Real-Time Systems. Design Principles for Distributed Embedded Applications. Herman Kopetz. Second Edition (811374), страница 65
Текст из файла (страница 65)
The worst-caseexecution time of a complex task in a node is therefore a global issue because it9.3 The Dual Role of Time221depends directly on the progress of the other tasks within the node or within theenvironment of the node.The WCET of a C-task cannot be determined independently of the other tasks inthe node. It can depend on the occurrence of an event in the node environment, asseen from the example of waiting for an input message. The timing analysis is not alocal issue of a single task anymore; it becomes a global system issue. It is impossible to give an upper bound for the WCET of a C-task by analyzing the task code only.The application programming interface of a C-task is more complex than that ofS-tasks. In addition to the three data structures already introduced, i.e., the inputdata structure, the output data structure, and the g-state data structure, the globaldata structures that are accessed at the blocking point must be defined.
Systemcalls must be provided that handle a WAIT-FOR-EVENT and a SIGNAL-EVENT.After the execution of the WAIT-FOR-EVENT, the task enters the blocked stateand waits in the queue. The event occurrence releases the task from the blockedstate. It must be monitored by a time-out task to avoid permanent blocking.The time-out task must be deactivated in case the awaited event occurs within thetime-out period, otherwise the blocked task must be killed.9.3The Dual Role of TimeA real-time image must be temporally accurate at the instant of use (see Sect. 5.4).In a distributed system, the temporal accuracy can only be checked if the durationbetween the instant of observation of a RT-entity, observed by the sensor node, andthe instant of use, determined by the actuator node, can be measured.
This requiresthe availability of a global time base of proper precision among all involved nodes.If fault tolerance is required, two independent self-checking channels must beprovided to link an end system to the fault-tolerant communication infrastructure.The clock synchronization messages must be provided on both channels in order totolerate the loss of any one of the channels.Every I/O signal has two dimensions, the value dimension and the temporaldimension. The value dimension relates to the value of the I/O signal.
The temporaldimension relates to the instant when the value was captured from the environmentor released to the environment.Example: In the context of hardware design, the value dimension is concerned with thecontents of a register and the temporal dimension is concerned with the trigger signal, i.e.,the control signal that determines when the contents of an I/O register are transferred toanother subsystem.An event that happens in the environment of a real-time computer can be lookedupon from two different timing perspectives:1.
It defines the instant of a value change of an RT entity in the domain of time. Theprecise knowledge of this instant is an important input for the later analysis ofthe consequences of the event (time as data).2229 Real-Time Operating Systems2. It may demand immediate action by the computer system to react as soon aspossible to this event (time as control).It is important to distinguish these two different roles of time. In the majority ofsituations, it is sufficient to treat time as data and only in the minority of cases, animmediate action of a computer system is required (time as control).Example: Consider a computer system that must measure the time interval between startand finish during a downhill skiing competition. In this application it is sufficient to treattime as data and to record the precise time of occurrence of the start event and finish event.The messages that contain these two instants are transported to another computer that latercalculates the difference.
The situation of a train-control system that recognizes a red alarmsignal, meaning the train should stop immediately, is different. Here, an immediate action isrequired as a consequence of the event occurrence. The occurrence of the event mustinitiate a control action without delay.9.3.1Time as DataThe implementation of time as data is simple if a global time-base of knownprecision is available in the distributed system.
The observing component mustinclude the timestamp of event occurrence in the observation message. We call amessage that contains the timestamp of an event a timed message. The timedmessage can be processed at a later time and does not require any dynamic datadependent modification of the temporal control structure. Alternatively, if a fieldbus communication protocol with a known constant delay is used, the time ofmessage arrival, corrected by this known delay, can be used to establish the sendtime of the message.The same technique of timed messages can be used on the output side. If anoutput signal must be invoked on the environment at a precise instant with aprecision much finer than the jitter of the output messages, a timed output messagecan be sent to the node controlling the actuator.
This node interprets the time in themessage and acts on the environment precisely at the intended instant.In a TT system that exchanges messages at a priori known instants with a fixedperiod between messages, the representation of time in a timed message can takeadvantage of this a priori information. The time value can be coded in fractions ofthe period of the message, thus increasing the data efficiency. For example, if anobservation message is exchanged every 100 ms, a 7 bit time representation of timerelative to the start of the period will identify the event with a granularity of betterthan 1 ms.
Such a 7-bit representation of time, along with the additional bit todenote the event occurrence, can be packed into a single byte. Such a compactrepresentation of the instant of event occurrence is very useful in alarm monitoringsystems, where thousands of alarms are periodically queried by a cyclic trigger task.The cycle of the trigger task determines the maximum delay of an alarm report(time as control), while the resolution of the timestamp informs about the exactoccurrence of the alarm event (time as data) in the last cycle.9.4 Inter-task Interactions223Example: In a single periodic TT-Ethernet message with a data field of 1,000 bytes andcycle time of 10 ms, 1,000 alarms can be encoded in a single message with a worst-casereaction time of 10 ms and an alarm resolution time of better than 100 ms.
In a 100 Mbit/s Ethernet system, these periodic alarm messages will generate a (background) system loadof less than 1% of the network capacity. Such an alarm reporting system will not cause anyincrease in load if all 1,000 alarms occur at the same instant. If, in an event-triggeredsystem, a 100 byte Ethernet message is sent whenever an alarm occurs, then the peak-loadof 1,000 alarm messages will generate a load of 10% of the network capacity and a worstcase reaction time of 100 ms.9.3.2Time as ControlTime as control is more difficult to handle than time as data, because it maysometimes require a dynamic data-dependent modification of the temporal controlstructure.
It is prudent to scrutinize the application requirements carefully toidentify those cases where such a dynamic rescheduling of the tasks is absolutelynecessary.If an event requires immediate action, the worst-case delay of the messagetransmission is a critical parameter. In an event-triggered protocol such as CAN,the message priorities are used to resolve access conflicts to the common bus thatresult from nearly simultaneous events. The worst-case delay of a particularmessage can be calculated by taking the peak-load activation pattern of the messagesystem into account [Tin95].Example: The prompt reaction to an emergency shutdown request requires time to act ascontrol. Assume that the emergency message is the highest priority message in a CANsystem. In a CAN system, the worst-case delay of the highest priority message is boundedby the transmission duration of the longest message (which is about 100 bits), because amessage transmission cannot be preempted.9.4Inter-task InteractionsInter-task interactions are needed to exchange data among concurrently executingtasks inside a component such that progress towards the common goal can beachieved.
There are two principal means to exchange data among a set of concurrently executing tasks: (1) by the exchange of messages and (2) by providing ashared region of data that can be accessed by more than one task.Within a component, shared data structures are widely used since this form ofinter-task interaction can be implemented efficiently in a single component wherethe tasks cooperate. However, care must be taken that the integrity of data that isread or written concurrently by more than one task is maintained.
Figure 9.3 depictsthe problem. Two tasks, T1 and T2 access the same critical region of data. We call2249 Real-Time Operating Systemsnon-critical sections of tasks T1 and T2criticalsection oftask T1progressof task T1time interval where a conflict can occurcritical resource(critical region of data)criticalsection oftask T2progressof task T2Fig. 9.3 Critical task sections and critical data regionsthe interval during the program execution during which the critical region of data isaccessed the critical section of a task. If the critical sections of tasks overlap, badthings may occur. If the shared data is read by one task while it is modified byanother task, then the reader may read inconsistent data. If the critical sections oftwo or more writing tasks overlap, the data may be corrupted.The following three techniques can be applied to solve the problem:1.
![](https://s.studizba.com/z.php?f=/templates/si/i/noavatar.png&w=100&h=100&t=1"){kind=avatar}
