Thanks to... Composing and synchronizing real-time components through virtual platforms in vehicular systems

Transcription

1 Thanks to... Composing and synchronizing real-time components through virtual platforms in vehicular systems Promotor and co-promotor: Prof. Johan J. Lukkien Dr. Reinder J. Bril Martijn van den Heuvel System Architecture and Networking (SAN) Department of Mathematics and Computer Science Eindhoven University of Technology The Netherlands Technical support: Dr. Mike Holenderski Dr. Erik J. Luit Dr. Richard Verhoeven Research collaboration (MDH): Dr. Moris Behnam Prof. Thomas Nolte Various M.Sc. students and postgraduates. / 32 2 / 32 An automotive example An automotive example: electronic stability program (ESP) Why this growth of electronic parts? 3 / 32 Chip Design Magazine (Jan. 2005) Increasing number of applications; Extensive networking between them. 4 / 32

2 An automotive example: electronic stability program (ESP) An automotive example: IVDC advances beyond ESP... Adding suspension control and software-based vehicle state estimation: Increasing number of applications, for example: ABS, TCS, ESP; Extensive networking between them. 5 / 32 An automotive example: deployment of IVDC advances τ τ2 6 / 32 Experimental setup: 4X Local controllers for active suspension; X Global IVDC and supervisory control. Component composition on central ECU Supervisory control Demo: IVDC with active suspension 4X Local controllers for steering, braking, suspension; Front and rear IVDC; X Global IVDC state estimation and supervisory control. Local controllers B. Bonsen, R. Mansvelders, and E. Vermeer. Integrated vehicle dynamics control using state dependent riccati equations. In AVEC, Aug IVDC τ τ2 Our contribution: Virtualization techniques applied to a central node: Component composition on central ECU RTOS+middleware Supervisory + IVDC Legend: Supervisory control τ τ2 Hardware (CPU: 200 MHz) Network Task Virtual processor Virtual network bus Send or receive messages 7 / 32 IVDC τ τ2 RTOS+middleware Legend: Hardware (CPU: 200 MHz) Network (Semi-)independent developed components by various partners! Task Virtual processor Virtual network bus Send or receive messages Synchronization between independently developed components. 8 / 32

3 Demo: active suspension on Demo: active suspension off 9 / 32 Demo: active suspension on 0 / 32 Hierarchical composition of s for vehicular systems Component composition on central ECU Supervisory control τ τ2 τ τ2 RTOS+middleware Hardware (CPU: 200 MHz) Network Legend: Global Scheduler IVDC Task Virtual processor Virtual network bus Send or receive messages Component 0 Component R Component n R2 component: server, set of tasks and (task) server or virtual processor: a CPU budget allocated each period Tasks, located in arbitrary components, may share resources i.e. deal with and global priority inversion! / 32 2 / 32

4 Resource sharing across components: a closer look Add a resource arbiter to each, i.e., at the task level and at the component level. Tasks may request: Access to shared memory: shared buffers; memory-mapped devices. Component 0 R Global Scheduler Component... R2 Component n 2 Operating-system services: in-kernel: short non-preemptive critical sections; device drivers and other services: mutually exclusive between users. 3 Global limited-preemptive access to the processor: reduce cache misses; less pipeline flushes. 3 / 32 Component Interface Ωs Virtual platform of Cs Other components interfaces Other virtual platforms Independent development and Transparent synchronization protocols for compositional real-time systems. IEEE TII, 8(2): , May 202. M. M. H. P. van den Heuvel, M. Behnam, R. J. Bril, J. J. Lukkien, and T. Nolte. Opaque analysis for resource sharing in compositional real-time systems. In CRTS, pages 3 0, Nov. 20. M. M. H. P. van den Heuvel, M. Behnam, R. J. Bril, J. J. Lukkien, and T. Nolte. Optimal and fast composition of resource-sharing components in hierarchical real-time systems. In RTCSA, Aug Dependable resource sharing for compositional real-time systems. In RTCSA, pages 53 63, Aug / 32 Independent development and integration of components A programmer s perspective: Independent development and resources are shared between tasks, not between components. Transparent synchronization protocols for compositional real-time systems. IEEE TII, 8(2): , May tasks claim and protect their resources; Question from integrator to programmer: Component Interface Ωs Other components interfaces Is the resource or global to a component? Don t know, don t care! Virtual platform of Cs Other virtual platforms Postpone binding of SRP primitives until component integration. P. López Martinez, L. Barros, and J. Drake. Scheduling configuration of real-time component-based applications. In Reliable Softw. Technology - Ada-Europe, volume 606 of LNCS, pages Springer, 200. Transparent synchronization protocols for compositional real-time systems. IEEE TII, 8(2): , May / 32 6 / 32

5 Independent timing analysis of components Independent development and Interface of a component: period P s ; guaranteed budget Q s within each period; Component Interface Ωs Other components interfaces Virtual platform of Cs Other virtual platforms M. M. H. P. van den Heuvel, M. Behnam, R. J. Bril, J. J. Lukkien, and T. Nolte. Opaque analysis for resource sharing in compositional real-time systems. In CRTS, pages 3 0, Nov. 20. M. M. H. P. van den Heuvel, M. Behnam, R. J. Bril, J. J. Lukkien, and T. Nolte. Optimal and fast composition of resource-sharing components in hierarchical real-time systems. In RTCSA, Aug set of RHTs {X sl } which defines X s = max{x sl }. l Analytical perspective: incremental analysis: separate concerns of and global scheduling; 2 easier analysis: no timing details on global resource sharing; 3 avoid protocol-specific knowledge to compute Q s and {X sl }. Some analyses in literature do not support this independence! 7 / 32 8 / 32 The key idea Specify partial interfaces... The key idea Specify partial interfaces and merge them Interpretation C n may use one resource R l for at most X n,l time units supplied within period P n. Gained independence: Detect which resources are shared by others. Arbitrate shared resources by SRP; 9 / 32 Merge them at composition! 20 / 32

6 The key idea Prune dependencies at composition Gained independence: Detect which resources are shared by others. Add an arbiter for shared resources only Gained independence: Detect which resources are shared by others. Arbitrate shared resources by SRP; Merge just remaining candidates! 2 / / 32 Scheduling and containment of temporal faults Independent development and Temporal isolation stunned by overrun when a task unwinds: C C 2 Component Interface Ωs Other components interfaces Virtual platform of Cs Other virtual platforms C 3 t 0 t Legend: critical section normal execution budget arrival t e time Dependable resource sharing for compositional real-time systems. In RTCSA, pages 53 63, Aug. 20. No longer a guarantee for: overrun durations blocking durations 23 / / 32

7 Sources of unpredictable interferences Global effects of SRP-based arbitration: Confine temporal faults What if an interfering task exceeds its WCET? A solution to prevent an increase of resource-holding times: Disable preemptions. τ h s2l τ 2 τ 3 R l R l R l rc sl time resource ceiling (rc sl): highest priority of any () task sharing resource R l What if a task exceeds its critical-section length? NO solution to prevent an increase of resource-holding times. To protect independent components: Extend SRP with enforced blocking durations. RHT It is now similar to the protected Immediate-PCP in: What if task τ exceeds its WCET? What if a task (τ 2 or τ 3 ) exceeds its critical-section length? 25 / 32 D. de Niz, L. Abeni, S. Saewong, and R. Rajkumar. Resource sharing in reservation-based systems. In RTSS, pages 7 80, / 32 Scheduling of resource-sharing components Independent development and Budget depletion during a critical section can lead to excessive blocking times: P s P s Q s P s B s Q s Q s Component Interface Ωs Other components interfaces Solutions: Virtual platform of Cs Other virtual platforms M. M. H. P. van den Heuvel, R. J. Bril, J. J. Lukkien, and T. Nolte. Performance evaluation of analysis methods for arbitrating nonpreemptive resource access in compositional real-time systems. In VtRES, Sep React upon budget depletion by allowing budget overruns. Overrun with payback (OWP): the consumed overrun is subtracted from the next budget; 2 Overrun without payback (ONP): no penalty for overrun. Prevent budget depletion by checking the remaining budget. SIRAP: insert idle time during task execution; 2 BROE: delay budget supply. 27 / / 32

8 Timing analysis of resource-sharing components BROE SIRAP IONP ONP IOWP OWP δ BROE SIRAP IONP ONP IOWP OWP 0. δ N = 5 components BROE SIRAP IONP ONP IOWP OWP Number of components (N) Implicit deadlines (α = ). BROE SIRAP IONP ONP IOWP OWP Number of components (N) Implicit deadlines (α = ). 0 0 N = 5 components Ratio of feasible systems Ratio of feasible systems Ratio of feasible systems synthetic periodic tasks: 8 tasks/component; tasks generated by UUnifast with total utilization of ; random task deadline constraints: [WCETi + α(pi WCETi ); Pi ]; short non-preemptive critical section. Ratio of feasible systems Timing analysis of resource-sharing components 29 / 32 SIRAP: no independent analysis of components, i.e., detailed task-level analysis of global resource sharing. ONP: enables independent analysis of SIRAP, but weak performance. BROE: weaker composition rules than SIRAP. 30 / / 32 Questions? Independent development and 2 Independent timing analysis of 3 Scheduling components and Component Interface Ωs Other components interfaces Virtual platform of Cs Other virtual platforms Current and future challenges: Mixed criticality: 2 deal with uncertain timing specs of tasks; graceful degrade functions by enabling/disabling optional ones. Let s pass the remote... Industrial standards: timing augmented descriptions of components. 3 / 32