A Hierarchical Co-ordination Language for Interacting Real-time Tasks Arkadeb Ghosal, UC Berkeley Thomas A. Henzinger, EPFL Daniel Iercan, "Politehnica" U. of Timisoara Christoph Kirsch, University of Salzburg Alberto Sangiovanni-Vincentelli, UC Berkeley

active releasestartpreemptionresumecompletiontermination running Logical Execution Time (LET) completion event { Physical { Logical release eventtermination event The logical and physical execution times are depicted below. The events controlling a task behavior are: Events generated by the platform: start preempt resume completion Event generated by the environment: release termination Logical Execution Time

Communicators,Tasks and LET LET for task t2 t2 reads 2 nd instance of c3 t2 updates 6 th instance of c1 t2 updates 5 th instance of c2 A communicator is a variable (with a fixed data type) and can be accessed (i.e. read from and write to) only at specific time instances (denoted as communicator period). A task is a block of sequential code (without any internal synchronization point) that reads from certain instances of some communicators, performs computation and updates certain instances of the same or other communicators. The read/ write instances of communicators implicitly specify LET for task t1, t c1 c2 c3 c4 Four communicators c1, c2, c3 and c4 with access periodicity 2, 3, 4 and 3 respectively. LET for task t1 t1 reads 2 nd instance of c1 t1 reads 2 nd instance of c4 t1 updates 4 th instance of c2

Ports and Precedence A port is variable with fixed data type but is not bound to time instances i.e. as soon as the evaluation of t1 is complete, task t2 can read the output c1 c2 c3 Direct communication between tasks is allowed for tasks with identical frequencies (tasks with different frequencies can only communicate via communicators); direct communication ensure zero latency. LET for task t2 t2 reads 2 nd instance of c3 LET for task t1 t1 reads 2 nd instance of c1 t1 reads 2 nd instance of c4 LET for task t3 t3 updates 5 th instance of c2 The read/ write instances of communicators and ports implicitly specify LET for a task Task t2 and t3 writes the output to ports; at release t3 reads the ports.

program P Modes, Modules and Programs A mode is a group of task with identical frequency (expressed as mode period). Tasks within a mode may interact through ports; however tasks in different modes can only communicate through communicators. t1 t2 t3 mode m1 t1 t2 t3 mode m1 t4 t5 t6 t7 t8 t9 mode m2 mode m11 mode m12 mode m13 module M1 module M2 module M3 mode m31 mode m32 mode m22 mode m21 mode m23 HTL allows mode switching (possible only at end of mode periods) based on values of communicators and ports. A network of modes switching between themselves is referred as a module. An HTL program is a set of modules and a set of communicators. The modules are composed in parallel while modes in a module are composed sequentially. At any instance, tasks of at most one mode of a module may be executing.

Refinement A mode in a program can be replaced by another HTL program. This does not add expressiveness of the model; in fact a HTL program with arbitrary levels of refinement can be translated into one with no refinement. Refinement allows compact representation without overloading analysis; e.g. for an HTL program (with certain restrictions) schedulability is ensured if the top-level program (without considering any refinement) is schedulable.

Refinement t4 t5 t6 t7 t8 t9 mode m2 t4r t5r t6r t9r mode m2r -- latest communicator read of t5r  latest communicator read of t5, -- earliest communicator write of t5r  earliest communicator write of t5, -- dependencies of t5r  dependencies of t5, and -- wcet (t5r)  wcet (t5) and wctt (t5r)  wctt (t5) mode m2r refines mode m2 period [m2] = period [m2r] ensuring that when m2 switches, all tasks in m2r has terminated execution. every task in m2r maps to an unique task in m2; e.g. t5r to t5. t5 does not execute at run-time but ensures that t5r is accounted for during schedulability analysis of the top level program. Mapping is constrained in such a way that if mode m2 is schedulable, then mode m2 is schedulable as well. Schedulability needs to be checked only for the top level of an HTL program. This avoids a combinatorial explosion, and permits scheduling to be performed by the HTL compiler.

active releasestartcompletiontermination running transmission Logical Execution Time (LET) completion event { Physical { Logical release eventtermination event Distribution running Different modules can run on different hosts. The semantics remain the same as if they were running on a single host; however code generation and analysis take the distribution into account. Communicators shared across hosts are replicated in all hosts. When a task, writing to such a communicator, completes execution, the output is transmitted to all hosts. The transmission time is included in the LET for the task.

Steer-By-Wire Control Architecture Actuators: rack electric motors Sensors: steer angle/ torque, wheel angle, motor torque/ current, friction, power, pitch, yaw, roll MCU FR ECU1 Steering Feedback MCU FL MCU RR MCU RL ECU2 ECU3 ECU4 SENSORS FUNCTIONALITIES ACTUATORS Driver Interface Desired steer Desired Torque Vehicle Interface Wheel Angle Motor Current Motor Torque Speed Rolling Friction Power Pitch/ Yaw/ Roll Vehicle Actuation Wheel Motor Actuation Driver Feedback Steer Feedback Warning Power Coordinator Unit Motor Actuator Controller Steer Feedback Supervisory Control Fault Handling

SBW Implementation sensor_rr control fault diagnosis steer feedback power supervisor1 supervisor2 supervisor3 sensor_rl sensor_fr sensor_fl actuator_rr actuator_rl actuator_fr actuator_fl modules lohi sensor [rr, rl, fl, fr] actuator [rr, rl, fl, fr] steer feedback power lo hi startnml deg control fault diagnosis supervisor [1,2,3] lohi lohilohi nml emg modes idle motion crawl average manual cruise manual cruise over steering under steering fault1 fault2 no fault1 fault2 no fault2 fault1 refinement

CONTROLLER HTL COMPILER HTL Program Functionality Description Timing Description PLANT Host 1 S / A Host 2 S / A Host 3 S / A Inter-host communication Flatten E-code Generator Schedule Generator WCET + WCTT Estimator Well- formed? Well- timed? Schedulable ? E code E machine Functionality Implementation (C code) Implementation