AADL Inspector/Cheddar labs
Full day tutorial at Ada Europe conference, June 2018, Lisbon, Portugal
Frank Singhoff, Lab-STICC UMR CNRS 6285/Université de Bretagne Occidentale
Pierre Dissaux, Ellidiss Tech.
This set of exercises show how to use AADLInspector to run scheduling analysis with Cheddar.
The slides of the lecture to do those exercises
can be downloaded here .
To do the following exercises, you need AADLInspector.
You can either download and install AADLInspector
on your laptop (for Windows or Linux targets only).
You can also use a virtual machine (vdi file named "cheddar_tutorial.vdi")
if you are able to run Virtual Box. The
cheddar_tutorial.vdi file is there . When launched, you must log to the
machine with "cheddar" as login name (same string for the password).
Then, to have AADLInspector in your path, run the following command:
For windows target, just click on the AADLInspector icon.
For Linux station, use the following command:
The objective of this first exercise is to discover the basic analysis options
of the tool.
- Download the
following AADL model.
- Save those files in a specific folder. Those files are composing
an AADLInspector project: the file .aic allows AADLInspector to load
all AADL files composing your model from the menu File/Load.
- From File/Load, load the project.
- With the Static analysis/Parse and Instanciante LMP button,
verify the AADL model. What is the root component of this model ? Give the instance model graph.
- To perform a scheduling analysis, the processor component
has to be extended with few properties.
Add to the cpu_leon2 component
the following properties:
Scheduling_protocol => (rate_monotonic_protocol);
- Compute the scheduling of this thread set with Cheddar by the button
Timing Analysis/Simulation timelines (Cheddar).
From this simulation, compute with Cheddar the response times of the threads
by the button Simulation Tests (Cheddar).
- Compute theoretical worst case thread response times, always with Cheddar
but with the button
Timing Analysis/Theoretical Tests (Cheddar).
- Open the task response thread summary panel.
- Do a simulation with Marzhin.
- Explain why we have different response times for each thread on
- Update the Scheduling_protocol property
for subcomponent cpu
with value posix_1003_highest_priority_first_protocol
- Do again the questions 6, 7 and 8.
In this exercise, we will model and analyze a set of threads
writing or reading data from a shared memory area. We will assume that the
shared memory area
is modeled by a data component. Writing or reading an element
will be modeled by the access of the data component in mutual exclusion.
The objective of this exercise is to gradually build and analyze such model.
In the first question, we will define two independant threads, i.e. we do not model
the shared memory area. In the next question, we intend to model several readers and
writers, always independents. Finally, in the last question, we extend the second
version of the model with the thread communications.
Question 1 :
Let assume this sample of AADL model:
thread implementation reader.impl
thread implementation writer.impl
process implementation application.impl
system implementation smpl.impl
process1 : process application.impl;
cpu1 : processor cpu;
Actual_Processor_Binding => (reference(cpu1)) applies to process1;
- Change the definition of the threads and the process above in order to:
- Define a periodic thread called writer with a deadline
and a period of 10 ms. The priority is 20.
The execution time of this thread is about 1 ms in the best case and 3 ms
in the worst case.
- Define a periodic thread called reader with a deadline
and a period of 20 ms.
The execution time of this thread is about 2 ms.
The priority is 10.
- Check correctness of the model with LMP.
- In order to perform scheduling analysis, extend your modele with the
- Perform the scheduling analysis with AADLInspector.
Question 2 :
- From the model of the previous question and without introducing
new component type, extend the model in order to declare 3 writers
and 2 readers with the following properties:
- Writer 1 : Deadline = Period = 40 ms ; execution time ranging 1 and 5 ms ; Priority = 1
- Writer 2 : Deadline = Period = 20 ms ; execution time ranging 1 and 4 ms ; Priority = 2
- Writer 3 : Deadline = Period = 20 ms ; execution time ranging 1 and 2 ms ; Priority = 3
- Reader 1 : Deadline = Period = 40 ms ; execution time ranging 1 and 3 ms ; Priority = 4
- Reader 2 : Deadline = Period = 40 ms ; execution time ranging 1 and 2 ms ; Priority = 5
- Verify your model by simulations with AADLInspector.
Question 3 :
In order to model the thread communications, we now extend the previous model with a data component.
- Change your previous model by adding a data component and the required
connections to the threads. For this data component, define the following property:
Concurrency_Control_Protocol => PCP;
- Once updated, analyze your model with AADLInspector to locate
locks and unlocks of the data component.
This exercise is extracted from [Cottet00] and is about a simplified
architecture model of the Mars Pathfinder mission.
In this exercise, you must look for a design mistake and propose
a solution for it.
In 1997, Mars Pathfinder casts a mobile robot called Sojourner on Mars.
This mobile robot was controled by a multitask software running on a VxWorks target.
This software was composed of the following tasks:
|Tasks || Priorities || Periods/Deadlines ||Executime time |
|SCHED_BUS || 1 || 125 ms ||25 ms |
|DATA || 2 || 125 ms ||25 ms |
|CONTROL || 3 || 250 ms ||25 ms |
|RADIO || 4 || 250 ms ||25 ms |
|VIDEO || 5 || 250 ms ||25 ms |
|MESURE || 6 || 5000 ms ||50 ms |
|FORECAST || 7 || 5000 ms ||Between 50 ms and 75 ms |
- All the tasks are periodic, synchronous, and have deadlines equal to periods.
- FORECAST is sometimes released for a job of 50 ms, and sometimes for a job of 75 ms, depending of
the size of the payload to handle.
- Priority levels expressed bellow are VxWorks priorities : the lower the value is,
the higher the priority
- DATA, CONTROL, MESURE and FORECAST required a shared data which is accessed by a critical section
during all their execution times (i.e all their capacity/WCET).
To reduce costs, those critical sections were implemented with a mutex that did
inheritance priority protocol such as PIP or PCP.
In order to define those critical sections without PIP/PCP, simply
do not add the Concurrency_Control_Protocol property when defining your data component.
- During the mission of Mars PathFinder, operators noticed that some deadlines
were missed, leading to frequent reboots
of the hardware.
Design an AADL model to discover what are the missed deadlines and why those threads
where not able to meet their deadlines.
- How to solve this issue? Apply it on your AADL model.
This exercise shows how to synchronize dataflows and control flows in a simplified
Flight Control System (see the figure bellow from [Pagetti14] and the AADL model inspired from this article).
Question 1 :
- Download the
that represents a possible AADL design for the functional model shown above.
- Note the use of Feature Groups and Thread Groups.
- Identify what are the main missing AADLconstructs.
Question 2 :
- Add missing connections in
THREAD GROUP IMPLEMENTATION Flight_Software.impl
- Run scheduling analysis.
Question 3 :
- Add Priority and/or Dispatch_Offset properties in order to ensure a proper ordering of the threads
regarding the dataflow logics.
- Check with the scheduling analysis tools.
F. Cottet, J. Delacroix, C.
Kaiser, and Z. Mammeri.
Ordonnancement temps réel.
[Pagetti14] The ROSACE Case Study: From
Simulink Specification to Multi/Many-Core Execution, Claire Pagetti, David Saussiéy, Romain Gratia,
Eric Noulard, Pierre Siron. RTAS 2014 conference.