Real-Time Systems. Design Principles for Distributed Embedded Applications. Herman Kopetz. Second Edition (811374), страница 39
Текст из файла (страница 39)
5.9, where the pressure in a vessel is monitored bya distributed system. The alarm-monitoring node (node A) receives a periodic messageMDA from the pressure-sensor node (node D). If the pressure changes abruptly for noapparent reason, the alarm-monitoring node A should raise an alarm.
Suppose that theoperator node B sends a message MBC to node C to open the control valve in order torelease the pressure. At the same time, the operator node B sends a message MBA to node A,to inform node A about the opening of the valve, so that node A will not raise an alarm dueto the anticipated drop in pressure.alarmmonitorACcontrol valveMDAcomm.systemMBAoperatorBMBCDFig. 5.9 Hidden channel in the controlled objectpressuresensorhiddenchannelvessel5.5 Permanence and Idempotency123dmaxof MBAoperator Bcontrol Cvalve54alarm Amonitor61MBA1interval ofincorrectalarmMBCMDA2pressuresensor Dsending ofsending of2arrival of3sending of4arrival of5arrival of6 permanence ofMBCMBAMBCMDAMDAMBAMDA3real-timeFig.
5.10 Permanence of messagesAssume that the communication system has a minimum protocol execution timedmin and a maximum protocol execution time dmax, i.e., a jitter djit ¼ dmax dmin.Then the situation depicted in Fig. 5.10 could occur. In this figure, the messageMDA from the pressure sensor node arrives at the alarm monitoring node A beforethe arrival of the message MBA from the operator (that informs the alarm monitoring node A of the anticipated drop in pressure). The transmission delay of thehidden channel in the controlled object between the opening of the valve and thechanging of the pressure sensor is shorter than the maximum protocol executiontime. Thus, to avoid raising any false alarms, the alarm-monitoring node shoulddelay any action until the alarm message MDA has become permanent.Action Delay.
The time interval between the start of transmission of a givenmessage and the point in time when this message becomes permanent at thereceiver, is called the action delay. The receiver must delay any action on themessage until after the action delay has passed to avoid an incorrect behavior.Irrevocable Action. An irrevocable action is an action that cannot be undone.An irrevocable action causes a lasting effect in the environment.
An example of anirrevocable action is the activation of the firing mechanism on a firearm. It is particularlyimportant that an irrevocable action is triggered only after the action delay has passed.Example: The pilot of a fighter aircraft is instructed to eject from the airplane (irrevocableaction) immediately after a critical alarm is raised.
Consider the case where the alarm hasbeen raised by a message that has not become permanent yet (e.g., event 4 in Fig. 5.10). Inthis example, the hidden channel, which was not considered in the design, is the cause forthe loss of the aircraft.5.5.2Duration of the Action DelayThe duration of the action delay depends on the jitter of the communication systemand the temporal awareness of the receiver (see also Table 7.2).
Let us assume theposition of the omniscient outside observer who can see all significant events.1245 Temporal RelationsSystems with a Global Time. In a system with global time, the send time tsend of themessage, measured by the clock of the sender, can be part of the message, and canbe interpreted by the receiver. If the receiver knows that the maximum delay of thecommunication system is dmax, then, the receiver can infer that the message willbecome permanent at tpermanent ¼ tsend + dmax + 2g, where g is the granularity ofthe global time-base (see Sect. 3.2.4 to find out where the 2g comes from).Systems without a Global Time.
In a system without global time, the receiver doesnot know when the message has been sent. To be on the safe side, the receiver mustwait dmax dmin time units after the arrival of the message, even if the message hasalready been dmax units in transit. In the worst case, as seen by the outside observer,the receiver thus has to wait for an amount of timetpermanent ¼ tsend þ 2dmax dmin þ glbefore the message can be used safely (where gl is the granularity of the local timebase). Since in an event-triggered communication system (dmax dmin + gl ) isnormally much larger than 2g, where g is the granularity of the global time, asystem without a global time-base is significantly slower than a system with aglobal time-base.
(In this case, the implementation of a time-triggered communication system is not possible, since we operate under the assumption that no globaltime base is available).5.5.3Accuracy Interval Versus Action DelayAn RT image may only be used if the message that transported the image ispermanent, and the image is temporally accurate. In a system without stateestimation, both conditions can only be satisfied in the time window (tpermanent,tobs + dacc). The temporal accuracy dacc depends on the dynamics of the controlapplication while (tpermanent tobs) is an implementation-specific duration. If animplementation cannot meet the temporal requirements of the application, then,state estimation may be the only alternative left in order to design a correctreal-time system.5.5.4IdempotencyIdempotency is the relationship among the members of a set of replicated messagesarriving at the same receiver.
A set of replicated messages is idempotent if the effectof receiving more than one copy of a message is the same as receiving only a singlecopy. If messages are idempotent, the implementation of fault tolerance by meansof replicating messages is simplified. No matter whether the receiver receives oneor more of the replicated messages, the result is always the same.5.6 Determinism125Example: Let us assume that we have a distributed system without synchronized clocks.In such a system, only untimed observations can be exchanged among nodes, and the timeof arrival of an observation message is taken as the time of observation. Assume a nodeobserves an RT entity, e.g., a valve, and reports this observation to other nodes in thesystem.
The receivers use this information to construct an updated version of the local RTimage of the RT entity in their RT objects. A state message might contain the absolute valueposition of valve at 45 , and will replace the old version of the image. An event messagemight contain the relative value valve has moved by 5 .
The contents of this event messageare added to the previous contents of the state variable in the RT object to arrive at anupdated version of the RT image. While the state message is idempotent, the event messageis not. A loss or duplication of the event message results in a permanent error of theRT image.5.6DeterminismDeterminism is a property of a computation that makes it possible to predict thefuture result of a computation, given that the initial state and all timed inputs areknown. A given computation is either determinate or not determinate.Example: Consider the case of a fault-tolerant brake-by-wire system in a car.
Afteragreement on the sensor inputs (e.g., brake pedal position, speed of the car, etc.), threeindependent but synchronized channels process identical inputs. The three outputs arepresented to four smart voting actuators (Figs. 9.8 and 9.9), one at the brake-cylinder ofeach one of the four wheels of the car. After the earliest possible arrival of a correct outputmessage at a voting actuator, an acceptance window is opened. The duration of theacceptance window is determined by the differences in the execution speeds and the jitterof the communication system of the three channels, provided they operate correctly.
Everycorrect deterministic channel will deliver the same result before the end of the acceptancewindow. If one channel fails, one of the three arriving result messages will contain a valuethat is different from the other two (value failure) or only two (identical) result messages willarrive during the acceptance window (timing failure). By selecting the majority result at theend of the acceptance window, the voter will mask a failure of any one of the three channels.The end point of the acceptance window is the significant event when the voting actions canbe performed and the result can be transmitted to the environment.
If the computations andthe communication system have a large jitter, then this end point of the acceptance windowis far in the future and the responsiveness of the computer system is reduced.5.6.1Definition of DeterminismIn Sect. 2.5 the principle of causality has been introduced. Causality refers to theunidirectional relationship that connects an effect to a cause [Bun08]. If thisrelationship is one of logical and temporal entailment, we speak of determinism,which we define as follows: A physical system behaves deterministically if, given aninitial state at instant t and a set of future timed inputs, then the future states and thevalues and times of future outputs are entailed. The words time and instants refer tothe progression of dense (physical) time.
![](https://s.studizba.com/z.php?f=/templates/si/i/noavatar.png&w=100&h=100&t=1"){kind=avatar}
