/ \

SPECIAL FEATURE REAL- TIME EMBEDDED SYSTBMS

Modelling of real-time constraints using SDL for

embedded systems design by Ahmad Alkhodre, Jean-Philippe Babau and

Jean-Jacques Schwarz

The use of SDL has arisen as a promising way of dealing with the increasing complexity of embedded real-time systems. However, SDL does not take into

account non-functional aspects, such as the time requirements, that are especially important in the context of real-time systems. Furthermore, the associated code generators do not integrate the management of temporal constraints. A real-time semantic extension to SDL for real-time systems

modelling is proposed. The real time profile is added to SDL in order to prepare the real-time code generation. To illustrate the proposal, an example of a speed

regulator is presented.

mbedded systems interact strongly with physical processes and are subject to strong reliability constraints, in particular at the E temporal level. ‘A real-time embedded system

is defined as a system whereby the correctness of the system depends not only on the logical results of computation, but also on the time at which results are produced’.’ Because of the need for correctness, the development of such systems implies the use of formal languages. Although SDL (Specification and Description Language) is such a formal language, increasingly used for the development of embedded systems, it does not give a clear translation of time and does not provide a complete description of how the model should be executed over time.

In order to use the existing edition and verification tools of SDL (without any modification to SDL or multiplication of formalisms), we propose temporal semantics associated to a standardised architecture supporting the temporal constraints.

To prepare the further code generation, a semantic configuration of time allowing flexible specification of the temporal constraints and temporal knowledge of the system is proposed.

SDL: basic principle and real time SDL is a formal language that can model concurrency

and distributed systems: it also has some specific

instructions for temporal data. It is an ITU-T standardised language and, because it is supported by integrated development environments (objectGEODE, Tau): it is widely used in industry

The code generated by the tools is usually based on the services of a real-time multitasking executive. The application thus formed is then a set of communicating tasks.

SDL sees the world as divided into two parts: the system and its environment. The specifications written in SDL are limited to the system as the object of our consideration. The most important property defined in SDL is the bebaviour of the system. This behaviour defines how the system under consideration reacts to events in the environment that are communicated by signals sent to the system.

The language is based on communicating finite state machines (FSM) and abstract data types. It includes the concepts of type and genericity. At the first level, the application is a system made up ofblocks or ‘subsystems’ (Clock, Appli, Sensor and Actuator in Fig. l(u)) related to one another and to the border of the system by channels (canl, can2 and can3 in Fig. l(u)). Blocks are composed of ‘substructures’ (sub-blocks) and processes (input, command and output in Fig. l(b), which may communicate by internal messages (I, 0). A process in SDL is a communicating FSM with, potentially, several instances being executed in parallel. Fig. l(c) presents the

A COMPUTLNG & CONTROL ENGINEERING JOURNAL AUGUST 2002

\ REAL-TIME EMBEDDED SYSTEMS

a

block appli

/

b

process command

idle

I /

c

Fig. 1 Basics of SDL: (a) system; (b) block level; (c) process level

hehaviour of a process. It starts with an idle state, then it activates by the reception of a signal (I), verifies the guard and performs an action, sends message (0) and terminates by returning to the idle state.

Communication is made via signals (data) conveyed between blocks by the means of channels. The communicating mechanism is mono-senderlmulti- receiver; however, at the time of transmission of a given signal, only one receiver among those waiting receives it.

Time in SDL can only be defined and manipulated using the NOW instruction and the 'timer'." NOW gives access to a global clock and returns the current time. The actions related to the timer are the activation SET(delay) (expiry at NOW + delay) and the termination RESET. When a timer expires, it sends a signal to the waiting processes. At implementation, each action takes a certain amount of time for execution. As SDL does not specify how global time flows, the assumption, during the simulation of a SDL model, is to consider that the duration of an action can he ignored. SDL does not give a clear translation of time and does not provide a complete description in which the model must he executed over time.

This raises a problem for the development and the validation of real-time systems. On the one hand, temporal validation (schedulahility analysis) is really in a model of tasks in which each task is characterised by a priority level camed out from the temporal constraints, and on the other hand, the SDL code generators do not

integrate temporal constraints (not specified in SDL). It is thus necessary to add real-time semantics to SDL in order to build a real-time code generator.

Research in this field has taken three main directions. The first focuses on enhancing SDL by adding new structures to describe the real-time features (QSDL4 and SDL*"). The second uses SDL to model the behaviour. The model is then translated into another formalism to introduce the temporal requirement (as timed automata p,?. The third direction proposes that SDL is provided with temporal semantics8 That is the case considered in this paper, and we base our approach for the implementation level (within the aim of further code generation) on an architecture model.

Architecture model The real time system must react to stimuli (input

events) coming from the interfaces with the environment and produce answers (data or output events) within a given deadline. For a mono-processor system, the stimuli are distributed according to four categories: interrupts and data (IT-lev, Update-A_n) sent by the process, periodic clock signals (TIC-n) and messages (local MSGloc and remote MSG-net).

Input data is associated with the stimuli or directly read on the process. Output data (data or events) is associated with the messages (ANS, COW.

Fig. 2 shows a generic SDL modelling of a real-time system based on typed blocks. These blocks represent

A COMPUTING & CONTROL ENGINEERING JOURNAL AUGUST 2002

REAL-TIME EMBEDDED SYSTE~S \

..... 1 ._._..__ J .._._. I

Fig. 2 Proposed architecture model

the system application data processing and all the com- becomes a shared resource. ponents that interact with it: the clock block produces TIC-n signals; the software block represents another application that may be placed on the same machine; and the net block models the remote application that can interact with the application by sending network messages (MSG-net). In addition, the external environ- ment blocks model the physical process. This block interacts with the application by sending interrupts IT-lev and data Update-A-n.

At implementation, each category of exchange corres- ponds to a dedicated mode of communication between the application and its environment. For example, a polling server is dedicated to each interrupt and a periodic alarm is associated with each periodic clock signal. A mailbox, or some other queuing mechanism, is linked with the software communication and the exchanged data

In order to generate the corresponding code, it is necessary to classify the I/O exchanges between the application and its environment according to the type of communication used in the exchange. We propose typed naming rules for these signals (see Table 1). These signals can also convey data not represented here, because they may be specific to a given application.

In addition, the signals presented above are repre- sented in Tablel. For each one, the type (activation, message, response, data), its temporal characteristics and its associated constraints (as deadline, dage) are given.

Real-time semantics The proposed semantics integrate the 'event-action'

model of Jahanian and Mokq into the former architecture model. A real-time application is composed of a group of

Table 1 Type naming rules for these signals

i name category signal type information constraints I TIC_n(p,di) periodic activation n: number identifies the top di: deadline

iT-lev(di ,dz) activation on interrupt lev: interrupt level d2: deadline

p: period

d i : minimal interval between two interrupts

d i : minimal interval between two interrupts

MSG_net(di,dz) message from net net: the type of net idem

MSG_loc(di,d?) local message LOC: local idem

, RQST_S(di,dz) synchronous request from other software X idem

RQST_A(di,dn) asynchronous request from other software X idem

ANS application's response to a request X X Update-A-n data update active n: the number identifies the data dtimesiamp: data deadline

dvaieur: data values dtimenamp: data timestamp

dvaieur: data values dtimestamp: data timestamp

ddva: data age

Update-D-n data update dated: n: the number identifies the data ddva: data age note: this category is not a signal, but shared variable

COh4PUTING 8z CONTROL ENGINEERING JOURNAL AUGUST 2002

\

\ /

REAL-TIME EMBEDDED SYSTEMS

sender

[ Wait-answer

receiver

( Wait-msg ) RQST-S(d1)

Sewice

sender

Resume-processing I a b

Fig. 3 (a) Asynchronous message; (b) Asynchronous message exchange

actions that operate on data by taking into account the time flow, and events rising from the computer system or its environmentJO The temporal constraints expressed on the events are the frequency of their arrivals (minimum elapsed time between two successive events) and the response times (deadline). The temporal constraints expressed on the data are related to the life span and validity, and those relating to the actinns are the execution and communication duration.

At the implementation stage, the temporal constraints relating to the events and the data are derived from the actions launched by these events and from the actions which process the data. They can he translated into activation dates of the actions (periodic. suoradic and

production dates, and delay from taking into account the data.

In the following, we gwe a description of the stimuli (TIC, IT, MSG), and focus on the data case.

Activation models Based on the three categnries of stimuli defined in the

architecture model, three activation modes, relating to the type of signal, are defined

(i) Periodic activation The periodic activation TIC-n must launch an action with the periodicity p according to: @(el, I + 1) -@(el, 1) = b (where el is the launching event of the action and

aperiodic), waiting delays, deadlines, data ages, data @e; represents the Occurrencedate of the event evt)g

Fig. 4 Deadline propagation

......... ~ ~ . . ~ ............... ~ . . . ~ ~ .......... ; /*comment*/ ~ the following actions

~ : are to be executed s1 (dl) ......... i

lit' idle ...., I with respect to deadline dt .......... ~ ................... ~ ..............

I . . I i_~~ ................................

actions

A COMPUTING &CONTROL ENGINEEKLNG JOURNAL AUGUST 2002

(ii) Activation on interrupt The named signal IT-lev is dedicated to an interrupt that is characterised by its priority level (kv) and by dmin, the minimum interval separating two successive instances of the interrupt. dmin is defined by: @(IT, I + 1) -@(IT, z) > dmin.

(iii) Activation by message (locals andor remote) The messages exchanged between the processes can be either messages with responses (RQST), or messages without responses (MSG) (see Table 1). These two types can be either local or distant messages. In particular, the messages with responses can be either synchronous RQST-S (waiting for a response synchronisation in the transmitting process, Fig. 3(a)) or asynchronous RQST-A (not waitingfor theanswer, Fig. 3(b)). A process can launch or finish when it awaits a message. In addition, temporal constraints on the minimal time between two sent messages can also he expressed.

Deadline model When an event el occurs, a set of actions is to be

executed according to a specific deadline di. This constraint is expressed as: @(si, z) - (el, z) = di. (SI =the end of the action).

A deadline is therefore associated with each input signal to the system. The constraint is then propagated in an implicit manner, in accordance with the propagation mode" to all the signals sent consequently to the input signal (Fig. 4). The actions launched by these signals therefore inherit the constraint transferred by the signal. The periodic activation is simple to model in SDL by using the timer with a time-out equal to the period (Fig. 5): when the time-out of the timer expires, it sends a signal to the process, which carries out the corresponding action.

Once the temporal constraints and their associated semantics are specified in the model, it is possible to express specific real time policies (filtering, management of temporal faults etc.). For example, it can he necessary to proceed to the modification of the temporal constraints (increasing a period, deadline relaxation). When an action is to be realised within a deadline different from the initial one, it is necessary to specify the change of deadline for the signal activating the corresponding action (Fig. 4).

In addition, in the case of interrupt, it is often desirable to do some filtering in order to eliminate spurious interrupts. Such filtering is represented in Fig. 6 (the example also includes the management of a temporal fault called exception).

Data model A piece of data can represent any single or composed

information used by one or more action to be carried out. In real-time applications, data often stands for either information coming from the physical environment through measurements (for example: pressure), a shared

REAL-TIME EMBEDDED SYSTEh?S \

SET (now+periad,Tl)

timer-advanced

I Fig. 5 Periodic activation

variable (local or global), a file, or a datagram transferred via a network. Data is produced at a given moment by a producer (action, process, network) and is used by a consumer (action, process, network) in some given time interval.

From here on, we deal with the modification of the real- time data exchanged between the application and its

( wait_iT ) I IT_lev(di,dZ) <

(*) processing-series

now-aclivation_limec =dl

(*)

ig. 6 Interrupt and temporal fault management

COMPUTING & CONTROL ENGINEERING JOLIRNAL AUGUST 2002

\ &AL-TIME / EMBEDDED SYSTEMS

irocess maulator

NEWPlPEUpdate D 4

ENDNEWPEUpdate_D: DCL Update-D-1.

Update_d2lV: = (Vlarget)

Slrud V integer: T dtimestamo:

U pdate_A_t (torque.2TOP_n.d t &

( regulator-on )

rocess motor

1 Update-A-t (valus,vai.timestamp.deadline) < memorise the values

idle

g. 7 Data update

environment (process or network). Data can be categorised into two types:

Active data are data whose update generates a reaction of the system carried out by the launch of some actions (the update of other data, launch of an alarm etc.). This type of data is either periodic (for example, the periodic update of speed on an aircrafP), or aperiodic. Temporal data are time-stamped data, thus allowing the management of the history of their ev~lution. '~ These data are in either reading or writing mode.

To make correct decisions taking into account the real state of the environment, the data handled by realLtime applications must be coherent from a temporal point of view. This leads the model to express temporal constraints on the data to ensure the coherence of the model.

(i) Temporal characteristics The temporal characteristics to be associated with the above-mentioned data can also be summarised as:

Producer constraints

-The rhythm of data production is the rate at which data is produced. -The production date is the moment when the data was measured or calculated.

Consumer constraints -Latency is the delay required by the system to take data into account (maximum time between the produc- tion date of data and its actual date of consumption by the system). -Age is the maximum time interval between the production date and the consumption date of data by all actions of the system.

In order to prepare the code generation, we propose to model in SDL these temporal characteristics on the two types of data (active and temporal). A Driori, two approaches are possible. The first uses the 'export' and 'impor? concepts for the data with these temporal characteristics (reading and writing data between SDL processes); for example with each modification of temporal data, the data value with its production date are exported. In the second approach, SDL signals can be used to convey the values of data with their temporal

COMPUTING & CONTROL ENGINEERING JOURNAL AUGUST 2002 A

/ REAL- TIME EMBEDDED SYSTEMS

\

characteristics. The first approach is not satisfactory for the active

data because the 'data import' does not allow the launch of transactions in SDL-this leads us to follow the second approach. But the second approach is also not adapted to the temporal data because it embeds a synchronisation mechanism not present in the readwrite mechanism.

We propose type naming rules for this information (signals, data in import/exportj. According to the two categories of data defined in the architecture model, we define two modes of data updating. The first is a signal mechanism called active update. The second is a shared variable called dated update.

(ii) Active update The signal named Update-A-n is dedicated to an update of the active data (A) which is characterised by its identified number (n), the value of data (duaiuej, the production date (d6mcs~amp), the data age (dag@) and by the

time the system needs to take into account the data (ddmiiiinej.

(iiij Dated update The dated update (Update-D-n, where n is the identified number of data) is dedicated to the modification of data which are characterised by the value of data (dvaiue), date of production (dtipnestampj and data age (daze).

(ivj Use of temporal data The formalisation of real-time characteristics in SDL, in order to prepare the code generation, allows the installation of a real-time policy at the design stage. For example, it is often interesting to associate temporal filtering to react to data that are temporally inconsistent; Fig. 7 shows an SDI. pattern that provides this function.

Using this real~time policy, the data ages can be validated by applying the law of temporal coherence:'? instant-current ~ dtiresta,np = dage.

system speed_resulator_system

[TIC-Z] timer-ch2 clock-general

syntype dmin =duration endsyntype; syntype dage=duration endsyntype: ayntype dtimestamp=time endsyntype; syntype ddeadiine=duration endsyntype; signal IT_lev(dsadline. dmin), Updatep-7 (integerdage,dtimestamp,ddeadline);

1

Fig. 8 Speed regulator example

COMPUTING & CONTROL ENGINEERING JOURNAL AUGUST 2002

\ /

REAL-TIME EMBEDDED SYSTEMS

Example mode. This modelling allows the description of real-time We show, through the example of Fig. 8, the use of the policies.

temporal semantic extension of SDL. The example relates We are currently working on the description of the to a case study proposed in the 2001 SIVOES work~hop.'~ implementation model by introducing real-time The system to be modelled is a speed regulator designed operating system services (as tasks, interrupt service to align vehicle speed on a set-point value selected by the routine).16 The next stage is the validation of the driver. Speed is maintained with respect to changes in execution model, i.e. taking into account the expressed torque, which are signalled to the engine control system. real-time constraints. Vehicle speed is measured by a speedometer. Measure- The following step is to build an automatic code ments are performed at a frequency of 2 Hz. The speed generator supporting the interpretation of the suggested display is refreshed at the same rate. The regulation temporal semantics and the execution model. system is achieved when the driver actuates the regulator odoffbutton, thus generating a Start signal. This is only ,Misconceptions real~time a enabled at vehicle speeds of 50 kmih or more. System shutdown is achieved in any of the four following ways:

implicitly, by pressing the brake pedal explicitly, by actuating the odoff button by stopping the engine (via the starter) when vehicle speed falls below the 50 km/h threshold.

The anticipated response times for shutdown are: 500 ms on braking or odoff switch actuation, and 100 ms when

(that is a maximum and exceeding this period produces a temporal exception). From the example, we have

s&us problem for the next-generation systems', IEEE Computer, October 1988,21, (IO). pp. 10-19

2 ALVAREZ, J. M., DIAZ, M., LLOPIS, L. M., PIMENTAL. E.. and TROYA, J. hl.: 'Integrating schedulahility analysis and SDL in an ohjectnriented methodology for embedded realkime systems', in DSSOlJLl,R., BOCHMANN G.V. and LAHAV,Y. (Eds.), Proceedings of SDL Forum '99, Montreal, Canada (Elsevier Science BY 1999)

3MAMMc .lU, Z.: 'Expression et deviation des mntraintes temporells dam les applications temps der, APIIJESA, 1998,32, (Sifi), pp. M9- 644

4 DIEFENBRUCH, M.: 'aueuing SDL-a language for the functional and quantitative specification of distributed systems'. University Gsamthochschuk Esse", Fachbereich Mathematik und Informatik, 1997, (QUAFOS-Project Report Ql)

5 SPITZ, S.. SLOMKA, F., and DORFEL, M.: 'SDL*-an annotated speSfiutian language far engineering multimedia mmmunication systems', Sixth Open Workshop on High Speed Net- works,

the engine is halted or speed drops to less than 50 kmih

extracted the architecture model given inFig. 8, which presents the blocks associated with the four main hasic functions: CUI, the interface of the system with the

Stuttgart, BOZGA, M,, Octobm FERI\"DE~, 1997 cI,, GHIRW, L,, GRAF s,, KRIMM, P, MOUNlER. I... and SIFAKIS. J.: 'IF: an intermediate represntation for SDL and its applications', Proceeding. of the Ninth SDL Form.

unit; and &&gene&, presents the system global clock.

example: the IT-1 interrupt signal (representative of

Forum, Copenhagen, Uenmark. 27th29th June 2001, Section 6 in the proceedings

formal SDI. Femantim based on abstract state machines'. in The modelling includes several interrupt signals for GOTZHEIN, R,, GLAsER, U,, and pmZ, A,: .Towards a new

~~ ~~~~~~~~~ ~~~ ~~

pressing on the accelerator, which interrupts the DSSOULI, R., BOCHMA", G. V, and LAffAV, Y (Eds.), Proceedings of SDL Forum '99, Montreal, Canada (Elsevier Science BV, 1999, pp. regulator and gives the control of the vehicle to the driver) ,111 Inn> L , ' . " y I

9 JAHANIAN, F,,andMoK, A. K.: ' s fc ry anaiysisaf timing properties in realkime systems'. IEEE Trans &fit Esg, September 1986, 12, (91, PP. 890-904 -lU,z.: ,SDLmod~lisatiandeprotocolesets)st~mesr~actiis. (ISBN 2 74620 166 6, juillet ZWa!

11 BABAU, J. P., and SOLRROUII,LE, J. L.: 'Expressing real time constraints in a reflective abject model', IFAC Confro1 Enginewing PmcfUe. 1998.6, pp. 421~430

12 XLAOHUI, C., SONG, J., and LIU, w. S.: 'Maintaining temporal

characterised b y the constraints deadline, dmzn (the former is the time that the system has to take into account the interrupt and the latter is the minimal time between two consecutive interrupts). In a slightly simplified version, this interrupt is defined and managed as shown previously in Fig. 6. TIC-1 and T I C 2 represent periodic activation. Update-A-1 is the active updating typed

~~

signal for data 'torque' produced in the regulator. consistency: pessimistic YS optimistic concurrency controY, IEEE Tram on Know/& m d Data Evtgiacenng, October 1995.7, (51, pp. 7FA74ii The text box in Fig. 8 is dedicated to the declarations

resulting from the semantics. If they are not taken into

be used by the new code generator (deadline will then be regarded as a new key word).

Conclusion h~J iwaoddes . in t rane t .g~l~~aop2001l~i~~~2001 .hhn

13 SCHOLL, P.-C.. FAUVET, M.-C., and CANAVAGGIO, J. F.: 'Un modele d'historique pour un SGBD temporel: TSI, 1998, 17, (3). pp. 379-399

proposition paper, Internal Workshop on an Infrastructure for Temporal Databases, 1993

I S Case study: SIVOES 2001-'Specifiutian. implementation and validation of object-oriented embedded systems' workshop.

This paper has considered SDL as a high-level 16 ALKHODRE, A,, ef ai: 'Real time multitasking design based on SDI,',

account by the current code generators of SDL, they will 14 RAMAMKITHAM, K,: ,Time for real.time temporal

internal research report. April 2002 language able to model and specify real-time embedded systems. SDL has some instructions to deal with time but not with real time. This led us to propose an extension in the form of real-time semantics, which is based on a

0 EE 2002 The the Laboratory of L3i, N S A . L ~ ~ ~ ; bat Blaise Pascal. 69621 Villeurbanne. France: E-mail fahmad.

are

standard architecture, typed signals and a propagation alkhodre, jpbabau) @if.insa-lyon.fr; jjs@iuta.univ-lyonl.ir.

A COMPUTING & CONTROL ENGINEERING JOURNAL AUGUST 2002