Timed Automaton Models of Priority Preemptive Scheduling

1
Timed Automaton Models of Priority Preemptive
Scheduling

• Henderson, Wm
• May, 2004

2
What is this abt?

• Embedded systems controllers in washing
  machines, automobiles, etc.
• May have strict deadlines hard real-time
  e.g., steer-by-wire
• Must be able to predict performance under
  worst-case conditions
• Performance of distributed embedded systems is
  more difficult to predict

3
Structure

• Priority preemptive scheduling
• The Timed Automaton
• Modelling scheduling behaviour
• Some models
• Some results
• Further difficulties
• Future work

4
Multitasking Concurrency
Multitasking is commonly required in real-time
systems to handle concurrent processing
requirements.
5
Task Response Times Priority Preemptive
Scheduling

• We are modelling this bahaviour to compute worst
  (and best)-case response times

6
The Timed Automaton

• Finite automata composed of control states and
  transitions
• Clocks variables quantitative time constraints
• Such models can be checked using model checking
  tools
• This involves an exhaustive search for properties
• We use the UPPAAL model checker

7
A Timed Automaton
t is a clock s is an integer counter
t gt 5
s s 1
8
Modelling a Single Task
Task Period
Computation time
9
Modelling2 Tasks
10
A Fragment of the TA for 4 tasks (without resets,
invariants and guards)
11
Computing Response Times by Model Checking

• Express temporal properties specifying
• Latest time a task can be in Computing place
• Earliest time a task can be in Finished place

A Eltgt ( Taski Computing and ti gt
rmax,i) FALSE B Eltgt ( Taski Computing and ti
gt rmax,i) TRUE C Eltgt ( Taski Finished and ti
lt rmin,i) FALSE D Eltgt ( Taski Finished and ti
lt rmin,i) TRUE

• There may be numerous Computing and Finished
  places!

12
Building Checking the TA Model
System Description .TG
13
3 Task Timed Automaton
27 places 45 transitions
14
The Size of TA models
15
Searching for Response Time Bounds

• Start with bounds derived by applying simple
  (non-optimal) analysis
• Binary search ln(N1) property checks
• Until (not A and B) for maximal response

Maximal response time
16
Results

• Small/medium sized uniprocessor systems can be
  computed
• High LCM of periods slows computation
• Systems with gt7 tasks appear too large to be
  computed with 0.5 GByte

17
Property Verification Time

• Processing time (CPU) required to confirm/refute
  properties
• For each task
• Eltgt ( Taski Computing and ti gt ri) FALSE
• Eltgt ( Taski Computing and ti gt ri) TRUE
• Eltgt ( Taski Finished and ti lt ri) FALSE
• Eltgt ( Taski Finished and ti lt ri) TRUE
• TRUE properties usually require very little
  computational effort.
• FALSE properties may require very large
  computational effort

18
Both TRUE and FALSE properties
TRUE properties only
19
Verification times

• Typically gt103 difference in verification time
• 1s compared with 20 minutes!

20
Why is this?

• TRUE properties
• Search of the state space terminates as soon as
  the property is found
• FALSE properties
• require examination of complete state space to
  confirm that no such behaviour is possible
• Not sure why TRUE properties are always computed
  so quickly, however.

21
Can we take advantage of this?

• Possibly!
• The properties
• Eltgt ( Taski Computing and ti gt ri) FALSE
• Eltgt ( Taski Computing and ti gt ri) TRUE
• Establish a maximal response time.
• The single property
• Eltgt ( Taski Computing and ti gt ri) TRUE
• Alone is insufficient

22
Proposed Algorithm

• Usual Binary search, but
• Abandon property check for long computation
  times?
• There may be more appropriate search algorithms?
• Alternative property formulations

23
Initial Condition Problem

• Eltgt() properties examine system behaviour as it
  can evolve from an initial condition
• The model structure adopted may not allow some
  important behaviour

24
Initial Place
t0gtPMIN0
t0ltPMAX0 and t1ltPMAX1
WW
CW
FW
This determines task phasing
WF
t1gtPMIN1
CA
WC
FA
FP
CP
25
Example
Task 0 Period 30, C 10 Task 1 Period 60,
C 20
t0t10
Task 0
Task 1

• This model evolves to the worst case for task 1
  but never the best case!

26
So

• Eltgt ( WF and t1 lt 20 ) is False
• But the best case response time of task 1 is 20
• The TA model is too restrictive, preventing some
  behaviour characteristic of the best-case
• If PMAXn gt PMINn or WCETn gt BCETn, the model may
  exhibit all required behavours
• However, this is unlikely to be true for all
  tasks characteristics

27
Remedy?

• Need to change the model to allow any task
  phasing
• This would enable the model to exhibit all
  possible behaviours
• Minimal and maximal conditions would then be met

28
One Solution (for 2 tasks)
t0ltPMAX0 and t1ltPMAX1
t0gtPMIN0
WW
CW
t0gtPMIN0 or t1gtPMIN1
Init
t1gtPMIN1
CA
WC
t0 0
CP
29
Further Work

• Precedence constraints
• Distributed systems
• Automation of the analysis