Giotto Embedded Control Systems Development with Thomas A. Henzinger Ben Horowitz Christoph M. Kirsch University of California, Berkeley (presented by Marius Minea)

Embedded Systems Development Control Engineer Control Design Application models derives simulates Software Engineer Distributed Platform Giotto Program decomposes implements tests Functionality & Timing Matlab Giotto!

The Time-Triggered Paradigm [Kopetz]: -all communication activities triggered by clock -predictability (i.e., verifiability) -safety-critical applications (e.g., automotive) TTA: hardware & protocol realization Giotto: programming language realization Our Approach

Motivating Example: Flight Control (DARPA SEC Program)

Periodic Tasks INU task GPS task air data task pilot task pitch control roll control throttle controlaileron 1 taskaileron 2 tasktailplane taskrudder taskthrust task Sensor tasksControl tasksActuator tasks

200 Hz 1 kHz 200 Hz1 kHz

Modes Control system of airplane is designed to operate in different modes. In each mode a particular set of controllers is deployed. There are switches between modes. For example: –Navigational modes (taxi, takeoff, cruise). –Maneuver modes (dive, roll). –Fault tolerance modes (track which hardware is working).

Giotto Giotto is a tool-supported methodology for embedded control systems design Giotto consists of –a time-triggered and platform-independent programming language –a compiler –a runtime library Giotto provides an abstract programmer’s model

The Giotto Methodology Giotto Executable Giotto Program Compilation Giotto Runtime Library Distributed Platform Functionality & Timing Scheduling & Communication RTOS, e.g., VxWorks

Task Definition: Abstract Syntax fInput ports State Output ports Period

Task Invocation: Time-Deterministic Semantics fInput ports State Output ports Time Task time t Period 10ms time t+10ms

fInput portsOutput ports Time Task time t Period 10ms time t+10ms Don’t care Task Invocation: Time-Deterministic Semantics State Actual time the task uses the CPU (may be preempted)

Input/Output: Sensors-Control Law-Actuators f State SensorsActuators

Inter-task Communication: Connections P Q

Different Periods Time Task QQ tt+10mstt+5ms P

Q-to-Q Connection P Q

Zero-Delay Semantics Time Task QQ tt P

P-to-Q Connection P Q

Zero-Delay Semantics Time Task QQ tt P

Time-Deterministic Semantics Time Task QQ t+5ms P t Don’t care Perhaps on same CPU

Time-Deterministic Semantics Time Task QQ t+5ms P t

Time-Deterministic Semantics Time Task QQ t+5ms P t Most recent value guaranteed to be available (may have to be buffered)

Time-Deterministic Semantics Task QQ t+5ms P tt+10ms

An Abstract Programmer’s Model Input/Output PortsFunctionality Time-Determ. Computation Zero-Delay Communication Timing High-Level Programming Giotto

Giotto Modes Multi-modal control Fault tolerance Event modeling Resource sharing Uncertain environments Some Motivations:

Giotto Modes A mode is a parameterized set of tasks. A Giotto program consists of a set of modes and mode switches. A Giotto system is in a single mode at any given time.

Abstract Syntax of a Mode P Q Entry Port Period 10ms 1 2 Frequencies

MM’ Trigger predicate Abstract Syntax of a Mode Switch Connection Frequency 2: evaluation of trigger predicate every 5ms

Mode M P Q Period 10ms 1 2 Connection

Mode M’ P R 1 4 Connection Period 10ms

Concrete Syntax start m ( ) { mode m ( ) period 10 ms { taskfreq 1 do P ( ) ; taskfreq 2 do Q ( x, y ) ; exitfreq 2 if y = 5 then m’ ( y ) ; } mode m’ ( int z ) period 10 ms { taskfreq 1 do P ( ) ; taskfreq 4 do R ( x, z ) ; } Tasks are C procedures

Semantics of the Mode Switch Task QQ Mode t+10mst+10ms PP R Easy Case:

Semantics of the Mode Switch Task Q Time Mode t+5ms P Interesting Case:

Semantics of the Mode Switch Task Q t+5ms RR t+7.5mst+10ms PP R

Mode M P Q 1 2 Connection

Semantics of the Mode Switch Task Q t+5ms RR Time P Mode switch already finished!

Mode M’ P R 1 4 Connection

Semantics of the Mode Switch Task Q t+5ms RR Time P

Mode M’ P R 1 4 Connection

Semantics of the Mode Switch Task Q t+5ms RR Time P

Mode M’ P R 1 4 Connection

Semantics of the Mode Switch Task Q t+5ms RR Time P Initial value

Semantics of the Mode Switch Task QRR Time P

Input/Output PortsFunctionality Time-Determ. Computation Zero-Delay Communication Timing High-Level Programming Giotto ModesDecomposition The Abstract Programmer’s Model

The Giotto Compiler Automatic code generation Compilation directives in the form of Giotto annotations for distributed platforms

The Giotto Compiler Giotto Compiler Giotto Program Giotto Executable Two possible answers: Giotto executable “Not schedulable” (either because program overconstrained, or because compiler not smart enough)

Closing the Gap: Giotto-Architecture Annotations Giotto Compiler Hosts (CPUs), Nets, Worst-case execution / transmission times Giotto Program Giotto-A Program Distributed Platform

Closing the Gap: Giotto-Mapping Annotations Giotto Compiler Tasks to Hosts, Connections to Nets Hosts, Nets, Performance Giotto Program Giotto-A Program Giotto-AM Program Distributed Platform

Closing the Gap: Giotto-Schedule Annotations Giotto Program Giotto Compiler Giotto-A Program Distributed Platform Giotto-AM Program Giotto-AMS Program Hosts, Nets, Performance Tasks to Priorities (say), Connections to TDMA (say) Tasks to Hosts, Connections to Nets

P Platform Dependency Task QQ Time Computation

P Giotto-AM Task QQ Time Host A

P Giotto-AMS Task QQ Time Host A Priority

Platform Dependency Task QRR Time Communication P

Giotto-AMS Task QRR Time Host BBB Network C P Host A t+10ms Real deadline for P! Time slot for connection

The Giotto Runtime Library Giotto Executable Giotto Program Compilation Giotto Runtime Library Distributed Platform Functionality & Timing Scheduling & Communication RTOS, e.g., VxWorks

The Giotto Runtime Library Giotto Runtime Library Distributed Platform RTOS, e.g., VxWorks Timer service Scheduling service TCP/IP stack Scheduling & Communication Abstraction Task, connection mapping Task priorities Connection TDMA slots Real-Time OS Services

Pure Lego Demo

Heterogeneous Lego-VxWorks Demo VxWorks Lego Wireless Ethernet – Infrared bridge

Behavior of each Robot Lead FollowEvade My sensor pushed Someone else’s sensor pushed My sensor pushed Stop Evading finished Someone else’s evading finished

Soon to Fly Giotto: ETH Zurich Helicopter