1. Compositional Analysis of Timed Systems by Abstraction Leonid Mokrushin TAPVES 2007-02-08

2. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Outline Motivation Arrival/Service Curves Compositional Analysis TA as Curve Transformers Abstracting TA Examples and Demo Conclusions

3. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se The ABB Robot Controller ABB robot controller (2 500 000 loc) Real time tasks A,B,C,D Read inputs from channels write output to channels Task priority order D>C>B>A (FPS) Buffer overflow/underflow, WCRT ABCD CommandsHigh-level instructions Precise moves Requests Welding program

4. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Old Results (CFSM) Turing power Equivalent to finite automata people: Brand, Zafiropulo, Pachl, Purush Iyer, Finkel, Abdulla, Jonsson ABAAB ABСAB Half duplex

5. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Communicating Timed Automata (CTA) Replace Finite Automata by Timed Automata  Communication via unbounded FIFO channels  Time is global (time passes globally and for all automata in the same pace) A, B, C – Timed Automata  Negative results carry over  Positive results – do not carry over (previous proofs do not work in timed setting) ABС

6. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se CTA - Results CTA with one channel  Accepts non-regular context free languages  Only regular languages in the untimed case!  Equivalent to Petri Nets with one unbounded place (Eager reading: One-counter machines) CTA with two channels  Non-context free context sensitive languages  Petri Nets with two unbounded places (Eager reading: Turing machines) [CAV06, Pavel & Wang] AB ABС

7. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se The ABB Robot Controller TA A TA B TA C TA D TA SCH Task Ready Queue Shared variables TA A xTA B xTA C xTA D xTA SCH with queues is TOO BIG

8. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se In general: Precise analysis is impossible Our hope: Find a suitable abstraction

9. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Kahn Process Networks (‘70s) S 1, S 2, S 3,… – streams  possibly infinite sequences of letters A,B,C – processes  mappings from streams to streams, e.g., B:(S 2, S 6 )  S 5 A B C S1S1 S3S3 S2S2 S6S6 S5S5 S4S4 Modeling Distributed, Signal Processing Systems

10. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Abstract Stream Transformers Components = Abstract stream transformers  Abstract stream defines a timed language Asynchronous communication Network Calculus (Cruz, Boudec, Thiran ‘91-’04)  Arrival Curves Real-Time Calculus (Thiele, Chakraborty ‘00s)  Upper/Lower Arrival/Service Curves A2 A3 A1 Q1 Q2 Abstract stream

11. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Arrival/Service Curves time events window size number of events window size time available resources window size available service window size upper bound lower bound upper bound lower bound Arrival Curves (events / data) Service Curves (resources) (a,3)(a,3.34)(a,3.39)(a,4)(a,10)...(100%,0)(50%,3.3)(100%,7)...

12. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Building an Arrival Curve t window sizeslide Slide a timed window of a fixed size Count max/min number of events in the window Choose another window etc. t window size events [0,4] [1,5][1,5]

13. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Timing Analysis Delay bound = max vertical distance  required buffer size Backlog bound = max horizontal distance  flow delay bound required buffer size guaranteed resource (lower service curve) worst case request (upper arrival curve) window size number of events response time (flow delay bound)

14. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Compositional Timing Analysis Component = Stream Transformer Stream = Upper & Lower Bounds Real-Time Calculus  S O = f E (S I, S AR ), S RR = f R (S I, S AR ) Compositional Analysis  Scheduling, end-to-end delay, backlog TASK Available Resources Remaining Resources OutputInput T1 T2 T3 T4 = = Event Stream Resource Stream SOSO S RR SISI S AR

15. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Resources & Scheduling Fixed priority scheduling policy Priority order: Priority(A)<Priority(B)<Priority(C)<Priority(D) Highest priority task has 100% of CPU Negative service curve = non-schedulable Opposite direction gives min resource ABCD 100% <100%

16. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Timed Automata with Tasks Events  Actions Timing constraints  Clocks / Guards / Resets  Complex event pattern Tasks  Asynchronous execution  WCET, Deadline  Scheduling policy  Precedence constraints  Resource constraints Task (C,D) x<3 a! x:=0

17. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Run of TAT (Idle, x=0, []) Idle P Q 0.1  (Idle, x=0.1, [])  (RelP, x=0, [P(2,8)]) 1.5  (RelP, x=1.5, [P(0.5,6.5)])  (RelQ, x=1.5, [P(0.5,6.5),Q(2,20)]) 1.5  (RelQ, x=3, [Q(1,18.5)])  (Idle, x=3, [Q(1,18.5)])  (RelP, x=0, [P(2,8),Q(1,18.5)]) 0.11.62.13.1 2  (RelP, x=2, [Q(1,16.5)]) 5.1

18. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se TA as Curve Transformers Timed Automata as complex task release patterns We have to make them operate on curves TA 1 T2 T1 TA 2 a! b? c! T3 Ready queue a! Timed Automaton OS Scheduling Policy CPU b? Task completed Task released T IMES Tool

19. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se TA Curve Transformation TA Model of a System Component Event Generator Event Observer L(EG) = L(AC) Arrival Curve Departure Curve Curve transformation using U PPAAL inputoutput F L(F(AC))  L(EO) window size number of events upper bound lower bound window size number of events upper bound lower bound A EG || A F i || A EO for every component F i is possible Assumption:

20. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Encoding Arrival Curves as TA const int LB = 12; const int UB = 12; const int m[LB] = {0,0,0,1,1,1,2,2,3,3,3,4}; const int M[UB] = {2,2,4,4,4,4,5,5,7,7,7,7}; const int CN = m[LB-1]<M[UB-1]?M[UB-1]:m[LB-1]; clock x[CN]; int[0,CN-1] index; int[0,CN] counter; int[0,UB] v; int[0,CN-1] getIndex(int backtrack) { int i = index-backtrack; if(i<0) i += CN; return i; } void addNewEvent() { x[index]:=0; index = (index==CN-1?0:index+1); if(counter<CN) counter++; } const int LB = 12; const int UB = 12; const int m[LB] = {0,0,0,1,1,1,2,2,3,3,3,4}; const int M[UB] = {2,2,4,4,4,4,5,5,7,7,7,7}; const int CN = m[LB-1]<M[UB-1]?M[UB-1]:m[LB-1]; clock x[CN]; int[0,CN-1] index; int[0,CN] counter; int[0,UB] v; int[0,CN-1] getIndex(int backtrack) { int i = index-backtrack; if(i<0) i += CN; return i; } void addNewEvent() { x[index]:=0; index = (index==CN-1?0:index+1); if(counter<CN) counter++; } time window size number of events M[UB] m[LB]CN=7 circular clock buffer x1x1 x2x2 x3x3 x4x4 x5x5 x6x6 x7x7 pointer X 4 >M[i-1] X 3 >M[i-2] X 2 >M[i-3] X 1 >M[i-4] Invariant  lower bound Guard  upper bound Generator

21. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Approximating TA with Arrival Curves clock x; int counter; clock x; int counter; A SYSTEM || A OBSERVER One clock & one integer Non-deterministic window offset One window  one state space exploration Max considerable window size (dt) must be specified number of events dt time dt max & min Observer dt time dt time x==0x==dt

22. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se A Problem with Approximation number of events window size Last measured dt Actual stream Overapproximated stream t We need to know “safe” value of dt

23. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se A Problem with Approximation number of events window size response time Service curve Sometimes we can still perform timing analysis using “precise” data An adaptive approach?

24. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Another algorithm number of events window size Search for the segment that touches the curve Find the smallest intersection point and repeat Encoding of the intersection criterion into TA =m/n Angle  is rational m,n - integers LCM(m,n) can become very big (hyperperiod) Rapid slow down

25. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Simple Scheduling Example 4 tasks: 3 periodic+1 aperiodic (TA) Preemptive fixed priority scheduling Given BCET/WCET Abstracting release pattern with streams Analysis  Worst case response time  Required OS ready queue size

26. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se An Example with Feedback TASK1 input depends on the TASK2 output TASK1 uses TASK2’s remaining resource TASK2 input depends on TASK1 output Given  TASK1 input stream  Initial condition on activation of TASK2 Iterative computation until fixed point TASK1TASK2 AND CPU Initial Conditio n Input Stream 100%

27. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Books & Papers Rene L. Cruz. A Calculus for Network Delay. IEEE Transactions on Information Theory, 1991 J.-Y. Le Boudec, P. Thiran. Network Calculus. A Theory of Deterministic Queuing Systems for the Internet. 2004 L. Thiele and S. Chakraborty and M. Naedele. Real-time Calculus for Scheduling Hard Real-Time Systems. Proc. of ISCAS, 2000 L. Thiele and S. Chakraborty and M. Gries and A. Maxiaguine and J. Greutert. Embedded Software in Network Processors - Models and Algorithms. Proc. of EMSOFT, 2001 E. Wandeler, L. Thiele. Real-Time Interfaces for Interface- Based Design of Real-Time Systems with Fixed Priority Scheduling. 2005 P. Krcal, L. Mokrushin, W. Yi. A Tool for Compositional Analysis of Timed Systems by Abstraction. Tool paper submitted to CAV 2007. …

28. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Conclusions Abstraction technique for timed component systems One component at a time  no big product (GALP) Possibility to parallelize verification Heterogeneous systems  a potential to combine different formalisms Prototype How good is our abstraction? (Examples) Feedback? (Termination) Bound on max window size? (Adaptation?) Shared resources? (Priority Ceiling Protocol)

29. Informationsteknologi Institutionen för informationsteknologi | www.it.uu.se Thank you!