1. Extending the smart-card personalisation system by the graphical treatment Angelika Mader University of Twente

2. Cybernetix – smart card personalisation system personalisation stations conveyer belt unloader printer flip over laser engraver flip over printer loader

3. personalisation stations conveyer belt unloader printer flip over laser engraver flip over printer loader 1 11 1 11111111 111 1111 1 1 Cybernetix- smart card personalisation system way of a single card through the system

4. Cybernetix - smart card personalisation system Research question: can we use model checking tools to find an optimal schedule? optimal means optimal throughput; because the belt is not moving with constant speed, it is not the number of gaps that we optimize. First approach: isolation of the personalisation part

5. Isolation of the personalisation part personalisation stations conveyer belt unloader printer flip over laser engraver flip over printer loader processing times: Personalisation 10-50 Unloader, Loader, Flip-Over 2 Printer 3 Laser Engraver 4 Belt movement 1 dominates:

6. smart card personalisation super single mode 1 1 1 1 2 1 2 1 23 1 23 1 2 34 1 2 34 1 2 34 123 4 1 23 45 1 23 45 1 23 4 5 1 23 4 5 6 1 23 4 5 6 1 23 4 5 67 1 2345 67 12 345 67 12 345 67 12 3456 7 12 3456 78 12 3456 78 123 456 78 23 456 78 23 4567 8 23 4567 89 23 4 5 67 89 3 4 5 67 89 3 4 5 67 8 9 3 4 5 67 8 9 10 345 67 8 9 45 67 8 9 45 6789 11 456 789 1011 56 789 1011 56 78910 11 56 78910 1112 1 2 3 123 45 etc. belt unloaderloader personalisation stations

7. First results problem difficult for model checking: does not scale up to great numbers of cards for a periodic schedule we need some sort of cycle detection

8. More first results By elementary combinatorial argumentation: the throughput of the super-single mode is k max{4k+3,p+2} The super-single mode meets the theoretical upper bound for throughput, if p >= 4k+1 (i.e. personalisation time is long enough w.r.t. number of stations) k: even number of stations p: personalisation time Cycle length

9. Alternative Architecture 7 4 6 3 5 2 1 8 Why: allows for an easier schedule and easier analysis argumentation transfer to the more complicated super-single mode different composition properties: good for comparison 10 9 8 7 4 6 3 5 4 7 3 6 2 5 1 8 8 4 7 3 6 2 5 1 4 8 3 7 2 6 1 5 4 8 3 7 2 6 5 9 9 4 8 7 3 6 2 5 9 8 4 7 3 6 5 9 8 4 7 3 6 2 5 8 9 7 4 6 5 11 10 8 9 7 4 6 3 5 1110 8 7 9 6 4 5 11 8 10 7 9 6 4 5 11 8 10 7 9 6 5 12 811 7 10 6 9 5 12 811 7 10 6 9 5 8 12 7 11 6 10 5 9

10. Even more first results By elementary combinatorial argumentation: the throughput of the alternative architecture is k max{4k,p+2} The alternative schedule meets the theoretical upper bound for throughput, if p >= 4k-2 (i.e. personalisation time is long enough w.r.t. number of stations) k: number of stations p: personalisation time Cycle length

11. Personalisation & graphical treatment personalisation stations conveyer belt unloader printer flip over laser engraver flip over printer loader cards are processed on the belt cards do not overtake each other graphical treatment only adds delays processing times: Personalisation 10-50 Unloader, Loader, Flip-Over 2 Printer 3 Laser Engraver 4 Belt movement 1

12. Personalisation & graphical treatment cards leave the personalisation part with a certain delay pattern (rythm) that depends on the schedule (the belt does not move with constant speed!) the time pattern interferes with the delays by the graphical treatment: extreme cases are that the graphical treatment delays synchronize completely with the time pattern of the personalisation part and have no negative effect at all, or contrary, that the delays are added completely to the production time personalisation schedules interfere differently with graphical part; this holds even for different optimal schedules (will be shown by experiments) timing analysis of interference does not seem possible using elementary reasoning use UPPAAL for throughput analysis of the composition of personalisation part and graphical part

13. Timing analysis - idea: Add explicit scheduling process in the UPPAAL model, that enforces super-single mode or the alternative schedule for the personalisation part. Personalisation & graphical treatment

14. process Personalisation1{ clock pers_time; state PERSONALISING, IDLE; init IDLE; trans IDLE -> PERSONALISING{ guard card_id[0]==0,// no card in the personalisation station Belt[1]>0, // there is an unpersonalised card on the belt moving==0; // belt must stand still sync s_p1?; assign pers_time:=0, card_id[0]:=Belt[1], // load card in the pers. station Belt[1]:=0;},// position on the belt gets empty PERSONALISING -> IDLE{ guard pers_time>=Personalise, Belt[1]==0, // belt cell under station is empty moving==0; // belt must stand still sync s_p1?; assign Belt[1]:=-card_id[0], // put pers. card on the belt card_id[0]:=0;};// personalisation station is empty now }

15. process Scheduler{ state S1, S2, S3, S4, S5, S6, S7, S8, S9, S10, S11, S12, S13, S14, S15, S16, S17, S18, S19, S20, …, S95; init S1; trans S1 -> S2{sync s_ul!; },// synchonizes with unloader S2 -> S3{sync s_m!;},// synchronizes with belt S3 -> S4{sync s_m!;},… S4 -> S5{sync s_ul!; }, S5 -> S6{sync s_m!;}, S6 -> S7{sync s_m!;}, … S21 -> S22{sync s_m!;}, S22 -> S23{sync s_ul!; }, S23 -> S24{sync s_m!;}, S24 -> S25{sync s_p1!;},// synchronizes with personalisation station 1 S25 -> S26{sync s_p2!;}, // synchronizes with personalisation station 2 S26 -> S27{sync s_p3!;},… S27 -> S28{sync s_p4!;},...

16. Personalisation & graphical treatment Timing analysis – experiments: super-single mode and alternative schedule 4 and 8 personalisation stations pick&drop times (1/2 time unit or zero) at personalisation stations time measurements for 12,16,20,24 and 16,24,32,40 cards until cycle length is determined. personalisation times 10,20,30,40,50 cost-optimal UPPAAL

17. Timing analysis -experiments number of cards personalisation time 121620 10 113 140 137 171 161 202 20 129 148 153 179 177 210 30 167 168 199 201 231 234 40 207 198 249 241 291 284 50 247 228 299 281 351 334 4 stations & graphical treatment, super-single mode & alternative architecture

18. Timing analysis -experiments number of cards personalisation time 121620 10 113 +24 140 137 +24 +31 171 161 +31 202 20 129 +24 148 153 +24 +31 179 177 +31 210 30 167 +32 168 199 +32 +33 201 231 +33 234 40 207 +42 198 249 +42 +43 241 291 +43 284 50 247 +52 228 299 +52 +53 281 351 +53 334 4 stations & graphical treatment, super-single mode & alternative architecture

19. First new results decomposition helps to analyse more complex scheduling problems results from the analysis of the first part go into a explicit scheduler of the larger system (model) cycles could be detected (because we know batch size = cards per cycle) with cycle length we also have throughput

20. Second version of graphical treatment cards are printed on one side only: Flip-overs (and laser engraver) are not in use each card can be printed at first OR second printer scheduling problem: what is the best schedule for the printers when the personalisation part is in super-single mode or the alternative schedule? can be solved with cost-optimal UPPAAL by similar approach as for the first version personalisation stations conveyer belt unloader printer flip over laser engraver flip over printer loader

21. Conclusions so far Personalisation part is dominant but not the only source of delay in the system Different optimal schedules can interfere differently with graphical treatment part: optimality is not compositional Even if the whole problem is not (yet) solvable with model checking, model checking can be used for parts of solutions Decomposition method for complex schedules can help to find good schedules Mixed strategies can help

22. What has to be done Schedule and timing analysis for faulty cards: performance models? More experiments with different architectures (e.g. numbers of cells on the belt)