Giotto. Thomas A. Henzinger, Benjamin Horowitz, Christoph Kirsch. UC Berkeley

Transcription

1 Giotto Thomas A. Henzinger, Benjamin Horowitz, Christoph Kirsch UC Berkeley

2 Control Software Development Mathematical Model Platform Constraints e.g. Matlab/Simulink -CONCURRENCY -ENVIRONMENT TIME some automatic code generation, some manual code optimization -hardware configuration -RTOS (scheduling algorithm) -network protocol -DISTRIBUTION -PLATFORM TIME Executable Code

3 Control Software Development Mathematical Model Platform Constraints Problems: e.g. Matlab/Simulink -close correspondence between model and code is lost with code optimization -if either model or platform changes, the entire process needs to be repeated -hardware configuration -RTOS (scheduling algorithm) -network protocol some automatic code generation, some manual code optimization Executable Code

4 Control Software Development Mathematical Model An intermediate layer that separates platform-independent from platformdependent software issues. Platform-independent Software Model Platform Constraints e.g. synchronous language -executable -composable -verifiable -optimizable -portable -reusable Executable Code

5 Control Software Development Mathematical Model e.g. What is the control equation? What is the sampling rate? Platform-independent Software Model Platform Constraints e.g. Which procedure computes the control equation? Which (clock) event triggers the computation? -still CONCURRENCY -still ENVIRONMENT TIME Executable Code e.g. Which CPU executes the control procedure? What priority has the execution?

6 Control Software Development Mathematical Model Platform-independent code generation and optimization e.g. shared data structures Platform-dependent code generation and optimization e.g. choice of priorities Platform-independent Software Model Platform Constraints SEPARATION OF CONCERNS!!! Executable Code

7 Motivation: Flight Control Software Single CPU.

8 Motivation: Flight Control Software Two or three connected CPUs.

9 Motivation: Flight Control Software

10 Motivation: Flight Control Software 200 Hz 400 Hz 200 Hz 1 khz

11 Platform-independent Software Model 1. Concurrent periodic tasks: -sensing -control law computation -actuating 2. Multiple modes of operation: -navigational modes (autopilot, manual, etc.) -maneuver modes (taxi, takeoff, cruise, etc.) -degraded modes (sensor, actuator, CPU failures)

12 Platform-independent Software Model Mode 1 Task S 400 Hz Task C 200 Hz Task A 1 khz Condition 1.2 Condition 2.1 Mode 2 Task S 400 Hz Task C 200 Hz Task A 1 khz Task A 1 khz Mode 3 Task S 400 Hz Task C 200 Hz Task A 2 khz Mode 4 Task C 100 Hz Task A 1 khz

13 Platform-independent Software Model Host code e.g. C Functionality. Glue code Giotto Timing and interaction. -Concurrency, not distribution. -Environment time, not platform time.

14 Platform-independent Software Model Host code e.g. C Functionality. Glue code Giotto Timing and interaction. This kind of software is understood: Host code may be generated automatically. The software complexity lies in the glue code: Giotto enables requirements-driven rather than platform-driven glue-code programming.

15 The Giotto Programmer s Model Programming in terms of environment time: -time-triggered task invocation -tasks have fixed duration ( WCET ) -tasks are not preemptable Implementation in terms of platform time: -need access to (logical) global time, no other platform requirements -tasks may finish early, but outputs cannot be observed early -tasks may be preempted Similar to the synchronous programmer s model, only simpler (no fixpoint issues).

16 The Giotto Programmer s Model Given: 1. Units of scheduled host code (application-level tasks). e.g. control law computation Input ports Task Output ports 2. Units of synchronous host code (system-level drivers). e.g. device drivers Task Task driver loads task input ports. 3. Real-time requirements and data flow between tasks. Giotto: Glue code that calls 1. and 2. in order to realize 3.

17 Environment Timeline (defined by Giotto semantics) Task duration Sensor Driver Task d Actuator Driver execution in environment time 0. Task execution in environment time d. Sensor/output ports read. Input ports loaded. Output ports read. Actuator/input ports loaded. Time t Time t Time t+d Time t+d

18 Platform Timeline (chosen by Giotto compiler) Sensor Driver Task d Actuator Task on CPU. Input ports loaded. Output ports read. Time t Time t Time t+d Time t+d

19 Platform Independence ensures Predictability Input Determinism: The Giotto compiler chooses for a given platform a platform timeline that is value equivalent to the environment timeline defined by the Giotto semantics. implies Time Determinism: For a given time-triggered sequence of sensor readings, the corresponding time-triggered sequence of actuator settings is uniquely determined (i.e., there are no race conditions).

20 Helicopter Software Control 10 a Actuators i Sensors s Navigation 5

21 Helicopter Software Control 10 a Actuators i Sensors s Navigation 5 Matlab Design

22 Helicopter Software: Environment Timeline Task a i Control a i s Navigation s Navigation s t t t+5ms t+5ms t+10ms t+10ms Block of synchronous code (nonpreemptable) Scheduled tasks (preemptable)

23 Helicopter Software: Giotto Syntax (Functionality) sensor gps_type GPS uses c_gps_device ; actuator servo_type Servo := c_servo_init uses c_servo_device ; output ctr_type CtrOutput := c_ctr_init ; nav_type NavOutput := c_nav_init ; driver sensing (GPS) output (gps_type gps) { c_gps_pre_processing ( GPS, gps ) } task Navigation (gps_type gps) output (NavOutput) { c_matlab_navigation_code ( gps, NavOutput ) }

24 Helicopter Software: Giotto Syntax (Timing) mode Flight ( ) period 10ms { actfreq 1 do Actuator ( actuating ) ; taskfreq 1 do Control ( input ); taskfreq 2 do Navigation ( sensing ) ; }

25 The Giotto Compiler Functionality Timing Interaction Hardware Native Code Giotto Program Giotto-H for tasks and drivers hardware specification -topology (CPUs, nets) -performance (WCET, latency) Giotto Compiler Executables or Failure either Giotto-H overconstrained, or compiler not smart enough (distributed scheduling problem!)

26 Closing the Gap: Annotated Giotto Functionality Timing Interaction Hardware Map Native Code Giotto Program Giotto-H Giotto-HM for tasks and drivers -topology (CPUs, nets) -performance (WCET, latency) -assign tasks to CPUs -assign connections to nets Giotto Compiler Executables or Failure either Giotto-HM overconstrained, or compiler not smart enough (local scheduling problems)

27 Closing the Gap: Annotated Giotto Functionality Timing Interaction Hardware Map Schedule Native Code Giotto Program Giotto-H Giotto-HM Giotto-HMS for tasks and drivers -topology (CPUs, nets) -performance (WCET, latency) -assign tasks to CPUs -assign connections to nets -assign tasks to priorities (say) -assign connections to TDMA slots (say) Giotto Compiler Executables or Failure Giotto-HMS overconstrained

28 Single-CPU Helicopter: Annotated Giotto [ host Heli address ] // Giotto-H Annotation mode Flight ( ) period 10ms { actfreq 1 do Actuator ( actuating ) ; taskfreq 1 do Control ( input ) [ host Heli deadline 10 ] ; // Giotto-MS taskfreq 2 do Navigation ( sensing ) [host Heli deadline 5 ] ; }

29 Single-CPU Helicopter: Platform Timeline (EDF) Task t t t+5ms t+5ms t+10ms t+10ms

30 Code Generation Task a s i Control Navigation F1: call(actuating) a i call(sensing) call(input) schedule(control [10]) schedule(navigation[5]) future(timer, F2:) s return s Navigation t t t+5ms t+5ms t+10ms t+10ms

31 Code Generation Task F2: call(sensing) a i schedule(navigation[5]) Control future(timer, F1:) return a i s Navigation s Navigation s t t t+5ms t+5ms t+10ms t+10ms

32 Two-CPU Helicopter: Annotated Giotto (Time-triggered Communication) [ host HeliCtr address ; host HeliNav address ; network HeliNet address connects HeliCtr, HeliNav ] mode Flight ( ) period 10ms { actfreq 1 do Actuator ( actuating ) ; taskfreq 1 do Control ( input ) [ host HeliCtr deadline 7 ] ; taskfreq 2 do Navigation ( sensing ) [host HeliNav deadline 2 ; push ( NavOutput ) to ( HeliCtr ) in HeliNet slots (7,10) ] ; }

33 Two-CPU Helicopter: Platform Timeline (Time-triggered Communication) TDMA Slot HeliCtr HeliNet HeliNav t t t+5ms t+5ms t+7ms t+10ms t+10ms

34 Code Generation for HeliNav F2: call(sensing) schedule(navigation[2]) HeliCtr schedule(connection[(7,10)]) future(timer, F1:) return HeliNav t t t+5ms t+5ms t+7ms t+10ms t+10ms

35 Two-CPU Helicopter: Annotated Giotto (Event-triggered Communication) [ host HeliCtr address ; host HeliNav address ; network HeliNet address connects HeliCtr, HeliNav ] mode Flight ( ) period 10ms { actfreq 1 do Actuator ( actuating ) ; taskfreq 1 do Control ( input ) [ host HeliCtr deadline 10 ] ; taskfreq 2 do Navigation ( sensing ) [host HeliNav deadline 2; push ( NavOutput ) to ( HeliCtr ) in HeliNet deadline 3 ] ; }

36 Two-CPU Helicopter: Platform Timeline (Event-triggered Communication) Message HeliCtr HeliNet HeliNav t t t+5ms t+5ms t+6.5ms t+7.5ms t+10ms

37 Mode Switch Mode m Mode m f 10 f 10 d g 5 5 p s d h 2.5

38 Mode Switch: Environment Timeline Task f p d g p Mode t+5ms Time

39 Mode Switch: Environment Timeline Task f p d g p s Mode Switch t+5ms Time

40 Mode Switch: Environment Timeline Task f p d g p s d t+5ms t+5ms Time

41 Mode Switch: Environment Timeline Task f p d g p s d h t+5ms t+7.5ms Time

42 Mode Switch: Environment Timeline Task f p d g p s d h d h d t+10ms

43 Try it out!