http://cadena.projects.cis.ksu.edu santos laboratory, kansas state university, usa cadena: analyzing...

http://cadena.projects.cis.ksu.edu

SAnToS Laboratory, Kansas State University, USA

Cadena: Analyzing Component-based Embedded System Designs

Matthew DwyerJohn Hatcliff

SupportUS Army Research Office (ARO)US National Science Foundation (NSF)US Department of Defense Advanced Research Projects Agency (DARPA)

Rockwell-Collins ATCBoeingLockheed Martin IBM

Xianghua Deng

http://bogor.projects.cis.ksu.edu

Matt Hoosier

Distributed Real-time Embedded Systems

Mission-control software for Boeing military aircraft

Boeing’s Bold Stroke Avionics Middleware (PRISM)

…built on top of ACE/TAO RT CORBA

Software Communications Architecture (SCA) of the Joint Tactical Radio System (JTRS)

CORBA-based middleware with radio-specific services

Multiple vendors (Rockwell-Collins), government branches

Fire-effects cell control software for HIMARS/MLRS

Component-oriented redesign of legacy Ada system

Lockheed Martin (Eagan, Dallas)

Component-based Design

Cadena development environment allows model-based development of applications using the CORBA Component

Model (CCM)

Component DevelopmentComponent

Development

CCMComponent

Input event port

Outputevent port

EventPorts

Require aninterface

Provide an interface

Interface Ports

Control-Push Data-Pull

Component A computes some data that is to be read by one or more components Bi

Typical situation

Run-time ActionsA publishes a dataAvailable event

Bi call the getData() method of A to fetch the data

dataAvailable

getData()

Depending on current state, component may not fetch data

Control-Push Data-Pull Structure

1. Logical GPS component receives a periodic event indicating that it should read the physical GPS device.2. Logical GPS publishes DATA_AVAILABLE event

3. Airframe component fetches GPS data by calling GPS GetData method4. Airframe updates its position data and publishes DATA_AVAILABLE event5. NavDisplay component fetches AirFrame data by calling AirFrame GetData method6. NavDisplay updates the physical display

Output

Example System

Example SystemBasic components seen earlier

Basic components seen earlier

Example SystemNavigation Steering Subsystem

Navigation Steering Subsystem

Example System

Tactical Steering Subsystem

Example System

Display Control

on/off

Component IDL

CORBA 3CCM IDLModalSP Components

Component IDL

output data port (facet)

Component IDL

input data port (receptacle)

Component IDL

output event port (event source)

Component IDL

input event port (event sink)

Component IDL

mode attributemode attribute

Component Behavior

component BMModal { uses ReadData dataIn; consumes DataAvailable inDataAvailable; publishes DataAvailable outDataAvailable; provides ReadData dataOut; provides ChangeMode modeChange;

enum Modes (enabled,disabled); Modes m;

behavior { handles dataInReady (DataAvailable e) { case m of enabled { dataOut::data <- dataIn.getData(); push {} dataOutReady; } disabled {} } …

mode declaration using CORBA IDL

Component Behavior

behavior for events on dataInReady port

Component Behavior

behavior mode casesbehavior mode cases

Component Behavior

data flow specification

Component Behavior

behavior { handles dataInReady (DataAvailable e) { case m of enabled { dataOut::data <- dataIn.getData(); push {} dataOutReady; } disabled {} } … publish eventpublish event

Component-based Design

Cadena development environment allows model-based development of applications using the CORBA Component

Model (CCM)

Component IntegrationComponent Integration…up to 1000+ components

RT Middleware-based Implementation

Real Time Event Channel (from ACE/TAO RT CORBA)

CORBALevelCORBALevel

Event channel

Event channelAbstractly…Abstractly…

produceproduce

consumeconsume

Event channel

…Thread Pool

60Hz 20Hz 5Hz 1Hz

… … ……

correlation & filtering

proxy consumer holds list of consumer

references

proxy consumer holds list of consumer

references

consumer refs

dispatch queues for each rate

Threads run call-backs associated with event consumer ports

consumeconsume

produceproduce

In reality…In reality…

Domain-Specific ModelingBogor -- Extensible Modeling Language

Core Modeling Language

Threads,Objects,Methods,Exceptions, etc.

New Bogor primitives corresponding toEvent Channel API

publish()

subscribe()

push()

connect()

disconnect()…

Event publish() {

Bogor API calls…}

Java implementation of new primitives inside model-checker

Event connect() {

Bogor API calls…}

Bogor Modeling Extensions

Bogor extensions for representing event-channel queue data structures

…Thread Pool

60Hz 20Hz 5Hz 1Hz

… … ……

Bogor Modeling Extensions

Bogor extensions for representing CCM component API

…Thread Pool

60Hz 20Hz 5Hz 1Hz

… … ……

Bogor Algorithm Customization

Bogor default modules are unplugged and replaced with state representation, scheduling and search strategies customized to the Bold Stroke domain

BogorModulesBogorModules

IActionTaker

IExpEvaluator

IValueFactory

IBacktrackIF

ITransformer

ISchedulingStg

ISearcher

IStateFactory

IStateMgr

PrioritySchedS

PartialStMgr

LTSearcher

Bogor Customized To CadenaBogor -- Extensible Modeling Language

Core Modeling Language

Threads,Objects,Methods,Exceptions, etc.

+Extensions

Queues

Tables

RT CORBAEvent Service

API Abstraction

Domain-specific Abstractions

Event Service

SchedulingLazy Time

SearchPartial State

Representation

Bogor -- Customizable Checking Engine ModulesSchedulingStrategy

State-spaceExploration

StateRepresentation

Core Checker Modules Customized Checker Modules

…existing modules…

Assessments of Previous WorkCadena dSPIN

(ICSE’02)Bogor

(FMCO’02)

Boeing ModalSP 3 rate groups 8 components 125 events per hp

1.4 M states58 sec130 MB

9.1 K states8.59 sec1.61 MB

Boeing MediumSP 2 rate groups 50 components 820 events per hp

740 K states3 min21.5 MB

X want to check realistically-sized model

aggressive reductions are essential, but not enough

Possible Solutions

pro: don’t store any states cons: time required is too great because of high

degree of non-determinisms due to abstract nature of design models

Stateless search (Godefroid ’97)

keep an a priori bounded cache of states; discard to make room for others if the cache is full

pro: minimum memory requirement is space needed to store states in longest DFS stack

cons: selection of cache size

State caching (Godefroid ’93)

Key Observation

use the structure of periodic systems to decompose the state space search

Leverage patterns of periodic computation

Leveraging Periodic Structure

break the search into several regions divide the problem into smaller problems

Periodic Tasks

Hyper-period

“Macro-state” S1

Basic Idea

Hyper-period

Leveraging Periodic Structure

Common values in macro-state: dispatch queues empty, threads idle, correlators are at initial state

Different values in macro-state: component/system mode values are different

Periodic Tasks

Hyper-period

“Macro-state” S1

Macro-state Structure

Hyper-period

Quasi-Cyclic StructureTrace Structure

Macro-states

S1These successive macro-states may be different (acyclic)…

…but a portion of each of the states is repeating…

equal …and so we say that the state-space is quasi-cyclic.

Quasi-Cyclic Structure

Many applications with control-loops have this property GUIs, web-servers,

… Use a predicate Φ

to characterize the repeating portion

Trace Structure Macro-states

Generalizing

Φ-conforming

Φ-statesΦ-states

Φ-Bounded SearchTrace Structure Global State Store

Region State Store

Place initial Φ-state in global store, and begin state exploration.

Region State Store

Place states in region

state store until Φ-state is encountered.

Region State Store

Place Φ-state into global store

Region State Store

Flush region state store

Region State Store

Φ3Φ2

Region State Store

Φ3Φ2

Non-determinism in region generated two Φ-states. Put these into global state store.

, Φ2 , Φ3

Region State Store

Φ3Φ2

, Φ2 , Φ3

Flush region state store

Region State Store

Φ3Φ2

, Φ2 , Φ3

Explore these regions until Φ states encountered

Φ5Φ4

Region State Store

Φ3Φ2

, Φ2 , Φ3

Φ5Φ4

Φ4 , Φ5

(l3,0,5)

(l1,0,0)

(l3,0,0)

(l2,0,0)

(l3,0,2)

(l5,2,2)

(l4,2,0)

(l2,2,2)

(l3,0,3)

(l5,3,3)

(l4,3,0)

(l2,3,3)

(l3,0,4)

(l2,2,4)

(l5,2,4)

(l4,2,2)

(l2,3,5)

(l5,3,5)

(l4,3,2) (l4,2,3)

(l5,2,5)

(l2,2,5)

(l4,3,3)

(l5,3,6)

(end,3,6)

(l5,2,6)

(l4,2,4)

(end,2,6)

(l5,3,7)

(l4,3,4)

(end,3,7)

(l5,2,7)

(l4,2,5)

(end,2,7)

(l5,3,8)

(l4,3,5)

(end,3,8)

l1: y = 0; goto l2;l2: x = 0; goto l3;l3: true -> x = 2; goto l4; true -> x = 3; goto l4;l4: y = y + x; goto l5;l5: y > 5 -> skip; goto end; y <= 5 -> skip; goto l2;end:

A Quasi-cyclic System: Example

(l3,0,5)

(l1,0,0)

(l3,0,0)

(l2,0,0)

(l3,0,2)

(l5,2,2)

(l4,2,0)

(l2,2,2)

(l3,0,3)

(l5,3,3)

(l4,3,0)

(l2,3,3)

(l3,0,4)

(l2,2,4)

(l5,2,4)

(l4,2,2)

(l2,3,5)

(l5,3,5)

(l4,3,2) (l4,2,3)

(l5,2,5)

(l2,2,5)

(l4,3,3)

(l5,3,6)

(end,3,6)

(l5,2,6)

(l4,2,4)

(end,2,6)

(l5,3,7)

(l4,3,4)

(end,3,7)

(l5,2,7)

(l4,2,5)

(end,2,7)

(l5,3,8)

(l4,3,5)

(end,3,8)

A Quasi-cyclic System: Example

Quasi-cyclic Search: Example

(l1,0,0) Φ: pc = l3 Æ x = 0

Global States = {}

Queue = {}

(l1,0,0)

(l3,0,0)

(l2,0,0)

Φ: pc = l3 Æ x = 0

Global States = {}

Queue = {0}

Queue = {}

(l1,0,0)

(l3,0,0)

(l2,0,0)

(l3,0,2)

(l5,2,2)

(l4,2,0)

(l2,2,2)

(l3,0,3)

(l5,3,3)

(l4,3,0)

(l2,3,3)

Φ: pc = l3 Æ x = 0

Global States = {0}

Queue = {2}Queue = {2,3}

(l1,0,0)

(l3,0,0)

(l2,0,0)

(l3,0,2)

(l5,2,2)

(l4,2,0)

(l2,2,2)

(l3,0,3)

(l5,3,3)

(l4,3,0)

(l2,3,3)

(l3,0,4)

(l2,2,4)

(l5,2,4)

(l4,2,2)

(l3,0,5)

(l2,3,5)

(l5,3,5)

(l4,3,2) l1: y = 0; goto l2;l2: x = 0; goto l3;l3: true -> x = 2; goto l4; true -> x = 3; goto l4;l4: y = y + x; goto l5;l5: y > 5 -> skip; goto end; y <= 5 -> skip; goto l2;end:

Φ: pc = l3 Æ x = 0

Global States = {0,2}

Queue = {3}Queue = {3,4}Queue = {3,4,5}

(l1,0,0)

(l3,0,0)

(l2,0,0)

(l3,0,2)

(l5,2,2)

(l4,2,0)

(l2,2,2)

(l3,0,3)

(l5,3,3)

(l4,3,0)

(l2,3,3)

(l3,0,4)

(l2,2,4)

(l5,2,4)

(l4,2,2)

(l2,3,5)

(l5,3,5)

(l4,3,2)

(l3,0,5)

(l4,3,3)

(l5,3,6)

(end,3,6)

(l4,2,3)

(l5,2,5)

(l2,2,5)

Φ: pc = l3 Æ x = 0

Global States = {0,2,3}

Queue = {4,5}

(l4,3,3)

(l5,3,6)

(end,3,6)

(l3,0,5)

(l1,0,0)

(l3,0,0)

(l2,0,0)

(l3,0,2)

(l5,2,2)

(l4,2,0)

(l2,2,2)

(l3,0,3)

(l5,3,3)

(l4,3,0)

(l2,3,3)

(l3,0,4)

(l2,2,4)

(l5,2,4)

(l4,2,2)

(l2,3,5)

(l5,3,5)

(l4,3,2) (l4,2,3)

(l5,2,5)

(l2,2,5)

(l5,2,6)

(l4,2,4)

(end,2,6)

(l5,3,7)

(l4,3,4)

(end,3,7)

Φ: pc = l3 Æ x = 0

Global States = {0,2,3,4}

Queue = {5}

(l4,3,3)

(l5,3,6)

(end,3,6)

(l5,2,6)

(l4,2,4)

(end,2,6)

(l3,0,5)

(l1,0,0)

(l3,0,0)

(l2,0,0)

(l3,0,2)

(l5,2,2)

(l4,2,0)

(l2,2,2)

(l3,0,3)

(l5,3,3)

(l4,3,0)

(l2,3,3)

(l3,0,4)

(l2,2,4)

(l5,2,4)

(l4,2,2)

(l2,3,5)

(l5,3,5)

(l4,3,2) (l4,2,3)

(l5,2,5)

(l2,2,5)

(l5,3,7)

(l4,3,4)

(end,3,7)

(l5,2,7)

(l4,2,5)

(end,2,7)

(l5,3,8)

(l4,3,5)

(end,3,8)

Φ: pc = l3 Æ x = 0

Global States = {0,2,3,4,5}

Queue = {}

(l4,3,3)

(l5,3,6)

(end,3,6)

(l5,2,6)

(l4,2,4)

(end,2,6)

(l3,0,5)

(l1,0,0)

(l3,0,0)

(l2,0,0)

(l3,0,2)

(l5,2,2)

(l4,2,0)

(l2,2,2)

(l3,0,3)

(l5,3,3)

(l4,3,0)

(l2,3,3)

(l3,0,4)

(l2,2,4)

(l5,2,4)

(l4,2,2)

(l2,3,5)

(l5,3,5)

(l4,3,2) (l4,2,3)

(l5,2,5)

(l2,2,5)

(l5,3,7)

(l4,3,4)

(end,3,7)

(l5,2,7)

(l4,2,5)

(end,2,7)

(l5,3,8)

(l4,3,5)

(end,3,8)

Φ: pc = l3 Æ x = 0

Global States = {0,2,3,4,5}

Queue = {}

(l3,0,4)(l3,0,5) (l3,0,5)

(l3,0,2) (l3,0,3)

(l3,0,0)

(l4,3,3)

(l5,3,6)

(end,3,6)

(l5,2,6)

(l4,2,4)

(end,2,6)

(l3,0,5)

(l1,0,0)

(l3,0,0)

(l2,0,0)

(l3,0,2)

(l5,2,2)

(l4,2,0)

(l2,2,2)

(l3,0,3)

(l5,3,3)

(l4,3,0)

(l2,3,3)

(l3,0,4)

(l2,2,4)

(l5,2,4)

(l4,2,2)

(l2,3,5)

(l5,3,5)

(l4,3,2) (l4,2,3)

(l5,2,5)

(l2,2,5)

(l5,3,7)

(l4,3,4)

(end,3,7)

(l5,2,7)

(l4,2,5)

(end,2,7)

(l5,3,8)

(l4,3,5)

(end,3,8)

(l1,0,0)

(l3,0,0)

(l3,0,2) (l3,0,3)

(l3,0,5)(l3,0,4)

Search each region independently

max of 9 versus 37 states in classical DFS

note that the sum here is >37

same states may appear in multiple regions

Regions can be searched in parallel

Works well when reasonable fraction of state

variables are cyclic low-degree of overlapping

between regions

Bogor Algorithm Customization

Bogor default modules are unplugged and replaced with state representation, scheduling and search strategies customized for Quasi-cyclic Search

BogorModulesBogorModules

IActionTaker

IExpEvaluator

IValueFactory

IBacktrackIF

ITransformer

ISchedulingStg

ISearcher

IStateFactory

IStateMgr

PrioritySchedS

PartialStMgr

LTSearcherQCSearcher

Scaling #components in ModalSP

1000000

2000000

3000000

4000000

5000000

6000000

1 2 3 4 5 6

Classic v<=3

Cyclic v<=3

both searches have exponential time growth quasi-cyclic search takes more time (overlapping regions)

we’re seeing linear speedup in parallelizing QC search as problems scale there is sufficient available parallelism

An Integrated Environment for Modeling, Analysis, Synthesis, and Optimization of Component-based Systems

I. Platform for real-world experimentation with technologies for building high-assurance distributed systems using CORBA Component Model

… light-weight specification, analysis, and verification techniques… model-based development,

middleware configuration, and code synthesis

… robust tool environment suitable for industrial experimentation

… customizable to different domains/product lines

II. Avenue for collaborating with industrial research teams and middleware experts to guide next-generation component/middleware technology… interacting with groups at Boeing,

Rockwell-Collins, Lockheed-Martin to develop techniques that match fit into development process

… collaborating with middleware experts (e.g., ACE/TAO RT-middleware) to make frameworks more amenable to model-based configuration and analysis

For More Information…

http://cadena.projects.cis.ksu.edu

http://bogor.projects.cis.ksu.edu

SAnToS Laboratory, Kansas State Universityhttp://www.cis.ksu.edu/santos

Bogor Project

Cadena Project

http://bandera.projects.cis.ksu.eduBandera Project

http://cadena.projects.cis.ksu.edu santos laboratory, kansas state university, usa cadena: analyzing...

data slide

component idl corba

input output slide

ccm idl modalsp components

example system slide

dallas slide

earlier slide

logical gps component

Documents

analyzing component-based designs: the cadena environment ...

cadena final

cadena valor

dwyer industries, inc

gender and conflict in mindanao - wordpress.com...mindanao...

cadena limon

sharon dwyer vcccd

dwyer level

cadena alimenticia

an extensible and highly-modular model checking framework ...

dwyer issa presentation

cadena de suministros cadena de abasto supply chain

louise dwyer portfolio

cadena custodia

william t. dwyer

cis 706 translators i the wig project matthew dwyer 324e...

elizabeth dwyer portfolio

cadena de valor

dwyer details

home | dwyer instruments