Les interférences apparaissant dans les multicoeurs sont indésirables dans les systèmes tempsréel critiques, en particulier dans le domaine de l'aéronautique, où le déterminisme du fonctionnement temporel de tout système doit être formellement prouvé lors de la conception du système de manière à pouvoir être certifié et considéré comme opérationnel. Le but de cette thèse est de proposer une approche pour l'intégration logicielle d'applications IMA sur processeur multicoeur, sans impliquer de modification des plateformes logicielle et matérielle, et en respectant un maximum d'exigences de certification et concepts clés de l'avionique actuels, comme le partitionnement spatial et temporel ou encore la certification incrémentale. L'un des objectifs de la thèse est de respecter au maximum les procédés industriels d'intégration actuels de manière à maximiser les chances des contributions résultantes de la thèse d'être réutilisées au sein des industries avioniques. Un second objectif mineur est de permettre de réduire au minimum la phase d'adaptation des différents profils impliqués dans le processus d'intégration logicielle. Enfin, un troisième objectif est d'aider à optimiser le temps passé à effectuer les vérifications temporelles qui peuvent s'avérer difficiles et coûteuses en temps, mais aussi les choix architecturaux, de manière à réduire le time-to-market mais aussi optimiser le design du système en cours de conception. La contribution majeure de cette thèse est la proposition de deux stratégies complètes d'intégration logicielle/matérielle sur multicoeur pour des applications IMA. L'un des deux processus respecte les contraintes majeures de certification actuelles, ce qui en fait une stratégie potentiellement exploitable pour les applications les plus critiques de DAL A de l'aérospatial; la seconde offre un design le plus optimisé possible en termes de réduction de poids masse et consommation énergétique embarqués. Chaque stratégie est dite complète car elle contient: - une analyse temporelle statique qui borne les interférences inter-coeurs et permet de dériver des bornes supérieures de WCETs de manière fiable; - une formulation de problème de programmation par contraintes (PPC) pour l'allocation automatique et optimisée de logiciel sur matériel; la configuration résultante est correcte par construction car le problème de PPC exprimé exploite l'analyse temporelle mentionnée précédemment pour effectuer une vérification temporelle sur chaque configuration testée. - une formulation de problème de PPC pour la génération d'ordonnancement automatique et optimisé; la configuration résultante est correcte par construction car le processus exploite l'analyse temporelle mentionnée précédemment pour effectuer une vérification temporelle sur chaque configuration testée. / Interference in multicores is undesirable for hard real-time systems and especially in the aerospace industry, for which it is mandatory to ensure beforehand timing predictability and deadlines enforcement in a system runtime behavior, in order to be granted acceptance by certification authorities. The goal of this thesis is to propose an approach for multi-core integration of legacy IMA software, without any hardware nor software modification, and which complies as much as possible to current, incremental certification and IMA key concepts such as robust time and space partitioning. The motivations of this thesis are to stick as much as possible to the current IMA software integration process in order to maximize the chances of acceptation by avionics industries of the contributions of this thesis, but also because the current process has long been proven efficient on aerospace systems currently in usage. Another motivation is to minimize the extra effort needed to provide certification authorities with timing-related verification information required when seeking approval. As a secondary goal depending on the possibilities, the contributions should offer design optimization features, and help reduce the time-to-market by automating some steps of the design and verification process. This thesis proposes two complete methodologies for IMA integration on multi-core COTS. Each of them offers different advantages and has different drawbacks, and therefore each of them may correspond to its own, complementary situations. One fits all avionics and certification requirements of incremental verification and robust partitioning and therefore fits up to DAL A applications, while the other offers maximum Size, Weight and Power (SWaP) optimization and fits either up to DAL C applications, multipartition applications or non-IMA applications. The methodologies are said to be "complete" because this thesis provides all necessary metrics to go through all steps of the software integration process. More specifically, this includes, for each strategy: - a static timing analysis for safely upper-bounding inter-core interference, and deriving the corresponding WCET upper-bounds for each task. - a Constraint Programming (CP) formulation for automated software/hardware allocation; the resulting allocation is correct by construction since the CP process embraces the proposed timing analysis mentioned earlier. - a CP formulation for automated schedule generation; the resulting schedule is correct by construction since the CP process embraces the proposed timing analysis mentioned earlier.

Submitted by Miriam Lucas (miriam.lucas@unioeste.br) on 2018-02-22T14:23:15Z No. of bitstreams: 2 Felipe_Crestani_dos_Santos_2017.pdf: 5495370 bytes, checksum: 82f81445874bba45497cda5c8d784d2f (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) / Made available in DSpace on 2018-02-22T14:23:15Z (GMT). No. of bitstreams: 2 Felipe_Crestani_dos_Santos_2017.pdf: 5495370 bytes, checksum: 82f81445874bba45497cda5c8d784d2f (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) Previous issue date: 2017-11-17 / The main line of research of this work is the study of approaches for supporting the development and analysis of the Power System Protection. In general, this process is carried out through of a large number of simulations involving various operating scenarios. The main limitation of this technique is the impossibility of coverage of all behavior of the system under analysis. In this context, this work proposes the use of Model Checking as a tool to support the procedure of development of power system protection schemes, principally in the sense of proving the security requirements and temporal deterministic expected behavior. Model Checking is a verification technique that explores exhaustively and automatically all possible system states, checking if this model meets a given specification. This work focuses on this two pillars of the Model Checking: to choose an appropriate modeling formalism for representation of the power system protection and how to describe the specification in temporal-logic for the verification process. With regard to the modeling formalism, the power system protection will be represented by the Hybrid Automata theory, while the verification tool adopted will be Statistical Model Checking, by the UPPAAL STRATEGO toolkit. It is underlined that this work is limited to the modeling of individual components of the power system protection, such that 18 models of the devices and protocols like communication bus (LAN), time synchronization protocol (PTP) and IEC 61850 communication protocols (SV and GOOSE) and Logical Nodes of power system protection, and 13 auxiliaries models, which emules the stochastic behavior to subsidise the verification process. The methodology of modelling adopted guarantees the effective representation of the components behaviour of power system protection. For this, the results of Model Checking process were compared with behavioral requirements defined by standards, conformance testings and paper related to the area. With regard to the contributions of this work, were identified three researches areas that could use the models developed in this work: i) implementation of power system protection schemes; ii) achievement of conformance testing; and iii) indication of the parameterization error of the power protection system scheme. / A linha de pesquisa abordada neste trabalho aponta para o estudo e desenvolvimento de ferramentas que subsidiem a proposição e validação de Sistemas de Proteção de Sistemas de Energia Elétrica. Em geral, este processo é realizado mediante simulações computacionais envolvendo diversos cenários de operação e distúrbios, tendo como principal limitação a impossibilidade de representar todos os caminhos de evolução do sistema em análise. Nesse contexto, propõe-se o emprego da técnica de Modelagem e Verificação Formal como ferramenta de suporte ao projeto, análise e implementação de estratégias de proteção, principalmente no sentido de comprovar se a estratégia atende os requisitos de segurança e comportamento determinístico temporal esperado. Em síntese, o método consiste na verificação de propriedades descritas em lógicas temporais, sob uma abstração apropriada (formalismo) do comportamento do sistema. Esta dissertação possui enfoque nestes dois requisitos: modelagem do sistema de proteção através de um formalismo adequado e tradução dos requisitos do comportamento desejado em propriedades descritas em lógica temporal. Com relação ao formalismo de apoio, a modelagem do sistema de proteção é baseada em uma abstração de Autômatos Temporizados Híbridos. Como ferramenta de validação, adota-se a técnica de Verificação Formal Estatística, através do software UPPAAL STRATEGO. Salienta-se que este trabalho se delimita apenas na modelagem e validação individual dos principais equipamentos de um sistema de proteção, sendo 18 modelos de dispositivos e protocolos como barramentos de comunicação (LAN), protocolo de sincronização de tempo PTP, protocolos de comunicação baseados em IEC 61850 e funções de proteção, e 13 modelos auxiliares que implementam um comportamento estocástico para subsidiar o processo de validação do sistema de proteção. O desenvolvimento dos modelos se deu através de uma abordagem sistemática envolvendo processos de simulação e verificação das propriedades sob o modelo em análise. Através desta metodologia, garante-se que os modelos desenvolvidos representam o comportamento esperado de seus respectivos dispositivos. Para isso, os resultados do processo de verificação foram comparados com requisitos comportamentais definidos por normas, testes de conformidade em equipamentos/protocolos e trabalhos acadêmicos vinculados à área. Com relação às contribuições do trabalho, identificou-se três linhas de pesquisa que podem fazer o uso dos modelos desenvolvidos: i) implementação de novas estratégias de proteção; ii) realização de testes de conformidade em equipamentos externos à rede de autômatos; e iii) indicação de erros de parametrização do sistema de proteção.

Software systems in the automotive domain are generally safety critical and subject to strict timing requirements. Systems of this character are often constructed utilizing periodically executed tasks, that have a hard deadline. In addition, these systems may have additional deadlines that can be specified on cause-effect chains, or simply task chains. They are defined by existing tasks in the system, hence the chains are not stand alone additions to the system. Each chain provide an end-to-end timing constraint targeting the propagation of data through the chain of tasks. These constraints specify the additional timing requirements that need to be fulfilled, when searching for a valid schedule. In this thesis, an offline non-preemptive scheduling method is presented, designed for single core systems. The scheduling problem is defined and formulated utilizing Constraint Programming. In addition, to ensure that end-to-end timing requirements are met, job-level dependencies are considered during the schedule generation. Utilizing this approach can guarantee that individual task periods along with end-to-end timing requirements are always met, if a schedule exists. The results show a good increase in schedulability ratio when utilizing job-level dependencies compared to the case where job-level dependencies are not specified. When the system utilization increases this improvement is even greater. Depending on the system size and complexity the improvement can vary, but in many cases it is more than double. The scheduling generation is also performed within a reasonable time frame. This would be a good benefit during the development process of a system, since it allows fast verification when changes are made to the system. Further, the thesis provide an overview of the entire process, starting from a system model and ending at a fully functional schedule executing on a hardware platform.

Réduire la consommation énergétique des systèmes temps réel embarqués multiprocesseurs est devenu un enjeu important notammentpour augmenter leur autonomie. Nous réduisons la consommation statique des processeurs en exploitant leurs états basseconsommation. Dans un état basse-consommation, la consommation énergétique est fortement réduite mais un délai de transition et une pénalité sont nécessaires pour revenir à l'état actif. Nous proposons dans cette thèse les premiers algorithmes d'ordonnancement tempsréel multiprocesseurs optimaux pour réduire la consommation énergétique des systèmes temps réel dur et des systèmes temps réel àcriticité mixte. Ces algorithmes d'ordonnancement permettent d'activer les état basse-consommation les plus économes en énergie.Chaque algorithme d'ordonnancement est divisé en deux parties. La première partie hors-ligne génère un ordonnancement en utilisant laprogrammation linéaire en nombres entiers pour minimiser la consommation énergétique. La seconde partie est en-ligne et augmente lataille des périodes d'inactivité les tâches terminent leur exécution plus tôt que prévu. Dans le cadre des systèmes temps réel à criticitémixte, nous profitons du fait que les tâches de plus faible criticité peuvent tolérer des dépassements d'échéances pour être plus agressifhors-ligne afin de réduire davantage la consommation énergétique. Les résultats montrent que les algorithmes proposés utilisent demanière plus efficace les états basse-consommation. La consommation énergétique lorsque ceux-ci sont activés est en effet jusqu'à dix fois plus faible qu'avec les algorithmes d'ordonnancement multiprocesseurs existants. / Reducing the energy consumption of multiprocessor real-time embedded systems is a growing concern to increase their autonomy. In thisthesis, we aim to reduce the energy consumption of the processors, it includes both static and dynamic consumption and it is nowdominated by static consumption as the semiconductor technology moves to deep sub-micron scale. Existing solutions mainly focused ondynamic consumption. On the other hand, we target static consumption by efficiently using the low-power states of the processors. In alow-power state, the processor is not active and the deeper the low-power state is, the lower is the energy consumption but the higher isthe transition delay to come back to the active state. In this thesis, we propose the first optimal multiprocessor real-time schedulingalgorithms minimizing the static energy consumption. They optimize the duration of the idle periods to activate the most appropriate lowpowerstates. We target hard real-time systems with periodic tasks and also mixed-criticality systems where tasks with lower criticalitiescan tolerate deadline misses, therefore allowing us to be more aggressive while trying to reduce the energy consumption. We use anadditional task to model the idle time and mixed integer linear programming to compute offline a schedule minimizing the energyconsumption. Evaluations have been performed using existing optimal multiprocessor real-time scheduling algorithms. Results show thatthe energy consumption while processors are idle is up to ten times reduced with our solutions compared to the existing multiprocessor real-time scheduling algorithms.

Several available free software audio solutions were analyzed, and Jackdmp—a C++ reimplementation of the renowned JACK Audio Connection Kit—was selected as the most appropriate solution for a real-time audio architecture on DROPS. The JACK sound architecture provides the lowest processing latency possible on a desktop computer for a given set of sound card parameters. It reduces the latency jitter caused by software to zero and synchronizes streams at sample accuracy. A real-time admission scheme for JACK clients is proposed. The execution time of different typical JACK clients was analyzed with measurements to validate the assumptions the proposal is based on, but also to gain further knowledge about their timing behavior. The measurements showed that the condition set by Paul Davis—the time to process a client must be a linear function of the buffer size—holds for all tested clients. Jackdmp was ported to DROPS. The developed design of the port and its implementation is documented here. Measurements showed that—although the real-time performance of the Linux kernel is continuously being improved in the mainline and on special external branches—DROPS can provide a signaling latency that is two times lower on average than the values that can be achieved on the same machine running with a low latency patched Linux kernel. Thus, it can be stated that DROPS is well-suited for real-time audio processing and that the pursued path to use it as the foundation of a truly real-time capable audio workstation should be followed. / Wenn man heute digitale Audiotechnik zum Aufnehmen oder Abmischen von Musik oder anderen Audiodaten verwenden möchte, steht man vor der Wahl, entweder auf eine sehr spezialisierte Hardwarelösung zurückzugreifen oder aber sich eines gewöhnlichen Desktopsystems mit entsprechender Audiosoftware zu bedienen. Der Vorteil eines Desktopsystems ist neben seinem deutlich niedrigeren Preis vor allem die Flexibilität. Bezüglich seines Echtzeitverhaltens bietet ein Computer mit einem Standard-Desktop-Betriebssystem aber bei weitem nicht dieselbe Verlässlichkeit einer spezialisierten Hardwarelösung oder analoger Technik. Die Architektur von DROPS --- mit dem echtzeitfähigen Fiasco- Mikrokern auf der einen Seite sowie der Unterstützung von Legacy-Anwendungen durch L4Linux auf der anderen Seite --- birgt die Hoffnung, die Vorteile von den beiden eben beschriebenen Welten auf einem System mit DROPS kombinieren zu können. Die Motivation meiner Arbeit war es, für dieses langfristige Ziel einen ersten Grundstein zu legen. Dazu war es meine Aufgabe, verschiedene Open-Source- Lösungen hinsichtlich ihrer Eignung als Echtzeit-Audioarchitektur für DROPS zu analysieren und die am besten geeignete auf L4Env zu portieren. Meine Wahl fiel dabei auf das in der Linux-Audio-Szene wohlbekannte Jack Audio Connection Kit (JACK). Desweiteren konnte ich in der Arbeit untersuchen, wie sich die JACK Audioarchitektur in ein globales Echtzeit-Scheduling --- z.B. eines von DROPS --- einbetten ließe, und schlage eine generische Methode dafür vor.

Several available free software audio solutions were analyzed, and Jackdmp—a C++ reimplementation of the renowned JACK Audio Connection Kit—was selected as the most appropriate solution for a real-time audio architecture on DROPS. The JACK sound architecture provides the lowest processing latency possible on a desktop computer for a given set of sound card parameters. It reduces the latency jitter caused by software to zero and synchronizes streams at sample accuracy. A real-time admission scheme for JACK clients is proposed. The execution time of different typical JACK clients was analyzed with measurements to validate the assumptions the proposal is based on, but also to gain further knowledge about their timing behavior. The measurements showed that the condition set by Paul Davis—the time to process a client must be a linear function of the buffer size—holds for all tested clients. Jackdmp was ported to DROPS. The developed design of the port and its implementation is documented here. Measurements showed that—although the real-time performance of the Linux kernel is continuously being improved in the mainline and on special external branches—DROPS can provide a signaling latency that is two times lower on average than the values that can be achieved on the same machine running with a low latency patched Linux kernel. Thus, it can be stated that DROPS is well-suited for real-time audio processing and that the pursued path to use it as the foundation of a truly real-time capable audio workstation should be followed. / Wenn man heute digitale Audiotechnik zum Aufnehmen oder Abmischen von Musik oder anderen Audiodaten verwenden möchte, steht man vor der Wahl, entweder auf eine sehr spezialisierte Hardwarelösung zurückzugreifen oder aber sich eines gewöhnlichen Desktopsystems mit entsprechender Audiosoftware zu bedienen. Der Vorteil eines Desktopsystems ist neben seinem deutlich niedrigeren Preis vor allem die Flexibilität. Bezüglich seines Echtzeitverhaltens bietet ein Computer mit einem Standard-Desktop-Betriebssystem aber bei weitem nicht dieselbe Verlässlichkeit einer spezialisierten Hardwarelösung oder analoger Technik. Die Architektur von DROPS --- mit dem echtzeitfähigen Fiasco- Mikrokern auf der einen Seite sowie der Unterstützung von Legacy-Anwendungen durch L4Linux auf der anderen Seite --- birgt die Hoffnung, die Vorteile von den beiden eben beschriebenen Welten auf einem System mit DROPS kombinieren zu können. Die Motivation meiner Arbeit war es, für dieses langfristige Ziel einen ersten Grundstein zu legen. Dazu war es meine Aufgabe, verschiedene Open-Source- Lösungen hinsichtlich ihrer Eignung als Echtzeit-Audioarchitektur für DROPS zu analysieren und die am besten geeignete auf L4Env zu portieren. Meine Wahl fiel dabei auf das in der Linux-Audio-Szene wohlbekannte Jack Audio Connection Kit (JACK). Desweiteren konnte ich in der Arbeit untersuchen, wie sich die JACK Audioarchitektur in ein globales Echtzeit-Scheduling --- z.B. eines von DROPS --- einbetten ließe, und schlage eine generische Methode dafür vor.