HRT-HOOD. A Structured Design Method for Hard Real-time Systems

Transcription

1 HRT-HOOD A Structurd Dsign Mthod for Hard Ral-tim Systms A. Burns and A.J. Wllings Ral-tim and Distributd Systms Rsarch Grou, Dartmnt of omutr Scinc Univrsity of York, Hslington, York, YO1 5DD, UK burns@minstr.york.ac.uk, andy@minstr.york.ac.uk Kywords: Structurd Dsign Mthods, Schdulability Analysis, Dndability ABSTRAT Most structurd dsign mthods claim to addrss th nds of hard ral-tim systms. Howvr, fw contain abstractions which dirctly rlat to common hard ral-tim activitis, such as riodic or soradic rocsss. Furthrmor, th mthods do not constrain th dsignr to roduc systms which can b analysd for thir timing rortis. In this ar w rsnt a structurd dsign mthod calld HRT-HOOD (Hard Ral-Tim Hirarchical Objct Orintd Dsign). HRT-HOOD is an xtnsion of HOOD, and includs objct tys which nabl common hard ral-tim abstractions to b rrsntd. Th mthod is rsntd in th contxt of a hard ral-tim systm lif cycl, which nabls issus of timlinss and dndability to b addrssd much arlir on in th dvlomnt rocss. W argu that this will nabl dndabl ral-tim systms to b nginrd in a mor cost ffctiv mannr than th currnt ractis, which in ffct trats ths toics as rformanc issus. To illustrat our aroach w rsnt a siml cas study of a Min Drainag ontrol Systm, and show how it can b dsignd using th abstractions rsntd in th ar. 1. Introduction Th most imortant stag in th dvlomnt of any ral-tim systm is th gnration of a consistnt dsign that satisfis an authoritativ scification of rquirmnts. Whr ral-tim systms diffr from th traditional data rocssing systms is that thy ar constraind by crtain non-functional rquirmnts (.g. dndability and timing). Tyically th standard structurd dsign mthods do not catr wll for xrssing ths tys of constraintskotz1991]. Th objctiv of this ar is to rsnt a structurd dsign mthod which is tailord towards th construction of ral-tim systms in gnral, and hard ral-tim systms in articular. W us th trm hard ral-tim systms to man thos systms which hav comonnts which must roduc HOOD is a tradmark of th HOOD Usr Grou Th work has bn suortd, in art, by th Euroan Sac Agncy (ESTE ontract 9198/90/NL/SF) and by th UK Dfnc Rsarch Agncy (ontract Numbr 2191/023). This ar has bn acctd for ublication in th Ral-tim Systms Journal.

2 - 2 - timly srvics; failur to roduc a srvic within th rquird tim intrval may rsult in svr damag to th systm or th nvironmnt, and may otntially caus loss of lif (for xaml in avionics systms). Rathr than dvloing a nw mthod from scratch, th HOOD mthod is usd as a baslin. Th nw mthod, calld HRT-HOOD (Hard Ral-Tim HOOD), was dsignd as art of an Euroan Sac Agncy (ESA) suortd rojct. HOOD was chosn as th bas-lin bcaus ESA currntly rcommnd th us of HOOD for thir systms dvlomnt. Howvr, w bliv th idas rsntd in th ar can b usd to xtnd othr common dsign mthods such as MascotSimson1986]. Although hard ral-tim systms can b dsignd using structurd mthods such as HOOD and Mascot, ths mthods lack xlicit suort for common hard raltim abstractions. onsquntly, thir us is rror ron and can lad to systms whos ral-tim rortis cannot b analysd. HRT-HOOD, in contrast, constrains th systm dcomosition so that th final dsign in amnabl to timing analysis using such tchniqus as fixd riority or arlist dadlin schduling. A dsign mthod cannot b rsntd in isolation but must b considrd within th contxt of th ovrall systm lif cycl of which it is a art. Unfortunatly th traditional systm lif cycl also fails to addrss adquatly th nds of th hard ral-tim systms dsignr. Sction 2 of this ar thrfor givs an ovrviw of th ral-tim systms dsign rocss and, in Sction 3, th HRT- HOOD systms lif cycl, which mbracs hard ral-tim nds, is rsntd. Th logical and hysical architctural dsign activitis ar idntifid as bing th ky aras whr hard ral-tim issus must b addrssd. Sction 4 considrs th logical architctur activity and idntifis th abstractions ndd to rrsnts hard ral-tim systms. Sction 5 thn addrsss how th logical dsign can b mad onto th hysical rsourcs of th systm. Toics such as schdulability and dndability analysis ar considrd at this stag. Sction 6, rsnts th HRT-HOOD mthod which addrsss th ky issus introducd in sctions 4 and 5. Sction 7 rsnts a siml cas study which illustrats th aroach. Sction 8 brifly comars HRT-HOOD with othr structurd dsign mthods. Finally in sction 9 w rsnt our conclusions. Objct Orintd Dsign Throughout this ar w shall us an objct abstraction for th dsign mthod. In articular w will us an xtndd HOOD objct framworkagncy1991]. HOOD attmts to combin th advantags of objct-orintd dsign and hirarchical dcomosition. It thrfor suorts thr basic softwar nginring rincilsagncy1991]: 1) Abstraction, information hiding and ncasulation An objct is dfind by th srvic it rovids to its usrs; th intrnal dtails ar hiddn. Th srvics it rovids ar scifid in th objct s intrfac. Th intrnal dtails ar dscribd in Oration ontrol Structur (OS) rocdurs, and its bhaviour in a synchronisation agnt calld an OBjct ontrol Structur (OBS). 2) Hirarchical dcomosition arnt objcts may b dcomosd into child objcts; HOOD uss th trm "includ" to rrsnt th arnt-child rlationshi. 3) ontrol structuring Orations on objcts ar activatd by control flows (thrads). In gnral thr may b svral thrads orating simultanously in an objct. HOOD uss th trm "us" to indicat that on objct rquirs th srvics of anothr. A HOOD objct has static and dynamic rortis. Th static rortis ar dfind to b th

3 - 3 - objct s intrfac, and th intrnal comonnts of th objct which imlmnts th functionality imlid by th intrfac. HOOD dfins th dynamic rortis of an objct by dscribing th ffct on th calling objct of invoking an oration. Ths ar: Squntial flow: whr control is transfrrd dirctly to th rquird oration. Th flow of control is dscribd within th intrnals of th oration (th OS). Aftr comltion, control is rturnd in th calling objct. aralll flow: whr control is not transfrrd dirctly to th calld objct but an indndnt flow is activatd in th Objct ontrol Structur (OBS) of th calld objct. This activation taks th form of an xcution rqust for th rquird oration. Th raction of th objct to this rqust will dnd on th intrnal stat of th calld objct. As with squntial flow, th OS for ach oration dfins th logic of th oration. For a mor dtaild discussion of HOOD s th HOOD rfrnc manualagncy1991] or RobinsonRobinson1992]. 2. Ovrviw of th HRT-HOOD Dsign rocss It is incrasingly rcognisd that th rol and imortanc of non-functional rquirmnts in th dvlomnt of comlx critical alications has hithrto bn inadquatly arciatdburns1991c]. Scifically, it has bn common ractic for systm dvlors, and th mthods thy us, to concntrat rimarily on functionality and to considr non-functional rquirmnts comarativly lat in th dvlomnt rocss. Exrinc shows that this aroach fails to roduc safty critical systms. For xaml, oftn timing rquirmnts ar viwd simly in trms of th rformanc of th comltd systm. Failur to mt th rquird rformanc oftn rsults in ad hoc changs to th systm. This is not a cost ffctiv rocss. Non-functional rquirmnts includ dndabilitylari1989] (.g. rliability, availability, safty and scurity), timlinss (.g. rsonsivnss, ordrlinss, frshnss, tmoral rdictability and tmoral controllability), and dynamic chang managmntkramr1988] (i.. incororating volutionary changs into a non-sto systm). Ths rquirmnts, and th constraints imosd by th xcution nvironmnt, nd to b takn into account throughout th systm dvlomnt lif cycl. W bliv that if hard ral-tim systms ar to b nginrd to high lvls of dndability, th ral-tim dsign mthod must rovid: th xlicit rcognition of th tys of activitis/objcts that ar found in hard ral-tim systms (i.. cyclic and soradic activitis); th intgration of aroriat schduling aradigms with th dsign rocss; th xlicit dfinition of th alication timing rquirmnts for ach objct; th xlicit dfinition of th alication rliability rquirmnts for ach objct; th dfinition of th rlativ imortanc (criticality) of ach objct to th succssful functioning of th alication; th suort for diffrnt mods of oration many systms hav diffrnt mods of oration (.g., tak-off, cruising, and landing for an aircraft); all th timing and imortanc charactristics will thrfor nd to b scifid on a r mod basis; th xlicit dfinition and us of rsourc control objcts; th dcomosition to a softwar architctur that is amnabl to rocssor allocation, schdulability and timing analysis;

4 - 4 - facilitis and tools to allow th schdulability analysiskligrman1986] to influnc th dsign as arly as ossibl in th ovrall dsign rocss; tools to rstrict th us of th imlmntation languag so that worst cas xcution tim analysis can b carrid out; tools to rform th worst cas xcution tim and schdulability analysis. In th nxt sction w show how ths ky ascts can b addrssd by xtnding th usual softwar dvlomnt lif cycl. 3. Th HRT-HOOD Softwar Dvlomnt Lif ycl Most traditional softwar dvlomnt mthods (including HOOD) incororat a lif cycl modl in which th following activitis ar rcognisd: Rquirmnts Dfinition during which an authoritativ scification of th systm s rquird functional and non-functional bhaviour is roducd. It is byond th sco of this ar to addrss issus of rquirmnts catur and analysis. W assum that th tchniqus for idntifying objcts and thir orations ar thos dscribd in th HOOD Usr ManualAgncy1989b]. Architctural Dsign during which a to-lvl dscrition of th roosd systm is dvlod. Dtaild Dsign during which th comlt systm dsign is scifid. oding during which th systm is imlmntd. Tsting during which th fficacy of th systm is tstd. For hard ral-tim systms this has th significant disadvantag that timing roblms will only b rcognisd during tsting, or wors aftr dloymnt. A constructiv way of dscribing th rocss of systm dsign is as a rogrssion of incrasingly scific commitmntsdobson1990, Burns1990a]. Ths commitmnts dfin rortis of th systm dsign which dsignrs orating at a mor dtaild lvl ar not at librty to chang. Thos ascts of a dsign to which no commitmnt is mad at som articular lvl in th dsign hirarchy ar ffctivly th subjct of obligations that lowr lvls of dsign must addrss. Early in dsign thr may alrady b commitmnts to th structur of a systm, in trms of objct dfinitions and rlationshis. Howvr, th dtaild bhaviour of th dfind objcts rmains th subjct of obligations which must b mt during furthr dsign and imlmntation. Th rocss of rfining a dsign transforming obligations into commitmnts is oftn subjct to constraints imosd rimarily by th xcution nvironmnt (Figur 1). Th xcution nvironmnt is th st of hardwar and softwar comonnts (.g. rocssors, task disatchrs, dvic drivrs) on to of which th systm is built. It may imos both rsourc constraints (.g. rocssor sd, communication bandwidth) and constraints of mchanism (.g. intrrut rioritis, task disatching, data locking). To th xtnt that th xcution nvironmnt is immutabl ths constraints ar fixd.

5 - 5 - Rquirmnts Obligations ommitmnts onstraints Excution Environmnt Figur 1: Obligations, ommitmnts and onstraints Obligations, commitmnts and constraints hav an imortant influnc on th architctural dsign of any alication. W thrfor dfin two activitis of th architctural dsignburns1991c]: th logical architctur dsign activity; th hysical architctur dsign activity. Th logical architctur mbodis commitmnts which can b mad indndntly of th constraints imosd by th xcution nvironmnt, and is rimarily aimd at satisfying th functional rquirmnts (although th xistnc of timing rquirmnts, such as nd-to-nd dadlins, will strongly influnc th dcomosition of th logical architctur). Th hysical architctur taks ths functional rquirmnts and othr constraints into account, and mbracs th non-functional rquirmnts. Th hysical architctur forms th basis for assrting that th alication s non-functional rquirmnts will b mt onc th dtaild dsign and imlmntation hav takn lac. It addrsss timing and dndability rquirmnts, and th ncssary schdulability analysis that will nsur (guarant) that th systm onc built will function corrctly in both th valu and tim domains (within som failur hyothss). To undrtak this analysis it will b ncssary to mak som initial stimations of th xcution tim of th roosd cod (and othr rsourc rquirmnts such as LAN usag), and to hav availabl th tim dndnt bhaviour of th targt rocssor and othr ascts of th xcution nvironmnt. Dndability analysis valuats th dsign with rsct to rliability, safty and scurity. Although th hysical architctur is a rfinmnt of th logical architctur its dvlomnt

6 - 6 - will usually b an itrativ and concurrnt rocss in which both modls ar dvlod/modifid. Th analysis tchniqus mbodid in th hysical architctur can, and should, b alid as arly as ossibl. Initial rsourc budgts can b dfind that ar thn subjct to modification and rvision as th logical architctur is rfind. In this way a fasibl dsign is trackd from rquirmnts through to dloymnt. Onc th architctural dsign activitis ar comlt, th dtaild dsign can bgin in arnst and th cod for th alication roducd. Whn this has bn achivd, th xcution rofil of th cod must again b stimatd (using a worst cas xcution tim analysr tool) to nsur that th initial stimatd worst cas xcution tims ar indd accurat. If thy ar not (which will usually b th cas for a nw alication), thn ithr th dtaild dsign must b rvisitd (if thr ar small dviations), or th dsignr must rturn to th architctural dsign activitis (if srious roblms xist). If th stimation indicats that all is wll, thn tsting of th alication rocds. This should involv masuring th actual tim of th cod s xcution. Th modifid lif cycl is rsntd in Figur 2. Rquirmnts Dfinition Logical Architctur Dsign hysical Architctur Dsign (Schdulability Analysis) Excution Environmnt onstraints Dtaild Dsign oding including od Timing Estimations Excution Environmnt onstraints Tsting including od Timing Masurmnts Figur 2: Th Hard Ral-tim Lif ycl Of cours as th dtaild dsign rogrsss, it may b ncssary to rvisit th logical and hysical architcturs to rovid nw or modifid functionality (ossibly as a rsult of a chang in rquirmnts).

7 - 7 - Dtaild Dsign and oding should follow th usual rocss, although cod masurmnt for worst cas timing bhaviour is a comlx issu. It will b ncssary to constrain th way in which cod is writtn so that analysis of xcution tim can b carrid out in a way that is not too ssimistic. For xaml all loos must b boundd, and thr must b limitd rcursion only. 4. Logical Architctur Dsign Thr ar two ascts of any dsign mthod which facilitat th logical architctur dsign of hard ral-tim systms. Firstly, xlicit suort must b givn to th abstractions that ar tyically rquird by hard ral-tim systm dsignrs. W tak th viw that if dsigns ar to b wll structurd so that thy can b analysd, thn it is bttr to rovid scific dsign guidlins rathr thn gnral dsign abstractions. For xaml, suorting th abstraction of a riodic activity allows th structur of that activity to b visibl to th dsign rocss which, in turn, facilitats its analysis. In contrast, allowing th dsignr to construct riodic activitis out of som mor rimitiv "task" activity roducs dsigns which ar mor difficult to analys. larly, car must b takn to nsur that th dsign mthod dos not bcom cluttrd with too many abstractions, howvr, it is imortant that th dsign mthod allows th xrssion of imortant analysabl rogram structurs. Th scond asct involvs constraining th logical architctur so that it can b analysd during th hysical architctur dsign activity. In articular dsigns ar forcd to ma down to a comutational modl which facilitats analysis. For xaml, th modl suorts singl thradd objcts which intract via data-orintd communication and synchronisation mchanisms (rathr than via tightly synchronous communication). Ths ascts ar now discussd in dtail Suorting ommon Hard Ral-tim Abstractions Th outcom of th logical architctur dsign activity is a collction of trminal objcts (objcts which do not rquir furthr dcomosition) with all thir intractions fully dfind. It is assumd that som form of functional dcomosition rocss has ld to th dfinition of ths trminal objcts. Although this dcomosition is ssntially functional, th xistnc of timing rquirmnts is a major drivr in th construction of th alication s architctur. Timing rquirmnts ar usually drivd from othr (highr-lvl) rquirmnts such as controllability. Thy normally tak th form of dadlins btwn inut and outut actions. Ths inut/outut rlationshis also rrsnt functional bhaviour, and hnc th initial dcomosition of th systm can b along functional lins. In HOOD only two basic objct tys ar dfind: ASSIVE and ATIVE. HRT-HOOD xtnds th numbr of bas tys to includ: ROTETED, YLI and SORADI. Thy ar dfind as follows. ASSIVE objcts which hav no control ovr whn invocations of thir orations ar xcutd, and do not sontanously invok orations in othr objcts. ATIVE objcts which may control whn invocations of thir orations ar xcutd, and may sontanously invok orations in othr objcts. ATIVE objcts ar th most gnral class of objcts and hav no rstrictions lacd on thm. ROTETED objcts which may control whn invocations of thir orations ar xcutd, and do not sontanously invok orations in othr objcts; in gnral ROTETED objcts may not hav arbitrary synchronisation constraints and must b analysabl for th blocking

8 - 8 - tims thy imos on thir callrs. YLI objcts which rrsnt riodic activitis, thy may sontanously invok orations in othr objcts, but th only orations thy hav ar rqusts which dmand immdiat attntion (thy rrsnt asynchronous transfr of control, AT, rqusts). SORADI objcts which rrsnt soradic activitis; SORADI objcts may sontanously invok orations in othr objcts; ach soradic has a singl oration which is calld to invok th soradic, and on or mor orations which ar rqusts which dmand immdiat attntion (thy rrsnt asynchronous transfr of control rqusts). HRT-HOOD distinguishs btwn th synchronisation rquird to xcut th orations of an objct and any intrnal indndnt concurrnt activity within th objct. Th synchronisation agnt of an objct is calld th Objct ontrol Structur (OBS). Th concurrnt activity within th objct is calld th objct s THREAD. Th thrad xcuts indndntly of th orations, but whn it xcuts orations th ordr of th xcutions is controlld by th OBS. A hard ral-tim rogram dsignd using HRT-HOOD will contain at th trminal lvl only YLI, SORADI, ROTETED and ASSIVE objcts. ATIVE objcts, bcaus thy cannot b fully analysd, will only b allowd for background activity. ATIVE objct tys may also b usd during dcomosition of th main systm but must b transformd into on of th abov tys bfor raching th trminal lvl. YLI and SORADI activitis ar common in ral-tim systms; ach contains a singl thrad that is schduld at run-tim. ROTETED objcts control accss to data that is shard by mor than on thrad (i.. YLI or SORADI objct); in articular thy rovid mutual xclusion. ROTETED objcts ar similar to monitorshoar1974] and conditional critical rgionsbrinch-hansn1973] in that thy can block a callr if th conditions ar not corrct for it to continu. A ASSIVE objct is ithr usd by only on othr objct or whn it can b usd concurrntly without rror. With ths tys of trminal objcts othr common aradigms usd in hard ral-tim systms can b suortd, in articular rcdnc constraind activitis. Ths involv a sris of comutations through trminal objcts. Thy ar likly to occur in a dsign which must rflct transaction dadlins. For xaml, considr a ractiv systm which on rcit of a valu from its inut snsors must roduc an outut valu to an actuator within a crtain riod. Th roduction of th actuator stting might rquir th coordination of mor than on objcts (oftn in th form of rcdnc constraints). Th trm transaction is usd hr to rrsnt th totality of comutation and communication rquird to roduc th outut. At a high lvl of dsign, a transaction is rrsntd by a singl objct: YLI or SORADI dnding on whthr th transaction is tim drivn or vnt drivn. Th objct is thn dcomosd into a st of trminal rcdnc constraind objcts. If th first activity of th transaction is cyclic thn thr is a cyclic rcdnc constraind activity (or cyclic transaction); if th first activity wr soradic (.g., vnt triggrd) thn it would b a soradic rcdnc constraind activity (or soradic transaction). Th ky rorty of rcdnc constraind activitis is that any activity within it can start immdiatly its rdcssor has trminatd. Hnc, thr is a collction of bfor and aftr rlationshis. In summary, th logical architctur dsign rocss may commnc with th roduction of ATIVE and ASSIVE objcts, and by a rocss of dcomosition will lad to th roduction of trminal objcts of th aroriat charactr. Transactions ar thrfor rrsntd as YLI or SORADI objcts which dcomos to trminal objcts with rcdnc constraind and rlatd

9 - 9 - activitis onstraining th Dsign for Analysis In ordr to analys th full dsign crtain constraints ar rquird. Ths ar mainly concrnd with th allowd communication/synchronisation btwn objcts. Thy ar: (a) (b) (c) (d) YLI and SORADI objcts may not call arbitrary blocking orations in othr YLI or SORADI objcts. YLI and SORADI objcts may call orations which ffct an asynchronous transfr of control orations in othr YLI or SORADI objcts. ROTETED objcts may not call blocking orations in any othr objct. ASSIVE orations contain only squntial cod which dos not nd to synchronis with any othr objct. Whr aroriat th dsign mthod itslf rohibits th abov bhaviours. Asynchronous transfr of control is usd to gt th immdiat attntion of a thrad. Th dtails of how it is imlmntd is, howvr, a concrn for th imlmntation languag and th undrlying orating systm (or krnl). It can b usd during fast mod changs but is not a gnral rquirmnt; many alications will not mak us of th facility. Othr constraints may b lacd on th dsign to aid dndability analysis. For xaml, to facilitat objct rlication it may b ncssary to nsur that a articular objct is dtrministic. It is imortant to mhasis that any hard ral-tim dsign mthod must constrain th dsign rocss if it is to roduc analysabl softwar. HRT-HOOD is xlicitly dsignd to nsur that systm dcomosition conforms to a st of constraints that facilitats analysis of th final systm. 5. hysical Architctur Dsign Th hysical architctural dsign activity is concrnd with maing th logical architctur onto th rquird hysical rsourcs in th targt systm. In ordr to undrtak th ncssary analysis, w must: hav a dsign xrssd in a mannr that facilitats analysis hav a mans of rdicting th bhaviour of th dsign on a givn latform (hardwar and krnl). Th logical architctur dsign activity nsurs that th dsign conforms to a comutational modl which facilitats timing analysis. Th xact form this analysis must tak is not dfind by HRT- HOOD. W hav, howvr, succssfully intgratd th HRT-HOOD dsign rocss with th us of static riority analysis and rmtiv disatchingaudsly1993, Burns1993a, Burns1993b]. Th construction of cyclic or bst-ffort schduling would also b ossibl with th comutational modl. In gnral hysical architctur dsign is concrnd with four activitis: 1) objct allocation th allocation of objcts in th logical architctur to rocssors within th constraints imosd by th functional and non-functional rquirmnts (.g, nsuring that all dvic controllr objcts ar locatd on th sits whr th controlld dvics rsid, or that all rlicas run at sarat sits) For som dsigns th mhasis of th hysical architctural dsign activity may b on dtrmining th minimal rsourcs rquird to mt all th timing and dndability rquirmnts. Th idas rsntd in this sction qually aly to this cas.

10 - 10-2) ntwork schduling schduling th communications ntwork so mssag dlays ar boundd 3) rocssor schduling dtrmining th schdul (static or dynamic) which will nsur that all tasks within all objcts rsiding on all rocssors will mt thir dadlins 4) dndability for xaml, dtrmining whthr an objct should b rlicatd to tolrat hardwar failurs, stimating th comlxity of an objct to s whthr softwar fault tolrant tchniqus should b mloyd In gnral, th thr activitis of task allocation, rocssor schduling and ntwork schduling ar all N-hard roblmsburns1991a]. This has ld to a viw that thy should b considrd saratly. Unfortunatly, it is oftn not ossibl to obtain otimal solutions (or vn fasibl solutions) if th thr activitis ar tratd in isolation. For xaml, allocating a task T to a rocssor will incras th comutational load on, but may rduc th load on th communications mdia (if T communicats with tasks on ), and hnc th rsons tim of th communications mdia is rducd, allowing communications dadlins lswhr in th systm to b mt. Th tradoffs can bcom vry comlx as th hard ral tim architctur bcoms mor xrssiv. It is byond th sco of this ar to discuss ths issus. Th radr is rfrrd to th rlvant litraturdhall1978, Bannistr1983, Davari1986, hn1990, Ramamritham1990, Wilf1986, Zhao1987, Fohlr1989, Audsly1991a, Tindll1992, Xu1990]. Whatvr allocation and schduling mthod is usd, th dsign mthod must suort th dfinition of a hysical architctur by: 1) allowing timing attributs to b associatd with objcts, 2) roviding th abstractions with which th dsignr can xrss th handling of timing (and othr run-tim) rrors Th hysical dsign must of cours b fasibl within th contxt of th xcution nvironmnt. This is guarantd by th allocation and schdulability analysis. Issus of dndability must also b addrssd during this activity. Both hardwar and softwar failurs must b considrd. As an xaml of th issus addrssd in th construction of th hysical architctur, suos that th rliability rquirmnts togthr with knowldg of th hardwar s failur charactristics imly that a articular objct b rlicatd (so that a coy is always availabl, givn th systm failur hyothss). Th rlicatd objct is a singl ntity in th logical architctur; in th hysical architctur it bcoms svral objcts, ach mad to a articular rocssor. Suos furthr that th chosn aroach to obtaining th rquird lvl of rliability is such that th rlication is activ, that is, all cois must always hav th sam stat. Th hysical architctur xrsss this rorty, and maks xlicit th obligations: a) that th objct is dtrministic, and b) that an atomic broadcast rotocol must b rovidd or imlmntd. Othr forms of rlication such as ladr/followrbarrtt1990] or assiv rlication can also b scifid. Each will rsnt scific obligations Objct Attributs Th way in which th non-functional rquirmnts ar scifid during th hysical architctur dsign activity is via objct attributs. All trminal objcts hav associatd ral-tim attributs. Many attributs ar associatd with maing th timing rquirmnts on to th logical dsign (.g., dadlin, imortanc). Ths must b st bfor th schdulability and dndability analysis can

11 ! " b rformd. Othr attributs (such as riority, rquird rlication tc) can only b st during this analysis. For ach scifid mod of oration, th YLI and SORADI objcts hav a numbr of tmoral attributs dfind: Th riod of xcution for ach YLI objct. Th minimum arrival intrval for ach SORADI objct. Offst tims for rlatd objcts. Dadlins for all soradic and cyclic activitis. Two forms of dadlin ar idntifid. On is alid dirctly to a soradic or cyclic activity. Th othr is alid to a rcdnc constraind activity (transaction); hr thr is a dadlin on th whol activity and hnc only th last activity has a tru dadlin. Th dadlins for th othr activitis must b drivd so that th comlt transaction satisfis its timing rquirmnts (in all cass). To undrtak th schdulability analysis, th worst cas xcution tim for ach thrad and all orations (in all objcts) must b known. Aftr th logical dsign activity ths can b stimatd (taking into account th xcution nvironmnt constraints) and aroriat attributs assignd. larly, th bttr th stimats th mor accurat th schdulability analysis. Good stimats com from comonnt rus or from argumnts of comarison (with xisting comonnts on othr rojcts). During dtaild dsign and coding, and through th dirct us of masurmnt during tsting, bttr stimats will bcom availabl which tyically will rquir th schdulability analysis to b rdon. In gnral not all activitis within th systm will b at th sam lvl of criticality. YLI and SORADI objcts will thrfor b annotatd with a criticality lvl (.g. safty critical, mission critical, background). As wll as roviding valuabl information for th schdulability analysis, th criticality lvl may also b usd during th validation and vrification of th total dsign. ritical activitis may rciv mor rigorous analysis of both thir timing charactristics and thir functional charactristics, than lss critical activitis. Not that although ASSIVE and ROTETED objcts do not hav a dirctly associatd criticality (imortanc) lvl, for validation and vrification uross, thy will b assignd a criticality lvl that quals th highst of thir usrs. During th hysical architctur dsign activity it will b ncssary to commit to a run-tim schduling aroach, for xaml static riority schduling with rioritis assignd using rat or dadlin monotonic schduling thoryliu1973, Audsly1993]. This rquirs othr attributs to b suortd. For xaml th riority of YLI and SORADI objcts. ROTETED objcts may b imlmntd by having ciling rioritis assignd that ar at last as high as th maximum riority of th thrads that us th orations dfind on that objctrajkumar1989]. In gnral th hysical architctur dsign is concrnd with annotating (via attributs) th objcts containd in th logical dsign. Thr ar howvr a numbr of cass in which xtra objcts may b addd during this activity. In addition to rlication for availability it may b dsirabl to rduc outut jittr (a non-functional rquirmnt); a YLI objct (say) with riod T and dadlin D, which could roduc its outut anywhr btwn its minimal xcution tim and D, may b rlacd by two rlatd objcts and a ROTETED objct. Th first objct which contains all th functionality of th original will hav a dadlin of D1 (D1 < D) by which tim it will hav lacd th outut data in a ROTETED objct. Th scond YLI rocss, which actually rforms th outut and which also has a cyclic tim of T, will hav an offst of D1 and a dadlin

12 of D-D1. Th closr D1 is mad to D th smallr th jittr. Thr is a final imortant oint to mhasis about th activity of architctural dsign that w hav calld th hysical dsign. Although thr ar bnfits from sing it as a distinct activity, it will tyically rocd concurrntly with th logical architctural dsign. It may b natural to add timing rquirmnts to objcts as thy ar dfind. Howvr, th full analysis can only b undrtakn onc a comlt st of trminal objcts is known. Furthrmor, th ovrhads associatd with th roosd xcution nvironmnt must b takn into account whn stimating xcution tims tc Handling Timing (and othr run-tim) Errors Schdulability analysis can only b ffctiv if th stimations/masurmnts of worst cas xcution tim is accurat. Within th timing domain two stratgis can b idntifid for limiting th ffcts of a fault in a softwar comonnt: # Do not allow an objct to us mor comutation tim (budgt tim) than it rqustd. $ Do not allow an objct to xcut byond its dadlin. On would xct a dsign mthod to allow a dsignr to scify th actions to b takn if objcts ovrrun thir allocatd xcution tim or miss thir dadlins. In both of ths cass th objct could b informd (via an xction) that a timing fault will occur so that it can rsond to th rror (within th original tim fram, b it budgt or dadlin). Thr is an obligation on th xcution nvironmnt to undrtak th ncssary tim masurmnts and to suort a mans of informing an objct that a fault has occurrd. Thr is also an obligation on th coding languag to rovid rimitivs that will allow rcovry to b rogrammd. SORADI objcts rsnt furthr difficultis if thy xcut mor oftn than was nvisagd whn th schdulability analysis was carrid out. Thr is an obligation on th xcution nvironmnt to nsur that a SORADI objct dos not xcut too arly and to allow rcovry action to b takn if invocations com too frquntly. A common systm aradigm that maks us of SORADI objcts is intrrut drivn I/O. Th logical architctur will ma th intrrut to th non-blocking start oration of a SORADI objct. Th arrival of an intrrut will thrfor rlas th SORADI objct. For th schdulability analysis, undrtakn as art of dfining th hysical architctur, th intrrut will b modlld as a soradic action with a minimum arrival intrval. Intrruts can also b mad to orations on ROTETED objcts, which may furthr rlas SORADI objcts. If th failur hyothsis of th hardwar systm is that intrruts will not occur too oftn thn th abov modl is adquat. Howvr if th softwar systm wishs to rotct itslf from a fault that would b causd by an ovr-activ intrrut sourc thn it must disabl intrruts for a dfind riod Othr Forms of Analysis Th mhasis so far in this ar has bn on th timing rquirmnts of hard ral-tim systms. Thr will howvr b othr forms of analysis that should b carrid out as art of th dfinition of a hysical architctur (vn for a singl rocssor systm). If thr is a fixd mmory constraint thn this will imos obligations on th dtaild dsign and coding. Whr owr consumtion is an issu thn th amount of RAM must b limitd, and th constructiv us of ROM may nd to b addrssd. Evn wight constraints may hav an influnc on th hysical architctur (this would b articularly tru if distribution or multirocssors wr an otion). W bliv, howvr, that th

13 framwork introducd in this sction can b xtndd into ths aras. 6. Hard Ral-tim HOOD (HRT-HOOD) In this sction w dscrib in dtail th abstractions rovidd by HRT-HOOD, and illustrat thir grahical rrsntation. W first considr th objct tys and thn th objct attributs of HRT- HOOD HRT-HOOD Objcts Figur 3 illustrats th grahical rrsntation of an HRT-HOOD objct (this is almost idntical to that of HOOD, th only diffrnc bing th addition of th objct ty indicator). Thr is also a txtual rrsntation of an objct but this will not b discussd in this arburns1991b]. T OBJET-NAME ROVIDED OERATIONS Objct Intrnals whr T = OBJET-TYE USED OBJETS Figur 3: Th Grahical Rrsntation of an HRT-HOOD Objct ASSIVE ASSIVE objcts hav no control ovr whn thir orations ar xcutd. That is, whnvr an oration on a assiv objct is invokd, control is immdiatly transfrrd to that oration. Each oration contains only squntial cod which dos not synchronis with any othr objct (i.. it dos not block). A ASSIVE objct has no OBS and no THREAD.

14 ATIVE Th orations on an ATIVE objct may b constraind or unconstraind. Unconstraind orations ar xcutd as soon as thy ar rqustd, similar to th orations on a ASSIVE objct. Thy may b usd to accss an objct s rad-only data or its unrotctd shard data. onstraind orations ar xcutd undr th control of th OBS. As with HOOD, thr ar two classs of constraints that can affct whn rqustd orations ar xcutd and thir ffct on th calling objct. 1) Function activation constraints imos constraints on whn a rqustd oration can b xcutd according th objct s intrnal stat. An oration is said to b "on" if th objct s intrnal stat allows th oration s xcution (for xaml: a buffr objct would allow a "ut" oration if its intrnal storag was not full). An oration is said to b "closd" if th objct s intrnal stat dos not allow th oration s xcution (for xaml: a buffr objct may not allow a "ut" oration if its intrnal storag is full; an oration rqusting an objct to sto its xcution can only follow a start rqust). An oration which has no functional activation constraints is considrd to b "on". 2) Ty of rqust constraints indicat th ffct on th callr of rqusting an oration. Th following rqust tys ar suortd: Asynchronous Excution Rqust ASER Whn an ASER oration is calld, th callr is not blockd by th rqust. Th rqust is simly notd and th callr rturns. In a rocss/mssag-basd dsign mthod this would b quivalnt to asynchronous mssag assing. Loosly Synchronous Excution Rqust LSER Whn an LSER oration is calld, th callr is blockd by th rqust until th calld objct is rady to srvic th rqust. In a rocss/mssag-basd dsign mthod this would b quivalnt to th occam/s synchronous styl of mssag assing. Highly Synchronous Excution Rqust HSER Whn an HSER oration is calld, th callr is blockd by th rqust until th calld objct has srvicd th rqust. In a rocss/mssag-basd dsign mthod this would b quivalnt to th Ada xtndd rndzvous styl of mssag assing (or rmot invocationburns1990b] ). As with HOODAgncy1991], both LSER and HSER may hav an associatd timout in which cas thy ar trmd TOER_LSER (Timd Oration Excution Rqust LSER) or TOER_HSER. In gnral a constraind oration may hav a functional activation constraint, and will always hav a ty of rqust constraint. ATIVE objcts in HRT-HOOD ar idntical to thos in HOOD ROTETED ROTETED objcts ar usd to control accss to rsourcs which ar usd by hard ral-tim objcts. Th intntion is that thir us should constrain th dsign so that th run-tim blocking for rsourcs can b boundd (for xaml by using riority inhritancsha1990], or som othr limitd blocking rotocol such as th immdiat riority ciling inhritanc associatd with th Ada9X rotctd rcordsintrmtrics1991] ). ROTETED objcts ar objcts which ar abl to control accss to thir orations, but

15 % & (unlik ATIVE objcts) thy do not ncssarily rquir indndnt thrads of control. A ROTETED objct dos hav an OBS but this is a monitor-lik construct: orations accss th intrnal data undr mutual xclusion, and functional activation constraints may b lacd on whn orations can b invokd. For xaml, a boundd buffr might b imlmntd as a ROTETED objct. Two tys of constraind orations ar availabl on ROTETED objcts: rotctd synchronous xcution rqust (SER) rotctd asynchronous xcution rqust (AER). A constraind oration can only xcut if no othr constraind oration has accss to th rotctd data. Only a SER ty of rqust can hav a functional activation constraint. A timout SER rqust (TOER_SER) must hav a functional activation constraint. ROTETED objcts may also hav non-constraind orations, which ar xcutd in th sam mannr as ASSIVE orations YLI YLI objcts ar usd to rrsnt riodic activitis. Thy ar activ objcts in th sns that thy hav thir own indndnt thrads of control. Howvr, ths thrads (onc startd) xcut irrsctiv of whthr thr ar any outstanding rqust for thir objcts orations. Furthrmor, thy do not wait for any of thir objcts orations at any tim during thir xcution. Indd, in many cass YLI objcts will not hav any orations. In gnral YLI objcts will communication and synchronis with othr hard ral-tim thrads by calling orations in ROTETED objcts. Howvr, it is rcognisd that som constraind oration may b dfind by a YLI objct bcaus: ' othr objcts may nd to signal a mod chang to th cyclic objct this could b achivd by having YLI objcts olling a "mod chang notifir" ROTETED objct but this is infficint if th rsons tim rquird from th YLI objct is short (if mod changs can occur only at wll dfind instancs thn "mod chang notifir" objcts would b aroriat) ( othr objcts may nd to signal rror conditions to th cyclic objct this could again b achivd by having YLI objcts olling an "rror notifir" ROTETED objct but this is again infficint whn th rsons tim rquird from th YLI objct is short Svral tys of constraind orations ar thrfor availabl on YLI objcts (ach may hav functional activation constraints). All of ths, whn on, rquir an immdiat rsons from th YLI s thrad. Th OBS of a YLI objct intracts with th thrad to forc an asynchronous transfr of control. Availabl orations includ an: ) Asynchronous, asynchronous transfr of control rqust (ASAT). This is similar to th ASER for activ objcts xct that it dmands that th YLI objct racts "immdiatly". Th rqust will rsult in an asynchronous transfr of control in th YLI objct s thrad. Not that th call is also asynchronous in that th callr is not blockd waiting for th transfr of control to tak lac. Hnc th call is an asynchronous, asynchronous transfr of control rqust. Othr forms of AT could b rovidd, for xaml a loosly synchronous AT (LSAT) or a highly synchronous AT (HSAT). A YLI objct may start its xcution immdiatly it is cratd, it may hav an offst (that

16 +, is a tim bfor which th THREAD should b dlayd bfor starting its cyclic xcution), or it may synchronis its start via a ROTETED objct. All YLI objcts hav a thrad, whras only thos with orations hav an OBS SORADI SORADI objcts ar activ objcts in th sns that thy hav thir own indndnt thrads of control. Each SORADI objct has a singl constraind oration (usually namd START) which is calld to invok th xcution of th thrad. Th oration is of th ty which dos not block th callr (ASER), it may b calld by an intrrut, in which cas th labl bcoms ASER_BY_IT. Th oration which invoks th soradic has a dfind minimum arrival intrval, and/or a maximum arrival rat. A SORADI objct may hav othr constraind orations but ths ar rqusts which wish to affct immdiatly th SORADI to indicat a rsult of a mod chang or an rror condition. As with YLI objcts ASAT orations ar ossibl. A SORADI objct which rcivs a asynchronous transfr of control rqust will immdiatly abandon it currnt comutation. Each trminal SORADI objct has a singl thrad, and an OBS Ral-tim Objct Attributs HOOD dos not xlicitly suort th xrssion of many of th constraints ncssary to nginr ral-tim systms. In th objct dscrition sklton languag (ODS) thr is a fild in which th dsignr can xrss "imlmntation and synchronisation" constraints. Rathr than us this to xrss an objct s ral-tim attributs, a sarat REAL-TIME ATTRIBUTES fild has bn addd. Ths attributs ar normally filld in at th trminal objct lvl. It is anticiatd that many of th valus of th attributs will b comutd by suort tools. Th following attributs rrsnt th ty of information a dsignr might wish to xrss about an alication. Som of thm may dnd on th schduling thory bing usd or th aroach to fault tolranc. * DEADLINE Each YLI and SORADI objct may hav a dfind dadlin for th xcution of its thrad. OERATION_WET Each xtrnally visibly oration of an objct must hav a worst cas xcution tim dfind. OERATION_BUDGET Each xtrnally visibly oration of an objct may hav a budgt xcution tim dfind. If an oration has an allocatd budgt thr must b an intrnal oration dclard within th objct which can b calld by th run-tim suort systm if th budgt is ovrrun. Th worst cas xcution tim for th xtrnal oration is th oration s budgt tim lus th budgt tim of th intrnal rror handling oration. THREAD_WET Each YLI and SORADI objct must hav a worst cas xcution tim dfind for its thrad of xcution. THREAD_BUDGET Each YLI and SORADI objct may hav a budgt xcution tim dfind for ach

17 / activation of its thrad of xcution. An ovrrun of th budgtd tim may rsult in th activity bing undrtakn by th thrad bing trminatd. Each YLI and SORADI objct must thrfor hav an intrnal oration which is to b calld if its thrad s budgt tim is ovrrun. Th worst cas xcution tim for th thrad is th thrad s budgt tim lus th budgt tim of th intrnal rror handling oration. ERIOD Each YLI objct must hav a dfind riod of xcution. OFFSET Each YLI objct may hav a dfind offst which indicat th tim that th THREAD should dlay bfor starting its cyclic orations. MINIMUM_ARRIVAL_TIME or MAXIMUM_ARRIVAL_FREQUENY Each SORADI objct must hav ithr a dfind minimum arrival tim for rqusts for its xcution, or a maximum arrival frquncy of rqust. REEDENE ONSTRAINTS A THREAD may hav rcdnc constraints associatd with its xcution. RIORITY Each YLI and SORADI objct may hav a dfind riority for its thrad. This riority is dfind according to th schduling thory bing usd. EXEUTION_TRANSFORMATION A YLI or a SORADI objct may nd to b transformd at run-tim to incororat xtra dlays. This may b rquird, for xaml, as a rsult of riod transformation during th schdulability analysis has of th mthod. IMORTANE Each YLI and SORADI objct must hav a dfind imortanc for its thrad. This imortanc rrsnts whthr th thrad is a hard ral-tim thrad or a soft ral-tim thrad. This list may b xtndd for xaml som hard ral tim schduling thoris rquir minimum/avrag xcution tims, utility/bnfit functions tc; fault tolrant systms my rquir objcts to b idntifid for rlication; safty critical systms may also rquir intgrity lvls to b assignd Th HRT-HOOD Us Rlationshi As with HOOD, ASSIVE objcts must not us constraind orations of othr objcts, and ATIVE objcts may us orations of any othr objct frly. Furthrmor, HRT-HOOD forbids ASSIVE objcts to us ach othr in a cyclic mannr. Th us rlationshis for th othr objct tys ar as follows. YLI and SORADI objcts must not us constraind orations of trminal ATIVE objcts unlss thy ar asynchronous; thy can, howvr, us constraind orations of nontrminal ATIVE objcts if ths orations ar imlmntd by child ROTETED objcts. YLI and SORADI objcts may us constraind orations of ROTETED objcts In any hard ral-tim systm th blocking tim of a thrad must b boundd. onsquntly oration calls which may rsult in arbitrary blocking must b rohibitd. In th mthod, hard ral-tim thrads synchronis with ach othr via th constraind orations on ROTETED objcts. Trminal ATIVE objcts ar not considrd by th mthod to b hard ral-tim, and

18 7 8 F G H consquntly YLI and SORADI objcts must not b dndnt uon thir xcution. YLI and SORADI objcts may call th constraind orations of othr YLI or SORADI objcts. Ths orations may rsult in som blocking. Th worst cas rsons tim of an asynchronous transfr of control rqust to ach YLI objct should b dfinabl. Timouts may b usd to bound this tim if th worst cas rsons is unacctabl. ROTETED objcts may only us ASER constraind oration or constraind orations on othr ROTETED objcts as long as thy hav no functional activation constraints. In gnral ROTETED objcts should not block onc thy ar xcuting (although som rquuing of rqusts may b allowd). Th following tabl summariss th HRT-HOOD us rlationshi. Not that any objct may us an unconstraind oration of any othr objct. 9:9;9;9<9;9;9;9<9;9;9;9<9;9;9;9<9;9;9<9;9;9;9<9;9;9;9<9;9;9;9<9;9;9<9;9;9;9<9;9;9;9<9;9;9;9<9;9;9<9;9;9;9<9;9;9;9<9;9;9;9<9;9;9;9<9;9;9<9;9;9;9<9;9;9;9<9;9;9;9<9 =:=;=;=<=;=;=;=<=;=;=;=<=;=;=;=<=;=;=<=;=;=;=<=;=;=;=<=;=;=;=<=;=;=<=;=;=;=<=;=;=;=<=;=;=;=<=;=;=<=;=;=;=<=;=;=;=<=;=;=;=<=;=;=;=<=;=;=<=;=;=;=<=;=;=;=<=;=;=;=<= allr YLI SORADI ROTETED ATIVE ASSIVE >:>;>;><>;>;>;><>;>;>;><>;>;>;><>;>;><>;>;>;><>;>;>;><>;>;>;><>;>;><>;>;>;><>;>;>;><>;>;>;><>;>;><>;>;>;><>;>;>;><>;>;>;><>;>;>;><>;>;><>;>;>;><>;>;>;><>;>;>;><> YLI ASER only?:?;?;?<?;?;?;?<?;?;?;?<?;?;?;?<?;?;?<?;?;?;?<?;?;?;?<?;?;?;?<?;?;?<?;?;?;?<?;?;?;?<?;?;?;?<?;?;?<?;?;?;?<?;?;?;?<?;?;?;?<?;?;?;?<?;?;?<?;?;?;?<?;?;?;?<?;?;?;?<? SORADI ASER ROTETED ASAT only ASAT and START ASER only A:A;A;A<A;A;A;A<A;A;A;A<A;A;A;A<A;A;A<A;A;A;A<A;A;A;A<A;A;A;A<A;A;A<A;A;A;A<A;A;A;A<A;A;A;A<A;A;A<A;A;A;A<A;A;A;A<A;A;A;A<A;A;A;A<A;A;A<A;A;A;A<A;A;A;A<A;A;A;A<A ATIVE B:B;B;B<B;B;B;B<B;B;B;B<B;B;B;B<B;B;B<B;B;B;B<B;B;B;B<B;B;B;B<B;B;B<B;B;B;B<B;B;B;B<B;B;B;B<B;B;B<B;B;B;B<B;B;B;B<B;B;B;B<B;B;B;B<B;B;B<B;B;B;B<B;B;B;B<B;B;B;B<B ASSIVE 6.4. Th HRT-HOOD Includ Rlationshi (dcomosition) Th "includ rlationshi" for HRT-HOOD objcts ar as follows: D An ATIVE objct may includ any othr objct. E A ASSIVE objct may only includ othr ASSIVE objcts. Not that in HOOD a ASSIVE objct may includ an ATIVE objct as long as th assiv natur of th arnt is not violatd. HRT-HOOD rmovs this fatur as it is no longr ncssary, givn HRT-HOOD s incras in xrssiv owr. A ROTETED objct may includ ASSIVE objcts, and on ROTETED objct. Th intntion is that ROTETED objcts should not hav sarat thrads of control. onsquntly thy can not dcomos into objcts which hav thir own indndnt thrads. Furthrmor, a arnt ROTETED objct guarants that its data is accssd undr mutual xclusion; any dcomosition must not violat th arnt s guarant. A SORADI objct may includ at last on SORADI objct along with on or mor ASSIVE, and ROTETED objcts. At on lvl of th dsign an objct may b considrd SORADI. Howvr, it may b dcomosd into a grou of rcdncd constraind SORADI objcts (communicating via ROTETED objcts) as long as th SORADI natur of th arnt is not violatd. A YLI objct may includ at last on YLI objct along with on or mor ASSIVE, ROTETED and SORADI objcts. At on lvl of th dsign an objct may b considrd YLI. Howvr, it may b dcomosd into a grou of rcdncd constraind YLI, ASSIVE, ROTETED and SORADI objcts as long as th YLI natur of th arnt is not violatd. Th HRT-HOOD "includ" ruls ar summarisd in th tabl blow.

19 I I;I<I;I;I;I<I;I;I;I<I;I;I;I<I;I;I<I;I;I;I<I;I;I;I<I;I;I;I<I;I;I<I;I;I;I<I;I;I;I<I;I;I;I<I;I;I;I<I;I;I<I;I;I;I<I;I;I;I<I;I;I;I<I;I;I<I;I;I;I<I;I;I;I<I;I;I;I<I;I J J;J<J;J;J;J<J;J;J;J<J;J;J;J<J;J;J<J;J;J;J<J;J;J;J<J;J;J;J<J;J;J<J;J;J;J<J;J;J;J<J;J;J;J<J;J;J;J<J;J;J<J;J;J;J<J;J;J;J<J;J;J;J<J;J;J<J;J;J;J<J;J;J;J<J;J;J;J<J;J arnt YLI SORADI ROTETED ATIVE ASSIVE K K;K<K;K;K;K<K;K;K;K<K;K;K;K<K;K;K<K;K;K;K<K;K;K;K<K;K;K;K<K;K;K<K;K;K;K<K;K;K;K<K;K;K;K<K;K;K;K<K;K;K<K;K;K;K<K;K;K;K<K;K;K;K<K;K;K<K;K;K;K<K;K;K;K<K;K;K;K<K;K YLI L L;L<L;L;L;L<L;L;L;L<L;L;L;L<L;L;L<L;L;L;L<L;L;L;L<L;L;L;L<L;L;L<L;L;L;L<L;L;L;L<L;L;L;L<L;L;L;L<L;L;L<L;L;L;L<L;L;L;L<L;L;L;L<L;L;L<L;L;L;L<L;L;L;L<L;L;L;L<L;L SORADI M M;M<M;M;M;M<M;M;M;M<M;M;M;M<M;M;M<M;M;M;M<M;M;M;M<M;M;M;M<M;M;M<M;M;M;M<M;M;M;M<M;M;M;M<M;M;M;M<M;M;M<M;M;M;M<M;M;M;M<M;M;M;M<M;M;M<M;M;M;M<M;M;M;M<M;M;M;M<M;M ROTETED N N;N<N;N;N;N<N;N;N;N<N;N;N;N<N;N;N<N;N;N;N<N;N;N;N<N;N;N;N<N;N;N<N;N;N;N<N;N;N;N<N;N;N;N<N;N;N;N<N;N;N<N;N;N;N<N;N;N;N<N;N;N;N<N;N;N<N;N;N;N<N;N;N;N<N;N;N;N<N;N ATIVE O O;O<O;O;O;O<O;O;O;O<O;O;O;O<O;O;O<O;O;O;O<O;O;O;O<O;O;O;O<O;O;O<O;O;O;O<O;O;O;O<O;O;O;O<O;O;O;O<O;O;O<O;O;O;O<O;O;O;O<O;O;O;O<O;O;O<O;O;O;O<O;O;O;O<O;O;O;O<O;O ASSIVE 6.5. Oration Dcomosition On arnt constraind oration may b imlmntd by on child constraind oration. Th grahical rrsntation is a dashd (or shadd) arrow from th arnt oration to th child oration. A constraind oration shall b imlmntd by a constraind child oration. Th following dcomositions ar valid (an * indicats an oration with a functional activation constraint): QRQ<Q;Q;Q<Q;Q;Q;Q<Q;Q;Q;Q<Q;Q;Q;Q<Q;Q;Q<Q;Q;Q;Q<Q;Q;Q;Q<Q;Q;Q;Q<Q;Q;Q<Q;Q;Q;Q<Q;Q;Q;Q<Q;Q;Q;Q<Q;Q;Q<Q;Q;Q;Q<Q;Q;Q;Q<Q;Q;Q;Q<Q;Q;Q<Q;Q;Q;Q<Q;Q;Q;Q<Q;Q;Q;Q<Q;Q;Q<Q SRS<S;S;S<S;S;S;S<S;S;S;S<S;S;S;S<S;S;S<S;S;S;S<S;S;S;S<S;S;S;S<S;S;S<S;S;S;S<S;S;S;S<S;S;S;S<S;S;S<S;S;S;S<S;S;S;S<S;S;S;S<S;S;S<S;S;S;S<S;S;S;S<S;S;S;S<S;S;S<S Dcomosition ommnts ASER ASER a arnt asynchronous oration can b imlmntd by ASER ASAT a child asynchronous oration, or an asynchronous asynchronous transfr of control oration ASER SER a arnt asynchronous oration can b imlmntd by a child TRT<T;T;T<T;T;T;T<T;T;T;T<T;T;T;T<T;T;T<T;T;T;T<T;T;T;T<T;T;T;T<T;T;T<T;T;T;T<T;T;T;T<T;T;T;T<T;T;T<T;T;T;T<T;T;T;T<T;T;T;T<T;T;T<T;T;T;T<T;T;T;T<T;T;T;T<T;T;T<T ASER AER synchronous or asynchronous rotctd oration *ASER *ASER *ASER SER an asynchronous rqust must nvr block *ASER AER URU<U;U;U<U;U;U;U<U;U;U;U<U;U;U;U<U;U;U<U;U;U;U<U;U;U;U<U;U;U;U<U;U;U<U;U;U;U<U;U;U;U<U;U;U;U<U;U;U<U;U;U;U<U;U;U;U<U;U;U;U<U;U;U<U;U;U;U<U;U;U;U<U;U;U;U<U;U;U<U *ASER *ASAT LSER LSER a arnt loosly synchronous oration can b imlmntd by LSER SER a child loosly synchronous oration, a rotctd synchronous LSER *SER rqust, a rotctd synchronous with a functional LSER LSAT activation constraint, or a loosly synchronous VRV<V;V;V<V;V;V;V<V;V;V;V<V;V;V;V<V;V;V<V;V;V;V<V;V;V;V<V;V;V;V<V;V;V<V;V;V;V<V;V;V;V<V;V;V;V<V;V;V<V;V;V;V<V;V;V;V<V;V;V;V<V;V;V<V;V;V;V<V;V;V;V<V;V;V;V<V;V;V<V asynchronous transfr of control oration *LSER *LSER similar to th abov *LSER *SER WRW<W;W;W<W;W;W;W<W;W;W;W<W;W;W;W<W;W;W<W;W;W;W<W;W;W;W<W;W;W;W<W;W;W<W;W;W;W<W;W;W;W<W;W;W;W<W;W;W<W;W;W;W<W;W;W;W<W;W;W;W<W;W;W<W;W;W;W<W;W;W;W<W;W;W;W<W;W;W<W *LSER *LSAT HSER HSER a arnt highly synchronous oration can b imlmntd by HSER SER a child highly synchronous oration, a rotctd synchronous HSER *SER rqust, a rotctd synchronous with a functional HSER HSAT activation constraint, or a highly synchronous XRX<X;X;X<X;X;X;X<X;X;X;X<X;X;X;X<X;X;X<X;X;X;X<X;X;X;X<X;X;X;X<X;X;X<X;X;X;X<X;X;X;X<X;X;X;X<X;X;X<X;X;X;X<X;X;X;X<X;X;X;X<X;X;X<X;X;X;X<X;X;X;X<X;X;X;X<X;X;X<X asynchronous transfr of control oration *HSER *HSER similar to th abov *HSER *SER YRY<Y;Y;Y<Y;Y;Y;Y<Y;Y;Y;Y<Y;Y;Y;Y<Y;Y;Y<Y;Y;Y;Y<Y;Y;Y;Y<Y;Y;Y;Y<Y;Y;Y<Y;Y;Y;Y<Y;Y;Y;Y<Y;Y;Y;Y<Y;Y;Y<Y;Y;Y;Y<Y;Y;Y;Y<Y;Y;Y;Y<Y;Y;Y<Y;Y;Y;Y<Y;Y;Y;Y<Y;Y;Y;Y<Y;Y;Y<Y *HSER *HSAT SER SER constraind orations on a arnt ROTETED objct *SER *SER must b imlmntd by idntical orations ZRZ<Z;Z;Z<Z;Z;Z;Z<Z;Z;Z;Z<Z;Z;Z;Z<Z;Z;Z<Z;Z;Z;Z<Z;Z;Z;Z<Z;Z;Z;Z<Z;Z;Z<Z;Z;Z;Z<Z;Z;Z;Z<Z;Z;Z;Z<Z;Z;Z<Z;Z;Z;Z<Z;Z;Z;Z<Z;Z;Z;Z<Z;Z;Z<Z;Z;Z;Z<Z;Z;Z;Z<Z;Z;Z;Z<Z;Z;Z<Z AER AER in th child. Not, that all th constraind orations of a arnt ROTETED objct must b imlmntd by th sam child ROTETED objct, in ordr to guarant th mutual xclusion of th arnt. \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Not that this maing is allowd bcaus on a singl/multi rocssor th tim takn to xcut th oration on a RO- TETED objct is assumd to b small and thrfor in ffct asynchronous. For a distributd systm this dcomosition would forc th two objcts onto th sam rocssing nod.