WO2019155003A1

WO2019155003A1 - Method for optimising an embedded system and associated devices

Info

Publication number: WO2019155003A1
Application number: PCT/EP2019/053172
Authority: WO
Inventors: Florian GREFF
Original assignee: Thales
Priority date: 2018-02-08
Filing date: 2019-02-08
Publication date: 2019-08-15
Also published as: FR3077698B1; FR3077698A1

Abstract

The invention concerns a method for optimising an embedded system, the embedded system comprising components, each component communicating with another component by exchange of at least one packet, each packet comprising at least a part of a data, the assembly of components forming a communication network comprising links, the method comprising at least a step of: - providing a global statistical requirement for the embedded system, - breaking down the global statistical requirement into individual requirements, one individual requirement for each link to a dataflow, and - for each link, determining the number of transmissions of packets guaranteeing compliance with the individual requirement belonging to the link in question.

Description

Method of optimizing an onboard system and associated devices

The present invention relates to a method for optimizing an onboard system. The present invention also relates to a computer program product adapted to the implementation of such an optimization method. The present invention also relates to a readable medium of information specific to implementing the optimization method. The present invention also relates to an embedded system associated with the optimization method.

For example, in the avionics field, real-time systems are used. Most embedded systems include components such as computing units, sensors and actuators, each component interacting with each other through communications devices. These can be communication buses (all components interact through the same link) or switched networks as for the Internet.

In the case of switched networks, the way two components communicate is called the network protocol. Each component communicates data via packets that are network envelopes for carrying the data.

In practice, a system may be subject to transient failures, i.e. network packet transmission errors. For example, a network packet may be corrupted due to a hardware error leading to a bit inversion. Although such errors are very rare events, these errors should be managed which can alter the integrity of the packet.

To verify that the packet arrives intact, it is known to check the integrity of the packets between a transmitter and a receiver via detector codes or error correctors (such as a checksum) added in queue. In any case, the codes make it possible to detect an error and possibly to correct it. In the event that an error is detected that the receiver can not correct, the packet is destroyed and a notification is eventually returned to the transmitter.

Such a control coupled with the implementation of a retransmission of the packet in certain cases is sufficient for non-critical communication flows but insufficient for communication flows having real-time properties. This is to ensure that a data or more precisely a package arrives at its destination before a strict deadline. This supposes on the one hand that the packet arrives intact and on the other hand within the allotted time. In other words, in order to meet the problems of guaranteeing real-time operation, it is desirable to manage the transient transmission errors to ensure that the real-time system functions properly.

One technique for handling such errors in a real-time context is to duplicate communications along disjoint paths. Such a technique assumes that transmission errors are so rare that a data item will suffer at most on one of the two paths. If an error occurs so that one of the data arrives too late to the receiver, then at least the other data arrives at the receiver in time.

However, such a technique involves a doubling of the network resources used, a doubling which is mostly unnecessary because transmission errors are rare. Moreover, such a technique is based on the assumption that one of the packets arrives at its destination without errors, which has a probability of not being true.

To overcome this last problem, it is known to calculate the risk that two packets arrive at their destination with an error. When the calculated risk is greater than the desired reliability for the real-time system, the number of retransmitted packets is increased, for example, the same packet is transmitted three, four or five times. This increases the number of resources involved in the system.

In the case of networks capable of retransmitting a packet having undergone a transmission error, if the reception of a packet has not been acknowledged by the neighbor after a waiting time, or if the latter has sent a negative acknowledgment, then the transmitter retransmits the packet. In such a case, the multiplication of retransmissions is even less indicated since it does not exploit the presence of such a retransmission mechanism.

However, the exploitation of such a mechanism is not easy insofar as the retransmission of a packet implies that the transmitter has sent two packets instead of one, which delays the arrival of the complete data. and can make him miss the deadline. There is also a lower probability that a packet stream corresponding to a datum experiences two or more transmission errors. The existence of such a probability, however small, shows that the reliability of the real-time system is not guaranteed.

To deal with such a problem, it is known to use probabilistic approaches to verify the compliance of a real-time system with a statistical requirement. The statistical requirement to be fulfilled corresponds to the reliability (referred to as "reliability" in English) of the real-time system and more precisely to the probability that no unmanaged failure occurs during the time interval considered (typically the duration of time). use of the system). Such a condition is equivalent to an average time between transient failures that is obtained by dividing the time interval considered by the desired reliability. In such a case, a failure corresponds to the case where a datum undergoes more retransmissions than the fixed limit.

It is then known to design a component and then observe the statistical properties of the designed component using an error model based on a Poisson process to obtain the probability that, over the lifetime of the system, the tasks are not going receive more retransmissions than expected. When the reliability criterion is not met, another architecture for the component is proposed and evaluated.

However, the iterative design process can be lengthy to achieve a real-time system that meets the desired reliability. In addition, such a method is incompatible with an incremental analysis because the calculated probability takes into account all the tasks implemented by the real-time system.

There is therefore a need for a method for optimizing an embedded system, particularly suitable for operating in real time, which makes it possible to obtain an embedded system with fewer resources involved while respecting a requirement of reliability and preference, a allocation of resources adapted to the need for reliability.

For this, the present description relates to a method for optimizing an on-board system, the embedded system comprising components, each component communicating with another component by exchanging at least one packet, each packet comprising at least a portion of a data item, the set of components forming a communication network having links, the method comprising at least one step of providing a global statistical requirement for the on-board system, decomposing the overall statistical requirement into individual requirements, an individual requirement for each link to a given stream, and, for each link, determining the number of packet transmissions ensuring compliance with the individual requirement specific to the link.

Such an optimization method is able to operate in real time, and makes it possible to obtain an embedded system with fewer resources involved while respecting a requirement of reliability and preference, a resource allocation adapted to the need for reliability.

Such a method also makes it possible to optimize the resources used while respecting a desired reliability, which is defined by the overall statistical requirement provided. In particular, unlike a global approach for example proposed in WO 2017/050215 A1 to minimize the overall delay of a set of exchanged signals, the method makes it possible to divide the global optimization problem into several individual problems for each embedded system link. Each individual problem is defined by an individual requirement. The process therefore allows to obtain an optimization of the resources used for each link. This allows a more efficient implementation for the method compared in particular to a so-called global approach as illustrated above.

According to particular embodiments, the optimization method comprises one or more of the following characteristics, taken in isolation or in any technically possible combination:

in the determination step, it is assumed that the errors on the transmission of a packet follow a statistical law.

- the statistical law is a law of Poisson.

during the determination step, an iterative process is implemented.

when the number of packet transmissions is too high on a link, the method comprises a step of allocating additional resources to the onboard system.

- The overall statistical requirement is that the average time between two failures for the system is less than a predefined value.

the links of the embedded system are in an SDRN architecture.

The present description also relates to a computer program product comprising a readable information medium, on which is stored a computer program comprising program instructions, the computer program being loadable on a data processing unit. and adapted to cause the implementation of a method as previously described when the computer program is implemented on the data processing unit.

The present description also relates to a readable medium of information storing a computer program comprising program instructions, the computer program being loadable on a data processing unit and adapted to lead to the implementation of a method such as than previously described when the computer program is implemented on the data processing unit.

The present description also relates to an embedded system comprising components, each component communicating with another component by exchange of at least one packet, each packet comprising at least a part of a datum, the set of components forming a network communication system comprising links, the system comprising a controller, the controller being adapted to implement a method as previously described. Other features and advantages of the invention will appear on reading the following description of embodiments of the invention, given by way of example only and with reference to the drawings which are:

FIG. 1, a schematic view of an exemplary system for implementing a method for optimizing an onboard system,

FIG. 2, a schematic representation of a network according to an SDRN architecture comprising a controller capable of implementing an admission control, and

- Figure 3, a flowchart of an example implementation of an example of admission control.

A computer 10 and a computer program product 12 are shown in FIG. 1. The interaction of the computer program product 12 with the system 10 makes it possible to implement a method of optimizing an onboard system.

More generally, the computer 10 is an electronic computer adapted to manipulate and / or transform data represented as electronic or physical quantities in computer registers 10 and / or memories in other similar data corresponding to data. in memories, registers or other types of display, transmission or storage devices.

The computer 10 comprises a processor 14 comprising a data processing unit 16, memories 18 and an information carrier reader 20. The computer 10 also includes a keyboard 22 and a display unit 24.

The computer program product 12 comprises a readable information medium. A readable information medium is a medium readable by the computer 10, usually by the data processing unit 14. The readable information medium is a medium adapted to memorize electronic instructions and capable of being coupled to a bus of a computer system.

By way of example, the readable information medium is a diskette or floppy disk ("floppy disk"), an optical disk, a CD-ROM, a magneto-optical disk, a ROM memory, a RAM memory, an EPROM memory, an EEPROM memory, a magnetic card or an optical card.

On the readable information medium is stored a computer program including program instructions.

The computer program is loadable on the data processing unit 14 and is adapted to drive the implementation of the optimization process. The operation of the computer 10 interacting with the computer program product 12 is now described with reference to an exemplary implementation of a method for optimizing an onboard system.

The embedded system having components, each component communicating with another component by exchanging at least one packet, each packet comprising at least a portion of a data item (a packet is a headset and a portion of a packet) useful carrying said at least a part of a data), the set of components forming a communication network having links L.

Each link L is adapted to be traversed by a communication flow / allowing the flow of packets, and therefore data, between the components.

In the context described, the embedded system is a real-time system.

The method includes a supply step, a decomposition step, and a determination step.

During the supply step, a global statistical requirement for the embedded system is provided.

The overall statistical requirement is expressed as follows: a probability p that a datum (any) arrives too late at its destination because of transmission errors during a time interval IT must be less than or equal to a value predefined.

For example, the time interval IT considered is the duration of use of the network.

Similarly, the overall statistical requirement can be expressed as an average time between two TME failures, a failure being in this case the fact that a data arrives too late at its destination because of the transmission errors. The average time between two failures TME is related to the probability p and to the time interval IT according to the following relation:

IT

TME = -

p

In the following, the overall statistical requirement is expressed using the notion of average time between two failures TME, knowing that, in an equivalent manner, it is possible to use the probability p and the time interval IT.

Thus, the overall statistical requirement is expressed as an inequality, namely that the mean time between two TME failures for the system is less than a predefined value.

During the decomposition step, the overall statistical requirement is broken down into individual average time requirements between two TME failures for each L link traversed by a communication flow. For this, it is considered that the components of the network are in series in terms of failure: if a packet arrives too late on one of the links L, then the network is considered globally failing.

In a case of a two-component system C1 and C2, this means that the mean time between failures of the system TME _system is related both to the average time between two failures of the first component TME _C1 and the average time between two failures of the second component TME _C2 by the following relation:

1 _ 1 1

TME _system TME _C1 TME _C2

Assuming that the two components are identical, then the average time between failures of the first component TME _C1 is equal to the average time between failures of the second component TME _C2 so that the previous relationship becomes:

Such reasoning is easily generalized to any number of identical components. Noting n the number of components of the system (n being an integer greater than or equal to 2) and TME _composing the average time between two failures of each component, it is obtained:

In this case, the components of the previous reasoning model the links L. It comes as follows:

TME {L) = TME _system * n _L

OR :

• n _L is the number of links L of the system, and

• TME (L) designates the average time between two failures for the link L, L being in this context an integer between 1 and n _L.

As explained above, a communication flow passes through each link L. The communication flow in a link L is specific to it. The communication flow is noted / in what follows.

In addition, each link L is divided into a plurality of channels that the communication stream / consumes according to a consumption coefficient noted w _{f L.} It follows that :

or: • n _{C t} is the number of channels of a link L of the system, and

• TME (L, f) is the average time between failures for link L and communication flow /.

By knowing the structure of the system from the point of view of exchanges between the components, the number of channels of a link L of the system n _{c L} , the number of links L and the consumption coefficients w _{f L} are known. Recalling here that the global statistical requirement expressed in the form of an inequality, namely that the average time between two TME failures for the system is less than a predefined value, the preceding formula makes it possible to obtain a value maximum for the average time between two failures for the link L and a communication flow TME L, f). Respect for this relationship is an individual requirement.

At the end of the decomposition step, it is thus obtained a specific individual requirement for each link L traversed by a communication flow and ensuring that the overall statistical requirement is verified.

During the determination step, it is determined, for each link, the number of packet transmissions ensuring compliance with the individual requirement associated with the link.

For this, a datum is simulated as an extended datum, that is to say as the datum repeated as many times as the datum is transmitted.

By way of example, for a set of packets corresponding to a datum that is transmitted three times, the size of the extended datum is equal to three times the size of the datum.

For the rest, the number of additional packets to retransmit in the worst case (still according to the statistical requirement) is noted K _{f L} while e _{f L} is the total size of the data without retransmission.

The worst case is the case where each bit error affects a different packet of the data, the number of retransmissions then being equal to the number of bit errors.

Furthermore, the average rate of bit errors in the network is denoted BER with reference to the English abbreviation for "Bit Error Rate" which literally means "bit error rate".

The minimum period between each sending of data in the flow is noted T _f .

It is assumed in the determination step that the bit errors follow a statistical law which is, in this case a Poisson's law.

The Poisson law is a discrete probability law that describes the behavior of the number of events occurring in a fixed time interval, if these events occur with an average frequency or known expectancy and regardless of the time elapsed since the previous event. If the average number of occurrences in the fixed time interval is l (strictly positive real number), then the probability p (/ c) that k occurrences occur is given by:

Or :

E denotes the exponential function, and

•! denotes the factorial function.

In the case considered of the determination step, the parameter of the Poisson distribution in the flux / is denoted _{f L.} Physically, the parameter of the Poisson's law f _L is the average number of retransmissions per data item, ie the average number of bit errors per data item.

The parameter of the Poisson's law

is related to the average bit error rate BER and the total size of the data without retransmission

_L by the following mathematical relationship:

This implies that the individual requirement to respect is written:

Taking into account the Poisson's law, it follows that the individual requirement to respect becomes:

The retransmissions induced by these errors can again undergo errors. The determination step therefore involves iterating the preceding process to converge to an optimal value of the number of additional packets to retransmit in the worst case K _{f L.}

An iteration of the process is detailed in the following in seven steps.

In the first step, the preceding condition makes it possible to obtain a value for the number of additional packets to be retransmitted in the worst case K.

In a second step, it is calculated the new total size of the data without retransmission 0'f _L according to the following formula:

q 'f, L = f, _L + ^K f, L In the third step, the new total size of the data without retransmission e ' _{f L} corresponds to a new communication flow / which consumes according to a new consumption coefficient which is denoted w' _{f L.}

In the fourth step, the new average time TME '(L, f) between two failures for the link L and a communication flow / is calculated via the following formula:

It is also determined in the fifth step the new parameter of the Poisson's law _{f L} via the relation:

7 _{, t} = BER. e ' _{f L}

The new individual requirement to respect is then written according to the formula

. TV> TME '(L, f) which allows in a sixth stage a new

value for the number of additional packets to retransmit in the worst case

In a seventh step, the new value for the number of additional packets to retransmit in the worst case

(obtained in the sixth step) and the value for the number of additional packets to be retransmitted in the worst case K _{f L} (obtained in the first step) are compared. As long as the two values are different, it is chosen to repeat the process.

At the end of the determination step, it is thus obtained for each link the number of additional packets to retransmit in the worst case K.

For a given architecture, the method thus makes it possible to obtain the number of packets to retransmit for each link L, which simply results in the fact that the packet actually transmitted comprises K _fiL times the data to be transmitted between the two components via the link L.

The method forces the respect of the reliability requirement instead of checking it a posteriori and allows the incremental allocation of the network resources under constraint of reliability. It is thus an inverted use of the mean time theory between two TME failures to guarantee a statistical situation rather than observe it. More specifically, the constraint of limiting the probability of failure becomes a design choice that is no longer experienced.

The method is thus a probabilistic approach for managing transmission errors without redundant communications.

The method is based on the principle of limiting the number of retransmission packets that a data item can undergo, in order to deduce an extended data size. equivalent in the worst case. It is this extended data size that is taken into account instead of the data size specified in the flow request. In other words, it is allocated the same resources as if the data was by default larger than the number of calculated retransmission packets.

By calculation, the data sizes are such that the total reliability of the network will be greater than or equal to the reliability requirement given in input.

The method thus ensures reliable management of transmission errors according to a reliability constraint without resorting to redundancies, in particular duplications, communications.

Compared to processes using one or more redundancies, the method allows better management of network resources used.

In summary, the proposed method is a method of optimizing an embedded system, including clean to operate in real time, which allows to obtain an embedded system with fewer resources involved while respecting a requirement of reliability.

It should be noted that this better management of network resources is completely transparent from the point of view of hardware and applications, no additional complexity being involved.

The method is also compatible with a system design taking into account other criteria. Indeed, if it is determined that the number of packets to retransmit is too high, it is possible to allocate additional resources to the embedded system, typically additional communication channels.

The application of this method to a real-time system network according to the SDRN architecture is in the form of a transparent extension.

The acronym SDRN refers to the English term "Software-Defined Real-Time Networking" which literally means "Software-defined real-time network".

Such architecture is notably described in a May 2017 publication by Florian Greff, Ye-Qiong Song, Laurent Ciarletta and Arnaud Samama entitled "A Dynamic Flow Allocation Method for the Design of a Software-Defined Real-Time Mesh Network", 13th IEEE International Workshop on Factory Communication Systems (WFCS 2017).

FIG. 2 illustrates a schematic representation of such a network according to the SDRN architecture. In the SDRN architecture, there are three stages, a first stage 30 which is the network 30, a second stage which is the controller 32 and a third stage which is that of the applications 34. Exchanges take place from the network 30 to the controller 32 (exchanges indicated by the arrow 36), from the controller 32 to the applications 34 (exchanges indicated by the arrow 38), from the controller 32 to the network 30 (exchanges indicated by arrow 40) and from applications 34 to controller 32 (exchanges indicated by arrow 42).

The network 30 communicates in particular its topology and the failures that occurred to the controller 32 while the controller 32 indicates to the network 30 a configuration to be respected.

The controller 32 communicates in particular to the applications 34 the results of the admission control while the applications 34 indicate to the controller 32 the properties of the flows.

The controller 32 calculates the configuration based on current traffic, network properties 30, properties of the underlying protocol and the optimization strategy. Based on this data, the controller 32 analyzes how the network 30 may behave in the worst case, in order to allocate the resources of the network 30 so that compliance with the real-time constraints of the communications is guaranteed.

More specifically, the calculation of the configuration by the controller 32 is called admission control. An implementation chart of the admission control is illustrated in Figure 3.

The admission control has two steps E50 and E52.

In the first step E50, the constraints are analyzed. The first step takes two inputs 54 and 56 to obtain two outputs 58 and 60.

The first input 54 corresponds to the properties of the stream while the second input 56 corresponds to the properties of the network 30 and the properties of the underlying protocol.

The first output 58 is the consumption coefficient and the second output 60 is the jump delay. A jump delay is the maximum time a packet of the stream spends on the link between two switches connected by the link, the delay being expressed in seconds.

The first output 58 and the second output 60 are respectively the first input and the second input of the second step E52 during which it is searched for the path.

The second step E52 also takes as input a third input 62 which comprises the topology, the state of the network 30 and the optimization strategy and returns in an output 66 the configuration parameters (symbolized by two arrows 64 in FIG. 3). , that is, the configuration sent by the arrow 40. The admission control illustrated in FIG. 3 is thus the heart of the SDRN architecture since it makes it possible to heat-allocate incrementally real-time communication flows on embedded networks.

To implement the optimization method, the method comprises a step of calculating additional parameters for inserting the results in the admission control.

The additional parameters calculated are the consumption coefficient and the jump delay.

For this last parameter, it is used the following relation:

Or :

• m _ΐ is the maximum size of a stream packet on the link L, this size being expressed in bit, and

• C _L is the capacity of the link L, this size being expressed in bits per second.

To use the optimization method in the admission control, it suffices to substitute for the values of the first output 58 and the second output 60 the calculated additional parameters.

Thus, the optimization method is a probabilistic approach for taking into account retransmissions in the SDRN admission control.

The process then corresponds to an extension of the admission control, this method is easily integrable into the SDRN architecture and brings a small additional cost to the admission control time.

Claims

1.- method for optimizing an embedded system, the embedded system comprising components, each component communicating with another component by exchanging at least one packet, each packet comprising at least a portion of a data, the set of components forming a communication network having links (L), the method comprising at least one step of:

- provision of a global statistical requirement for the embedded system,

- decomposition of the overall statistical requirement into individual requirements, an individual requirement for each link (L) to a given flow, and

for each link (L), determining the number of packet transmissions guaranteeing compliance with the individual requirement specific to the link (L) considered.

2. The method of claim 1, wherein, in the determination step, it is assumed that the errors on the transmission of a packet follow a statistical law.

3. The method of claim 2, wherein the statistical law is a Poisson law.

4. An optimization method according to any one of claims 1 to 3, wherein during the determination step, an iterative process is implemented.

5. An optimization method according to any one of claims 1 to 4, wherein when the number of packet transmissions is too high on a link (L), the method comprises a step of allocating additional resources to the system. embedded.

6. An optimization method according to any one of claims 1 to 5, wherein the overall statistical requirement is that the average time between failures (TME) for the system is less than a predefined value.

7. An optimization method according to any one of claims 1 to 6, wherein the links (L) of the embedded system are in an SDRN architecture.

8. Computer program product (12) comprising a readable information medium, on which is stored a computer program comprising program instructions, the computer program being loadable on a data processing unit (14) and adapted to carry out the implementation of a method according to any one of claims 1 to 7 when the computer program is implemented on the data processing unit (14).

9.- readable information storage medium storing a computer program comprising program instructions, the computer program being loadable on a data processing unit (14) and adapted to cause the implementation of a method according to any one of claims 1 to 7 when the computer program is implemented on the data processing unit (14).

10. Embedded system comprising components, each component communicating with another component by exchange of at least one packet, each packet comprising at least a part of a piece of data, the set of components forming a communication network comprising links (L), the system comprising a controller (32), the controller (32) being adapted to implement a method according to any one of claims 1 to 7.