搜索
14AdvancedElevatorBehaviorsDistributedEmbeddedSystemsChrisSzilagyiMarch15,2010©Copyright2010,PhilipKoopman2OverviewWherewe’vebeen:•End-to-endschedulingToday:•Timetriggereddesign,revisited•AdvancedelevatortopicsWherewe’regoing:•Verification,validation,andcertificationPhotoCredits::240_Sparks_Elevators.jpg:Carnival_Sensation_Grand_Atrium_elevators.JPG3Project7-ImplementationWorkingelevatorrequiredforsubmissionthisThursday•Mustpasstheonerequiredacceptancetest•Mustalsopassallunitandintegrationtests•MusthaveacompleteandconsistentdesignportfolioDesignrequirementsinthislectureareforprojects8andup•Don’tworryaboutfancydispatchersanddrivesifnotdesignedyet•GetthesimpleversionworkingfirstDebuggingtips•~ece649/project/codebase/debugging.html•Usethe-seedoptionforexactrepetitionofevents•Use-breaktospecifytimesto“pause”theelevator–ThenwatchtheGUIinslowmode,watchoutputs,oraddyourownbreakpointsAdditionalofficehourWednesdayMarch17th(4:30-5:30PM)•Location:UndergradLounge4Time-Triggeredvs.Event-TriggeredEvent-triggered•Actionsoccurinresponsetoaneventinthesystem•ETisgoodforsystemsthatarenaturallytransactional–Financialsystems–Systemsbackedbydatabases•RecordeventsinordertomaintainstateTime-triggered•Actionsoccurbasedontheprogressionoftime•Decisionsbasedonstatevariables•TTisgoodforsystemsthatarestateoriented”–Systemswithphysicalstatethatneedstoberepresentedinthesystem•Infereventsfromchangesinstatevariables–Havetosamplestatevariablesfastenough–Mightmisseventsthatoccurfasterthanthetime-triggeredperiod5Time-triggeredvs.Event-triggered:FaultRecoveryEvent-triggered•Makesurethatthemessagegotthrough–Okforpoint-to-point(e.g.TCP:SYN/ACK)–Multicastacknowledgementismessyandexpensive–EvenworseinthepresenceofByzantinefaults»ByzantineÎdifferentnodesreceivedifferentvaluesTime-triggered•Resilienttotransientfaults(e.g.lostmessages)•Faultrecovery(retransmission)happensautomaticallyWhataboutwastedbandwidth?(usualcounterargumentforTT)•Tomeetreal-timedeadlines,youhavetoleavebandwidthfreeforhigh-prioritymessagesnomatterwhat•Mightaswellsendthemessagesallthetime•TTmakesschedulesandreal-timeguaranteeseasiertomake6Time-Triggeredvs.Event-TriggeredTime-triggeredisnotalwaystheanswer,BUT…ProbablytherightanswerformostembeddedapplicationsMostpeopleunderstandevent-triggered•Time-triggeredrequiresadifferentwayofthinkingaboutdesign•LearnaboutTTsoyoucanunderstandthetradeoffs7HowdoIknowifmydesignistime-triggered?Time-triggereddesignsDO:•Performactions(computations)andwriteoutputseveryperiod•MakedecisionsbasedonlyonthecurrentstateofthesystemPuretime-triggereddesignsDONOT:•Haveactionsonarcs•Makedecisionsbasedonhowthecurrentstatewasreached•Haveentryactions(*annotation)YourprojectMUSTbetime-triggered!8EntryActionsonStatesThisisnotatime-triggeredbehaviorBestpractice:•EliminateentryactionswhereverpossibleAlternative(notthebestpractice):•Addanadditionalstatebetweenthetwostates•Thisaddscomplexity•Thisaddslatency(payattentiontosafetyconstraints)DoNOTadda“thisisthefirsttime”flagvariabletoworkaroundthis!DoNOTtakemorethanonetransitionperloopexecution•Needtohaveaworst-caseboundonexecutiontime•Approximateprocessorconstrainednodes.9AdvancedElevatorTopicsCommitpointDispatcheralgorithmsandthedesiredfloormessageRaceconditionsfordistributedsystemsStartupconditionsPassengerinteractionsReal-worldelevatordesigncomplexities10CommitPointCalculationStoppingdistance:Thedistancebetweenwhereyouarenowandwhereyoucanstop•Assumesfollowingnormal(non-emergency)accelerationprofile•Athighspeeds,thismightbemultiplefloorsawayCommitPoint:Theelevatorpositionatwhichyoumustdecidewhethertostopatparticularfloor•Occurswhenelevatorreachesthestoppingdistancefromthatfloorlocation•Thisisafunctionofelevatorspeed!Whenyoupassthecommitpoint,youlosetheoptionofstopping•Evenifyoustillhaven’treachedtheflooryet•Thinkofthe“pointofnoreturn”forthatfloor11Elevatormotionprofiles123Acceleration(m/s2)Velocity(m/s)0.51.01.0-1.0Position(m)123450.00Time(s)1234565.7512UsingTheCommitPointThecommitpointgetsfurtherawayasspeedincreases•Whenstopped,thecommitpointisexactlyatthefloor(stoppingdistance=0)•Athighspeeds,commitpointisseveralfloorsawayfromelevatorpositionThecourseprojectelevatorcanstop“instantly”fromslowspeed•But,fromfastspeedyouneedtorampdownComputationmustbeconservative,takeintoaccount•Granularityofsensorinputs•WorstcasenetworkdelaysControllersneedtohaveaconsistentnotionofcommitpoint•Nottoodifficultinthefault-freecase,orwithdroppedmessagefaultsInrealelevators,howdoescommitpointaffectcarfloorindicator?•Why?13DispatcherMessages–Whatdotheymean?DesiredFloor•Floor–thefloorweintendtogotonext•Direction–thedirectionweintendtogoafterwereachthedesiredFloor•Hallway–whichdoorsshouldopenDesiredDwell•Howlongtoholdthedoorsopen•Mightvarydependingonwhetheryouransweringahallcalloracarcall•Mightvarydependingonmode(uppeak,downpeak)StartinginProject8:Followtheaboveusage.Forexample:•Iftheelevatorisstoppedandopening