This paper presents a unified formal framework, called ReTA, that allows users to define scheduling problems using a user-friendly domain-specific language (DSL) and automatically obtain response times of jobs in return. ReTA supports user-defined online scheduling policies (beyond work-conserving or priority-based scheduling) for heterogeneous computing resource types with multiple instances per type (e.g., multiple CPU cores, GPUs, DSPs, and FPGAs on one single chip), thus supporting global, partitioned, and clustered scheduling. In the current version of ReTA, we focus on non-preemptive periodic tasks as these are susceptible to scheduling anomalies and hence harder to analyze. ReTA performs response-time analysis by constructing a timed labeled transition system (TLTS) from the domain model as a basis for performing a reachability analysis enriched with efficient state-space reduction techniques. Our empirical evaluations show that ReTA identifies up to 50 times more schedulable task sets than fixed-point iteration-based analyses. With a runtime on the order of a few minutes, ReTA produces highly accurate results two-orders of magnitude faster than an exact Timed Automata-based analysis in UPPAAL (e.g., for systems with 16 cores and 32 tasks).

This paper explores the design and verification of real-time cyber-physical systems transitioning from embedded platforms to the cloud. It covers opportunities, potential use cases, and challenges associated with the timing predictability of cloud-enabled real-time systems. The conclusion outlines future research directions to address these challenges.

Global scheduling reduces the average response times as it can use the available computing cores more efficiently for scheduling ready tasks. However, this flexibility poses challenges in accurately quantifying interference scenarios, often resulting in either conservative response-time analyses or scalability issues. In this paper, we present a new response-time analysis for preemptive periodic tasks (or job sets) subject to release jitter under global job-level fixed-priority (JLFP) scheduling. Our analysis relies on the notion of schedule-abstraction graph (SAG), a reachability-based response-time analysis known for its potential accuracy and efficiency. Up to this point, SAG was limited to non-preemptive tasks due to the complexity of handling preemption when the number of preemptions and the moments they occur are not known beforehand. In this paper, we introduce the concept of time partitions and demonstrate how it facilitates the extension of SAG for preemptive tasks. Moreover, our paper provides the first response-time analysis for the global EDF(k) policy - a JLFP scheduling policy introduced in 2003 to address the Dhall's effect. Our experiments show that our analysis is significantly more accurate compared to the state-ofthe-art analyses. For example, we identify 12 times more schedulable task sets than existing tests for the global EDF policy (e.g., for systems with 6 to 16 tasks, 70% utilization, and 4 cores) with an average runtime of 30 minutes. We show that EDF(k) outperforms global RM and EDF by scheduling on average 24.9% more task sets (e.g., for systems with 2 to 10 cores and 70% utilization). Moreover, for the first time, we show that global JLFP scheduling policies (particularly, global EDF(k)) are able to schedule task sets that are not schedulable using well-known partitioning heuristics.

Response-time analysis (RTA) is crucial for ensuring the timeliness of real-time systems. As system complexity increases, there’s a growing need for RTA techniques that can automate the process of finding worst-case response times. The schedule-abstraction graph (SAG), a recent reachability-based RTA, addresses this by systematically exploring the decision space of global job-level fixed-priority (JLFP) scheduling policies for a given task set. SAG significantly outperforms existing RTAs for global scheduling on multicore, e.g., it can identify 12 times more schedulable task sets for global EDF in comparison to sufficient RTAs and operates 400 times faster than some other reachability-based tests. Despite these achievements, the state-space explored by the SAG can become very large in case the release jitter or the number of cores is large. This is because at present the SAG approach explores one scheduling decision at a time, leaving the parallelism inherent to global scheduling unexploited during state-space exploration. Recognizing that multiple jobs can be dispatched concurrently without interference, we introduce the first state-space-reduction technique for SAG that identifies and analyzes sets of independent jobs in tandem. We apply this technique to both preemptive and non-preemptive SAG frameworks. Our empirical evaluations show that our solution efficiently reduces the number of explored states while maintaining or even enhancing the accuracy of the SAG analysis, enabling it to scale to larger systems. For instance, our method achieves a 6 times reduction in runtime while improving schedulability by 16% for preemptive task sets scheduled using global EDF (e.g., for systems with 2 to 12 cores and 60% utilization).

The increasing dynamism and interconnectivity of Cyber-Physical Systems of Systems (CPSoS) emphasize the need for advanced performance modeling approaches. Performance models serve the purpose of exploring and evaluating design solutions, providing insights into system behavior during the early design phases, and managing performance risks during development. Despite the advancements in hybrid modeling within the field of performance modeling, the challenge of constructing models effectively and efficiently while ensuring their trustworthiness has not received much attention. This paper proposes a method, that is, step-by-step guidelines on using formalisms, techniques, and tools, to construct trustworthy hybrid models for analyzing and predicting stochastic timing performance of CPSoS. The method integrates design patterns for improved model design and development, alongside Bayesian calibration and statistical validation techniques to further enhance trustworthiness of the models. Although many individual techniques, formalisms and tools are available, our contribution lies in proposing a systematic method for achieving trustworthiness within the context of hybrid performance modeling and simulation. We concretize the method for cloud-based cyber-physical systems. Through two case studies, we show the efficacy of the proposed method for accurately predicting end-to-end latency of offloading imaging tasks to the cloud. The first case study showcases the application of design patterns in a practical scenario involving a cloud-based healthcare system—a collaboration with an industry partner in healthcare systems. The second case study has been implemented as a prototype to show the use of calibration and validation techniques with operational data in a laboratory context using an image-reconstruction application.

In safety-critical real-time systems such as autonomous cars, fault-tolerance is essential for system reliability but can increase end-to-end latency and hinder schedulability. This paper presents a novel, safe, and latency-aware fault-tolerant scheduling technique for multi-rate task chains. A naive use of traditional fault-tolerance mechanisms, such as checkpointing and re-execution with recovery blocks, can violate end-to-end latency requirements. Our technique uses recovery blocks but leverages inherent task redundancies in multi-rate task chains (where data producers and consumers have different periods) to reduce the need for recovery. Moreover, it determines the priority of the recover blocks such that the end-to-end latency of the task chain is reduced in the presence of transient faults. Our experiments show that our technique significantly improves schedulability and reduces data age compared to the state-of-the-art checkpointing method. For instance, for systems with 4 to 16 cores and 10 to 40 tasks, we achieve up to 6 times higher schedulability and reduce data age by 21% under various fault levels.

Switching max-plus linear system (SMPLS) models are an apt formalism for performance analysis of discrete-event systems. SMPLS analysis is more scalable than analysis through other formalisms such as timed automata, because SMPLS abstract pieces of determinate concurrent system behavior into atomic modes with fixed timing. We consider discrete-event systems that are decomposed into a plant and a Supervisory Controller (SC) that controls the plant. The SC needs to react to events, concerning e.g. the successful completion or failure of an action, to determine the future behavior of the system, for example, to initiate a retrial of the action. To specify and analyze such system behavior and the impact of feedback on timing properties, we introduce an extension to SMPLS with discrete-event feedback. In this extension, we model the plant behavior with system modes and capture the timing of discrete-event feedback emission from plant to SC in the mode matrices. Furthermore, we use I/O automata to capture how the SC responds to discrete-event feedback with corresponding mode sequences of the SMPLS. We define the semantics of SMPLS with events using new state-space equations that are akin to classical SMPLS with dynamic state-vector sizes. To analyze the extended models, we formulate a transformation from SMPLS with events to classical SMPLS with equivalent semantics and properties such that performance properties can be analyzed using existing techniques. Our approach enables the specification of discrete-event feedback from the plant to the SC and its performance analysis. We demonstrate our approach by specifying and analyzing the makespan of a flexible manufacturing system.

Supervisory control design of cyber-physical systems has many challenges. Model-based systems engineering can address these, with solutions originating from various disciplines. We discuss several tools, each state-of-the-art in its own discipline, offering functionality such as specification, synthesis, and verification. Integrating such mono-disciplinary tools in a multi-disciplinary workflow is a major challenge. We present Analytics as a Service, built on the Arrowhead framework, to connect these tools and make them interoperable. A seamless integration of the tools has been established through a service-oriented architecture: The engineer can easily access the functionality of the tools from a single interface, as translation steps between equivalent models for the respective tools are automated.

While multicore real-time systems are extensively employed in the industry, research gaps still exist in developing a scalable analysis to find tight bounds on the worst-case response time (WCRT) of tasks scheduled by global preemptive scheduling policies. Additionally, the presence of release jitter poses a challenge where examining the earliest and latest release times may not derive WCRT. The existing analyses either provide very conservative bounds or face challenges in scaling to systems with numerous cores and tasks. This work provides preliminary foundations to derive tight WCRT bounds for tasks scheduled by global preemptive job-level fixed-priority scheduling policies (e.g., EDF and FP) on homogeneous multicore platforms by performing a reachability analysis using time-label-transition systems. Our solution uses 2 orders of magnitude less memory than UPPAAL and identifies on average 12% (up to 39%) more schedulable task sets than sufficient schedulability analyses (e.g., for systems with 4 cores and 10 tasks).

The activity framework is a promising model-based design approach for Flexible Manufacturing Systems (FMS). It is used in industry for specification and analysis of FMS. It provides an intuitive specification language with a hierarchical view of the system's actions and events, activities built from them, and an automaton that captures the overall behavior of the system in terms of sequences of activities corresponding to its accepted words. It also provides a scalable timing analysis method using max-plus linear systems theory. The framework currently requires manual implementation of the supervisory controller that governs the system behavior. This is labor-intensive and error-prone. In this article, we turn the framework into a model-driven approach by introducing an execution architecture and execution engine that allow a specification to be executed in a time- and behavior-preserving fashion. We prove that the architecture and engine preserve the specified ordering of actions and events in the specification as well as the timing thereof up to a specified bound. We validate our approach on a prototype production system.

Market trends show advanced usage of safety-critical systems with novel services based on smart data analytics. Customers require continuous updates to applications and services and seek lower costs, and easy-to-install solutions (maintenance) for safety-critical cyber-physical systems (CPS). Leveraging edge and cloud technologies has the potential to enhance safety-critical CPS, also in regulated environments. This is only possible when safety, performance, cybersecurity, and privacy of data are kept at the same level as in on-device only safety-critical CPS.This paper presents thirteen selected safety and performance concepts for distributed device-edge-cloud CPS solutions. This early result of the TRANSACT project aims to ensure needed end-to-end performance and safety levels from an end-user perspective, to extend edge and cloud benefits of more rapid innovation and inclusion of value-added services, also to safety-critical CPS.

Real-time systems are commonly used in safety-critical applications which require tasks to be completed before their deadlines, even in the presence of faults. Thus, fault tolerance becomes essential to ensure a certain level of reliability in safety-critical real-time systems [1]. To achieve fault tolerance in computer systems, redundancy can be implemented either in space (spatial redundancy) or time (time redundancy) [2]. Unlike spatial redundancy which involves increasing hardware resources, time redundancy focuses on re-execution or multiple executions of software on the same hardware resources [3] and therefore is better suited for embedded systems with limited cost and size constraints that are subject to transient faults more often than permanent faults [2], [4].

Safety and control functions of modern automotive systems are implemented as chains of periodic data producer/consumer tasks run at different rates. To simplify the development of such systems, automotive standards relax synchronization requirements between tasks, allowing a task to run even if its dependent tasks are inactive. This gives birth to more complex timing constraints such as data age, which specifies the maximum duration of time that input data of a task chain is still allowed to affect the output of the chain. We develop a technique to compute lower and upper bounds on the data age of multi-rate task chains that execute upon a heterogeneous computing platform using a job-level fixed-priority scheduling policy. To the best of our knowledge, we are the first to consider uncertainties in the timing parameters (namely, both the release jitter and execution-time variation) of the tasks. Such an assumption makes the problem more challenging as it increases the number of possible schedules that the system may encounter during its lifespan. We represent these uncertainties by timing intervals and devise an analysis that uses those intervals to explore possible dependencies between jobs. We incorporated various pruning rules to make the analysis much faster and far less pessimistic than the state of the art. Our evaluations on an industrial case study as well as synthetic task sets show that our analysis reduces the overestimation of the data age by 36% on average (and up to 42%) in comparison to the state of the art when the number of tasks varies from 10 to 50.

System-Performance Engineering (SysPE) encompasses modeling formalisms, methods, techniques, and industrial practices to design systems for performance, where performance is taken integrally into account during the whole system life cycle. Industrial SysPE state of practice is generally model-based. Due to the rapidly increasing complexity of systems, there is a need to develop and establish model-driven methods and techniques. To structure the field of SysPE, we identify (1) industrial challenges motivating the importance of SysPE, (2) scientific challenges that need to be addressed to establish model-driven SysPE, (3) important focus areas for SysPE and (4) best practices. We conducted a survey to collect feedback on our views. The responses were used to update and validate the identified challenges, focus areas, and best practices. The final result is presented in this paper. Interesting observations are that industry sees a need for better design-space exploration support, more than for additional performance modeling and analysis techniques. Also tools and integral methods for SysPE need attention. From the identified focus areas, scheduling and supervisory control is seen as lacking established best practices.

LSAT (Logistics Specification and Analysis Tool) is a tool for rapid design-space exploration of supervisory controllers that steer the product logistics and orchestrate the behavior in flexible manufacturing systems. LSAT enables lightweight modeling of system resources, system behavior, and timing characteristics. The tool provides various visualizations to explore the controlled system behavior and analysis and optimization techniques to improve the system performance. Compared to existing approaches, LSAT provides concise modeling using languages tailored towards the application domain, with domain concepts are elements of the language. LSAT provides efficient performance analysis by exploiting the structure of the models. In this paper, we describe the rationale for developing LSAT and position it with respect to other performance modeling and analysis tools. We illustrate the benefits of LSAT with an example system.

This article presents a modular automaton-based framework to specify flexible manufacturing systems and to optimize the makespan of product batches. The Batch Makespan Optimization (BMO) problem is NP-Hard and optimization can therefore take prohibitively long, depending on the size of the state-space induced by the specification. To tame the state-space explosion problem, we develop an algebra based on automata equivalence and inclusion relations that consider both behavior and structure. The algebra allows us to systematically relate the languages induced by the automata, their state-space sizes, and their solutions to the BMO problem. Further, we introduce a novel constraint-based approach to systematically prune the state-space based on the the notions of nonpermutation-repulsiveness and permutation-attractiveness. We prove that constraining a nonpermutation-repulsing automaton with a permutation-attracting constraint always reduces the state-space. This approach allows us to (i) compute optimal solutions of the BMO problem when the (additional) constraints are taken into account and (ii) compute bounds for the (original) BMO problem (without using the constraints). We demonstrate the effectiveness of our approach by optimizing an industrial wafer handling controller.

We introduce a technique to verify temporal properties expressed in MTL on Interval Message Sequence Charts (IMSC), a model based on UML2.0 MSC that captures the timed execution of component-based software systems.We accomplish this by encoding the IMSC and the property of interest in a constraint satisfaction problem, which is then solved with an SMT solver.We demonstrate the scalability of this technique with a synthetic case study and a large-scale industrial case study.

This paper introduces a new measurement-based approach to get insights in timing bottlenecks of existing largescale component-based software systems. As a foundation we formalize a subset of the Message Sequence Charts standards (Z120 and UML2.0) called Timed Message Sequence Charts (TMSC). TMSCs capture the execution of component-based software systems in an intuitive way and are amenable to formal timing analysis. We introduce a scalable heuristicsbased technique to automatically infer TMSCs from execution traces. We demonstrate the effectiveness of our approach by automatically computing critical paths in the software of an industrial lithography scanner to identify timing bottlenecks.

We develop a model-based approach to predict timing of service-based software applications on Linux-based multi-core platforms for alternative mappings (affinity and priority settings). Service-based applications consist of communicating sequential (Linux) processes. These processes execute functions (also called services), but can only execute them one at a time. Models are inferred automatically from execution traces to enable timing optimization of existing (legacy) systems. Our approach relies on a linear progress approximation of functions. We compute the expected share of each function based on the mapping (affinity and priority) parameters and the functions that are currently active. We validate our models by carrying out a controlled lab experiment consisting of a multi-process pipelined application mapped in different ways on a quadcore Intel i7 processor. A broad class of affinity and priority settings is fundamentally unpredictable due to Linux binding policies. We show that predictability can be achieved if the platform is partitioned in disjoint clusters of cores such that i) each process is bound to such a cluster, ii) processes with non real-time priorities are bound to singleton clusters, and iii) all processes bound to a non-singleton cluster have different real-time priorities. For mappings using singleton clusters with niceness priorities only, our model predicts execution latencies (for each pipeline iteration) with errors less than 5% relative to the measured execution times. For mappings using a non-singleton cluster (with different real-time priorities) relative errors of less than 2% are obtained. When real-time and niceness priorities are mixed, we predict with errors of 7%.