Optimal Static Partition Configuration in ARINC653 System

Transcription

1 JOURNAL OF ELECTRONIC SCIENCE AND TECHNOLOGY, VOL. 9, NO. 4, DECEMBER 7 Optmal Statc rtton Confguraton n ARINC6 System Sheng-Ln Gu, Le Luo, Sen-Sen Tang, and Yang Meng Abstract ARINC6 systems, whch have been wdely used n avoncs ndustry, are an mportant class of safety-crtcal applcatons. rttons are the core concept n the Arnc6 system archtecture. Due to the exstence of parttons, the system desgner must allocate adequate tme slots statcally to each partton n the desgn phase. Although some tme slot allocaton polces could be borrowed from task schedulng polces, no exstng lteratures gve an optmal allocaton polcy. In ths paper, we present a partton confguraton polcy and prove that ths polcy s optmal n the sense that f ths polcy fals to confgure adequate tme slots to each partton, nor do other polces. Then, by smulaton, we show the effects of dfferent partton confguraton polces on tme slot allocaton of parttons and task response tme, respectvely. Index Terms ARINC6, earlest-next release tme frst polcy, optmal partton confguraton polcy, real-tme systems.. Introducton Hard real-tme (HRT) systems are a class of specfc computng systems, whch are usually embedded nto other physcal devces and used to execute tasks wth rgorous real-tme computng requrements. Wth the ncrement of hardware capablty and enhancement of software engneerng technques, HRT systems become more wdely used n aerospace domans, such as ntegrated modular avoncs (IMA) [] and flght control systems. To promote safety, effcency, regularty, and nterchangeablty, and to reduce lfe-cycle costs n the development of dgtal Manuscrpt receved July 8, ; revsed October 7,. Ths work was supported by the Natonal Natural Scence Foundaton of Chna under Grant No and by the Natonal Hgh-Tech Research and Development Plan of Chna under Grant No. 7AA4. S.-L. Gu, L. Luo, S.-S. Tang, and Y. Meng are wth the School of Computer Scence and Engneerng, Unversty of Electronc Scence and Technology of Chna (e-mal: shengln_gu@uestc.edu.cn; lluo@uestc. edu.cn; tssen@6.com; mengyang@6.com). Color versons of one or more of the fgures n ths paper are avalable onlne at Dgtal Object Identfer:.969/j.ssn X..4.6 avoncs systems, the 6 seres of ARINC (Aeronautcal Rado, Incorporated) specfcatons and reports descrbe the desgn foundaton for such systems nstalled on arcrafts. Wthn the 6 seres, a standard, ARINC6 [], was presented to defne space and tme parttonng, whereby the applcatons resdent on a core module are parttoned wth respect to space (memory parttonng) and tme (temporal parttonng). These parttons on the same core module must be scheduled on statcally predefned and fxed tme slots wthn each major tme frame (MTF), and satsfy the correspondng partton parameters. The tme slot allocaton to each partton wthn a MTF s called as partton confguraton. That MTF s perodcally repeated throughout the module s runtme operaton. Due to most works on ARINC6 doman focusng on modelng [],[4] and on task analyss [] [7], system desgners usually confgure tme slots of each partton manually [8], whch s a heavy, complcated, and error-prone job when the number of parttons ncreases, snce the tme slots of each partton nvocaton could be non-consecutve and constrcted by the perodcty requrement. In addton, a few tools [8],[9] could facltate system desgners only to a lmted extent. requrement enforcement analyss language (REAL) [8], for example, just helps desgners to verfy correctness of MTF, not generatng partton confguraton. Other lteratures gve some ways to generate partton confguratons automatcally accordng to some schedulng algorthms, lke deadlne-monotonc schedulng [] (DMS). In [], the authors dscussed some confguraton prncples of IO (nput/output) partton. To our best knowledge, none of the exstng lteratures dscussed the optmal ssue n partton confguraton of ARINC6 systems. Hence, the motvaton of ths paper s to fnd the optmal partton confguraton polcy n parttoned systems, f ths optmal polcy s not feasble for a set of parttons, nor are other confguratons. In Secton, the formal model and the correspondng notatons of ARINC6 partton are gven. Secton presents a polcy to generate partton confguraton automatcally and proves ths polcy optmal. In Secton 4, by smulaton, we show the effects of dfferent partton confguraton polces on tme slot allocaton and on task response tme, respectvely. Fnally, conclusons are drawn n Secton.

2 74 JOURNAL OF ELECTRONIC SCIENCE AND TECHNOLOGY, VOL. 9, NO. 4, DECEMBER Fg.. ARINC6 system archtecture.. System Model An Arnc6 system may comprse of one or more core modules connected wth one another usng swtched Ethernet, and each core module may consst of one or more processors, as llustrated n Fg.. A set of parttons, Π = { P, P,, } P n, runs on a processor of a core module, and s scheduled on statc tme slots wthn a perodc local MTF, where each partton P k ( k n ) has a perod U k, a duraton S k, an offset O k relatve to the start of the frst MTF, and a set of tasks, Γ {,,, = τ,,, } k τ k τ k k n. Each nvocaton of a partton must complete ts duraton before the next nvocaton s release of the same partton. The length of the local MTF, MF, s fxed and defned as a multple of the least common multple (LCM) of all partton perods on the processor, namely MF = k LCM( U, U,, U ), k () n where s the set of nature numbers. Unless otherwse specfed, ths paper concerns the parttons on one processor by default. Hence, n the rest of ths paper, MTF means the local MTF. A detaled example of a partton set s gven by Table. On one processor there are three parttons. We can see partton P wth U = ms s released at tme ponts ms, τ, τ,n Pratton Pratton Pratton Pratton Pratton P P P P P MF MF Core module Module Table : rtton parameters rtton U/ms S/ms O/ms Task set P 8 τ, τ P 4 τ, τ 4 P 4 7 τ, τ 6 P P P P P P P P P P P P P P P P P Fg.. Example of a MTF. τ, τ,n τ, Processor τ,n MF Processor Processor MF (ms) τ, τ,n CoreModule module Ethernet 4 τ, Processor τ,n MF CoreModule module ms, 6 ms, 9 ms, and ms, respectvely; partton P s released every ms, begnnng from the tme pont 4 ms, wth ts perod U = ms and offset Ο =4 ms; partton P s released at tme ponts 7 ms, 47 ms, and 87 ms. MF s set as LCM(U,U,U )= ms. The frst MTF s shown n Fg., wthn the tme nterval [, ]. The symbol denotes the release of a partton nvocaton. Due to the frst releases of parttons P and P, both the frst nvocaton of partton P and that of P are cut nto two nonadjacent tme ntervals.. rtton Confguraton As mentoned n Secton, the tme slot allocaton to each partton n each MTF must satsfy the correspondng partton propertes. We frst gve the defnton of the feasblty of the partton confguraton polcy. Defnton. A partton confguraton polcy s feasble for a set of parttons, f any nvocaton of each partton can be allocated wth tme slots, of whch the total amount s equal to the correspondng partton duraton, before the next released nvocaton of the same partton. The partton confguraton polcy n Fg. s feasble, snce each partton nvocaton could be allocated adequate tme slots before the next released one. If there exsts a feasble tme slot confguraton polcy for a set of parttons, Π={P, P,, P n }, we have the followng property. Theorem. If there exsts a feasble partton confguraton polcy for a set of parttons, Π={P, P,, P n }, S U must be satsfed. n Proof. Assume S U > and there also exsts a n feasble partton confguraton polcy. The total amount of tme slots needed by all parttons wthn the length of MTF, MF, s ( U ) S, whch satsfes: MF n ( MF U) S = MF S U > MF. () n n Equaton () means the total needed amount of tme slots s larger than MF, that s, there must exst at least one partton nvocaton that could not fnsh before ts next release, whch contradcts the assumpton above. An nterestng observaton n Fg. s that tme slots are always allocated to the newly released parttons, as f the newly released partton has the hghest prorty. For example, at tme pont 4, partton P s released and preempts P ; at tme pont 7, partton P s released and preempts P. In other words, although ARINC6 defnes that all parttons are equal, ts semantcs mples that the prorty of tme slot allocaton s gven to the newly released partton. We call ths property preempton frst (PF). However, ARINC6 s semantcs does not defne whch preempted partton should resume executon

3 GUI et al.: Optmal Statc rtton Confguraton n ARINC6 System 7 frst after the newly released partton fnshes, namely the defnton of resumng polces s absent from ARINC6. In Fg., at tme pont 8, partton P fnshes, and whch partton, P or P, should resume executon frst, s nondetermnstc. The resumng polcy n Fg. chooses partton P to resume frst. By ths resumng polcy, all partton nvocatons can fnsh before the next released nvocaton of the same partton. Snce partton confguraton polces are dstnct from each other just n resumng polces, n ths paper, unless otherwse specfed, we do not dstngush between the partton confguraton polcy and the resumng polcy. In the followng part, an optmal partton confguraton polcy, earlest-next release tme frst (ENRTF), are presented to generate partton confguraton automatcally, so that a lot of system desgners tme and efforts could be saved when the scale of parttons ncreases. Frstly, the defntons of an optmal partton confguraton polcy and the ENRTF polcy are gven as follows. Defnton. A partton confguraton polcy s optmal n the sense that f ths polcy s not feasble for a set of parttons, nor are other polces. Defnton. The partton confguraton polcy ENRTF resumes the preempted nvocaton wth the earlest-next release tme, when the newly released partton fnshes, and confgures tme slots to ths nvocaton untl the duraton of ths nvocaton s satsfed, or a new partton s released. In Fg., the resumng polcy does not satsfy ENRTF polcy, at tme pont 8, partton P fnshes and P resumes. However, the next nvocatons of P and P wll be released at tme ponts and 4, respectvely, where tme pont 4 s the earlest one seen from tme pont 8. Hence, accordng to the ENRTF polcy, the tme slots [8, ] should be allocated to partton P and slots [, 4] to P. Theorem. The partton confguraton polcy, ENRTF, s an optmal resumng polcy. Proof. We shall prove the nverse negatve proposton of Defnton, that s, f there exsts a feasble partton confguraton polcy for a set of parttons, then the ENRTF polcy s also feasble for those parttons. Assume there exsts a feasble polcy X for a set of parttons. Wthout loss of generalty, consder the tme slots between two nvocatons of partton P a n Fg. (a). Before P a fnshes, P b s released and preempts P a. Smlarly, P c s released and preempts P b before P b fnshes, then P d and P e are released n sequence. Note that the resumng polces are responsble for assgnng tme slots to those preempted parttons only when the latest released partton fnshes and no new partton s released, as llustrated by the bold box,, and n Fg. (a). Each slot n box s denoted as P P, where P { P, P, P, } x, x a b c { P, P, P, P, }, P { P, P, P, P, P, } x a b c d. x a b c d e P x = P a x x P b t MF (a) means that ths slot s dle. Hence, due to the feasble polcy X, there must be tme slots wthn these three boxes for P a, of whch the amount s equal to S a x, shown as the shaded tme slots n Fg. (a). We could shft and consoldate all Px s, whch are equal to P a and wthn the three boxes, towards P c s completon tme t, as shown n Fg. (b). Now the tme slot allocaton n the new box s consstent wth the ENRTF polcy, snce P a has the earlest-next release tme seen from tme t. Then, the above process could repeat for the rest tme slots, untl all tme slots allocaton becomes consstent wth the ENRTF polcy. The case gven above can be generalzed as the followng process. When a feasble partton confguraton polcy exsts for a gven set of parttons, let us scan ts whole tme slot allocaton from ts begnnng to the end. At any tme t m, when a partton fnshes, we choose the one wth the earlest-next release among all released parttons, say P, and consoldate the tme slots of P wthn the nterval [t m, t ], where t s the P s next release tme. Consoldaton s processed by shftng these tme slots towards tme pont t m and dsplacng tme slots that have not been consoldated. Snce ths process merely swtches the order of the tme slots wthn the nterval endng at t, no tme slots are dsplaced beyond t, n other words, no dsplaced tme slots affect the feasblty of that resumng polcy. The resultng tme slot allocaton after the scan s the ENRTF polcy, whch s also feasble for that set of parttons. MF Ωa x (b) Fg.. Tme slots assgned by partton confguraton polcy X. P P ENRTF Resumng polcy X P P P P P P P U MF U Fg. 4. Tme slot allocaton wthn two MTFs. P b P d P d P c P c P P P P P P MF

4 76 Although we have proved the optmal partton confguraton polcy for ARINC6 systems, that s stll not suffcent for generatng the partton confguraton automatcally. To guarantee the perodcty of tme slot confguraton of MTF, we have to make more constrants on partton parameters. Consder the followng two parttons: U = ms, S = ms, and O = ms; U =4 ms, S = ms, and O = ms, and assume the value of k n MF equal to, hence MF=LCM(U, U )=. The partton confguraton polcy we choose allocates tme slots to partton P when P and P released smultaneously, as shown n Fg. 4. In Fg. 4, we can see that ths polcy s feasble for these two parttons. However, the tme slot allocaton n the frst MTF s not exactly the same as that n the second one, snce the last released nvocaton of P n the frst MTF does not fnsh by the tme pont ms, whch nterferes wth the tme slot allocaton n the next MTF. If all the released partton nvocatons wthn each MTF could fnsh before ts next MTF, then tme slot allocaton n each MTF s exactly the same. Theorem. When generatng tme slot confguraton under a certan feasble polcy, just consderng the frst MTF s suffcent, f under ths polcy all the partton nvocatons released wthn the frst MTF could fnsh before the second MTF starts. Proof. If all the partton nvocatons released wthn the frst MTF could fnsh before the next one starts, no precedng partton nvocatons can nterfere wth tme slot allocaton n the next MTF, hence tme slot allocaton n the next MTF s exactly the same as that n the precedng one, whch guarantees the perodcty of MTF. Corollary. MTFs wth dfferent MFs are equvalent, f when MTF has the shortest MF, the followng condtons are both satsfed: ) the used partton confguraton polces s feasble; ) all the partton nvocatons released wthn the frst MTF could fnsh before the next MTF starts. Proof. For a set of parttons, {P, P,, P n }, consder the frst MTF wth the shortest length MF=LCM(U, U,, U n ). For a feasble polcy, f all released parttons wthn the nterval [, MF] could fnsh wthn the same nterval, then each nterval [kmf, (k+)mf] (k ) has exactly the same tme slot confguraton as that n [, MF]. Therefore, a MTF wth the length MF=kLCM(U, U,, U n ) s equvalent to the shortest MTF repeatng k tmes. Note that the proof of theorem s ndependent of the length of the MTF. 4. Smulaton In ths secton, two experments are set up to show how dfferent partton confguraton polces affect the tme slot confguraton of parttons and the response tme of tasks, respectvely. JOURNAL OF ELECTRONIC SCIENCE AND TECHNOLOGY, VOL. 9, NO. 4, DECEMBER rtton response tme (ms) rtton response tme (ms) rtton response tme (ms) rtton P rtton P rtton P 44 6 rtton nvocatons (a) rtton P rtton P rtton P 4 6 rtton nvocatons (b) rtton P rtton P rtton P 4 6 rtton nvocatons (c) Fg.. rtton response tme under dfferent polces: (a) under ENRTF polcy, (b) under DMS polcy, and (c) under FIFO polcy. 4. Effects on rtton Tme Slot Allocaton To show the effects on partton tme slot allocaton from partton confguraton polces, we use the partton parameters shown n Table and the partton confguraton polces of ENRTF, DMS, and FIFO (frst n, frst out), respectvely. The condtons of Corollary are satsfed for all three polces under these partton parameters, hence MF s set as LCM(U,U,U )= ms. Those effects on partton tme slot allocaton are shown by the so-called response tme of parttons, smlar to that defned for tasks. Fg. shows the effects, n a MTF, from polces ENRTF, DMS, and FIFO sequentally. It can be seen that partton P has the same worst-case response tme under three polces, P has the mnmum worst-case response tme under polcy ENRTF, and P has the mnmum

5 GUI et al.: Optmal Statc rtton Confguraton n ARINC6 System 77 ] Task response tme (ms) 4 Task response tme (ms) 4 Task response tme (ms) Task response tme (ms) 4 4 Task nvocatons (a) 4 4 Task nvocatons (c) 4 Task response tme (ms) Task response tme (ms) 4 4 Task nvocatons 4 4 (b) 4 4 Task nvocatons (d) Task nvocatons Task nvocatons (e) (f) Fg. 6. Task response tme under dfferent polces: (a) task τ, (b) task τ, (c) task τ, (d) task τ 4, (e) task τ, and (f) task τ 6. worst-case response tme under polcy FIFO. However, we should note that the worst-case response tme of P s, equal to ts perod, under both DMS and FIFO. If we augment any duraton S ( {,,}) wth even ms, ths partton system s not feasble any more under polcy DMS or FIFO. Polcy ENRTF reduces the worst-case response tme of P by augmentng the worst-case response tme of P slghtly, snce P has adequate slack tme. Hence, polcy ENRTF s optmal n the sense that ENRTF tres to gve adequate tme slots to each partton nvocaton, f t fals, no other polces could succeed. 4. Effects on Task Response Tme To show the effects on task response tme from partton confguraton polces, we fx partton and task parameters usng the partton confguraton polces among ENRTF, DMS, and FIFO. The partton parameters lsted n Table are stll used. For tasks, we assume all tasks are perodc, and they are scheduled by DMS n the correspondng parttons. The task parameters are gven as follows: C =8 ms, T =7 ms; C =8 ms, T =6 ms; C = ms, T =4 ms; C 4 = ms, T 4 = ms; C =6 ms, T = ms; and C 6 = ms, T 6 =4 ms, where C s the worst-case executon tme and T s the task perod. Fg. 6 shows the effects on each task from dfferent partton confguraton polces. Polcy ENRTF makes tasks τ and τ have the maxmum worst-case response tme, and task τ have the mnmum worst-case response tme under

6 78 JOURNAL OF ELECTRONIC SCIENCE AND TECHNOLOGY, VOL. 9, NO. 4, DECEMBER ENRTF n contrast. Smlarly, polcy DMS makes tasks τ and τ 6 have the maxmum worst-case response tme, whereas tasks τ and τ have the mnmum worst-case response tme under DMS. Fg. 6 (d) and (e) show that both tasks τ 4 and τ have the same worst-case response tme under the three polces. Note that each fgure n Fg. 6 shows the perodcty of task response tme, thus choosng the frst task nvocatons s suffcent to show ther response tmes. From the smulaton results, we can see that no partton confguraton polcy could guarantee that each task has ts mnmum worst-case response tme. Researchng whether there s a partton confguraton polcy whch makes each task has acceptable worst-case response tme s a part of our future work.. Conclusons In ths paper, the optmal partton confguraton polcy s studed n the sense that f ths optmal polcy could not confgure tme slots to each partton successfully wthn the MTF, nor can other polces. We also show the smulaton results of the partton confguraton polcy s effects on tme slot confguraton and on task response tme. Note that n ths paper a necessary condton s gven for determnng the feasblty of partton confguraton polces. However, the current man technque fgurng out the feasblty of those polces s stll to smulate the tme slot allocaton wthn one MTF. Dervng suffcent condtons for determnng the feasblty of those partton confguraton polces s our future work. References [] R. L. Alena, J. P. Ossenfort, K. I. Laws, A. Goforth, and F. Fgueroa, Communcatons for ntegrated modular avoncs, n Proc. of 7 IEEE Aerospace Conf., Montana, 7, pp. 8. [] Avoncs applcaton software standard nterface ARINC Specfcaton 6P-, Aeronautcal Rado Inc., Annapols, 6. [] F. Snghoff and A. Plantec, AADL modelng and analyss of herarchcal schedulers, n Proc. of SIGAda Annual Internatonal Conf. on the Ada Programmng Language, Farfax, 7, pp. 4. [4] J. Delange, A. Plantec, and F. Kordon, Valdate, smulate and mplement ARINC6 systems usng AADL, n Proc. of the ACM SIGAda Annual Internatonal Conf. on Ada and Related Technologes, Tampa Bay, 9, pp. 44. [] Y. Lee, D. Km, M. Youns, and J. Zhou, rtton schedulng n APEX runtme envronment for embedded avoncs software, n Proc. of Internatonal Conf. on Real-Tme Computng Systems and Applcatons, Hroshma, 998, pp. 9. [6] L. Almeda and P. dreras, Schedulng wthn temporal parttons: response-tme analyss and server desgn, n Proc. of ACM Internatonal Conf. on Embedded Software, Psa, 4, pp. 9. [7] Y. Lee and D. Km, Schedulng tool and algorthm for ntegrated modular avoncs systems, n Proc. of Dgtal Avoncs Systems Conf., Phladelpha,, pp..c.-.c.-8. [8] J. Delange, O. Glles, J. Hugues, and L. utet, Model-based engneerng for the development of ARINC6 archtectures, n Proc. of SAE 9 AeroTech Congress and Exhbton, Seattle, 9, do:.47/9--4. [9] Safety-Crtcal Software Development for Integrated Modular Avoncs, Wnd Rver Systems, Inc., Berkeley, 6. [] A Compostonal Framework for Avoncs Systems, Unversty of nnsylvana, Phladelpha, 9. [] L. Knnan and J. Wlad, Portng applcatons to an ARINC6 complant IMA platform usng VxWorks as an example, n Proc. of the rd Dgtal Avoncs Systems Conference, Salt Lake Cty, 4, pp..b..-8. Sheng-Ln Gu was born n Chongqng n 98. He receved the B.S. degree from Unversty of Electronc Scence and Technology of Chna (UESTC) n. He s currently pursung hs Ph.D. degree wth UESTC. Hs research nterests nclude real-tme software modelng and schedulablty analyss. Le Luo was born n Schuan Provnce n 967. She s a professor and doctoral supervsor wth UESTC. Her research nterests nclude embedded real-tme operatng systems, embedded development tools, embedded mddleware, embedded software platforms, etc. Sen-Sen Tang was born n Anhu Provnce, n 986. He receved her B.S. degree from UESTC n 9. He s currently pursung hs M.S. degree wth UESTC. Hs research nterests nclude real-tme software modelng and mplementaton. Yang Meng was born n Henan Provnce n 987. She receved her B.S. degree from Huazhong Agrcultural Unversty n 8. She s currently pursung her M.S. degree wth UESTC. Her research nterests nclude embedded software analyss and modelng tool mplementaton.