Reactive control of adaptive embedded systems

Embedded systems have to be more and more adaptive: they must perform reconfigurations in reaction to changes in their environment, related to resources or dependability. The management of this dynamical adaptivity, as in autonomic systems, can be considered as a control loop, on continuous or discrete criteria. Embedded systems are also by nature safety-critical, and must be statically checkable for stringent guarantees of predictability. This is the goal of the formal techniques for their specification, validation and verification. The reactive systems approach to this problem exploits models and automated tools based on state machines. This position paper aims at drawing the attention of the autonomic computing community towards the existence of control solutions in discrete controller synthesis (DCS), and of programming languages and analysis and synthesis tools to support them. We use them as a foundation for an approach combining adaptivity and predictability, and describe a method for the safe design of safe execution systems, relying on a technique for the static guarantee of dynamic reconfigurations. We base our position on previous work in reactive and embedded systems, and draw directions detailing opportunities and challenges, towards the model-based control of adaptive systems. Key-words: Embedded systems, safe design, adaptive systems, autonomic computing, behavior enforcement, self-configuration, discrete controller synthesis, reactive systems, synchronous programming. ∗ http://pop-art.inrialpes.fr/people/rutten , [email protected] Contrôle réactif de systèmes embarqués adaptatifs Résumé : Les systèmes embarqués doivent être de plus en plus adaptatifs : ils doivent se reconfigurer en réaction à des changements dans leur environnement, concernant les ressources ou la fiabilité. La gestion de cette adaptativité dynamique peut être traitée, par exemple dans le calcul autonomique, au niveau de l’intergiciel, en captant l’état du système, en décidant d’actions de reconfiguration, et en les exécutant. On peut donc considérer qu’il s’agit d’une boucle de contrôle, sur des critères continus ou discrets. Les systèmes embarqués sont aussi par nature à sécurité critique. Obtenir une prévisibilité statique est le but des techniques de spécification, validation et vérification. L’approche des systèmes réactifs exploite des modèles, par exemple synchrones, et des outils automatiques pour la vérification ou la synthèse de contrôleurs discrets (SCD). Dans cet article de position, nous proposons une approche pour combiner adaptativité et prévisibilité, et décrivons une méthode pour la conception sûre de systèmes à exécution sûre, basée sur une technique pour la garantie statique de reconfigurations dynamiques. Mots-clés : Systèmes embarqués, conception sûre, systèmes adaptatifs, calcul autonomique, synthèse de contrôleurs discrets, programmation synchrone. Reactive control of adaptive embedded systems 3 1 Context and position statement Context. Embedded systems are proliferating, in a great variety of environments. Their design involves techniques ranging from application expertise, to software validation, and to System on Chip design. Embedded systems have to be more and more adaptive: they must perform reconfigurations in reaction to changes in their environment concerning e.g., power supply, communication bandwidth, quality of service, or also typically dependability and fault tolerance for a safe execution. The run-time management of this dynamical adaptivity is the object of research on ways to design and implement adaptation strategies. One approach is in autonomic computing, where functionalities are defined, typically at middleware level, for sensing the state of a system, deciding upon reconfiguration actions, and performing them. Embedded systems are by nature safety-critical, due to their deep interaction with their embedding environment, machines, goods or people, and also due to their wide-spread use and the cost of maintenance or recall of defect products. They have a special requirement for safe design, which classicaly contradicted dynamical operating system features. Obtaining static predictability is the goal of their specification, validation and verification techniques. The reactive systems approach to this problem exploits finite or bounded models e.g., synchronous, and automated algorithms for verification e.g., by model checking, or synthesis e.g., using discrete controller synthesis (DCS). Statement. An important concern is then to combine these two different requirements for embedded systems i.e., to be adaptive and predictable. This goal can also be formulated as: a method for the safe design of safe execution systems, a technique for the static guarantee of correct dynamic reconfiguration, a tool for the off-line computation of run-time controllers. In this position paper, we argue that model-based control of adaptive systems can contribute to this goal, in the following concrete directions: 1. modeling adaptation domains and reconfiguration mechanisms of autonomic systems in terms of their events and states, as discrete event systems; 2. stating the adaptation strategies and safety features in terms of logical properties; 3. obtaining their correct control using the available techniques for specifying, verifying, testing, compiling, and also, more originally, by solving the DCS problem thus defined; 4. obtaining control solutions adapted to each application, exploiting their specificities, thanks to the automation of the method that offers easy modifiability; 5. integrating these formal techniques in a user-aimed tool and method e.g., through the definition of domain-specific languages, with a compilation involving DCS; 6. and, last but not least, integrating an executable form of the resulting controller into the execution platform e.g., at middleware-level.