Time-triggered Model Research Articles

Modeling and proving hybrid programs with Event-B: An approach by generalization and instantiation

• A correct-by-construction approach to design and verify Cyber-Physical Systems. • A formal Event-B modeling of the event-time triggered template introduced by Kopetz. • Generic Event-B models for Cyber-Physical Systems. • A set of instantiation rules of the generic models using two different strategies. • Illustration on two frequently used CPS case studies: Stop Sign and Water Tank. Hybrid systems are one of the most common mathematical models for Cyber-Physical Systems (CPSs). They combine discrete dynamics represented by state machines or finite automata with continuous behaviors represented by differential equations. The measurement of continuous behaviors is performed by sensors. When these sensors have a continuous access to these measurements, this kind of model is called an Event-Triggered model. The properties of such models are easier to prove, while their implementation is difficult in practice. Therefore, it is preferable to introduce a more concrete kind of model, called Time-Triggered models, where the sensors take periodic measurements. Contrary to Event-Triggered models, Time-Triggered models are much easier to implement, but much more difficult to verify. Based on the differential refinement logic (dR L ), a dynamic logic for refinement relations on hybrid systems, it is possible to prove that a Time-Triggered model refines an Event-Triggered model. However, being done by hand, this proof is error-prone since no prover is available to support this logic. To overcome this limit, this paper introduces another correct-by-construction approach to prove this refinement, based on Event-B to take advantage of its well-defined refinement process and its support tools. We use the Rodin platform to develop Event-B models and its associated provers (automatic and interactive) to ensure their correctness. The obtained Event-B models are generic and can be then instantiated to model and prove any specific CPS. The proposed approach is illustrated by two frequently used CPS case studies.

Distributed graph queries over models@run.time for runtime monitoring of cyber-physical systems

Smart cyber-physical systems (CPSs) have complex interaction with their environment which is rarely known in advance, and they heavily depend on intelligent data processing carried out over a heterogeneous and distributed computation platform with resource-constrained devices to monitor, manage and control autonomous behavior. First, we propose a distributed runtime model to capture the operational state and the context information of a smart CPS using directed, typed and attributed graphs as high-level knowledge representation. The runtime model is distributed among the participating nodes, and it is consistently kept up to date in a continuously evolving environment by a time-triggered model management protocol. Our runtime models offer a (domain-specific) model query and manipulation interface over the reliable communication middleware of the Data Distribution Service (DDS) standard widely used in the CPS domain. Then, we propose to carry out distributed runtime monitoring by capturing critical properties of interest in the form of graph queries, and design a distributed graph query evaluation algorithm for evaluating such graph queries over the distributed runtime model. As the key innovation, our (1) distributed runtime model extends existing publish–subscribe middleware (like DDS) used in real-time CPS applications by enabling the dynamic creation and deletion of graph nodes (without compile time limits). Moreover, (2) our distributed query evaluation extends existing graph query techniques by enabling query evaluation in a real-time, resource-constrained environment while still providing scalable performance. Our approach is illustrated, and an initial scalability evaluation is carried out on the MoDeS3 CPS demonstrator and the open Train Benchmark for graph queries.

Network Topology Optimization Based on Time-Triggered DIMA

Distributed Integrated Modular Avionics System (DIMA) has attracted extensive attention in recent years, and the time-triggered Ethernet (TTE) supports the time triggering mechanism of DIMA system, so it has become the main protocol adopted by this system. In order to generate a network topology with lower architecture cost, load balancing and relatively short path, we studied the network topology optimization problem based on TTE. In view of the arbitrariness of TTE network topology, based on the analysis of time-triggered DIMA model, Floyd algorithm and simulated annealing algorithm are applied to realize topology optimization. The simulation results show that the proposed topology design and optimization method can not only effectively reduce network congestion, but also save network cost.

On design and formal verification of SNSP: a novel real-time communication protocol for safety-critical applications

The correct operation of time-triggered protocols highly depends on the well-synchronized clocks of the system. To maintain the global time, one strict constraint must be exerted on communication activities (e.g. temporal padding and sparse time base etc.), which not only increases complexity of the protocol design but also incurs a penalty in the network utilization. While for event-triggered protocols, it is difficult to achieve the real-time requirement and determinism. Therefore, it is necessary to explore the combination of the advantages of these two categories of protocol for applications in different scenarios. This paper proposes the Safe Node Sequence Protocol (SNSP), which is a variant of full time-triggered protocol TTP/C. In SNSP, a strict node sequence is defined and the order of communication events is established by this pre-configured order without binding to global time, so the protocol changes communication activities and error detection to an event-triggered model. Therefore, SNSP possesses the characteristics of both time-triggered and event-triggered model. Also, the potential impact of global time, such as byzantine clock failure, on the protocol is eliminated. At the same time, the formal verification of SNSP is much easier in the absence of global time. Moreover, we model the protocol and use formal checker SPIN to validate the basic fault-tolerant requirement of SNSP. The simulation results show the protocol enables better resource utilization and is more effective.

Performance research on time-triggered Ethernet based on network calculus

Abstract In the paper, we research on the performance of time-triggered Ethernet based on network calculus. Three kinds of data with different priority are imported to research on time-triggered Ethernet. Firstly, we adopt network calculus to obtain the theory-bound value of the network performance parameters. Then, we design and implement the time-triggered Ethernet clock synchronization, redundancy fault-tolerant, multi-data communication, service-performance model, node model, and network model successfully in two different topologies. Lastly, we compare the simulation value with the network calculus value and obtain the comparison result. The result shows that the performance parameters of time-triggered Ethernet well meet the theory value, and time-triggered Ethernet specification is feasible.

State-of-the-art Versus Time-triggered Object Tracking in Advanced Driver Assistance Systems

Most state-of-the-art driver assistance systems cannot guarantee that real-time images of object states are updated within a given time interval, because the object state observations are typically sampled by uncontrolled sensors and transmitted via an indeterministic bus system such as CAN. To overcome this shortcoming, a paradigm shift toward time-triggered advanced driver assistance systems based on a deterministic bus system, such as FlexRay, is under discussion. In order to prove the feasibility of this paradigm shift, this paper develops different models of a state-of-the-art and a time-triggered advanced driver assistance system based on multi-sensor object tracking and compares them with regard to their mean performance. The results show that while the state-of-the-art model is advantageous in scenarios with low process noise, it is outmatched by the time-triggered model in the case of high process noise, i.e., in complex situations with high dynamic.

A time-triggered object tracking subsystem for advanced driver assistance systems

Multi-sensor object tracking is an important feature for advanced driver assistance systems in future automobiles. Most state-of-the-art systems cannot guarantee deterministic processing of the sensor values due to unsynchronized sensing and processing units. To overcome this shortcoming we propose a paradigm shift towards a time-triggered system architecture providing a deterministic bus system, synchronized nodes, and a global time-base. The paradigm shift is supported by results of a simulation of different synchronization and scheduling approaches which suggest that although non-time-triggered approaches perform well in scenarios with low process noise, the time-triggered model becomes advantageous in potentially dangerous scenarios with high dynamics. In order to validate the results of the simulation for real life scenarios, we analyzed test drives derived from a testbed featuring a Volkswagen Touran being equipped with a laser scanner, a stereo camera system, a FlexRay communication system, an object tracking subsystem and a differential GPS system as reference.

Time-triggered buffers for event-based middleware systems

Application developers utilizing event-based middleware have sought to leverage domain-specific modeling for the advantages of intuitive specification, code synthesis, and support for design evolution. For legacy and cyber-physical systems, the use of event-based middleware may mean that changes in computational platform can result anomalous system behavior, due to the presence of implicit temporal dependencies. These anomalies are a function not of the component implementation, but of the model of computation employed for supporting system composition. In order to address these behavioral anomalies, the paper presents an approach where time-based blocks are inserted into the system to account for the temporal dependencies. An advantage of capturing the system composition in a domain-specific modeling language is the ability to efficiently refactor an application to include time-triggered, event-based schedulers. This paper describes how an existing event-based component topology can be modified to permit a time-triggered model of computation, with no changes to the existing component software. Further, the time-triggered components can be deployed alongside standard publish/subscribe methodologies. This strategy is beneficial to the maintenance of existing legacy systems upon upgrade, since the current operational mode could be maintained with minimal changes to the legacy software even under changes to the target platform which alter execution speed. These time-triggered layers are discussed in three permutations: fully triggered, start triggered, and release triggered. A discussion is provided regarding the limitations of each approach, and a brief example is given. The example shows how to apply these triggering approaches without the modification of existing components, but instead through the insertion of triggered buffers between legacy components.

Maximizing the stability radius of a set of systems under real-time scheduling constraints

We address the problem of synthesising real-time embedded controllers taking into account constraints deriving from the implementation platform, thus exploring the relation between the processor's time (or attention) devoted to different control tasks and the overall robustness of the resulting design. Assuming a time-triggered model of computation for tasks controlling a set of independent systems and a real-time preemptive scheduling policy managing a single CPU processor board, we deal with two problems: 1) deciding whether a performance specification can be attained on a candidate platform, 2) optimising performance on a platform. The considered performance metric is the minimum stability radius attained over the different feedback loops.

Transparent recovery from intermittent faults in time-triggered distributed systems

The time-triggered model, with tasks scheduled in static (off line) fashion, provides a high degree of timing predictability in safety-critical distributed systems. Such systems must also tolerate transient and intermittent failures which occur far more frequently than permanent ones. Software-based recovery methods using temporal redundancy, such as task reexecution and primary/backup, while incurring performance overhead, are cost-effective methods of handling these failures. We present a constructive approach to integrating runtime recovery policies in a time-triggered distributed system. Furthermore, the method provides transparent failure recovery in that a processor recovering from task failures does not disrupt the operation of other processors. Given a general task graph with precedence and timing constraints and a specific fault model, the proposed method constructs the corresponding fault-tolerant (FT) schedule with sufficient slack to accommodate recovery. We introduce the cluster-based failure recovery concept which determines the best placement of slack within the FT schedule so as to minimize the resulting time overhead. Contingency schedules, also generated offline, revise this FT schedule to mask task failures on individual processors while preserving precedence and timing constraints. We present simulation results which show that, for small-scale embedded systems having task graphs of moderate complexity, the proposed approach generates FT schedules which incur about 30-40 percent performance overhead when compared to corresponding non-fault-tolerant ones.

A comparison of emerging time-triggered protocols for automotive X-by-wire control networks

This paper compares the emerging time-triggered protocols that will find use in automotive control networks. At present there is no de facto standard in the automotive industry for in-vehicle networking based on the time-triggered model. As the industry is pushing towards incorporating X-by-wire technology (X standing for steer, brake, shift, etc.) for future cars, car manufacturers are working towards agreeing industry standards for X-by-wire control system applications. Currently there are four protocols based on the time-triggered paradigm which are competing for the X-by-wire automotive market. These protocols are TTCAN, TTP/C, Flex Ray and Byteflight.