Real-Time Systems. Design Principles for Distributed Embedded Applications. Herman Kopetz. Second Edition (811374), страница 93
Текст из файла (страница 93)
The final section of thisclosing chapter presents the results of a recent research project that puts the timetriggered architecture on a system-on-chip, where a time-triggered network on chipconnects the IP-cores, the components of the TTA. We hope that in the future someof these innovative ideas will be taken up by industry to provide a cost-effectiveexecution environment that supports the design of large understandable anddependable real-time systems.H.
Kopetz, Real-Time Systems: Design Principles for Distributed Embedded Applications,Real-Time Systems Series, DOI 10.1007/978-1-4419-8237-7_14,# Springer Science+Business Media, LLC 201132532614.114 The Time-Triggered ArchitectureHistory of the TTAThis short view back on the origins and the history of the time-triggeredarchitecture illustrates the close interdependence among basic research, technology research, and industrial innovation. The TTA experience has shown that anindustrial deployment of a radical innovation takes a long time – much more than10 years.
This is a reminder to funding agencies that a short-range project viewwill not produce radical innovations, but only marginal improvements of existingtechnology.14.1.1 The MARS ProjectAround 1980, the industrial development of real-time systems proceeded in anad hoc manner without a strong conceptual foundation. Systems were builtaccording to the intuitive feeling of skilled practitioners.
During an extensivecommissioning phase, experienced programmers finely tuned the diverse parameters of real-time systems such as task priorities and communication timeouts.Even minor changes and additions to the software were problematic, since theyrequired an expensive readjustment and retest of many system parameters. Sincesystem design was not based on solid theoretical foundations, there was alwaysa risk that the system will fail to meet the performance requirements ininfrequently occurring rare event scenarios.
As discussed in Chap. 1, thepredictable performance of a real-time system in a rare-event scenario is ofparamount importance in many applications (see also the example in Sect. 1.2.1on a power blackout).In 1979, the MARS (MAintainable Real-Time System) project started at theTechnical University of Berlin with the objective to develop a strong conceptualbasis, constructive methods and a new architectural framework for the systematicdesign and maintenance of distributed real-time systems [Kop85]. During theevaluation of the first MARS prototype around 1982, it became clear that morefundamental research, both at the conceptual and experimental level, was needed togain a better understanding of the following topics:llllDevelopment of a proper model of time and construction of a fault-tolerantglobal time base in a distributed real-time system.
Such a distributed real-timebase, without reliance on a single central clock, is at the core of dependable realtime systems.The notion of state, determinism and simultaneity and its role in the development of fault-tolerant systems.Real-time communication protocols that provide timeliness and error-detectioncoverage with minimal jitter.The effectiveness of mechanisms that establish the fail-silence of architecturalunits, such that cost-effective structures for fault masking can be built.14.1 History of the TTA327In 1983, the MARS project moved from the TU Berlin to the Vienna Universityof Technology, where the Austrian Ministry of Science and Technology and theEuropean Commission generously funded the continuation of the research. In thefollowing years the focus of the research shifted to investigate fundamental problems in the field of fault-tolerant clock synchronization and the design of real-timeprotocols.
A prototype VLSI chip, the CSU (clock synchronization unit), wasdeveloped to support the fault-tolerant clock synchronization in distributed systems[Kop87]. The CSU was used in a second academic prototype of MARS that wassubjected to extensive fault-injections experiments [Kar95,Arl03]. This academicprototype received some attention from the research and funding communities afterpublishing a video of a control application with this prototype, The Rolling Ball onMARS – the video can be downloaded from the web [Mar91].14.1.2 The Industrial TTA PrototypeIn the following years, the success of the academic prototype and the strongindustrial interest in building real-time systems constructively led to a number oftechnology-oriented research projects, funded mainly by the European Commission.
In these projects, the first industrial-strength prototype of the time-triggeredarchitecture, using the TTP protocol, was developed with strong participation of theautomotive industry. This industrial prototype was used in a car to implement afault-tolerant brake-by-wire system. The precise interface specifications of thecomponents, enabled by the availability of a global time base, were decisive forreducing the planned commissioning time of the prototype brake-by-wire system byan order of magnitude.
The success of this prototype gave industrial credibility tothe concepts of the time-triggered architecture. In 1998, TU-Vienna launched aspinoff company, TTTech (Time-Triggered TECHnology) to further develop andmarket the time-triggered technology. In the meantime, TTTech has been successful to deploy the time-triggered technology in a number of reputable industrialprojects, among them the Airbus A 380, the Boeing 787 (the Dreamliner), theAUDI A 8 premium car, and the NASA Orion program [McC09].14.1.3 The GENESYS ProjectRecognizing the strategic importance of embedded computing, the European Commission formed, together with industry, academia, and national governments, theEuropean technology platform ARTEMIS (Advanced Research and Technology forEMbedded Intelligence and Systems) in 2004.
It is a goal of ARTEMIS to developa cross-domain embedded system architecture, supported by design methods andtools, to significantly improve the functionality, dependability, and cost-effectivenessof embedded systems. In a first phase an expert working group consisting of32814 The Time-Triggered Architectureindustrial and academic partners captured the requirements and constraints ofsuch a cross-domain architecture [Art06]. The following GENESYS (GENericEmbedded SYStems) project, submitted by a consortium of 20 industrial andacademic partners coming from the different embedded system domains, wasfunded by the Framework Program of the European Commission to develop ablueprint for such an architecture that should consider the captured requirementsand should be applicable in the industrial domain as well as in the multimediadomain.
The architecture blueprint, developed during the GENESYS project, hasbeen strongly influenced by the concepts and experience with the time-triggeredarchitecture. The blueprint is published in a book freely available on the web[Obm09]. At the time of writing, there are ongoing ARTEMIS projects(INDEXYS and ACROSS) that implement the GENESYS architecture.14.2Architectural StyleThe architectural style describes the principles and structuring rules that characterize an architecture (see Sect. 4.5.1). A principle is an accepted statement aboutsome fundamental insight in a domain of discourse.
Principles establish the basis ofthe formulation of operational rules, i.e., the services of an architecture.14.2.1 Complexity ManagementAs outlined in Chap. 2, the management of the ever-increasing cognitive complexity –the antonym of simplicity – of embedded systems is a subject of steadily increasingconcern. The architectural style of the TTA is shaped to a significant degree by thisquest to control the growth of complexity of large embedded systems and to facilitatethe building of understandable systems.In Sect.
2.5, seven design principles that lead to understandable systems havebeen introduced. Each one of these seven principles is part of the architectural styleof the TTA. Of distinct importance for the TTA is principle seven, the principle ofconsistent time. Embedded computer systems must interact with the physicalenvironment that is ruled by the progression of physical time. The progression ofphysical time is thus a first-order citizen and not an add-on of the cyber-model thatis the basis of the computer control of the physical environment. The availability ofa fault-tolerant sparse global time base in every node of a large embedded system isat the foundation of the TTA. This global time base helps to simplify a design.
Inthe TTA, this global time base is used:lTo establish a consistent temporal order of all relevant events in cyber space andto solve the problem of simultaneity in a distributed computer system. Theconsistent temporal order is a prerequisite for introducing the notion of a consistent state of a distributed system. A consistent notion of state is needed when anew (repaired) component must be reintegrated into a running system.14.2 Architectural Stylellllllll329To build systems with deterministic behavior that are easy to understand, avoidthe occurrence of Heisenbugs, and support the straightforward implementationof fault-masking by redundancy.To monitor the temporal accuracy of real-time data and to ensure that a controlaction at the interface to the physical environment is based on data that istemporally accurate.To synchronize multimedia data streams that originate from different sources.To perform state estimation in order to extend the temporal accuracy of real-timedata to the instant of use in case the dynamics of the physical process outpace thecapabilities of the computer system.To precisely specify the temporal properties of interfaces such that a componentbased design-style can be followed.
The reuse of components is critically dependent on a precise interface specification that must include the temporal behavior.To establish conflict-free time-controlled communication channels for the transport of time-triggered (TT) messages. TT-messages have a short delay andminimal jitter and thus help to reduce the dead-time in distributed phase-alignedcontrol loops. This is of particular importance in smart grid automation.To detect the loss of a message within one time granule. A short error- detectionlatency is fundamental for any action taken to increase the availability of asystem.To avoid the replay of messages and to strengthen the services of securityprotocols.Considering the above listed services that can best be accomplished by using afault-tolerant sparse global time, it is our opinion that the availability of a consistentglobal time real-time base is an element of the solution space and not of the problemspace in the design of a real-time system.14.2.2 Component OrientationThe notion of a component introduced in Chap.
![](https://s.studizba.com/z.php?f=/templates/si/i/noavatar.png&w=100&h=100&t=1"){kind=avatar}
