1 CREATING EFFECTIVE ORGANIZATIONAL DESIGNS STRATEGIC MANAGEMENT BUAD 4980.
CS:4980 Foundations of Embedded Systemshomepage.cs.uiowa.edu/~tinelli/classes/4980/Spring... ·...
35
CS:4980 Foundations of Embedded Systems Copyright 20014-16, Rajeev Alurand Cesare Tinelli. Created by Cesare Tinelli at the University of Iowa from notes originally developed by Rajeev Alur at the University of Pennsylvania. These notes are copyrighted materials and may not be used in other course settings outside of the University of Iowa in their current form or modified form without the express written permission of one of the copyright holders. During this course, students are prohibited from selling notes to or being paid for taking notes by any person or commercial firm without the express written permission of one of the copyright holders. Timed Model
Transcript of CS:4980 Foundations of Embedded Systemshomepage.cs.uiowa.edu/~tinelli/classes/4980/Spring... ·...
CS:4980FoundationsofEmbeddedSystems
Copyright 20014-16, Rajeev Alur and Cesare Tinelli. Created by Cesare Tinelli at the University of Iowa from notes originally developed by Rajeev Alur at the University of Pennsylvania. These notes are copyrighted materials and may not be used in other course settings outside of the University of Iowa in their current form or modified form without the express written permission of one of the copyright holders. During this course, students are prohibited from selling notes to or being paid for taking notes by any person or commercial firm without the express written permission of one of the copyright holders.
TimedModel
ModelsofReactiveComputationq Synchronousmodel
§ Componentsexecuteinasequenceofdiscreteroundsinlock-step§ Computationwithinaround:Executealltasksinanorderconsistent
withprecedenceconstraintsq Asynchronousmodel
§ Speedsatwhichdifferentcomponentsexecuteareindependent§ Computationwithinastep:Executeasingletaskthatisenabled
q Continuous-timemodelfordynamicalsystem§ Synchronous,butnowtimeevolvescontinuously§ Executionofsystem:Solutiontodifferentialequations
q Timedmodel§ Likeasynchronousforcommunicationofinformation§ Canrelyonglobaltimeforcoordination
ExampleTimedModel
clockx:=0off
press?–>x:=0dim bright
press?
(press&x>=1)?(press&x<=1)?
Initialstate: (mode=off,x=0)Timedtransition:(off,0)–0.5–>(off,0.5)Inputtransition: (off,0.5)–press?–> (dim,0)Timedtransition:(dim,0)–0.8–> (dim,0.8)Inputtransition: (dim,0.8)–press?–> (bright,0.8)Timedtransition:(dim,0.8)–1–> (dim,1.8)Inputtransition: (dim,1.8)–press?–> (off,1.8)
ExampleTimedModel
q Clockvariables§ Testsandupdatesinmode-switcheslikeothervariables§ New: Duringatimedtransitionofdurationd,thevalueof
clockvariablesincreasesbyanamountequaltodq Timingconstraint:Settingx to0 foroff–>dimandguardx<=1
fordim–>bright specifiesthattimingofthesetwotransitionsis<=1 apart
clockx:=0off
press?–>x:=0dim bright
press?
(press&x>=1)?(press&x<=1)?
Example:TimedBuffer
bool in bool out
q Bufferwithaboundeddelay
q Behavior:Inputreceivedonchannelinistransmittedonoutputchanneloutafteradelayofd,withLB<=d<=UB(i.e.weknowlowerandupperboundsonthisdelay)
ModelingTimedBuffer
clocky:=0
in?–>x:=in;y:=0
in?
q Modeindicateswhetherthebufferisfullornotq Statevariablex remembersthelastinputvaluewhenbufferisfullq Clockvariabley tracksthetimeelapsedsincebufferfilledupq Whenbufferisfull,inputeventsareignoredq Guardy>=1ensuresthatatleast1 timeunitelapsesinmodeFull
Howtoensurethatmode-switchfromFull toEmpty isexecutedbeforeclocky exceedstheupperbound1?
FullEmpty
y>=1–>out:=x
ClockInvariants
q Theconstrainty<=1associatedwithmodeFull isaclockinvariant
q Atimedtransitionofdurationd isallowedonlyiftheclockinvariantissatisfiedfortheentiredurationofthetransition§ (Full,x,0.8)–0.7–> (Full,x,1.5) allowed§ (Full,x,0.8)–1.4–> (Full,x,2.2) disallowed
q Clockinvariantstolimithowlongaprocessstaysinamode
clocky:=0
in?–>x:=in;y:=0
in?
Fully<=2
Empty
y>=1–>out:=x
ExamplewithTwoClocks
clockx,y:=0
in?–> x:=0
q Inputevent:inq Outputevents:out1,out2q Twoclockvariables:x,yq Astimepasses,bothclocksincrease(andatthesamerate)q Sampletimedtransitionsfromstate(mode,x,y)=(Wait2,0.8,0):
(Wait2,0.8,0)–0.3–>(Wait2,1.1,0.3)–0.72–>(Wait2,1.82,1.02)
Wait1x<=1
Idle
y>=1–> out2!
out1!; y:=0Wait2x<=2
TwoClockExample
q Clockx trackstimeelapsedsincethelastinputeventq Clocky trackstimeelapsedsincetheoutputeventq Whatisthebehaviorofthismodel?q Ifinputeventoccursattimet,theprocessissuesanoutputeventon
channelout1 attimet’ withintheinterval[t,t+1],andthenonchannelout2 attimet’’withintheinterval[t’+1,t+2]
clockx,y:=0
in?–> x:=0Wait1x<=1
Idle
y>=1–> out2!
out1!; y:=0Wait2x<=2
ExampleSpecification
q ConsideratimedprocesswithInput:eventx Output:eventy, eventz
q Desiredbehavior§ Foreachinput,producebothoutputevents§ Timedelaybetweenx? andy! isintheinterval[2,4]§ Timedelaybetweenx? andz! isintheinterval[3,5]§ Ignorelaterinputsreceivedintheseintervals
DefinitionofTimedProcessq AtimedprocessTP consistsof
1. AnasynchronousprocessP,wheresomeofthestatevariablescanbeoftypeclock (rangingnon-negativereals)
2. AclockinvariantCI,aBooleanexpressionoverP’sstatevariables
q Inputs,outputs,states,initialstates,internalactions,inputactions,andoutputactionsexactlyasintheasynchronousmodel
q Notation:Forastates andtimet,lets+t denotethestatesuchthat§ (s+t)(x)=s(x)+t foreveryclockvariablex,and§ (s+t)(y)=s(y)foreverynon-clockvariabley
q Timedactions:Givenastates andatimed>0,s–d–>s+d isatransitionofdurationd aslongasthestates+t satisfiesinvariantCIforallt in[0,d]Note: Ifaclock-invariantisaconvexconstraintthenitissufficienttocheckthattheend-statess ands+d satisfyCI
CompositionofProcesses
bool in boolout1
q Howtoconstructtimedprocesscorrespondingtothecompositionofthetwoprocesses?
q Whatarethepossiblebehaviorsofthecompositeprocess?
boolout2
TimedBuf1
TimedBuf2
CompositionofTimedProcesses
clocky1:=0
in?–> x1:=in;y1:=0
in?
Fully1<=UB1Empty
y1>=LB1–> out1:=x1TimedBuf1
clocky2:=0
in?–> x2:=in;y2:=0
in?
Fully2<=UB2
Empty
y2>=LB2–> out2:=x2TimedBuf2
Thecompositeprocesshasfourmodes:(Empty,Empty),(Empty,Full),(Full,Empty),(Full,Full),
CompositionofTimedProcesses
(mode=EF=>y2<=UB2)&(mode=FF=>y1<=UB1&y2<=UB2)&(mode=FE=>y1<=UB1)
CompositionofProcesses
q IfUB1<LB2thenout1 guaranteedtooccurbeforeout2§ Implicitcoordinationbasedonboundsondelays
q Isitpossibletoobservetwoout1eventswithoutaninterveningout2event?§ Dependsonrelativemagnitudesofbounds(needtiminganalysis!)
bool in boolout1
boolout2
TimedBuf1
TimedBuf2
DefinitionofParallelCompositionq ConsidertimedprocessesTP1 =(P1,CI1)andTP2 =(P2,CI2)
q WhenistheparallelcompositionTP1 |TP2 defined?§ ExactlywhentheasynchronousparallelcompositionP1 |P2
isdefined(thatis,whentheoutputsofthetwoaredisjoint)
q TP1|TP2=(P1 |P2,CI1 &CI2)§ AsynchronouscompositionofP1andP2 definestheinternal,
inputandoutputactionsofthecomposite§ Conjunctionoftheclock-invariantsdefinestheclock-
invariantofthecomposite
q Consequence:Thecompositeprocesscanallowatimedactionofdurationd exactlywhenboth TP1 andTP2 canwaitfortimed
BlockDiagrams
q Componentscanbetimedprocessesnow§ Operation:instantiation(input/outputvariablerenaming),parallel
composition,andvariablehiding
q Astepofthecompositesystemiseither1. Aninternalstepofoneofcomponents2. Acommunication(input/output)stepinvolvingrelevantsender
andreceivers3. Atimedstepinvolvingallthecomponents
TimedModel
q Timedmodelissometimescalledthesemi-synchronousmodel(mixofasynchronousandsynchronous)
q Definitions/conceptsthatcarryovernaturallyfromthosemodels:§ Executionsofatimedprocess§ Transitionsystemassociatedwithatimedprocess§ Safety/liveness requirements
q Distributedcoordinationproblems:howcanweexploittheknowledgeoftimingdelaystodesignprotocols?
Recall:SharedMemoryAsynchronousProcesses
q ProcessesP1andP2communicatebyreading/writingsharedvariables
q Eachsharedvariablecanbemodeledasanasynchronousprocess§ Stateofeachsuchprocessisthevalueofcorrespondingvariable§ Inimplementation,sharedmemorycanbeaseparatesubsystem
q Readandwritechannelbetweeneachprocessandeachsharedvariable§ Towritex,P1synchronizeswithxonx.write1channel§ Toreadx,P2synchronizeswithx onx.read2channel
x.write1
P1
x
y
P2y.write1
y.read2
y.write2
x.read2
x.write2
y.read1
x.read1
SharedMemoryProgramswithAtomicRegisters
AtomicReg nat x:=0
ProcessP1
nat y1:=0
y1:=x
x:=y1+1
ProcessP2
nat y2:=0
y2:=x
x:=y2+1
Declarationofsharedvariables+codeforeachprocess
Keyrestriction:Eachstatementofaprocesseither
changeslocalvariables,readsasinglesharedvar,orwritesasinglesharedvar
Executionmodel:executeonestepofoneoftheprocesses
Whatifweknewlowerandupperboundsonhowlongareadorawritetakes?Couldwesolvecoordinationproblemsbetter?
AsynchronousExecutionModel
nat x:=0;y:=0
Ax:x:=x+1
Ay:y:=y+1
q TasksAx andAy executeinanarbitraryorder
q Foreverypossiblechoiceofnumbersm andn,thestate(m,n)isreachable
q Recall:Fairnessassumptionscanbeusedtoruleoutexecutionswhereoneofthetasksisignoredforever(althoughthisdoesnotaffectthesetofreachablestates)
q Whatifweknowhowlongeachoftheseincrementstake?
(x,y)
TimedIncrements
q TaskAx incrementsx,andthistakesbetween1 to2 timeunits
q TaskAy incrementsy,andthisalsotakesbetween1 to2 timeunitsq Twotasksexecuteinparallel,asynchronously,buttimingintroduces
loosecoordinationq Whichstatesarereachable?Whatistherelationshipbetweenmand
n sothatthestate(m,n)isreachable?
clocku:=0nat x:=0
u>=1–>x:=x+1;u:=0
u<=2
clockv:=0nat y:=0
v>=1–> y:=y+1;v:=0
v<=2
q Safetyrequirement:processesshouldnotbothbeincriticalsectionsimultaneously(canbeformalizedusinginvariants)
q Absenceofdeadlocks:ifanyprocessistryingtoenter,thensomeprocessshouldbeabletoenter
ProcessP1
EntryCode
CriticalSection
Tobedesigned
ProcessP2
EntryCode
CriticalSection
MutualExclusionProblem
MutualExclusion:IncorrectSolutionAtomicReg {0,1,2}Turn:=0
Whatistheproblem?
ProcessP1
Idle Try1Turn=0?
Crit
else
Turn:=0
Try2Turn:=1
ProcessP2
Idle Try1Turn=0?
Crit
else
Turn:=0
Try2Turn:=2
Timing-basedMutualExclusion
1. Beforeenteringcriticalsection,readthesharedvariableTurn2. IfTurn!=0thengotostep1andtryagain3. IfTurn=0thensetTurn toyourID
Proceedingdirectlytocriticalsectionisaproblem(sincetheotherprocessmayalsohaveconcurrentlyreadTurn tobe0,andupdatingTurn toitsownID).Solution:
4. Delayandwaittillyouaresurethatconcurrentwritesarefinished
5. ReadTurn again:ifTurn equalsyourownIDthenproceedtocriticalsection;otherwise,gotoStep1andtryagain
6. Whendonewithcriticalsection,setTurn backto0
Fisher’sMutualExclusionProtocol
AtomicReg Turn:=0
Idlenat y,clockx
Testy:=Turn Set
Delay
y=0–> Turn:=myID
y!=0?
;x:=0x<=Δ1
Timingassumption:writingTurn takesatmostΔ1
Checkx>=Δ2 –> y:=Turn x:=0
Crit
y=myID ?
y!=myID ?Turn:=0
Whydoesthiswork?
WaitforatleastΔ2 timeunits,andreadTurn again
PropertiesofTimedFisher’sProtocolq AssumingΔ2 >Δ1,thealgorithmsatisfies:
§ Mutualexclusion:Twoprocessescannotbeincriticalsectionsimultaneously
§ Deadlockfreedom:Ifaprocesswantstoentercriticalsectionthensomeprocesswillentercriticalsection
q Protocolworksforarbitrarilymanyprocesses(notjust2)§ Incontrast,intheasynchronousmodel,mutualexclusion
protocolforN processesislotmorecomplexthanPeterson’salgorithm
q Exercise:Doestheprotocolsatisfythestrongerpropertyofstarvationfreedom(ifaprocesswantstoentercriticalsectiontheniteventuallywill)?
q Exercise:IfΔ2 <=Δ1 doesmutualexclusionhold?Deadlockfreedom?
TimedCommunication
q Supposeasenderwantstotransmitasequenceofbitstoareceiverconnectedbyacommunicationbus
q Naturalstrategy:Dividetimeintoslots,andineachslottransmitabitusinghigh/lowvoltagevaluestoencode0/1
q Manchesterencoding:0 encodedasafallingedge,and1encodedasarisingedge
TimedCommunicationChallenges
q Senderandreceiverknowthedurationofeachtimeslot,but…q Receiverdoesnotknowwhenthecommunicationbegins
§ Whenidle,thevoltageissettolowq Receivercannot reliablydetectfallingedgesq Senderandreceiverclocksaresynchronizedimperfectlyduetodrift
§ Whenaclockx is1,actualelapsedtimeisininterval[1-ε,1+ε]§ Sinceinthetimedmodelclocksareconsideredtobeperfect,
wecancapturethiserrorbyusingx<=1+ε insteadofx<=1,and1-ε <=xinsteadof1<=x
q Addressingthechallenges:§ Allmessagesstartwith1 andendwith00§ Processesusetiminginformationtotransmit0s
AudioControlProtocol
q ProtocoldevelopedbyPhilipstoreliablytransmitmessagesinpresenceofimperfectclocks
q Designlogicforreceivertomapmeasureddelaysbetweensuccessiveraisingedgestosequenceofbits
q Verification:Provethatmessagetransmissionisreliableforagivendriftrateε
q Optimization:Findthelargestskewvaluethattheprotocoltolerates
AudioControlSystem
SenderProcess
ReceiverProcess
ExecutionExample
Credits
NotesbasedonChapter7of
PrinciplesofCyber-PhysicalSystemsbyRajeevAlurMITPress,2015
