Real-Time Systems. Design Principles for Distributed Embedded Applications. Herman Kopetz. Second Edition (Real-Time Systems. Design Principles for Distributed Embedded Applications. Herman Kopetz. Second Edition.pdf), страница 7

Since the state of a controlled object in the controlled cluster is afunction of real time, a given RT image is only temporally accurate for a limitedtime interval. The length of this time interval depends on the dynamics of thecontrolled object. If the state of the controlled object changes very quickly, thecorresponding RT image has a very short accuracy interval.Example: Consider the example of Fig. 1.2, where a car enters an intersection controlledby a traffic light.

How long is the observation the traffic light is green temporally accurate?If the information the traffic light is green is used outside its accuracy interval, i.e., a carenters the intersection after the traffic light has switched to red, an accident may occur. Inthis example, an upper bound for the accuracy interval is given by the duration of theyellow phase of the traffic light.The set of all temporally accurate real-time images of the controlled cluster is calledthe real-time database. The real-time database must be updated whenever an RTentity changes its value. These updates can be performed periodically, triggered by theprogression of the real-time clock by a fixed period (time-triggered (T T) observation),or immediately after a change of state, which constitutes an event, occurs in the RTentity (event-triggered (ET) observation).

A more detailed analysis of time-triggeredand event-triggered observations will be presented in Chaps. 4 and 5.Signal Conditioning. A physical sensor, e.g., a thermocouple, produces a raw dataelement (e.g., a voltage). Often, a sequence of raw data elements is collected andan averaging algorithm is applied to reduce the measurement error. In the next stepthe raw data must be calibrated and transformed to standard measurement units.how long is the observation:"the traffic light is green"temporally accurate?Fig.

1.2 Temporal accuracyof the traffic light information1.2 Functional Requirements5The term signal conditioning is used to refer to all the processing steps that arenecessary to obtain meaningful measured data of an RT entity from the raw sensordata. After signal conditioning, the measured data must be checked for plausibilityand related to other measured data to detect a possible fault of the sensor. A dataelement that is judged to be a correct RT image of the corresponding RT entity iscalled an agreed data element.Alarm Monitoring. An important function of a real-time computer system is thecontinuous monitoring of the RT entities to detect abnormal process behaviors.Example: The rupture of a pipe, a primary event, in a chemical plant will cause many RTentities (diverse pressures, temperatures, liquid levels) to deviate from their normaloperating ranges, and to cross some preset alarm limits, thereby generating a set ofcorrelated alarms, which is called an alarm shower.The real-time computer system must detect and display these alarms and must assistthe operator in identifying a primary event that was the initial cause of these alarms.For this purpose, alarms that are observed must be logged in a special alarm logwith the exact instant when the alarm occurred.

The exact temporal order of thealarms is helpful in identifying the secondary alarms, i.e., all alarms that can bea causal consequence of the primary event. In complex industrial plants, sophisticated knowledge-based systems are used to assist the operator in the alarmanalysis.Example: In the final report on the August 14, 2003 power blackout in the United Statesand Canada we find on [Tas03, p. 162], the following statement: A valuable lesson from theAugust 14 blackout is the importance of having time-synchronized system data recorders.The Task Force’s investigators labored over thousands of data items to determine thesequence of events much like putting together small pieces of a very large puzzle. Thatprocess would have been significantly faster and easier if there had been wider use ofsynchronized data recording devices.A situation that occurs infrequently but is of utmost concern when it does occur iscalled a rare-event situation.

The validation of the performance of a real-timecomputer system in a rare event situation is a challenging task and requires modelsof the physical environment (see Sect. 11.3.1).Example: The sole purpose of a nuclear power plant monitoring and shutdown system isreliable performance in a peak-load alarm situation (a rare event). Hopefully, this rareevent will never occur during the operational life of the plant.1.2.2Direct Digital ControlMany real-time computer systems must calculate the actuating variables for theactuators in order to control the controlled object directly (direct digital control –DDC), i.e., without any underlying conventional control system.Control applications are highly regular, consisting of an (infinite) sequenceof control cycles, each one starting with sampling (observing) of the RT entities,61 The Real-Time Environmentfollowed by the execution of the control algorithm to calculate a new actuatingvariable, and subsequently by the output of the actuating variable to the actuator.The design of a proper control algorithm that achieves the desired control objective, and compensates for the random disturbances that perturb the controlledobject, is the topic of the field of control engineering.

In the next section ontemporal requirements, some basic notions of control engineering will beintroduced.1.2.3Man–Machine InteractionA real-time computer system must inform the operator of the current state of thecontrolled object, and must assist the operator in controlling the machine or plantobject.

This is accomplished via the man–machine interface, a critical subsystem ofmajor importance. Many severe computer-related accidents in safety-critical realtime systems have been traced to mistakes made at the man–machine interface[Lev95].Example: Mode confusion at the man–machine interface of an aircraft has been identifiedto be the cause of major aircraft accidents [Deg95].Most process-control applications contain, as part of the man–machine interface, anextensive data logging and data reporting subsystem that is designed according tothe demands of the particular industry.Example: In some countries, the pharmaceutical industry is required by law to record andstore all relevant process parameters of every production batch in an archival storage inorder that the process conditions prevailing at the time of a production run can bereexamined in case a defective product is identified on the market at a later time.Man–machine interfacing has become such an important issue in the design ofcomputer-based systems that a number of courses dealing with this topic have beendeveloped.

In the context of this book, we will introduce an abstract man–machineinterface in Sect. 4.5.2, but we will not cover its design in detail. The interestedreader is referred to standard textbooks on user interface design.1.31.3.1Temporal RequirementsWhere Do Temporal Requirements Come from?The most stringent temporal demands for real-time systems have their origin in therequirements of control loops, e.g., in the control of a fast process such as anautomotive engine. The temporal requirements at the man–machine interface are, in1.3 Temporal Requirements7comparison, less stringent because the human perception delay, in the range of50–100 ms, is orders of magnitude larger than the latency requirements of fastcontrol loops.A Simple Control Loop. Consider the simple control loop depicted in Fig.

1.3consisting of a vessel with a liquid, a heat exchanger connected to a steam pipe,and a controlling computer system. The objective of the computer system is tocontrol the valve (control variable) determining the flow of steam through the heatexchanger such that the temperature of the liquid in the vessel remains within asmall range around the set point selected by the operator.The focus of the following discussion is on the temporal properties of thissimple control loop consisting of a controlled object and a controlling computersystem.The Controlled Object.

Assume that the system of Fig. 1.3 is in equilibrium.Whenever the steam flow is increased by a step function, the temperature of theliquid in the vessel will change according to Fig. 1.4 until a new equilibrium isreached. This response function of the temperature in the vessel depends on theenvironmental conditions, e.g., the amount of liquid in the vessel, and the flow ofsteam through the heat exchanger, i.e., on the dynamics of the controlled object.(In the following section, we will use d to denote a duration and t to denote aninstant, i.e., a point in time).set point selectedby an operatorcontrolling computer systemtemperaturesensorcontrol valvefor steam flowflow sensorsteam pipeFcontrolledobjecttemp.Fig. 1.3 A simple control looptemperature of liquid90%10%onFig. 1.4 Delay and rise timeof the step responseoffdobjectreal-timedrisesteam flow81 The Real-Time EnvironmentThere are two important temporal parameters characterizing this elementarystep response function, the object delay d object (sometimes called the lag timeor lag) after which the measured variable temperature begins to rise (caused bythe initial inertia of the process and the instrumentation, called the process lag)and the rise time d rise of the temperature until the new equilibrium state hasbeen reached.

To determine the object delay d object and the rise time d rise from agiven experimentally recorded shape of the step-response function, one findsthe two points in time where the response function has reached 10% and 90%of the difference between the two stationary equilibrium values.

These two pointsare connected by a straight line (Fig. 1.4). The significant points in time thatcharacterize the object delay d object and the rise time d rise of the step responsefunction are constructed by finding the intersection of this straight line withthe two horizontal lines that denote the two liquid temperatures that correspondto the stable equilibrium states before and after the application of the stepfunction.Controlling Computer System. The controlling computer system must sample thetemperature of the vessel periodically to detect any deviation between the intendedvalue and the actual value of the controlled variable temperature. The constantduration between two sampling points is called the sampling period d sample and thereciprocal 1/d sample is the sampling frequency, f sample.