t1

9 8 Perre-Emmanuel Hladk are transtons related to an actvaton. Other transtons are not lnked to an actvaton and therefore are not treated by the schedulablty analyss. 5.2 Computaton of sequences of actvatons The executon of a system can be descrbed by the set of tmngs of actvatons of operatons. Ths set s called a sequence of actvatons. Defnton 5.1. By denotng op, t the actvaton of an operaton op at an nstant t, a sequence of actvatons s defned as an ordered set of actvatons { op, t 1, op j, t 2,..., op k, t 3 } wth t t Computng the sequence from a path. We denote the drected graph obtaned wth loll to be G = (V, E), where V s the set of vertces and E s the set of drected edges that connects an ordered par of vertces. The set of edges of unt tme transtons s denoted C,.e., the set of transtons labeled, and the set of edges that represents a transton related to an actvaton s denoted A. The sets A and C are a partton of E: E = A C and A C =. An edge e n A s lnked to a set of operatons actvated durng the transton e; ths set s denoted Op e. For a drected path p = e 1 e 2...e n, e E (to smplfy, we omt the vertces n the path) from a graph G = (V, E), the sequence of actvatons s(p) can be computed wth an teratve expresson: t 0 = 0 s 0 = f e C otherwse t = t s = s 1 t = t 1 s = s 1 o j Op e { o j, t } Equalty between two sequences. If two operatons op 1 and op 2 are actvated at the same tme t, then for the sequences s 1 = {s start, < op 1, t >, < op 2, t >, s end } and s 2 = {s start, < op 2, t >, < op 1, t >, s end }, the order of the releases of the operatons s chosen by the schedulng polcy; therefore, these sequences produce the same schedulng (f the scheduler s determnstc). From a schedulablty perspectve, we consder s 1 and s 2 to be equvalent. Defnton 5.2. Two sequences of actvatons s 1 and s 2 are sad to be equal, denoted s 1 = s 2, ff a = o j, t s 1, a s also n s 2 (and vce versa). From a dscrete state graph computed usng loll, the computaton of all sequences can produce multple equal sequences, e.g., n the example depcted n Fgure 4(b), the sequence s(p 1 ) = { a 0, 0, a 1, 0 } from the pathp 1 = (3, 4)(4, 7) s equal to the sequence ssued from the path p 2 = (3, 5)(5, 7), s(p 2 ) = { a 1, 0, a 0, 0 }. To speed up the schedulablty analyss of a system, t s of nterest to not consder multple sequences and to avod equal ones Equvalence and mnmalty. For a graph G = (V, E) and a vertex v V, we denote P (G, v) to be the set of all smple paths from v (a smple path refers to a path that contans no repeated vertces). Defnton 5.3. G 1 s equvalent at G 2, denoted as G 1 G 2, from v 1 V 1 and v 2 V 2 ff {s(p) p P (G 1,v 1 )} = {s(p) p P (G 2,v 2 )}. Manuscrpt submtted to ACM

10 A Brute-Force Schedulablty Analyss for Formal Model under Logcal Executon Tme Assumpton Defnton 5.4. A graph G s sad to be mnmal from a vertex v, f all paths from v produce dfferent sequences of actvatons:. (p 1,p 2 ) P (G,v) 2,p 1 p 2 = s(p 1 ) s(p 2 ) Graph reducton. It s possble to compute a mnmal graph equvalent to a graph G = (V, E) from an ntal vertex. The detals of the algorthms are not gven here. Only the man steps are descrbed. Frst step: The reducton algorthm begns computng all subgraphsg = (V, E ) ofg that have connected components such that: () all edges n E are n A, () all other edges n E connected to V are n C, and () all vertces n V connected to a edge n E are n V. Therefore, a subgraph G descrbes a set of actvatons occurrng between two unt tmes,.e., n [t, t + 1). In the example depcted n Fgure 4(b), we have two subgraphs G 1 = ({1, 2, 3, 4, 5, 6 }, {(1,2 ), (2,5 ), (1,3 ), (3,5 ), (3,6 ), (1,4 ), (4,6 )}) and G 2 = ({7, 8 }, {(8, 7 )}). Moreover, for each subgraph G = (V, E ), the set I of vertces v n V wth an edge n C that ponts to v s computed and the set of vertces v n V wth an edge n A that ponts from v s denoted O. For the example depcted n Fgure 4(b), for G 1, we have I 1 = {1 } and O 1 = {5,6 }. Second step: The algorthm computes all paths from vertces n I to O for a subgraph G. For each path p, the set of actvated operatons {o o Op e, e p} s computed and saved only f another path does not have () the same ntal vertex, () the same fnal vertex, and () the same set of actvated operatons. Therefore, for each subgraph G, we have a mnmal lst of paths, l = [p,1,p,2,...], where each path p s descrbed by ( p, f p, s p ) wth p as an ntal vertex, f p as a fnal vertex, and s p as a set of operatons. In the example depcted n Fgure 4(b), for the subgraph G 1, the mnmal lst s l 1 = [(1, 5, {a 0, a 1 }), (1, 6, {a 1, a 2 })]. Thrd step: The algorthm computes a new graph G mn by replacng all subgraphs G n G wth edges lnked to a set of operatons {e = ( p, f p ),Op e = s p p l }. In ths example, we obtan the new graph gven n Fgure 4(c). Fourth step: It s possble that two edges of G mn wth dfferent ntal nodes have the same set of operatons, and therefore a more compact representaton of the graph may exst. Therefore, n the last step, the new graph G mn s consdered to be an automaton where each set of Op e s assocated wth a symbol. Ths step uses the classc Hopcroft s algorthm to reduce the automata Equvalence and mnmalty of the reducton algorthm. Theorem 5.5. The graph G mn obtaned wth the reducton algorthm s equvalent to G. Proof. Accordng to the constructon of G mn, for all parts p = e e +1...e +k of a path p = n 1 e 1 n 2 e 2 n 3...e n n n+1 from G such that e m A,m [, + k] and (e 1, e +k+1 ) C 2, there exsts an edge e = (n, n +k+1 ) n G mn such that s(e) = s(e e +1...e +k ). Conversely, the algorthm ensures that all actvaton sequences from a path of G mn exst f there exsts a path wth the same sequence n G. Theorem 5.6. The graph G mn obtaned wth the reducton algorthm s mnmal. Manuscrpt submtted to ACM

11 10 Perre-Emmanuel Hladk Proof. The automaton mnmzaton at the end of the reducton algorthm guarantees that a word accepted by the automaton has a unque path, and therefore the graph s mnmal n the sense of the defnton Computaton of the schedule traces The reducton algorthm obtans a mnmal graph that represents all the possble sequences of actvatons for a gven system. To compute all the paths,.e., all sequences of actvatons that the system can experence, a depth-frst search algorthm can be used combned wth a stop condton based on the duraton of the path,.e., the algorthm s stopped when t from equaton reaches a fxed value. Accordngly, how can ths duraton be set to guarantee that all executon scenaros have been checked? Note that all graphs have a shape of lollpop (or racket), as shown n Fgure 5. Ths means that the system has an ntal phase followed by perodc behavor. Therefore, f each operaton s consdered to be an ndependent task wth a perod equal to the perodc behavor of the lollpop and an offset equal to ts frst nstance of actvaton, the system can be consdered to be a concrete perodc system and therefore the classcal results dependng on the schedulng polcy can be used to determne a smulaton nterval [7]. After enumeratng all the actvaton sequences, ths sequence s translated nto the nput format for the schedulng smulator SmSo. Note that any schedulng polcy can be chosen wth the smulator; however, the scheduler needs to be C-sustanable to ensure the fasablty of the analyss [7]. 5.4 Embedded schedulng polcy It s possble to adaptvely check the schedulablty by computng the schedulng drectly whle traversng the mnmal actvaton graph. The detals of ths algorthm are not provded here. The man dea s to compute the state of the scheduler and to check the schedulablty at each step when the paths are computed. The descrpton of a state depends on the schedulng algorthm, for example, for EDF, the remanng work for each job and the absolute deadlne are suffcent nformaton to compute the next state. A smple depth-frst search algorthm s therefore used to compute the new scheduler state and check the schedulablty of all paths from each vertex. If all operatons have fnshed, the algorthm reaches the next vertex wth an out edge not n C. Ths new vertex s then marked as a source, and a new computaton from ths vertex s released, but only f the vertex has never been used as a source before. Note that only memoryless schedulng s consdered; therefore, all past events that lead to a state can be forgotten and, f ths state s met agan the future, t wll be exactly the same. Ths algorthm ends when all paths are explored. Its termnaton s guaranteed by the fnte number of vertces. Ths algorthm has two major advantages on the toolchan wth SmSo: () the smulaton duraton s computed by the algorthm,.e., the algorthm s stopped when all actvaton sequences have been explored, and () the number of paths to explore s reduced thanks to the cuts made when all the remanng work has been treated. However, the man drawback s the necessty to wrte a specfc procedure to update the scheduler state for each schedulng polcy. 6 EXPERIMENTS The toolchan s mplemented n ML for frac, Tna, and loll. SmSo s mplemented n Python, as are the other tools. The NetworkX package ( s used to manpulate the graphs. To show the effcency of the approach, an experment was conducted on a synthetc benchmark. Ths example s descrbed n Fgure 6 and s composed of seven executon flows. Each flow s perodcally actvated and trggers the actvaton of operatons. In Fgure 6, the uplets under the clocks represent the offset,.e., the frst actvaton, and the Manuscrpt submtted to ACM

12 A Brute-Force Schedulablty Analyss for Formal Model under Logcal Executon Tme Assumpton clock1 <0,5> clock2 <3,15> clock6 <0,20> <1,3> Op1 <1,2> Op2 <4,6> Op3 <1,2> Op4 clock3 <1,40> Op5 <10,20> <2,10> <7,15> Op6 Op7 clock5 <2,10> mode == true <10,20> <3,5> Op12 Op13 mode == true mode == true <2,5> <1,3> Op10 Op11 clock <offset,perod> clock4 <0,100> mode == true <7,40> <2,4> Op8 Op9 clock7 <6,40> <3,5> Op15 <2,20> Op16 mode == true <3,5> <1,2> Op14 Op17 <wcet,deadlne> Op. Fg. 6. Synthetc example for the experments. <3,10> Op18 perod of the flow. An operaton s represented by a rectangle and an uplet wth ts WCET and deadlne. An arrow between two operatons ndcates that the second operaton s actvated when the deadlne of the prevous one s reached. A vertcal lne represents a condtonal synchronzaton and ndcates that an operaton s actvated only f the condton s verfed. For example, operaton 9 s actvated only f the varable mode s true, otherwse operaton 8 s actvated. Note that the value mode s shared by varous flows and can be thought of as a mode-change. Here, the change can happen at any tme but only once. By consderng the condtonal cases, the maxmum utlzaton factor,.e., the sum of the WCET operatons dvded by the perod, s 185%; therefore, a mnmum of two processors s necessary to schedule ths system. For ths study, the scheduler was a Global EDF on 3 processors. The model of ths system s wrtten n Facre wth the pattern gven n Secton 4 for the operatons. The clocks, condtons, and the mode-change are also modeled wth the Facre language. The Lstng 3 gves an example of Facre code for the clock4 and the flow 4. The WCETs are specfed n a dedcated xml fle (see Secton 4). The experments were performed on a 2.6 GHz Intel Core 5 wth 8 GB of memory. The state graph obtaned wth Tna has 31,125 states and 72,139 transtons. The dscrete graph produced by loll has 2244 nodes and 2834 edges, and the reduced graph has only 1780 nodes and 1870 edges. The computaton tme s 1.03 s wth Tna and 1.89 s wth loll. The transton phase of the lollpop has a duraton of 22 unts of tme and a perod of 600 (equal to the lcm of the perods of all the flows). The number of paths explored wth the brute force method coupled wth SmSo s 282. The computaton tme to compute all the actvaton sequences s 0.89 s, and the smulaton of all the sequences wth SmSo s 75.8 s. All deadlnes are respected. Manuscrpt submtted to ACM

13 12 Perre-Emmanuel Hladk p r o c e s s c l o c k 4 [ t c k 4 : none ] s s t a t e s o f f s e t S t a t e, s t a r t S t a t e, o r d e r S t a t e from o f f s e t S t a t e wat [ 0, 0 ] ; / o f f s e t : 0 / 6 t o s t a r t S t a t e from s t a r t S t a t e t c k 4 ; / s y n c h r o n z a t o n event / 9 t o o r d e r S t a t e from o r d e r S t a t e 11 wat [ 1 0 0, ] ; / p e r o d : 100 / t o s t a r t S t a t e p r o c e s s p4 [ t c k 4 : none ](& mode : nat ) s s t a t e s watstate, readmode, updateinputdataop8, computestateop8, updateinputdataop9, computestateop9 17 var : nat : = 0, arg : nat : = 0, tmp : nat from w a t S t a t e 20 t c k 4 ; t o readmode 22 from readmode tmp : = mode ; wat [ 0, 0 ] ; 25 f tmp = 1 then t o updateinputdataop e l s e t o updateinputdataop end from updateinputdataop8 31 arg : = ; wat [ 0, 0 ] ; 33 t o computestateop from computestateop8 / Op8 : d e a d l n e 40 wcet 7 / : = Op8 ( arg ) ; 36 wat [ 4 0, 4 0 ] ; t o w a t S t a t e from updateinputdataop9 39 arg : = ; wat [ 0, 0 ] ; t o computestateop9 42 from computestateop9 / Op9 : d e a d l n e 4 wcet 2 / : = Op9 ( arg ) ; 44 wat [ 4, 4 ] ; t o w a t S t a t e Lstng 3. Facre model excerpt of the synthetc example The method wth the schedulng polcy embedded n the tool explores 269 sequences wth a mean sze of 42 operatons n 1.2 s. Ths experment shows the feasblty of the method and that t s possble to proceed to an exhaustve schedulablty analyss wth the smulaton tool. Note that the use of SmSo ncreases the duraton of the analyss; however, t s easy to experment wth varous schedulers on the same system. Here, the example s not schedulable wth two processors. The smulaton tools can easly gve a trace where a task do not respect ts deadlne. 7 CONCLUSION In ths artcle, a schedulablty analyss was presented for a system under the LET hypothess. Ths hypothess has the advantage of clearly separatng the temporal analyss of the applcaton behavor from the schedulng. The revealed soluton s based on the work of Goossens et al. [7], and a schedulng smulaton was used to produce an exact schedulablty test. Two versons were proposed. The frst one uses the noton of the feasblty nterval of a concrete task system, and the second adaptvely enumerates all schedulng scenaros. Manuscrpt submtted to ACM

14 A Brute-Force Schedulablty Analyss for Formal Model under Logcal Executon Tme Assumpton A complete mplementaton was carred out, and experments were conducted on a synthetc system. The results demonstrate the usablty of ths method. REFERENCES [1] Tesnm Abdellatf, Jacques Combaz, and Joseph Sfaks Model-based mplementaton of real-tme applcatons. In Proc. of ACM Internatonal Conference on Embedded Software (EMSOFT). [2] Bernard Berthomeu, Jean-Paul Bodevex, Patrck Faral, Mamoun Flal, Hubert Garavel, Perre Gaufllet, Frederc Lang, and Franços Vernadat Facre: an Intermedate Language for Model Verfcaton n the Topcased Envronment. In Proc. of the Embedded Real Tme Software (ERTS). [3] Bernard Berthomeu, Perre-Olver Rbet, and Franços Vernadat The tool TINA Constructon of Abstract State Spaces for Petr Nets and Tme Petr Nets. Internatonal Journal of Producton Research 42, 14 (2004). [4] Jean-Paul Calvez Embedded Real-Tme Systems A Specfcaton and Desgn Methodology. Wley. [5] Maxme Chéramy, Perre-Emmanuel Hladk, and Anne-Mare Déplanche SmSo: A Smulaton Tool to Evaluate Real-Tme Multprocessor Schedulng Algorthms. In Proc. of the 5th Internatonal Workshop on Analyss Tools and Methodologes for Embedded and Real-tme Systems (WATERS). [6] Mkel Cordovlla, Frédérc Bonol, Erc Noulard, and Clare Pagett Multprocessor Schedulablty Analyser. In Proc. of the 26th Annual ACM Symposum on Appled Computng (SAC). [7] Joël Goossens, Emmanuel Grolleau, and Llana Cucu-Grosjean Perodcty of real-tme schedules for dependent perodc tasks on dentcal multprocessor platforms. Real-Tme Systems (2016). [8] Thomas Henznger, Benjamn Horowtz, and Chrstoph Krsch Gotto: a tme-trggered language for embedded programmng. Proc. IEEE 91, 1 (2003). [9] Perre-Emmanuel Hladk, Slvano Dal Zlo, Olver Pasquer, Sébasten Pllement, and Bernard Berthomeu Outllage pour la modélsaton, la vérfcaton et la génératon d applcatons temporsées et embarquées. In 15èmes journées Approches Formelles dans l Assstance au Développement de Logcels (AFADL). [10] Hermann Kopetz Event-Trggered Versus Tme-Trggered Real-Tme Systems. In Proc. of the Internatonal Workshop on Operatng Systems. [11] Cédrck Lelonnas, Jérôme Delatour, Matthas Brun, Olver H. Roux, and Charlotte Sedner Formal Synthess of Real-Tme System Models n a MDE Approach. Internatonal Journal on Advances n Systems and Measurements 7 (2014). [12] Dder Lme and Olver H. Roux Formal verfcaton of real-tme systems wth preemptve schedulng. Real-Tme Systems 41, 2 (2009). [13] Chang L. Lu and James Layland Schedulng Algorthms for Multprogrammng n a Hard-Real-Tme Envronment. J. ACM 20, 1 (1973). [14] Florent Peres, Perre-Emmanuel Hladk, and Franços Vernadat Specfcaton and verfcaton of real-tme systems usng the POLA tool. In Proc. of the 3rd Internatonal Workshop Internatonal Conference on Verfcaton and Evaluaton of Computer and Communcaton Systems (VECoS). Manuscrpt submtted to ACM