Modeling of Dynamically Modifiable Embedded Real-Time Systems

Transcription

1 ing of Dynamically Modifiable Embedded Real-Time Systems Franz Rammig University of Paderborn Heinz Nixdorf Institute Paderborn, Germany Telephone: Fax: Carsten Rust University of Paderborn C-LAB Paderborn, Germany Telephone: Fax: Abstract In the paper a Petri net based approach for modeling dynamically modifiable embedded real-time systems is presented. The presented work contributes to the extension of a Petri net based design methodology for distributed embedded systems towards the handling of dynamically modifiable systems. Extensions to the underlying High-Level Petri net model are introduced that allow for dynamic modifications of a net at run-time. Furthermore, a simulation tool for the resulting self-modifying net model is outlined. The tool has been designed to simulate the execution of a dynamically modifying Petri net on a simplified model of a hardware platform which is dynamically modifying as well. Keywords: Petri nets, reconfigurable systems, autonomic computing, embedded real-time systems 1. Introduction The design of embedded real-time systems is becoming even more complicated. The reasons are manifold, e.g. limited resources, reliability requirements, distributed and concurrent behavior and heterogeneity of models as well as target platforms. A further factor raising complexity of embedded systems design is that they tend to be dynamic to an increasing extent. As an example, consider an adaptive robot control, where components of the control software are changed at run-time due to results of online learning algorithms. Another application scenario is a group of mobile robots that cooperatively solve a problem. Since robots may enter or leave the scenario or just change their location, the entire system is highly dynamic. Such systems gain increasing interest, e.g. when studying autonomic computing. Even in traditional application domains like automotive systems, dynamically modifying control systems are considered, for instance for the handling of so called fail-over situations, that is in error situations, where functionality has to be relocated. Obviously, dynamically changing system parts increase the heterogeneity of an embedded real-time system. Dynamically evolving subsystems which imply a powerful basic model for specification have to be considered together with basic controllers running under hard reliability constraints. In this paper, we present our approach to model such systems, which we would like to characterize as heterogeneous embedded real-time systems including dynamically modifiable components. Our approach is based on High-Level Petri nets as the underlying formal model. We have chosen a High-Level Petri net model for several reasons, for instance in order to benefit from the multitude of existing verification and analysis methods based on Petri nets. While Petri nets are well-established for the design of static systems, they lack support for dynamically modifiable systems. We therefore propose an extension of High-Level Petri nets in such a way that an engineer is enabled to annotate transitions with transformation rules. A transformation rule specifies a modification of the system that is realized when the annotated transition fires. Many design methodologies and modeling means for embedded real-time systems exist, based on a variety of formal models. Examples for design languages are synchronous languages, data flow diagrams, StateCharts, Petri nets and SDL. Several languages and methodologies originate from the area of hardware/software-codesign. Exam-

2 ples are Ptolemy [2], SystemC [11], SpecC [4] and SPI [6]. Most of the methodologies mentioned are devoted to the design of heterogeneous systems. However, they provide no sufficient support for systems which include dynamic components. Dynamic creation of tasks for instance is not supported by most of the systems above mentioned. Only Ptolemy allows for creating tasks at run-time. However, the tasks can not be connected with already existing tasks. Structural transformations of components at run-time, as proposed by our specification language, are not supported. In the following sections, we will first give an overview over our design methodology for systems that are structurally dynamic by nature. Section 3 describes the High- Level Petri net that was developed for these systems whereas Section 4 introduces our extensions for dynamically modifiable systems. In Section 5 the main ideas for simulation and analysis are described. In particular, a simulation environment is outlined. 2. Design Flow The work presented in this paper is part of our overall effort towards a design methodology for distributed embedded real-time systems including dynamically evolving components [8]. The approach is based on a wellestablished, previously developed, methodology for static systems, which for instance is described in [9]. The methodology proposes a design flow divided into the three stages ing, Analysis and Partitioning, and Synthesis (cf. Fig- Analysis & Partitioning ing High-Level Petri Net Synthesis Implementation Processor Processor Processor Sensor Bus Actuator Target Architecture Figure 1. Design Flow ure 1). Within the stage of modeling, a heterogeneous model of the system under construction specified using languages from different application domains is transformed into one unique High-Level Petri net model, namely an extended Predicate/Transition-Net (Pr/T Net). In the second stage, Petri net analysis and timing analysis methods are applied in order to validate functional requirements as well as temporal ones and furthermore in order to gather information for an efficient implementation of the system. The implementation is generated in the final stage of synthesis. In this paper we will concentrate on modeling aspects. 3. Basic Petri Net In this section, we give a brief overview of our Petri net model. The mechanisms for dynamic modification will be described in the following section. Basically, we use extended Predicate/Transition-Nets (Pr/T Nets), a High-Level form of Petri nets. Petri nets are bipartite directed graphs PN = (P, T, f, g) augmented by a marking M and firing rules. The Petri net graph consists of a finite set of places P, a finite set of transitions T, directed edges f P x T from places to transitions and g T x P from transitions to places. Places model conditions. For this purpose they may be marked by tokens. Driven by specific firing rules a transition can fire based on the local marking of those places it is directly connected with. By firing, the marking of these places is modified. In the case of High-Level nets the tokens are typed individuals. The other net components are annotated accordingly: places with data types, edges with variable expressions and transitions with a guard and a set of variable assignments. Now a transition can fire only if the formal edge expressions can be unified with actually available tokens and this unification passes the guard expression of the transition. By firing the input tokens are consumed and calculations associated with the transition are executed. By this new tokens are produced that are routed to output places according to variable expressions annotating the output edges of the transition. Figure 2 shows an example net, a component of a robot control. The component is to be activated when the controlled robot is in a mode called EXPLORE, where it moves around and searches for interesting items. The component determines whether the robot shall stay in this mode and computes values for the movement of the robot. When an obstacle is detected causing a switch to another mode it is determined in addition, where the obstacle is located. 2

3 Explore. class RobState { RobState state; SenorValues sensors; state.mode == RobState.EXPLORE T 1 class StateDelta { class SensorValues { class ActuatorSettings { public leftspeed; public rightspeed; public void setexploremode( SensorValues sensors ) { sensors.noobstacle() T nstate.switchmode = false; 3 settings.setexploremode( sensors ); StateDelta nstate ; P 1 sensors sensors sensors.obstacleatleft() nstate.dir = RobState.LEFT; T 4 sensors.obstacledetected() T nstate.switchmode = true; 2 settings.leftspeed = 0; settings.rightspeed = 0; sensors + nstate P 2 sensors + nstate sensors.obstacleatright() nstate.dir = RobState.RIGHT; T 5 SenorValues sensors; StateDelta nstate ; SenorValues sensors; StateDelta nstate ; SenorValues sensors; Figure 2. High-Level Petri net Example Sensors State Ctrl CtrlState Explore Justify Fullturn DState Actuators Figure 3. Hierarchical Pr/T Net Since the component is to be used in a hierarchical specification (see below), several nodes are characterized as interface nodes in order to indicate that they can be connected to nodes from other components. In general both, transitions and places can be characterized as interface nodes. In the example, transition T 1 is an input node and transitions T 3, T 4, and T 5 are output nodes. Pr/T Nets are very powerful, offering the modeling power of Turing machines. To support easy modeling of highly complex systems we additionally added a hierarchy concept that combines hierarchy over places (following Harels hierarchy concepts for StateCharts [5]) and over transitions (in accordance with the concepts of Structured nets by Cherkasova/Kotov [1]). As an example for a hierarchical specification, another component of the robot control is depicted in Figure 3. The above described Explore- Module is instanciated through a hierarchical transition. The net contains two further modes specified in a similar way as the Explore-Module and a discrete control for switching between modes. The latter is specified within a hierarchical place. Finally we added description means for timing to Pr/T Nets. By this we obtained an elegant, adequate and powerful modeling means that serves as foundation of our entire work on design systems for distributed embedded systems. However up to now this modeling technique is adequate only for structurally static systems. Systems that are structurally dynamic by nature demand for some further extensions that are to be described in the sequel sections. 3

4 4. Dynamic Modification In the case of static systems the resulting system can be modelled in advance. In the case of a dynamically reconfigurable one, only the generating system of a set of potentially resulting systems can be provided. Obviously this is an even more demanding task. Resulting systems are modelled by extended Pr/T Nets in our case. By reasons of intended elegance and in order to achieve a self-contained concept we decided to use an extension of these modeling means to describe the generation process as well. For defining a formal model for selfmodifying Petri nets, first of all several datatypes have to be introduced. These types for instance Net or Transition are needed to represent subnets, their components, and their annotations within net inscriptions. The introduction of suchlike types however is basically not an extension of the existing Petri net model, but an application of the High-Level-concept. Interrelations between nets can be described by means of functions between the new datatypes. For specifying net transformations, we propose two alternative mechanisms, that complement one another. The first one is based on Petri net-refinements. Figure 4 shows an example for the refinement of a transition t by a subnet, whose interface consists of transitions only (in the example one input transition and three outputs). The figure also ex- t refines emplifies the application of the refinement in a net containing transition t. The arcs between the surrounding net and t are replaced by the dashed arcs between the surrounding net and the ports of t. By annotating a transition with a refinement rule like the one in Figure 4, the specified Petri net-refinement is bound to the execution of the transition. It should be mentioned that such a refinement usually is used only during the specification of a system. Several approaches for Petri net refinement can be found in literature. For our purposes, we use a set of refinements proposed by Lakos in [7]. Besides the above described refinement of a transition by a transition bounded subnet, the set of refinements also includes a place refinement, a type refinement and a net extension. Currently the latter is not used in our approach. The refinement of places is similar to that of transitions. Type refinement extends the annotations of a net. Using refinements for net modifications combines two advantages. On the one hand, Petri net refinements are a thorougly elobarated concept for developing a specification in a well-structured way. They allow for defining transformations that preserve certain relevant properties of the specification. On the other hand they are powerful enough for describing a variety of dynamic modifications. However, in some cases it is necessary to extend the limited set of refinement operations. We therefore offer a second more generic approach based on rules as they are used in High- Level replacement systems [3]. An example rule is depicted in Figure 5. Left Interface Right t Figure 5. Rule for Dynamic Transformation of Subnets Figure 4. Rule for Dynamic Modification of Refinements The rule can be applied to a net N, when N contains the net on the left hand side of the rule (Left). When the rule is applied, the left hand side is replaced by the net on the right hand side (Right). The replacement is done with respect to a common interface (Interf ace). The interface must be part of the net N for application of a rule, but it 4

5 remains unchanged during replacement. Hence, it specifies the interface of the modified net to the surrounding net. By annotating a transition with a replacement rule like the one in Figure 5, a corresponding net transformation is bound to the execution of the transition. For both approaches, i. e. annotating a transition t mod of a Petri net N with a refinement rule or with a replacement rule, the annotation specifies that, by firing of t mod, an arbitrary transition t of N (or an arbitrary subnet Left in the case of a replacement rule) is modified. Usually it is not reasonable to specify rules applicable to arbitrary transitions. Therefore, restrictions on the application can be specified. On the one hand, a scope may be specified, that is a subnet in which the transformation may take place. On the other hand, attributes of the component to be modified can be specified in the guard of a transition. That way it is possible for instance to specify precisely to which transition a transformation should be applied by specifying its fully qualified path name. For defining the semantics of a transition annotated in such a way, the definition of net markings as well as the transition firing rule have to be extended. The net marking now consists of a standard net marking a mapping from places to multisets of tokens and a description of the dynamic part of the net. The latter consists of a net and its (conventional) marking. For an extended marking M of a dynamically modifiable net N, we use the term Actual Net to denote the union of the static net and the dynamic net in M. The term Effectice Marking denotes the marking of the actual net, i. e. the union of the marking of the static net and the marking of the dynamic one. For standard transitions introducing no dynamic modifications, the firing rule, i. e. the conditions for transition firing and the effect of transition firing, now can be reduced to the standard firing rule: a transition t of the actual net in an extended marking M is enabled in that marking if t is enabled in the effective marking. The effects of transition firing are defined accordingly. For a transition t mod which is annotated with a transformation rule R (i. e. a refinement rule or a replacement rule), the firing rule is extended canonically: it is enabled in an extended marking M if R is applicable in the actual net and t is enabled, whereby t is the standard transition without the rule R. The firing of t mod causes beyond the standard effects the net transformation specified by R. The applicability of a rule R to the actual net in a marking M is defined as follows. In the case of a refinement rule, R is applicable, if a component matching the left side of the rule with all restrictions specified in the transition annotation is part of the actual net. The matching component may be part of the dynamic net part as well as of the static one. If the component however is already refined by a subnet, this subnet must not contain static components. In the case of a replacement rule, R again is applicable, if a component matching the left side is part of the actual net. Here, the interface may be static or dynamic. The other components of the subnet matching the left side must be dynamic. Ctrl Ctrl Out In Module CtrlState Sensors State Module DState Actuators E2J J2F F2E refines State Figure 6. Petri net with dynamic modification One simple possible application of the extended net model is the robot control depicted in Figure 3. The hierarchical transitions for each possible mode of the robot can be folded into one transition Module. The mode switching transitions of the discrete control Ctrl are annotated with 5

6 transformation rules changing the refinement of M odule as shown in Figure 6. This specification is more compact than the depicted one. Beyond that, it is more flexible, since transformation rules determining the refinement can depend on run-time data. 5. Simulation and Analysis Simulation is an extremely helpful tool when selfmodifying systems are considered. The designer needs some support to observe whether his or her intentions are met by the generation process he or she designed. Traditional Petri net simulation environments, however, are not adequate as they make use of the fixed static structure of ordinary nets. In addition, these environments simulate the behavior of a specified net without respect to the hardware used for implementing the specified system. Hence, the examination of scenarios where also the hardware is subject to dynamic modification is not possible. Therefore we designed a completely new simulation environment based on objectoriented principles and concepts from JINI. The environment includes on the one hand execution engines for dynmically modifiable nets as they were described in the previous section. Furthermore classes are provided for building a simplified model of the target hardware. Simulation Simulation of Execution PN-Engine PN-Engine PN-Engine PN-Engine Processor Sensor Allocation Service Processor Bus Actuator Figure 7. Execution Platform Processor The architecture of the execution platform is exemplified in Figure 7. The platform includes models of all relevant hardware elements, i.e. sensors, actuators, processors and communication media. They build a set of JINI services, which are utilized by so called Petri net engines. These engines model the software i.e. operating system services and basic simulation libraries needed for execution of Petri nets. The engines act as clients of the processor objects, but also as services for execution of Petri nets. Petri nets are assigned to processors by an Allocation Service, which is an extension of the standard JINI lookup service. Having built up an architecture like the depicted one, it is possible to consider several scenarios, that may occur at run-time, for instance that a processor is removed for some reason or a new processor registers to the system. In addition to simulation, Petri nets offer a wide variety of methods for analysis and verification, which can be used in order to prove certain properties of a specified net. The usage of High-Level nets, especially with the different further extensions that we have made, certainly reduces the possibilies for formal analysis on a big scale. For single components specified with respect to certain restrictions, existing methods can still be applied, however. Furthermore, the specification of dynamically modifiable components based on the existing well-investigated formal frameworks allow for specifying components with assured properties. Besides functional properties, the focus of our work in the area of analysis is on timing analysis. In order to yield accurate estimates for the Worst-Case Execution Time of time critical model parts, we use a Petri net based analysis. In order to increase accuracy, it adds an additional model layer to existing timing analysis tools, which usually are source code based. A further extension to existing tools is that the analysis method includes an online component. At run-time, it is responsible for the decision, whether a certain modification of a system is feasible with respect to the specified deadlines. For more details concerning the timing analysis method we refer to [10]. 6. Conclusion and Future Work We presented a Petri net based approach for modeling dynamically modifiable embedded real-time systems. With the presented work, we extended an existing approach which was adequate for static systems only. Two approaches were proposed for incorporating mechanisms for dynamic modifications into High-Level Petri nets, one based on Petri net-refinements, the other on rules as they are used in High-Level replacement systems. Furthermore, the concept of a simulation tool for the resulting Petri net-model was outlined. Besides the extended Petri net model, the main characteristic of the presented simulation platform is 6

7 the support for hardware integration: the tool not only supports an engineer in simulating Petri nets, but also in simulating the execution of a Petri net-realization on a distinct target hardware, e.g. a network of microcontrollers. Due to the self-modifying net model and integration of hardware, the simulation platform enables a designer to evaluate systems where the application as well as the hardware is subject to dynamic modifications. In the paper, mainly concepts applied only to a small application example were presented, while we are currently evaluating our approach. Evaluation is done in two directions. On the one hand we are modeling larger applications in order to check the practicability of the modeling concept and the necessity for improvements respectively. On the other hand we generate large random Petri net-graphs for corresponding hardware models in order to evaluate the performance of our simulation platform. As to concepts we are going to examine the applicability of analysis methods to our extended Petri net-model, at least to components of a distinct net. and Theory of Petri Nets (ICATPN 2000), Aarhus, Denmark, June 2000, volume 1825, pages Springer-Verlag, [8] C. Rust, F. Stappert, and R. Bernhardi-Grisson. Petri Net Based Design of Reconfigurable Embedded Real-Time Systems. In Distributed And Parallel Embedded Systems, pages Kluwer Academic Publishers, [9] C. Rust, J. Tacken, and C. Böke. Pr/T-Net Based Seamless Design of Embedded Real-Time Systems. In J.-M. Colom and M. Kounty, editors, LNCS 2075; International Conference in Application and Theory of Petri Nets (ICATPN), volume 2075, pages , Newcastle upon Tyne, U.K., Springer Verlag. [10] F. Stappert and C. Rust. Worst Case Execution Time Analysis for Petri Net s of Embedded Systems. In International Conference on Embedded Systems and Applications, Las Vegas, [11] S. Swan. An Introduction to System-Level ing in SystemC. In Published on Open SystemC Initiative, Technical Papers, May References [1] L. A. Cherkasova and V. E. Kotov. Structured Nets. In J. Gruska and M. Chytil, editors, Mathematical Foundations of Computer Science, volume 118 of Lecture Notes in Computer Science. Springer Verlag, [2] E. Lee et al. Overview of the Ptolemy Project. Technical Memorandum M01/11, Dept. EECS, University of California, Berkeley, CA 94720, July [3] H. Ehrig, A. Habel, H. Kreowski, and F. Parisi-Presicce. From Graph-Grammars to High-Level Replacement Systems. In H. Ehrig, H. Kreowski, and G. Rozenberg, editors, Graph-Grammars and Their Application to Computer Science, 4th International Workshop, Bremen, Germany, March 5-9, 1990, Proceedings, volume 532 of Lecture Notes in Computer Science, pages Springer, [4] D. D. Gajski, J. Zhu, R. Domer, A. Gerstlauer, and S. Zhao. SpecC: Specification Language and Methodology. Kluwer Academic Publishers, January [5] D. Harel. Statecharts: A visual formalism for complex systems. Science of Computer Programming, 8(3): , June [6] M. Jersak, D. Ziegenbein, F. Wolf, K. Richter, R. Ernst, F. Cieslok, J. Teich, K. Strehl, and L. Thiele. Embedded System Design using the SPI Workbench. In Proc. FDL 00, Forum on Design Languages 2000, Tübingen, Germany, September [7] C. Lakos. Composing abstractions of coloured petri nets. In Nielsen, M. and Simpson, D., editors, Lecture Notes in Computer Science: 21st International Conference on Application 7