1 Introduction to APP4MC

The goal of the project is the development of a consistent, open, expandable tool platform for embedded software engineering. It is based on the model driven approach as basic engineering methodology. The main focus is the optimization of embedded multi-core systems.

Most functions in a modern car are controlled by embedded systems. Also more and more driver assistance functions are introduced. This implies a continuous increase of computing power accompanied by the request for reduction of energy and costs. To handle these requirements the multi-core technology permeates the control units in cars. This is today one of the biggest challenges for automotive systems. Existing applications can not realize immediate benefit from these multi-core ECUs because they are not designed to run on such architectures. In addition applications and systems have to be migrated into AUTOSAR compatible architectures. Both trends imply the necessity for new development environments which cater for these requirements.

The tool platform shall be capable to support all aspects of the development cycle. This addresses predominantly the automotive domain but is also applicable to telecommunication by extensions which deal with such systems in their native environment and integrated in a car.

Future extensions will add support for visualization tools, graphical editors. But not only design aspects will be supported but also verification and validation of the systems will be taken into account and support tools for optimal multi-core real-time scheduling and validation of timing requirements will be provided. In the course of this project not all of the above aspects will be addressed in the same depth. Some will be defined and some will be implemented on a prototype basis. But the basis platform and the overall architecture will be finalized as much as possible.

The result of the project is an open tool platform in different aspects. On the one hand it is published under the Eclipse Public License (EPL) and on the other hand it is open to be integrated with existing or new tools either on a company individual basis or with commercially available tools.

2 User Guide

2.1 Introduction

APP4MC comes with a predefined perspective available in the Eclipse menu under Window -> Open Perspective -> Other -> APP4MC. This perspective consists of the following elements:

• AMALTHEA Model Explorer
• Editor
  • Tree Editor showing the structure of the model content
  • Standard Properties Tab is used to work on elements attributes

The following screenshot is showing this perspective and its contained elements.

2.1.1 Steps to create a new AMALTHEA model

APP4MC provides a standard wizard to create a new AMALTHEA model from scratch.

Step 1: Create a new general project

The scope of an AMALTHEA model is defined by its enclosing container (project or folder).
Therefore a project is required.

Step 2: Create a new folder inside of the created project

It is recommended to create a folder ( although a project is also a possible container ).

Step 3: Create a new AMALTHEA model

In the context menu (right mouse button) an entry for a new AMALTHEA model can be found.

Another starting point is File -> New -> Other

In the dialog you can select the parent folder and the file name.

2.1.2 AMALTHEA Editor

The AMALTHEA Editor shows either the entire model that contains sub models or one of the sub models.
The next screenshot shows the "New Child" menu with all its possibilities.

In addition the AMALTHEA Editor has two commands available at the top right of the Editor.

Show types of model elements

The Show types of elements button triggers the editor to show the direct type of the element in the tree editor using [element_type]. The following screenshot shows the toggle and the types marked with an underline.

Search for model elements

The editor provides the possibility to filter model elements by using the available name attribute. For example this can be used to find all elements in the model with "ABS" at the beginning of their name. The search and result view is using the Eclipse search as result view.

The search result is using the Eclipse Search View.

An additional option is to toggle the search results to show them as a plain list instead of a tree grouped by type.

2.1.3 AMALTHEA Examples

The AMALTHEA tool platform comes with several examples. This section will describe how a new project based on these examples can be created.

Step 1

Click the "new" icon in the top left corner and select "Example..." or use the right mouse button.

Step 2

The "New Example" wizard will pop up and shows several examples.
Select one examples and hit continue.

Step 3

You will see a summary of the example projects that will be created.
Click "Finish" to exit this dialog.

You can now open the editor to inspect the models.

2.2 Concepts

2.2.1 Timing in Amalthea Primer

An Amalthea model per se is a static, structural model of a hardware/software system. The basic structural model consists of software model elements (tasks, runnables), hardware model elements (processing units, memories, connection handlers), stimuli that are used to activate execution, and mappings of software model elements to hardware model elements. Semantics of the model then allows for definite and clear interpretation of the static, structural model regarding its behavior over time.

Different Levels of Model Detail

Amalthea provides a meta-model suitable for many different purposes in the design of hardware/software systems. Consequently, there is not the level of Amalthea model detail – modeling often is purpose driven. Regarding timing analysis, we exemplary discuss three different levels of detail to clarify this aspect of Amalthea. Note that we focus on level of detail of the hardware model and assume other parts of the model (software, mapping, etc.) fixed.

Essential software model elements are runnables, tasks, and data elements (labels and channels). Runnable items of a runnable specifies its runtime behavior. You may specify the runnable items as a directed, acyclic graph (DAG). Amalthea has different categories of runnable items, we focus on the following four:

• Items that branch paths of the DAG (runnable mode switch, runnable probability switch).
• Items that signal or call other parts of the model (custom event trigger, runnable call, etc.).
• Items that specify data access of data elements (channel receive/send, label access).
• Items that specify execution time (ticks, execution needs).

Tasks may call runnables in a call graph. Note that a runnable can be called by several tasks. We then map tasks to task schedulers in the operating system model, and we map every task scheduler to one or more processing units of the hardware model. Further, we map data elements to memories of the hardware model.

This coarse level of hardware model detail-the hardware model consists only of mapping targets, without routing or timing for data accesses-may already be sufficient for analysis focusing on event-chains or scheduling.

As the second example of model detail, we now add access elements to all processing units of the hardware model, modeling data access latencies or data rates when accessing data in memories-still ignoring routing and contention. This level of detail is sufficient, for example, for optimizing data placement in microcontrollers using static timing analysis.

A more detailed hardware model, our third and last example of model detail, will contain information about data routing and congestion handling. Therefore, we add connection handlers to the hardware model for every possible contention point, we add ports to the hardware elements, and we add connections between ports. For every access element of the processing units, we add an access path, modeling the access route over different connections and connectionHandlers. the combination of all access elements are able to represent the full address space of a processing unit. This level of detail is well suited for dynamic timing simulation considering arbitration effects for data accesses.

In the following, we discuss 'timing' of Amalthea in context of level of detail of the last example and discrete-event simulation.

Discrete-Event Simulation

For dynamic timing analysis, the initial state of the static system model is the starting point, and a series of state changes is subject to model analysis. The state of a model mainly consist of states of HW elements (processing units and connection handlers). During analysis, a state change is then, for example, a processing unit changing from idle to execute.

When we are interested in the timing of a model, a common way is using discrete-event simulation. In discrete-event simulation, a series of events changes the state of the system and a simulated clock. Such a simulation event is, for instance, a stimuli event for a task to execute on a processing unit, what in turn may change the state of this processing unit from idle to execute.

Note that every event occurs at a specified point in simulated time; for instance, think of a new stimuli event that shall activate a task in 10ms from the current value of the simulated clock. Unprocessed (future) events are stored in an event list. The simulator then continuously processes the event occurring next to the current simulated time, and forwards the simulated clock correspondingly, thereby removing the event from the event list. Note that this is a very simplified description. For instance, multiple events at the same point in simulated time are possible. Processing events may lead to generation of new events. For instance, processing an end task execution event may lead to a new stimuli event that shall occur 5ms from the current value of the simulation clock added to the event list.

After sketching the basic idea of discrete-event simulation, we can be more precise with the term Amalthea timing: we call the trace of state changes and events over time the dynamic behavior or simply the timing of the Amalthea model. This timing of the model than may be further analyzed, for instance, regarding timing constraints.

Stimulation of task execution with corresponding stimuli events, and scheduling in general, is not further discussed here. In the following, we focus on timing of execution at processing units and data accesses.

Execution Time

The basic mechanism to specify execution time at a processing unit is the modeling element ticks. Ticks are a generic abstraction of time for software, independent of hardware. Regarding hardware, one may think of ticks as clock ticks or cycles of a processing unit. You can specify ticks at several places in the model, most prominently as a runnable item of a runnable. The ticks value together with a mapping to a specific processing unit that has a defined frequency then allows computation of an execution time. For instance, 100 ticks require 62.5ns simulated time at a processing unit with 1.6GHz, while 100 ticks require 41.6ns at a processing unit with 2.4GHz.

When the discrete-event simulator simulates execution of a runnable at a processing unit, it actually processes runnable items and translates their semantics into simulation events. We already discussed the runnable item ticks: when ticks are processed, we compute a corresponding simulation time value based on the executing processing unit's frequency, and store a simulation event in the list of simulation events for when the execution will finish.

In that sense, ticks translate into a fixed or static timing behavior - when execution starts, it is always clear when this execution will end. Note that the current version of Amalthea (0.9.3) also prepares an additional concept for specification of execution timing besides using ticks: execution needs. Execution needs will allow sophisticated ways of execution time specification, as required for heterogeneous systems. Execution needs define the number of usages of user-defined needs; a later version of Amalthea (> 0.9.3) then will introduce recipes that translate such execution needs into ticks, taking hardware features of the executing processing unit into account. Note that, by definition, a sound model for timing simulation always allows to compute ticks from execution needs. Consequently, for timing analysis using discrete-event simulation as described above, we first translate execution needs into ticks, resulting in a model we call ticks-only model. Thus, we can ignore execution needs for timing analysis.

Data Accesses

For data accesses, in contrast to ticks, the duration in simulation time is not always clear. A single data access may result in series of simulation events. Occurrence of these events in simulation time depends on several other model elements, for example, access paths, mapping of data to memory, and state of connection handlers. Thus, a data access may result in dynamic timing behavior. Note that there are plenty of options in Amalthea for hardware modeling; consequently, options for modeling and simulation of data accesses are manifold (see above Different Levels of Model Detail). In the following, we discuss some modeling patterns for data accesses.

Consider a hardware model consisting of two processing units, a connection handler, and a single memory. We add a read and a write latency to all connections and the connection handler. Additionally, we add an access latency to the memory. There are no read or write latency added to access elements of the processing units. Only access paths specify the routes from the specific processing unit to the memory across the connection handler, see the following screenshot.

As described in the beginning of this section, a single data access may result in a series of events. Expected simulation behavior is as follows: When the discrete-event simulator encounters a runnable item for a data read access at Cpu0, we add an event for one tick later to the event queue of the simulator, denoting passing the connection from Cpu0 to the connection handler MyConnectionHandler. (For simplicity, we do not use time durations calculated from the Cpu0's frequency here, what would be required to determine the correct point in simulated time for the event). After passing the connection, the state of MyConnectionHandler is relevant for the next event: Either MyConnectionHandler is occupied by a data access (from Cpu1), a data access arrives at the same time, or MyConnectionHandler is available.

• If MyConnectionHandler is available, we add an event for three ticks later-this is the read latency of the connection handler.

• If a data access from Cpu1 arrives at the same time, the connection handler handles this data access based on the selected arbitration mechanism (attribute not shown in the screen shot – we assume priority based with a higher priority for Cpu1). We add an event for three ticks later, when MyConnectionHandler is available again. We then check again for data accesses from Cpu1 at the same time and set a corresponding event.

• If MyConnectionHandler is occupied, we add an event for whenever the connection handler is not occupied anymore. We then check for data accesses from Cpu1 at the same time and set a corresponding event.

Eventually, MyConnectionHandler may handle the read access from Cpu0, and when the simulator reacts on the corresponding event, we add an event for one tick later, as this is the read latency for the connection between the connection handler and the memory. The final event for this read data access from Cpu0 results from the access latency of the memory (twelve ticks). When the simulator reacts on that final event, the read access from Cpu0 is completed and the simulator can handle the next runnable item at Cpu0, if available.

Note that in the above example there is only one contention point. We thus could reduce the number of events for an optimized simulation. Further, note that we ignore size of data elements in this example. We could use data rates instead of latencies at connections, the connection handler, and the memory to respect data sizes in timing simulation or work with the bit width of ports. Furthermore beside constant latency values it is also possible to use distributions, in this case the simulator role the dice regarding the distribution. At a last note, adding to the discussion of different detail levels: Depending on use-case, modeling purpose, and timing analysis tool, there may be best practice defined for modeling. For instance, one tool may rely on data rates, while other tools require latencies but only at memories and connection handlers, not connections. Tool specific model transformations and validation rules should handle and define such restrictions.

2.2.2 Hardware

Structural Modeling of Heterogeneous Platforms

To master the rising demands of performance and power efficiency, hardware becomes more and more diverse with a wide spectrum of different cores and hardware accelerators. On the computation front, there is an emergence of specialized processing units that are designed to boost a specific kind of algorithm, like a cryptographic algorithm, or a specific math operation like "multiply and accumulate". As one result, the benefit of a given function from hardware units specialized in different kinds may lead to nonlinear effects between processing units in terms of execution performance of the algorithm: while one function may be processed twice as fast when changing the processing unit, another function may have no benefit at all from the same change. Furthermore the memory hierarchy in modern embedded microprocessor architectures becomes more complex due to multiple levels of caches, cache coherency support, and the extended use of DRAM. In addition to crossbars, modern SoCs connect different clusters of potentially different hardware components via a Network on Chip. Additionally, power and frequency scaling is supported by state of the art SoCs. All these characteristics of modern and performant SoCs (specialized processing units, complex memory hierarchy, network like interconnects and power and frequency scaling) were only partially supported by the former Amalthea hardware model. Therefore, to create models of modern heterogeneous systems, new concepts of representing hardware components in a flexible and easy way are necessary: Our approach supports modeling of manifold hierarchical structures and also domains for power and frequencies. Furthermore, explicit cache modules are available and the possibilities for modeling the whole memory subsystem are extended, the connection between hardware components can be modeled over different abstraction layers. Only with such an extended modeling approach, a more accurate estimation of the system performance of state of the art SoCs becomes feasible.

Our intention is allowing to create a hardware model once at the beginning of a development process. Ideally, the hardware model will be provided by the vendor. All performance relevant attributes regarding the different features of hardware components like a floating point unit or how hardware components are interconnected should be explicitly represented in the model. The main challenge for a hardware/software performance model is then to determine certain costs, e.g. the net execution time of a software functionality mapped to a processing unit. Costs such as execution time, in contrast to the hardware structure, may change during development time – either because the implementation details evolve from initial guess to real-world measurements, the implementation is changed, or the tooling is changed. Therefore, the inherent attributes of the hardware, e.g. latency of an access path, should be decoupled from the mapping or implementation dependent costs of executing functions. We know from experience that it is necessary to refine these costs constantly in the development process to increase accuracy of performance estimation. Refinement denotes incorporation of increasing knowledge about the system. Therefore, such a refinement should be possible in an efficient way and also support re-use of the hardware model. The corresponding concepts are detailed in the following section.

Recipe and Feature concept: An outlook of an upcoming approach

Disclaimer: Please note that the following describes work in progress – what we call "recipes" later is not yet part of the meta-model, and the concept of "features" is not final.

The main driver of the concept described here is separation of implementation dependent details from structural or somehow "solid" information about a hardware/software system. This follows the separation of concerns paradigm, mainly to reduce refinement effort, and foster model re-use: As knowledge about a system grows during development, e.g. by implementing or optimizing functionality as software, the system model should be updated and refined efficiently, while inherent details shall be kept constant and not modified depending on the implementation.

An example should clarify this approach: For timing simulation, we require the net execution time of a software function executed on the processing unit it is mapped onto. This cost of the execution depends on the implementation of the algorithm, for instance, as C++ code, and the tool chain producing the binary code that eventually is executed. In that sense, the execution needs of the algorithm (for instance, a certain number of "multiply and accumulate" operations for a matrix operation) are naturally fixed, as well as the features provided by the processing unit (for instance, a dedicated MAC unit requiring one tick for one operation, and a generic integer unit requiring 0.5 ticks per operation). However is implementation- and tool-chain-dependent how the actual execution needs of the algorithm are served by the execution units. Without changing the algorithm or the hardware, optimization of the implementation may make better use of the hardware, resulting in reduced execution time. The above naturally draws the lines for our modeling approach: Execution needs (on an algorithmic level) are inherent, as well as features of the hardware. Keeping these information constant in the model is the key for re-use; implementation dependent change of costs, such as lower execution time by an optimized implementation in C++ or better compiler options, change during development and are modeled as recipe. A "recipe" thus takes execution needs of software and features of the hardware as input and results in costs, such as the net execution time. Consequently, recipes are the main area of model refinement during development. The concept is illustrated below.

Note that flexibility is part of the design of this approach. Execution needs and features are not limited to a given set, and recipes can be almost arbitrary prescripts of computation. This allows to introduce new execution needs when required to favorable detail an algorithm. For instance, the execution need "convolution-VGG16" can be introduced to model a specific need for a deep learning algorithm. The feature "MAC" of the executing processing unit provides costs in ticks corresponding to perform a MAC operation. The recipe valid for the mapping then uses these two attributes to compute the net execution time of "convolution-VGG16" in ticks, for instance, by multiplying the costs of xyz MAC operations with a penalty factor of 0.8. Note that with this approach execution needs may be translated very differently into costs, using different features.

To further motivate this approach, we give some more benefits and examples of beneficial use of the model:

• Given execution needs of a software function that directly correspond the features of processing units, the optimal execution time may be computed (peak performance).
• While net execution time is the prime example of execution needs, features, and recipes, the concept is not limited to "net execution time recipes", recipes for other performance numbers such as power consumption are possible.
• Recipes can be attached at different "levels" in the model: At a processing unit and at a mapping. If present, the recipe at mapping level has precedence.

General Hardware Model Overview

The design of the new hardware model is focusing on flexibility and variety to cover different kind of designs to cope with future extensions, and also to support different levels of abstraction. To reduce the complexity of the meta model for representing modern hardware architectures, as less elements as possible are introduced. For example, dependent of the abstraction level, a component called ConnectionHandler can express different kind of connection elements, e.g. a crossbar within a SoC or a CAN bus within an E/E-architecture. A simplified overview of the meta model to specify hardware as a model is shown below. The components ConnectionHandler, ProcessingUnit, Memory and Cache are referred in the following as basic components.

Class diagram of the hardware model

The root element of a hardware model is always the HwModel class that contains all domains (power and frequency), definitions, and hardware features of the different component definitions. The hierarchy within the model is represented by the HwStructure class, with the ability to contain further HwStructure elements. Therewith arbitrary levels of hierarchy could be expressed. Red and blue classes in the figure are the definitions and the main components of a system like a memory or a core.

The next figure shows the modeling of a processor. The ProcessingUnitDefiniton, which is created once, specifies a processing unit with general information (which can be a CPU, GPU, DSP or any kind of hardware accelerator). Using a definition that may be re-used supports quick modeling for multiple homogeneous components within a heterogeneous architecture. ProcessingUnits then represent the physical instances in the hardware model, referencing the ProcessingUnitDefiniton for generic information, supplemented only with instance specific information like the FrequencyDomain.

Link between definitions and module instances (physical components)

Yellow represents the power and frequency domains that are always created at the top level of the hardware model. It is possible to model different frequency or voltage values, e.g., when it is possible to set a systems into a power safe mode. All components that reference the domain are then supplied with the corresponding value of the domain.

All the green elements in the figure are related to communication (together with the blue base component ConnectionHandler). Green modeling elements represent ports, static connections, and the access elements for the ProcessingUnits. These ProcessingUnits are the master modules in the hardware model. The following example shows two ProcessingUnits that are connected via a ConnectionHandler to a Memory. There are two different possibilities to specify the access paths for ProcessingUnits like it is shown for ProcessingUnit_2 in the next figure. Every time a HwAccessElement is necessary to assign the destination e.g. a Memory component. This HwAccessElement can contain a latency or a data rate dependent on the use case. The second possibility is to create a HwAccessPath within the HwAccessElement which describes the detailed path to the destination by referencing all the HwConnections and ConnectionHandlers. It is even possible to reference a cache component within the HwAccessPath to express if the access is cached or non-cached. Furthermore it is possible to set addresses for these HwAccessPath to represent the whole address space of a ProcessingUnit. A typical approach would be starting with just latency or data rates for the communication between components and enhance the model over time to by switching to the HwAccessPaths.

Access elements in the hardware model

Current implementation with features and the connection to the SW Model

In the previous chapter the long time goal of the feature and recipe concept is explained. As an intermediate step before introducing the recipes we decided to connect the HwModel and SwModel by referencing to the name of the hardware FeatureCategories from the ExecutionNeed element in a Runnable. The following figure shows this connection between the grey Runnable item block and the white Features block. Due to the mapping (Task or Runnable to ProcessingUnit) the corresponding feature value can be extracted out of the ProcessingUnitDefinition.

An example based on the old hardware model is the "instruction per cycle" value (IPC). To model an IPC with the new approach a HwFeatureCategory is created with the name Instructions. Inside this category multiple IPC values can be created for different ProcessingUnitDefinitions.

Note: In version 0.9.0 to 0.9.2 exists a default ExecutionNeed Instructions together with a the HwFeatre IPC the cycles can be calculated by dividing the Instructions by the IPC value.

Execution needs example

Interpretation of latencies in the model

In the model read and write access latencies are used. An alternative which is usually used in specifications or by measurements are request and response latencies. The following figure shows a typical communication between two components. The interpretation of a read and write latency for example at ConnectionHandlers is the following:

• readLatency = requestLatency + response Latency

• writeLatency = requestLatency

The access latency of a Memory component is always added to the read or write latency from the communication elements, independent if its one latency from an HwAccessElement or multiple latencies from a HwAccessPath.

As example in case of using only read and write latencies:

• totalReadLatency = readLatency (HwAccessElement) + accessLatency (Memory)

• totalWriteLatency = writeLatency (HwAccessElement) + accessLatency (Memory)

An example in case of using an access element with a hardware access path:

n = Number of path elements

• totalReadLatency = Sum 1..n ( readLatency(p) ) + accessLatency (Memory)

• totalWriteLatency = Sum 1..n ( writeLatency(p) ) + accessLatency (Memory)

PathElements could be Caches, ConnectionHandlers and HwConnections. In very special cases also a ProcessingUnit can be a PathElement the ProcessingUnit has no direct effect on the latency. In case the user want to express a latency it has to be annotated as HwFeature.

2.2.3 Software (development)

The AMALTHEA System Model can also be used in early phases of the development process when only limited information about the resulting software is available.

Runnables

The Runnable element is the basic software unit that defines the behavior of the software in terms of runtime and communication. It can be described on different levels of abstraction:

1. timing only (activation and runtime)
2. including communication (in general)
3. adding detailed call graphs

To allow a more detailed simulation a description can also include statistical values like deviations or probabilities. This requires additional information that is typically derived from an already implemented function. The modeling of observed behavior is described in more detail in chapter Software (runtime).

Process Prototypes

Process Prototypes are used to define the basic data of a task. This is another possibility to describe that a set of Runnables has a similar characteristic (e.g. they have the same periodic activation).
A prototype can then be processed and checked by different algorithms. Finally a partitioning algorithm generates (one or more) tasks that are the runtime equivalents of the prototype.

This processing can be guided by specifications that are provided by the function developers:

• The Order Specification is a predefined execution order that has to be guaranteed.
• An Access Specification defines exceptions from the standard write-before-read semantics.

Constraints

In addition the partitioning and mapping can be restricted by Affinity Constraints that enforce the pairing or separation of software elements and by Property Constraints that connect hardware capabilities and the corresponding software requirements.
The Timing Constraints will typically be used to check if the resulting system fulfills all the requirements.

Activations

Activations are used to specify the intended activation behavior of Runnables and ProcessPrototypes. Typically they are defined before the creation of tasks (and the runnable to task mappings). So this is a way to cluster runnables and to document when the runnables should be executed.

The following activation patterns can be distinguished:

• Single: single activation
• Periodic: periodic activation with a specific frequency
• Sporadic: recurring activation without following a specific pattern
• Event: activation triggered by a TriggerEvent
• Custom: custom activation (free textual description)

To describe a specific (observed) behavior at runtime there are Stimuli in the AMALTHEA model. They can be created based on the information of the specified activations.

2.2.4 Software (runtime)

During runtime, the dynamic behavior of the software can be observed. The following Gantt chart shows an excerpt of such a dynamic behavior.

To model the observed behavior in the AMALTHEA model there are schedulable units (Processes) that contain the basic software units (Runnables) and stimuli that describe when the processes are executed. Statistical elements like distributions (Gauss, Weibull, ...) are also available in the model. They allow describing the variation of values if there are multiple occurrences.

In the following sections, a high level description of the individual elements of a software description that define the dynamic behavior are presented.

Processes (Tasks or ISRs)

Processes represent executable units that are managed by an operating system scheduler. A process is thus the smallest schedulable unit managed by the operating system. Each process also has its own name space and resources (including memory) protected against use from other processes. In general, two different kinds of processes can be distinguished: task and Interrupt Service Routine (ISR). Latter is a software routine called in case of an interrupt. ISRs have normally higher priority than tasks and can only be suspended by another ISR which presents a higher priority than the one running. In the Gantt chart above, a task called 'TASK_InputProcessing' can be seen. All elements that run within the context of a process are described in the following sections.

Runnables

Runnables are basic software units. In general it can be said that a Runnable is comparable to a function. It runs within the context of a process and is described by a sequence of instructions. Those instructions can again represent different actions that define the dynamic behavior of the software. Following, such possible actions are listed:

• Semaphore Access: request/release of a semaphore
• Label Access: reading/writing a data signal
• Ticks: number of ticks (cycles) to be executed
• ...

In the following sections elements, that can be of concern within a runnable, are described in more detail.

Labels

Labels represent the system's view of data exchange. As a consequence, labels are used to represent communication in a flattened structure, with (at least) one label defined for each data element sent or received by a Runnable instance.

Semaphore

The main functionality of a semaphore is to control simultaneous use of a single resource by several entities, e.g. scheduling of requests, multiple access protection.

Stimulation

Before, we described the dynamic behavior of a specific process instance. In general however, a process is not only activated once but many times. The action of activating a process is called stimulation. The following stimulation patterns are typically used for specification:

• Single: single activation of a process
• Periodic: periodic activation of a process with a specific frequency
• VariableRate: periodic activations based on other events, like rotation speed
• Event: activation triggered by a TriggerEvent
• InterProcess: activations based on an explicit inter-process trigger

2.2.5 General Concepts

Grouping of elements (Tags, Tag groups)

It is possible to use Tags for grouping elements of the model.

Custom Properties

The AMALTHEA model provides Custom Properties to enhance the model in a generic way. These can be used for different kind of purpose:

• Store attributes, which are relevant for your model, but not yet available at the elements
• Processing information of algorithms can be stored in that way, e.g. to mark an element as already processed

2.2.6 Scheduling

Scheduler to Core assignment

We distinguish between physical mapping and responsibility

• Executing Core means a scheduler produces algorithmic overhead on a core
• Responsibility means a scheduler controls the scheduling on core(s)

Task to Scheduler assignment

Tasks have a core affinity and are assigned to a scheduler

• Core Affinity Specifies the possible cores the task can run on. If only one core is specified, the task runs on this core. If multiple cores are specified, the task can migrate between the cores.
• Scheduler specifies the unique allocation of the task to a scheduler.

The scheduling parameters are determined by the scheduling algorithm and are only valid for a specific task – scheduler combination. Therefore the parameters are specified in the TaskAllocation object.

Scheduler hierarchies

Schedulers can be arranged in a hierarchy. If set, the parent scheduler takes the initial decision and delegates to a child-scheduler. If the child-scheduler is not a grouping of tasks, it can take scheduling decisions if permission is granted by the parent.
The scheduling parameters are determined by the scheduling algorithm of the parent scheduler. Therefore the relevant parameters in the hierarchical context are specified in the (intermediate) SchedulerAssociation object.

2.2.7 Communication via channels

Channel

Sender and receiver communicating via a channel by issuing send and receive operations; read policy and transmission policy define communication details.

A channel is specified by three attributes:

• elementType: the type that is sent to or read from the channel.
• defaultElements: number of elements initially in the channel (at start-up).
• maxElements (integer) denoting a buffer limit, that is, the channel depth. In other words, no more than maxElements elements of the given element type may be stored in the channel.

Channel Access

In the basic thinking model, all elements are stored as a sequential collection in the channel.

Sending

A runnable may send elements to a channel by issuing send operations.
The send operation has a single parameter:

• elements (integer): Number of elements that are written.

Receiving

A runnable may receive elements from a channel by issuing receive operations.
The receive operation is specified with a receive policy that defines the main behaviour of the operation:

• LIFO (last-in, first-out) is chosen if processing the last written elements is the primary focus and thereby missing elements is tolerable.
• FIFO (first-in, first-out) is chosen if every written element needs to be handled, that is, loss of elements is not tolerable.
• Read will received elements without modifying the channel
• Take will remove the received elements from the channel

The receive policy defines the direction a receive operation takes effect with LIFO accesses are from top of the sequential collection, while with FIFO accesses are from bottom of the sequential collection-and they define if the receive operation is destructive (take) or non-destructive) read.

Each operation further has two parameters and two attributes specifying the exact behavior. The two parameters are:

• elements (integer): Maximum number n of elements that are received.
• elementIndex (integer): Position (index i) in channel at which the operation is effective. Zero is the default and denotes the oldest (FIFO) or newest element (LIFO) in the channel.

In the following several examples are shown, of how to read or take elements out of a channel with the introduced parameters.

Two attributes further detail the receive operation:

• lowerBound (integer): Specify the minimum number of elements returned by the operation. The value must be in the range [0,n], with n is the value of the parameter elements. Default value is n.
• dataMustBeNew (Boolean): Specify if the operation must only return elements that are not previously read by this Runnable. Default value is false.

Transmission Policy

To further specify how elements are accessed by a runnable in terms of computing time, an optional transmission policy may specify details for each receive and send operation. The intention of the transmission policy is to reflect computing demand (time) depending on data.

The transmission policy consists of the following attributes:

• chunkSize: Size of a part of an element, maximum is the element size.
• chunkProcessingTicks (integer): Number of ticks that will be executed to process one chunk (algorithmic overhead).
• transmitRatio (float): Specify the ratio of each element that is actually transmitted by the runnable in percent. Value must be between [0, 1], default value is 1.0.

Example for using transmission policy to detail the receiving phase of a runnable execution. Two elements are received, leading to transmission time as given in the formula. After the receiving phase, the runnable starts with the computing phase.

2.2.8 Data Dependencies

Overview

It is possible to specify potential data dependencies for written data. More specifically, it is now possible to annotate at write accesses what other data potentially have influenced the written data. A typical "influence" would be usage of data for computing a written value. As such data often comes from parameters when calling a runnable, it is now also possible to specify runnable parameters in Amalthea and their potential influence on written data.

Semantics of the new attributes in Amalthea is described in detail below. In general, these data dependency extensions are considered as a way to explicitly model details that help for visualization or expert reviews. For use cases such as timing simulation the data dependency extensions are of no importance and should be ignored.

Internal Dataflow

In Embedded Systems, external dataflow is specified with reads and writes to labels, which are visible globally. This is sufficient for describing the inter-runnable communication and other use-cases like memory optimization. Nevertheless, for description of signal flows along an event chain, it is also necessary to specify the internal dataflow so that the connection between the read labels and the written labels in made.
Internal dataflow is specified as dependency of label writes to other labels, parameters of the runnable or event return values of called runnables. With this information, the connection of reads to writes of label can be drawn.

The internal dependencies are typically generated through source code analysis. The analysis parses the code and determines all writes to labels. For each of those positions, a backward slicing is made on the abstract syntax tree to derive all reads that influence this write. This collection is then stored as dependency at the write access.
Based upon this data a developer can now track a signal flow along from the sensor over several other runnables to the actuator. Existing event-chains can be automatically validated to contain a valid flow by checking if the segments containing a read label event and write label event within the same runnable are connected by an internal dependency. Without internal dependencies, this would introduce a huge manual effort. Afterwards the event-chains can be simulated and their end-to-end latencies determined with the usual tools.

2.2.9 Memory Sections

Purpose

Memory Sections are used for the division of the memory (RAM/ROM) into different blocks and allocate the "software" memory elements ( e.g. Labels), code accordingly inside them.
Each Memory Section has certain specific properties ( e.g. faster access of the elements, storing constant values). By default compiler vendors provide certain Memory Sections ( e.g. .data, .text) and additional Memory Sections can be created based on the project need by enhancing the linker configuration.

Definition

A "Memory Section" is a region in memory (RAM/ROM) and is addressed with a specific name. There can exist multiple "Memory Sections" inside the same Memory (RAM/ROM) but with different names. Memory Section names should be unique across the Memory (RAM/ROM).

Memory Sections can be of two types:

• Virtual Memory Section
• Physical Memory Section

Virtual Memory Section

"Virtual Memory Sections" are defined as a part of data specification and are associated to the corresponding Memory Elements (e.g. Label's) during the development phase of the software. Intention behind associating "Virtual Memory Sections" to Memory elements like Label's is to control their allocation in specific Memory (e.g. Ram1 or Ram2) by linker.

As a part of linker configuration – It is possible to specify if a "Virtual Memory Section" (e.g. mem.Sec1) can be part of certain Memory (e.g. Ram1/Ram2/SYSRAM but not Ram3).

Example:

Software should be built for ManyCore ECU – containing 3 Cores (Core1, Core2, Core3). Following RAMs are associated to the Cores: Ram1 – Core1, Ram2 – Core2, Ram3 – Core3, and also there is SYSRAM.

Virtual Memory Section : mem.sec1 (is defined as part of data specification) is associated to Label1 and Label2.

In Linker configuration it is specified that mem.sec1 can be allocated only in Ram1 or Ram2.

Below diagram represents the linker configuration content - w.r.t. possibility for physical allocation of mem.sec1 in various memories .

Based on the above configuration – Linker will allocate Label1, Label2 either in Ram1/Ram2/SYSRAM but not in Ram3/Ram4.

Physical Memory Section

"Physical Memory Sections" are generated by linker. The linker allocates various memory elements (e.g. Label's) inside "Physical Memory Sections".

Each "Physical Memory Section" has following properties:

• Name – It will be unique across each Memory
• Start and End address – This represents the size of "Physical Memory Section"
• Associated Physical Memory (e.g. Ram1 or Ram2)

Example: There can exist mem.sec1.py inside Ram1 and also in Ram2. But these are physically two different elements as they are associated to different memories (Ram1 and Ram2) and also they have different "start and end address".

Below diagram represents the information w.r.t. virtual memory sections (defined in data specification and associated to memory elements) and physical memory sections (generated after linker run).

Modeling Memory Section information in AMALTHEA

• As described in the above concept section:
  • Virtual memory sections are used:
    • To specify constraints for creation of Physical memory sections by linker
    • To control allocation of data elements (e.g. Labels) in a specific memory (e.g. Ram1/Ram2/SYSRAM)
  • Physical memory sections are containing the data elements after linker run (representing the software to be flashed into ECU)

Below figure represents the modeling of "Memory Section" (both virtual and physical) information in AMALTHEA model:

Below are equivalent elements of AMALTHEA model used for modeling the Memory Section information:

• Section
  • This element is equivalent to Virtual Memory Section defined during the SW development phase.
  • As a part of data specification defined in the sw-development phase, a Section object (with specific name) is associated to Label and Runnable elements.

• PhysicalSectionConstraint
  • This element is equivalent to the constraint specified in the linker configuration file, which is used to instruct linker for the allocation of Physical Memory Sections in specified Memories.
  • PhysicalSectionContraint is used to specify the combination of Virtual Memory Section and Memories (which can be considered by linker for generation of Physical Memory Sections).

Example: PhysicalSectionConstraint-1 is specifying following relation "Section-1" <--> "Memory-1", "Memory-2". This means that the corresponding Physical Memory Section for "Section-1" can be generated by linker in "Memory-1" or in "Memory-2" or in both.

• PhysicalSectionMapping
  • This element is equivalent to Physical Memory Section generated during the linker run.
    • Each PhysicalSectionMapping element:
      • Contains the Virtual Memory Section (e.g. Section-1) which is the source.
      • is associated to a specific Memory and it contains the start and end memory address (difference of start and end address represents the size of Physical Memory Section).
      • contains the data elements (i.e. Labels, Runnables part of the final software).

Note: There is also a possibility to associate multiple Virtual Memory Section's as linker has a concept of grouping Virtual Memory Sections while generation of Physical Memory Section.

Example: For the same Virtual Memory Section (e.g. Section-1), linker can generate multiple Physical Memory Sections in different Memories (e.g. PhysicalSectionMapping-1, PhysicalSectionMapping-2). Each PhysicalSectionMapping element is an individual entity as it has a separate start and end memory address.

2.3 Examples

2.3.1 Modeling Example 1

General information

Modeling Example 1 describes a simple system consisting of 4 Tasks, which is running on a dual core processor.
The following figure shows the execution footprint in a Gantt chart:

In the following sections, the individual parts of the AMALTHEA model for Modeling Example 1 are presented followed by a short description of its elements.

Hardware Model

The hardware model of Modeling Example 1 consists as already mentioned of a dual core processor.
The following gives a structural overview on the modeled elements.
There, the two cores, 'Core_1' and 'Core_2', have a static processing frequency of 100 MHz each, which is specified by the corresponding quartz oscillator 'Quartz'.

Operating System Model

The operating system (OS) model defines in case of Modeling Example 1 only the needed Scheduler.
Since a dual core processor has to be managed, two schedulers are modeled correspondingly.
In addition to the scheduling algorithm used by the scheduler, in this case OSEK, a delay of 100 ns is set, which is the presumed time the scheduler needs for context switches.
A comprehension of the modeled properties can be found in the following table:

Mapping Model

The mapping model defines allocations between different model parts.
On the one hand, this is the allocation of processes to a scheduler.
In case of Example 1, 'Task_1' and 'Task_2' are managed by 'Scheduler_1', while the other tasks are managed by 'Scheduler_2'.
On the other hand the allocation of cores to a scheduler is set.
For Modeling Example 1 two local schedulers were modeled.
As a consequence, each scheduler manages one of the processing cores.
A comprehension of the modeled properties can be found in the following tables:

Executable Allocation

Core Allocation

Software Model

Tasks

As already mentioned above, the software model of Modeling Example 1 consists exactly of four tasks, named 'Task_1' to 'Task_4'.
Each task is preemptive and has a priority assigned according its deadline, meaning the one with the shortest deadline, 'Task_1', has the highest priority, and so on.
Each task also calls a definitive number of Runnables in a sequential order.
A comprehension of the modeled properties can be found in the following table:

*MTA = Multiple Task Activation Limit

Runnables

In addition to the task, the software model also contains a definition of Runnables.
For Modeling Example 1, ten individual Runnables are defined.
The only function of those in this example is to consume processing resources.
Therefore, for each Runnable a constant number of instruction cycles is stated.
A comprehension of the modeled properties can be found in the following table:

Stimuli Model

The stimulation model defines the activations of tasks.
Since the four tasks of Modeling Example 1 are activated periodically, four stimuli according their recurrence are modeled.
A comprehension of the modeled properties can be found in the following table:

2.3.2 Modeling Example 2

General information

Modeling Example 2 describes a simple system consisting of 4 Tasks, which is running on a single core processor.
The following figure shows the execution footprint in a Gantt chart:

In the following sections, the individual parts of the AMALTHEA model for Modeling Example 2 are presented followed by a short description of its elements.

Hardware Model

The hardware model of Modeling Example 2 consists as already mentioned of a single core processor.
The following gives a structural overview on the modeled elements.
There, the core, 'Core_1' , has a static processing frequency of 600 MHz each, which is specified by the corresponding quartz oscillator 'Quartz_1'.

Operating System Model

The operating system (OS) model defines in case of Modeling Example 2 only the needed Scheduler.
Since only a single core has to be managed, a single scheduler is modeled correspondingly.
In addition to the scheduling algorithm used by the scheduler, in this case OSEK, a delay of 100 ns is set, which is the presumed time the scheduler needs for context switches.
A comprehension of the modeled properties can be found in the following table:

Mapping Model

The mapping model defines allocations between different model parts.
On the one hand, this is the allocation of processes to a scheduler.
Since there is only one scheduler available in the system, all four tasks are mapped to 'Scheduler_1'.
On the other hand the allocation of cores to a scheduler is set.
As a consequence, the scheduler manages the only available processing core.
A comprehension of the modeled properties can be found in the following tables:

Executable Allocation

Core Allocation

Software Model

Tasks

As already mentioned above, the software model of Modeling Example 2 consists exactly of four tasks, named 'Task_1' to 'Task_4'.
All tasks have assigned the same priority (10) to get a cooperative scheduling.
'Task_2' to'Task_4' call a definitive number of Runnables in a sequential order.
'Task_1' instead contains a call graph that models two different possible execution sequences.
In 70% of the cases the sequence 'Runnable_1_1', 'Runnable_1_2', 'Task_2', 'Runnable_1_4' is called, while in the remaining 30% the sequence 'Runnable_1_1', 'Runnable_1_3', 'Task_3', 'Runnable_1_4' is called.
As it can be seen, the call graph of 'Task_1' contains also interprocess activations, which activate other tasks.
A comprehension of the modeled properties can be found in the following table:

*MTA = Multiple Task Activation Limit

Runnables

In addition to the task, the software model also contains a definition of Runnables.
For Modeling Example 2, seven individual Runnables are defined.
The only function of those in this example is to consume processing resources.
Therefore, for each Runnable a number of instruction cycles is stated.
The number of instruction cycles is thereby either constant or defined by a statistical distribution.
A comprehension of the modeled properties can be found in the following table:

Stimulation Model

The stimulation model defines the activations of tasks.
'Task_1' is activated periodically by 'Stimulus_Task_1'
'Stimulus_Task_2' and 'Stimulus_Task_3' represent the inter-process activations for the corresponding tasks.
'Task_4' finally is activated sporadically following a Gauss distribution.
A comprehension of the modeled properties can be found in the following table:

2.3.3 Modeling Example "Purely Periodic without Communication"

This system architecture pattern consists of a task set, where each task is activated periodically and no data accesses are performed. The execution time for each task is determined by the called runnable entities as specified in the table below. All tasks contain just one runnable except of T₇, which calls at first R_7,1 and after that R_7,2.

The table below gives a detailed specification of the tasks and their parameters. The tasks are scheduled according fixed-priority, preemptive scheduling and if not indicated otherwise, all events are active in order to get a detailed insight into the system's behavior.

In order to show the impact of changes to the model, the following consecutive variations are made to the model:

1) Initial Task Set

For this variation, the Tasks T₄, T₅, T₆, and T₇ of the table above are active.

2) Increase of Task Set Size I

For this variation, the Tasks T₃, T₄, T₅, T₆, and T₇ are active. That way the utilization of the system is increased.

3) Increase of Task Set Size II

For this variation, the Tasks T₁, T₃, T₄, T₅, T₆, and T₇ are active. That way the utilization of the system is increased.

4) Increase of Task Set Size III

As from this variation on, all tasks (T₁ - T₇) are active. That way the utilization of the system is increased.

5) Accuracy in Logging

For this variation, just task events are active. That way, only a limited insight into the system's runtime behavior is available.

6) Schedule

As from this variation on, T₇ is set to non-preemptive. That way, the timing behavior is changed, which results in extinct activations (see red mark in the figure below).

7) Activation

As from this variation on, the maximum number of queued activation requests for all tasks is set to 2. That way, the problem with extinct activations resulting from the previous variation is solved.

8) Schedule Point

For this variation, a schedule point is added to T₇ between the calls of R_7,1 and R_7,2. That way, the timing behavior is changed in particular.

9) Scheduling Algorithm

For this variation, the scheduling algorithm is set to Earliest Deadline First. That way, the timing behavior is changed completely.

2.3.4 Modeling Example "Client-Server without Reply"

This system architecture pattern extends the modeling example "Purely Periodic without Communication" by adding an one-way communication between tasks. It consists of two tasks T₁, and T₂. Task T₁ sends a message to Task T₂ before runnable R₁ is called. In 20% of the cases Message 1, in 30% of the cases Message 2, in 20% of the cases Message 3, in 15% of the cases Message 4, and in 15% of the cases any other message than the previously mentioned ones is sent. Task T₂ reacts on the contents of the message by calling different runnables. In case of Message 1 runnable R_2,1, in case of Message 2 runnable R_2,2, in case of Message 3 runnable R_2,3, in case of Message 4 runnable R_2,4, and in case of any other message than the previous mentioned ones runnable R_2,x is called as default.

The table below gives a detailed specification of the tasks and their parameters. The tasks are scheduled according fixed-priority, preemptive scheduling and if not indicated otherwise, all events are active in order to get a detailed insight into the system's behavior.

In order to show the impact of changes to the model, the following consecutive variations are made to the model:

1) Initial Task Set

As defined by the table above.

2) Exclusive Area

For this variation, all data accesses are protected by an exclusive area. Therefore, the data accesses in T₁ as well as all runnables in T₂ (R_2,x, R_2,1, R_2,2, R_2,3, and R_2,4) are protected during their complete time of execution via a mutex and priority ceiling protocol. That way, blocking situations appear.

3) Inter-process Activation

As from this variation on, task T₂ gets activated by an inter-process activation from task T₁ instead of being activated periodically. The interprocess activation is performed right after the message message is written in T₂ and consequently before the runnable R₁ is called. That way, a direct connection between T₁ and T₂ is established.

4) Priority Ordering

As from this variation on, the priority relation between task T₁ and T₂ is reversed. As a consequence, the priority of task T₁ is set to 1 and the priority of task T₂ is set to 2. That way, a switch from asynchronous to synchronous communication is considered.

5) Event Frequency Increase

As from this variation on, the periodicity of T₁ is shortened. For this, the value for the period of task T₁ is cut in half to 50 * 10⁶ time units. That way, the utilization of the system is increased.

6) Execution Time Fluctuation

As from this variation on, the execution time distribution is widened for both tasks. Therefore, the maximum of every uniform distribution is increased by 1 percent so that they vary now by 2 percent. That way, the utilization of the system is increased, which results in extinct activations.

7) Activation

As from this variation on, the maximum number of queued activation requests for both tasks is set to 2. That way, the problem with extinct activations resulting from the previous variation is solved.

8) Accuracy in Logging of Data State I

For this variation, the data accesses in task T₁ and task T₂ are omitted. Instead, the runnable entities R_2,x, R_2,1, R_2,2, R_2,3, and R_2,4, each representing the receipt of a specific message, are executed equally random, meaning each with a probability of 20%. That way, only a limited insight into the system's runtime behavior is available.

9) Accuracy in Logging of Data State II

For this variation, just task events are active. That way, only a limited insight into the system's runtime behavior is available.

2.3.5 Modeling Example "State Machine"

In this system architecture pattern the modeling example "Client Server without Reply" is extended in such a way that now the task that receives messages (T₂) not only varies its dynamic behavior and consequently also its execution time according the transmitted content but also depending on its internal state, meaning the prior transmitted contents. To achieve, this task T₁ sends a message to task T₂ with either 0 or 1 before runnable R₁ is called. The value 0 is used in 75 % of the cases and 1 in the other cases as content of the message. Starting in state 0, T₂ decreases or increases the state its currently in depending on the content of the message, 0 or 1 respectively. The runnable R _2,1, R _2,2, and R _2,3 represent then the three different states that the system can be in.

The table below gives a detailed specification of the tasks and their parameters. The tasks are scheduled according fixed-priority, preemptive scheduling and if not indicated otherwise, all events are active in order to get a detailed insight into the system's behavior.

In order to show the impact of changes to the model, the following consecutive variations are made to the model:

1) Initial Task Set

As defined by the table above.

2) Exclusive Area

For this variation, all data accesses are protected by an exclusive area. Therefore, the data accesses in T₁ as well as all runnables in T₂ (R_2,1, R_2,2, and R_2,3) are protected during their complete time of execution via a mutex and priority ceiling protocol. That way, blocking situations appear.

3) Priority Ordering

As from this variation on, the priority relation between task T₁ and T₂ is reversed. As a consequence, the priority of task T₁ is set to 1 and the priority of task T₂ is set to 2. That way, the timing behavior is changed fully.

4) Inter-process Activation

As from this variation on, task T₂ gets activated by an inter-process activation from task T₁ instead of being activated periodically. The interprocess activation is performed right after the message message is written in T₁ and consequently before the runnable R₁ is called. That way, a direct connection between T₁ and T₂ is established.

5) Event Frequency Increase

As from this variation on, the periodicity of T₁ is shortened. For this, the value for the period of task T₁ is halved to 50 * 10⁶. That way, the utilization of the system is increased, which results in extinct activations.

6) Activation

As from this variation on, the maximum number of queued activation requests for both tasks is set to 2. That way, the problem with extinct activations resulting from the previous variation is solved.

7) Execution Time Fluctuation

As from this variation on, the execution time distribution is widened for both tasks. Therefore, the maximum of the uniform distribution is increased by 1 percent so that the uniform distribution varies now by 2 percent. That way, the utilization of the system is further increased.

8) Accuracy in Logging of Data State I

For this variation, the data write accesses in task T₁ and task T₂ are omitted. Instead, the runnables R_2,1, R_2,2, and R_2,3, each representing the execution of a specific state, are executed with a probability of 60 %, 30 %, and 10 % respectively. That way, only a limited insight into the system's runtime behavior is available.

9) Accuracy in Logging of Data State II

For this variation, just task events are active. That way, only a limited insight into the system's runtime behavior is available.

2.3.6 Modeling Example "Feedback Loop"

The task set of the modeling example "State Machine" is expanded further in this architecture pattern with the result that messages are exchanged in a loop, instead of just in one way. To achieve this, task T₁ sends a message u to task T₂ before runnable R₁ is called. The content of this message is 0, if the content of a previously received message e is 0, or 1 if it was 1. Task T₂ represents then a state machine with three states that increases its state, if message u is 1 and decreases, if it is 0. In each state the messages y and w are set with state specific values and sent to task T₃ and task T₄ respectively. In case of State 0, the messages y and w contain the value 0, in case of State 1 both contain 50 and in case of State 2 the value 100 is sent. These messages are written before runnable R₂ is called. However, in 30 % of the cases task T₄ is activated via an inter-process activation before this runnable call happens. Task T₃ varies its dynamic behavior and consequently also its execution time according the transmitted content of message y. Task T₄ finally prepares again the input for task T₁. If the content received in message w is 0, then in 30% of the cases the content of message e is 0, otherwise 1. In the case that message w is 50, message e is set to 0 with a probability of 50% and to 1 accordingly. Finally, message e is set to 0 in 70% of the cases and to 1 in 30% of the cases, if message w is 100. In addition to this feedback loop, other system architecture patterns are added to be executed concurrently in order to increase the complexity. The tasks T₅ and T₆ represent a client-server without reply and are equal to the tasks T₁ and T₂ respectively as described in the modeling example "Client-Server without Reply". T₇ is a periodically activated task without any communication and identical to task T₇ of modeling example "Purely Periodic without Communication".

The table below gives a detailed specification of the tasks and their parameters. The tasks are scheduled according fixed-priority, preemptive scheduling and if not indicated otherwise, all events are active in order to get a detailed insight into the system's behavior.

In order to show the impact of changes to the model, the following consecutive variations are made to the model:

1) Initial Task Set

For this variation, the tasks T₁, T₂, T₃, and T₄ of the table above are active.

2) Increase of Task Set Size I

For this variation, the Tasks T₁, T₂, T₃, T₄, T₅, and T₆ are active. That way the utilization of the system is increased.

3) Increase of Task Set Size II

As from this variation on, all tasks are active. That way the utilization of the system is increased.

4) Inter-process Activation

As from this variation on, task T₂ gets activated by an inter-process activation from task T₁, task T₃ by an inter-process activation from task T₂, and task T₆ by an inter-process activation from task T₅ instead of being activated periodically. The inter-process activation in task T₁ is performed right after the message u is written in T₂ and consequently before the runnable R₁ is called, in task T₂ respectively right before task T₄ is activated, and in task T₅ task T₆ is called right before runnable R₅. That way, a direct connection between these tasks is established.

5) Event Frequency Increase

As from this variation on, the periodicity of the tasks T₁, T₅, and T₇ are shortened. For task T₁, the value for the period is set to 450 * 10⁶, the task T₅ to 60 * 10⁶, and for task T₇ to 575 * 10⁶. That way, the information density is increased.

6) Execution Time Fluctuation

As from this variation on, the execution time distribution is widened for both tasks. Therefore, the maximum of the uniform distribution is increased by 1 percent so that the uniform distribution varies now by 2 percent. That way, the utilization of the system is increased, which results in extinct activations.

7) Activation

As from this variation on, the maximum number of queued activation requests for both tasks is set to 2. That way, the problem with extinct activations resulting from the previous variation is solved.

8) Accuracy in Logging of Data State I

For this variation, the data accesses in all tasks are omitted. Instead, the runnable entities R_3,0, R_3,1, and R_3,2, are executed with a probability of 50 %, 30 %, and 20 % respectively, and the runnable entities R_6,x, R_6,1, R_6,2, R_6,3, and R_6,4 are executed with a probability of 15 %, 20 %, 30 %, 20 %, and 15 % respectively. That way, only a limited insight into the system's runtime behavior is available.

9) Accuracy in Logging of Data State II

For this variation, just task events are active. That way, only a limited insight into the system's runtime behavior is available.

2.3.7 Modeling Example "State Machine Feedback Loop"

The task set of the modeling example "State Machine" is expanded further in this architecture pattern by combining the ideas behind the modeling example "State Machine" and "Feedback Loop". This means that messages are exchanged in a loop and each sender/receiver is also a state machine. To achieve this, task T₁ has two different internal states 0 and 1, and task T₂ manages three consecutive states 0, 1, and 2. The state task T₁ is currently in is sent via a message to task T₂ before runnable R₁ is called. If the content of the message sent from task T₁ is 1, task T₂ increases its internal state, e.g. from state 0 to 1, and if it is 0, task T₂ decreases its internal state accordingly. Then, depending on the state task T₂ is currently in, the according runnable (R_2,0 for state 0, etc.) is executed. If the maximum or minimum state of task T₂ is reached but the received message from task T₁ tells task T₂ to further increase or respectively decrease its internal state, task T₂ sends a message to task T₁. This message then causes task T₁ to toggle its internal state which consequently results in a switch from increasing to decreasing or vice versa. In addition to this state machine feedback loop, other system architecture patterns are added to be executed concurrently in order to increase the complexity. The tasks T₃ and T₄ represent a client-server without reply and are equal to the tasks T₁ and T₂ respectively as described above in the modeling example "Client-Server without Reply". T₅ is a periodically activated task without any communication and identical to task T₇ in the modeling example "Purely Periodic without Communication".

The table below gives a detailed specification of the tasks and their parameters. The tasks are scheduled according fixed-priority, preemptive scheduling and if not indicated otherwise, all events are active in order to get a detailed insight into the system's behavior.

In order to show the impact of changes to the model, the following consecutive variations are made to the model:

1) Initial Task Set

For this variation, the tasks T₁, and T₂ of the table above are active.

2) Increase of Task Set Size I

For this variation, the tasks T₁, T₂, T₃, and T₄ are active. That way the utilization of the system is increased.

3) Increase of Task Set Size II

As from this variation on, all tasks are active. That way the utilization of the system is increased.

4) Inter-process Activation

As from this variation on, task T₂ gets activated by an inter-process activation from task T₁, and task T₄ by an inter-process activation from task T₃ instead of being activated periodically. The inter-process activation in task T₁ is performed right after the message to task T₂ is written and consequently before the runnable R₁ is called, and in task T₃ task T₄ is called right before runnable R₃. That way, a direct connection between these tasks is established.

5) Event Frequency Increase

As from this variation on, the periodicity of the tasks T₁, T₃, and T₅ are shortened. For task T₁, the value for the period is set to 220 * 10⁶, the task T₃ to 50 * 10⁶, and for task T₅ to 500 * 10⁶. That way, the information density is increased.

6) Execution Time Fluctuation

As from this variation on, the execution time distribution is widened for both tasks. Therefore, the maximum of the uniform distribution is increased by 1 percent so that the uniform distribution varies now by 2 percent. That way, the utilization of the system is increased, which results in extinct activations.

7) Activation

As from this variation on, the maximum number of queued activation requests for both tasks is set to 2. That way, the problem with extinct activations resulting from the previous variation is solved.

8) Accuracy in Logging of Data State I

For this variation, the data accesses in all tasks are omitted. Instead, all runnablea representing a state are executed equally random, meaning the runnables R_2,0, R_2,1, and R_2,2 are each executed with a probability of 33 %, and the runnables R_4,x, R_4,1, R_4,2, R_4,3, and R_4,4 each with a probability of 20 %. That way, only a limited insight into the system's runtime behavior is available.

9) Accuracy in Logging of Data State II

For this variation, just task events are active. That way, only a limited insight into the system's runtime behavior is available.

2.3.8 Democar Example

The so called Democar model presented in the AMALTHEA example files describe a simple engine management system.

Origin

The Democar example is loosely based on the publicly available information taken from

A Timing Model for Real-Time Control-Systems and its Application
on Simulation and Monitoring of AUTOSAR Systems
Author: Patrick Frey

A version of the dissertation can be downloaded from University of Ulm: pdf.

Files

AMALTHEA_Democar.amxmi
contains the complete model, consisting of a hardware model, a model of the operating system, a stimulation model and a model that describes the software system.

Amalthea_ArExampleEngine.atdb
is an AMALTHEA Trace Database and it contains a trace that is the result of a simulation of this example.

2.3.9 Hardware Examples

This example contains two simple hardware models:

Example 1: Simple_ECU

The example shows a single structure with two identical cores with such an Instruction per cycle feature. The model includes only one frequency domain and no power domain. Each core is connected to all three different memory units via a HwAccessElement with read and write latencies. The memory components include an access latency. This means the total latency for a read and a write access are calculated in the following way:

TotalReadLatency = readLatency + accessLatency
TotalWriteLatency = writeLatency + accessLatency

This example shows a very simple hardware modeling approach where no interconnects and ports are necessary. Such a model can be used in a very early design phase where only rough estimations or a limited amount of informations about the system are available.

Example 2: Simple_E_E_Architecture

The second example shows a simple E/E-Architecture out of two identical ECUs. Each ECU contains two cores, one interconnect and a memory component. Both ECUs are connected via a CAN-Bus. In this example both possibilities for a HwAccessElement are shown. The local memory is just connected with read and write latencies and the external memory of the other ECU is connected with the help of a HwAccessPath. To use access paths hardware ports and connections between those ports are mandatory. The access paths itself is an ordered list of elements which are used for the connection. As an example for the access path between Core1EC1 and MainMemEC2 following access path elements are referred:

con1 -> internalCan_ECU1 -> con4 -> con9 -> CAN -> con10 -> con8 -> InterconnectEC2 -> con7.

That means the complete access paths includes:

• 3 x ConnectionHandler
• 6 x HwConnections

The latency in this case is the sum of all elements of the path plus the access latency of the memory. However latencies at connections are usually only used to account an offset for a specific component. In case a data rate is used the maximum data rate is limited by the lowest data rate in the path. In case of a ConnectionHandler the data rate is usually shared between different accesses.
The hierarchical ports from both ECUs to connect the CAN Bus with the ECUs as block boxes are not mandatory but recommended. This concept of hierarchical ports increases the number of HwConnections but allows also the structuring of all internal modules within a HwStructure and only connect the hierarchical ports with the rest of the system.

2.3.10 Scheduler Examples

The following elements are used to illustrate the structure of the example schedulers:

Hierarchical Scheduler

In this example the main scheduler realizes a Priority Round Robin strategy. The main scheduler works as a global scheduler that schedules subsystems like virtual machines or hypervisor partitions. Each partition realizes an OSEK scheduling system. In this case the main scheduler is responsible for both cores but only running on one core. Each OSEK subsystem is responsible for exactly one core but only if the main scheduler grants the core usage. The OSEK subsystems then decide on a FPP basis, which task can run. The coreAffinity for the tasks is not needed, since their scheduler is only responsible for one core.

Partitioned_FPP Scheduler

In this example a custom FPP scheduler named Partitioned_FPP is representing a global scheduler. It schedules tasks on a FPP basis but with the additional constraint that it's group must have budget left (has similarities to QNX's adaptive partitioned scheduling). The scheduler "Grouping" is only there to assign budgets to a logical task group and define no mapping or responsibility at all. Therefore in the taskAllocation only priority and coreAffinity are specified. The coreAffinity of tasks in the same group can differ, even task migration is possible if a task's affinity is CoreA as well as CoreB.

2.3.11 Numeric Modes Example

Dynamic task activations and the execution of different control paths can depend on internal system states, external events and scheduling effects resulting in different execution sequences of tasks. In APP4MC modes can be used to steer different execution paths. The designer can define modes that execute different paths within runnables, tasks, and even control dynamic activation schemes of tasks with multiple dependencies. This page explains the concepts with a simple example. For the description of the basic model elements, we refer the reader to the chapters:

Data Models -> Software Model -> Modes
Data Models -> Software Model -> Runnable Items -> Runnable Mode Switch
Data Models -> Software Model -> The Call Graph -> Mode Switch
Data Models -> Stimuli Model -> Mode Value List and Execution Condition

Example description

In this chapter, we show a small example how to use modes to steer the execution and the activation of tasks with modes. The following picture depicts the example:

In this example, we have three modes, one _Enum__ and two Numeric. The numeric modes are initialized with the value -1:

First, we have two data generators with Task genX and Task genY where each execution increases a numeric mode by 1. They are activated by a relative sporadic stimulus with an occurrence interval between 10ms and 50ms. The runnable counterForX executes this for genX:

On every execution, the generator tasks trigger the CustomEvent check to evaluate the EventStimulus. This event stimulus checks the condition:
executionMode == ModeA && countX > 2 && countY > 4
In this example, we do not describe the change of the executionMode to keep the model simpler. This mode could be changed e.g. from within the system or by an external ISR trigger.

If this condition is true, both counting modes are set to zero and the Task doA is called.

Another way to steer the execution depending can be done via mode switches on task level. In doB the mode check is done at task level as depicted in the following picture:

Only if the condition is true runnable runB is called. Within this runnable the counting modes are decremented by 3.

The last mechanisms is also possible at runnable level by using the runnableModeSwitch.

Beware of where to reset or change the modes. In doB the modes are reseted directly in the beginning. If you by accident put these after the tick element, it could result in an unintended behavior. In the generator tasks be aware of where to put the customEventTrigger. This element activates the stimuli evaluation. If you put a tick element between the increment and the trigger, the evaluation is delayed.

2.4 Tutorials

2.4.1 AMALTHEA Trace Database (ATDB) Import Example

The following section describes how to use the information contained within an AMALTHEA Trace Database (ATDB) to create a model.

Step 1

The figure above shows content of "Amalthea_ArExampleEngine.atdb", an AMALTHEA Trace database provided with the "Democar Example".
To get this file create a new example project (see "Creating an example"), based on the "Democar Example".

Step 2

Right-click on the project folder "org.eclipse.app4mc.amalthea.example.democar" or any other. You will see several possible options. In that option menu press "Import..." then.
This will open a dialogue where the different import options available are listed. Open the folder called "AMALTHEA" by clicking on cross next to the title. This is shown in the figure above.

Step 3

Next, choose mark the option "From AMALTHEA Trace DB" by clicking on it and proceed to the next page by either double-clicking the option name or by pressing the "Next" button. There you are prompted to enter the location of the ATDB file you want to import. Click the upper "Browse..." button to navigate your file system and select the wanted file. If you want to change the target project the model will be created in press the lower "Browse..." button and make your choice. The figure above shows an example input.

Step 4

After you have made all required inputs, click on "Finish". This will start the analysis of the database. Once the model creation is done the dialogue will close and the newly created amxmi file opened on the AMALTHEA Model editor as shown in the figure above.

2.5 Editors / Viewers

2.5.1 AMALTHEA Trace Database Metrics Viewer

This is a simple viewer that shows how to access the AMALTHEA trace database.

2.5.2 Sirius Viewer

Basic graphical viewers are realized using Sirius.

The following viewers are treated as a POC (Proof of concept) and are not final.
They can be extended and further developed to show additional parts of the model.

Activate capabilities for project

The following steps will activate the Sirius feature and AMALTHEA viewpoints:

To use Sirius, projects needs to have the Modeling Feature enabled. This can be done by right clicking on the project and select Configure – Convert to Modeling Project. Note that a new file representations.aird is created at top level of the project. This file is containing the user created diagrams.

Activate the AMALTHEA viewpoint by right click on the project and select Viewpoint Selection.

Note: Using one of the available commands to open a view using a right click on an element automatically adds the Modeling Nature and selects the available AMALTHEA viewpoint.

Available Diagrams

Task View

The current version of the Task View shows the Task as a container with the included Runnables.

Open/Create a view for a Task element by right click on it and select Task View.

A new diagram is shown based on the given Task element.

Communication Layer

The Communication Layer shows direct dependencies between Runnables. Therefore the following requirement must be fulfilled:

1. Runnable R1 writes Label L1
2. Runnable R2 reads Label L1

Enable it through the Layers option menu.

In this sample some of the available communications are fulfilling this requirement.

Label Layer

The Label Layer shows all Read/Write dependencies between Runnables and Labels.

Enable it through the Layers option menu.

After some arrangement it can look like the following:

Label View

The Label View shows a Label element including read/write accesses from corresponding Runnables.

Open/Create a view for a Label element by right click on it and select Label View.

A new diagram is shown based on the given Label element.

EventChain View

The EventChain view is the first version to show the included Events.
If there is a reference to a RunnableEvent, the corresponding Runnable is also shown.
This behavior can be extended also for Labels and Tasks for example.

Open/Create a view for an EventChain element by right click on it and select Event Chain View.

A new diagram is opening showing the order of the included Events.
If there is a RunnableEvent, the association to the Runnable includes the configured EventType.

Tasks View

The Tasks view is in general the same view as the already mentioned Task view above with the advantage to get an overview about all included Tasks of a Software model.

To open/create a Tasks view it is needed to switch to the Sirius perspective.

• This can be done by Window – Perspective – Open Perspective – Other and select then Sirius.
• On the left side inside of the Model Explorer go to an AMALTHEA model, expand it and do a right click on the Software model.
• Select New Representation – new Tasks Overview to create a new diagram.
• Change the name if needed and click on ok.

The same additional options are available as in the normal Task view like the Label Layer and Communication Layer.

Mapping View

The Mapping view gives an overview of the relation between Cores, Schedulers and Tasks, which is defined in the Mapping Model of AMALTHEA.

To open/create a Tasks view it is needed to switch to the Sirius perspective.

• This can be done by Window – Perspective – Open Perspective – Other and select then Sirius.
• On the left side inside of the Model Explorer go to an AMALTHEA model, expand it and do a right click on the Mapping model.
• Select New Representation – new Tasks Overview to create a new diagram.
• Change the name if needed and click on ok.

2.6 Model Validation

2.6.1 Usage of AMALTHEA Model Validation

The AMALTHEA model validation can be triggered by clicking on the "Validate" button of the Amalthea editor.

All elements of the model are included for validation. In the next window the list of profiles appears allowing the selection of specific validations.

If an error is found, it is shown in the Problems view of Eclipse. A simple double click on the error will lead you to the affected elements in the AMALTHEA model. The validation distinguishes between three error types: errors, warnings and info.

2.7 Model Migration

2.7.1 AMALTHEA Model Migration

Why model migration is required ?

EMF based models are the instances of ECORE meta model (which is updated for each release).

As there is a tight dependency between model instance and the corresponding meta model, old EMF models can not be loaded with the newer release of meta model.

Example : Due to the change in the namespace of the meta model, loading of model files from prior versions would fail with the latest version

This problem can be solved by explicitly migrating the model files from the prior versions to be compatible to the latest meta model version

AMALTHEA model migration

As described above, same scenario is also applicable for AMALTHEA models as they are instances of EMF based AMALTHEA ECORE meta model.

For each release of AMALTHEA there will be changes in the meta model contents, due to this it is not possible to load models built from previous releases of AMALTHEA into latest tool distribution.

Model Migration functionality is part of this distribution, using this feature it is possible to convert models from previous APP4MC releases to the ones which are compatible to the next versions of AMALTHEA meta model.

Only forward migration of models is supported by Model Migration functionality of AMALTHEA

2.7.2 Supported versions for model Migration

Model migration functionality provides a possibility to migrate the models ( created from previous releases of AMALTHEA ) to the latest versions

Only forward migration is supported

AMALTHEA meta model versions information

From below version, AMALTHEA meta model is a part of the official project Eclipse APP4MC ( See: www.eclipse.org/app4mc )

• 0.7.0

Model migration

As described above, only forward migration is supported by the AMALTHEA model migration utility.

Model migration utility migrates the specified model sequentially to the next versions (step by step) till expected version is reached.

Below figure represents the steps involved in the migration of model from 0.7.0 version to APP4MC 0.8.1 version:

2.7.3 Pre-requisites for AMALTHEA model migration

VM arguments

Default max heap memory (Xmx) used by the APP4MC distribution is 2 GB. In case of migrating huge models, it is recommended to increase this memory to 4 GB before invocation of "AMALTHEA Model Migration" feature

Follow the below steps to increase the heap memory setting of APP4MC :

• Open app4mc.ini file ( present in the location where APP4MC is installed) and change the parameter -Xmx from 2g to 4g. ( Note: In case if APP4MC plugins are integrated inside custom eclipse application, then corresponding <application_name>.ini file -Xmx parameter should be updated as specified below )

Linked files in eclipse project (virtual files)

In case you want to have linked files in eclipse project, during the drag and drop of the files select "Link to files" option in File Operation dialog and uncheck create link locations relative to option

2.7.4 How to invoke AMALTHEA model migration

Simple migration

An attempt to open an older model file in the model editor will show the following dialog.

The default button will simply migrate the selected file ...

• provided it doesn't have any references (only allowing single file migration)
• the original file is renamed (the version string is added, e.g. "model_0.9.2.amxmi")
• a log file with the current date is created (e.g. "ModelMigration__2019-07-30_15_43_44.log")

Migration dialog

AMALTHEA model migration utility is developed as a eclipse plugin and it is part of APP4MC distribution ( from release 0.7.0)

Model migration utility can be invoked by selecting the required models to be migrated in the UI and specifying the target AMALTHEA version to which models should be migrated

• Step 1: Selection of AMALTHEA models

• Step 2: Opening AMALTHEA Model Migration dialog and configuring migration inputs

On click of AMALTHEA Model Migration action, selected files are parsed and the following information is retrieved:

1. AMALTHEA model version to which model is belonging to
2. Referred AMALTHEA models inside the selected model ( i.e. case of cross document references)
   • AMALTHEA model version to which these models are belonging to

Once the above information is successfully retrieved, following Model Migration dialog is opened:

Model Migration dialog consists of following information:

1. Selected AMALTHEA model files : These are the models which are explicitly selected by the user
2. Model scope files : These are the model files which are referred in the models explicitly selected by the user
   Example: In the dialog shown above, mapping.amxmi is the file selected by the user, and it contains references to the model elements of : sw.amxmi, sw.amxmi-sw, default.amxmi-os. Due to this reason, all these referred models are selected implicitly for model migration
   Note: In case if the selected/referred models are having the different AMALTHEA model versions, migration can not be proceeded and the following error dialog is displayed
   
3. Input model version : This is the AMALTHEA model version to which both selected & referred models are belonging to
4. Output model version : This is the AMALTHEA model version to which both selected & referred models should be migrated to
5. Output directory : This is the location where migrated AMALTHEA models should be generated.

• Step 3: Model migration

Once the required parameters are configured in the model migration dialog, click on "Migrate Models" button in the dialog to invoke migration.

2.7.5 Additional details

For details regarding the below topics, refer to the corresponding links:

1. How model elements are migrated across various versions ?
2. How to update max heap memory used by the application ?

2.8 Model Loading (Amalthea "no-load" nature)

Use case for having "Amalthea no-load nature" is to avoid loading of Amalthea models present inside a project in certain cases like:

• File operations in workspace (rename of folders or rename of model files)
• User is not working on Amalthea models
• Also in the software build environments, where Amalthea models should be explicitly loaded instead of automatically getting loaded

2.8.1 How to add Amalthea "no-load" nature to the project ?

Nature can be added by following the steps shown in the below screenshot

By adding this nature, Amalthea model loader will be de-activated and Amalthea model editor can not be opened in this case

2.8.2 How to identify if Amalthea "no-load" nature is added to the project ?

If Amalthea "no-load" nature is added to the project, in the Model Explorer,there is a decorator icon and a suffix is added to the project as shown below:

2.8.3 If Amalthea "no-load" nature is added, can I still load Amalthea model files using a java program explicitly ?

Yes !!

By adding Amalthea "no-load" nature, only automatic model loading is disabled as a part of eclipse workspace build, user can explicitly load Amalthea model by using API's

2.8.4 How to remove Amalthea "no-load" nature from the project ?

One can explicitly remove the nature by following the steps as shown in the below screenshot

Other option: If the user tries to open a Amalthea model file, a dialog box opens up as shown below and from here as well user can remove the Amalthea "no-load" nature from the project

3 Data Models

3.1 Model Overview

The AMALTHEA data models are related to the activities in a typical design flow. The focus is on design, implementation and optimization of software for multicore systems. The data exchange between the activities is supported by the two main models of AMALTHEA, the System-Model and the Trace-Model.

Modeling
The behavior of a component or system is often defined in the form of block diagrams or state charts. Dynamical behavior can also be formalized by differential equations that describe how the state of a system changes over time. Modeling tools like Matlab/Simulink, ASCET or Yakindu allow to simulate the model and to generate software descriptions and implementation.

Partitioning
Based on the description of the software behavior (e.g. label accesses, synchronization, ...) this step identifies software units that can be executed in parallel.

System Modeling
The structure of the hardware (e.g. cores, memory sizes, ...) and system constraints are added to the model.
The constraints are limiting the possible results of the next step.

Optimization
The activity of assigning executable software units to the cores and mapping data and instructions to memory sections. This step can be done manually or supported by a tool that optimizes the partitioning based on information about the software behavior (e.g. data dependencies, required synchronization, etc.).

Simulation / Software Execution
In this step model-based simulation tools evaluate the timing behavior of the software.
Typically these types of high level simulations are based on the hardware and software description of the system.
Low level simulators (e.g. instruction set simulators) or real hardware can be used to execute existing software.
The resulting traces provide additional data that is the basis for a more detailed analysis.

A simplified picture shows the main purpose of the models.

The open AMALTHEA models allow custom tooling, interoperability of tools and the combination of different simulation or execution environments.

3.1.1 AMALTHEA System Model

The System Model contains:

Hardware / ECU Description
Hardware abstraction that includes general information about the hardware. Examples are: Number of cores, features of the cores, available memory, access times (from core x to memory y), etc.

SW Description
The description contains information about the static or dynamic behavior the software. This includes: tasks, software components, interfaces, variables, types, etc. It is also possible to describe the characteristics of software functions like the access to variables (read, write, frequency) or the calls to service routines (call tree).

Timing Constraints
Timing Constraints like End-to-End Delay, Latency and Synchronization can be formally written in the "TIMMO Timing Augmented Description Language" (TADL). They are derived from timing requirements or control theory.

Mapping Constraints
The different cores of a typical embedded multicore ECU have different features. For optimal performance it is necessary to restrict the assignment of some software functions to e.g. cores with fastest I/O connections or the maximum clock rate. For safety reasons it is required that some functions are located on specific cores that e.g. can run in lock step mode. Constraints like this are represented in this sub model.

SW Mapping
All information about the assignment of software units (e.g. tasks or runnables) to the cores and about the mapping of data and instructions to memory sections.

3.1.2 AMALTHEA Trace Model

There is no specific EMF data model to describe event traces. The relevant events and their states are represented in the Event Model. In addition special trace formats for multicore have been specified in the AMALTHEA project and a Trace Database has been implemented. This database stores traces in a way that allows fast retrieval of the information (see the Developer Guide for a detailed description of the database structure).

3.1.3 Structure of the model

The definition of the AMALTHEA data model follows some basic principles:

• The model is defined in one package to simplify the handling (e.g. allow opposite references).
• Different aspects are addressed in different logical sub models.
• Existing EMF models from other Eclipse projects are reused and referenced instead of creating own definitions.
• References are based on unique names within the same type of element.

We also try to use cycles wherever possible and needed instead of direct time information. This has advantages in a multi-core environment, as the cores could have different clock frequencies.

The following figure shows the different logical parts of the AMALTHEA data model and how they are referencing each other. The central AMALTHEA model and common model that contains reusable elements are drawn without connections in this diagram.

3.2 Model Basics

The following classes are used all over the Amalthea model to define specific attributes of the model classes.

3.2.1 Custom Properties

The CustomProperty element is used to define own properties that are not (yet) available in AMALTHEA. If there is the need to extend an element or to store tool information related to processing steps, CustomProperties can be used to store this type of information. It also provides the possibility to work with prototypical approaches that later (if established and more stable) can be integrated in the standard model.

The elements are stored in a HashMap. The values can be of different types as shown in the structure picture, like String, Integer, Boolean...
In addition a ReferenceObject is available to store own references to other EObject elements.
The ListObject can be used to store multi-valued custom properties.

3.2.2 Time (and Time Unit)

The AMALTHEA data model includes a common element to describe time ranges in an easy way, the Time element. The Time class in general allows to define negative time values. If only positive values are expected the AMALTHEA validation will show a warning.
The Time element can be contained by any other element for specifying attributes to store time information.
Time units are needed to describe different timing behavior and requirements, like deadlines or offsets of components.
To support different time ranges, especially different time units, AMALTHEA predefines these types like seconds, milli-seconds, micro-seconds, nano-seconds or pico-seconds.

3.2.3 Frequency (and Frequency Unit)

3.2.4 Data Size (and Data Size Unit)

The DataSize (and DataRate) definition contains units and prefixes

• according to the SI Standard
• for binary multiples

The DataSize provides convenience methods to get the size also in bit and byte.
It is internally converted and can be retrieved in both ways.

3.2.5 Data Rate (and Data Rate Unit)

3.2.6 Deviation

Deviations used to model constant values, histograms and statistical distributions within AMALTHEA. There is a wide variety of possible use cases, where such a distribution is needed. For example, the variation in runtime of functions can be imitated. Therefore, AMALTHEA currently supports the following statistical distributions:

The earlier implementation used Generics to support the different use cases. To simplify the usage (via Java API and in the editor) the new implementation provides three different top level interfaces for Time Deviation, Discrete Value Deviation (integer values) and Continuous Value Deviation (float values). They provide specialized methods to handle their values and a common interface to access minimum, maximum and average.
The following image shows the detailed hierarchy of time deviations, the other implementations are built accordingly.

Boundaries

With the Boundaries class it is possible to define the deviation of instructions in such a way that a specific scenario is covered. The scenario is on the one hand specified by the minimum and maximum value between which the instructions vary. On the other hand, the Sampling Type specifies the specific scenario that is covered. The following sampling types are available which are visualised in the figures below:

BestCase

Defines the scenario in which most instances should have runtimes close to the set minimum runtime, but still should consider some more time-consuming outliers up to the set maximum.

WorstCase

Defines the scenario in which most instances should have runtimes close to the set maximum runtime, but still should consider some less time-consuming outliers down to the set minimum.

AverageCase

Defines the scenario in which most instances should have runtimes close to the middle between the set minimum and maximum, but still should consider some less and more time-consuming outliers down to the set minimum or up to the set maximum respectively.

CornerCase

Defines the scenario in which most instances should have runtimes close to the set minimum and maximum runtime, but still should consider some other time-consuming outliers between those two.

Uniform

Defines the scenario in which all instances should have runtimes that are uniformly distributed between the set minimum and maximum.

Uniform Distribution

The uniform distribution is a statistical distribution where the values between the stated lower and upper bound are equally likely to be observed.

Gaussian/Normal Distribution

The Gaussian/normal distribution is a statistical distribution where the values decrease symmetrically. The maximum value and thus its location is thereby stated by the mean and the rate of decrease is defined by its standard deviation. Since the curves approach zero on either side, an additional upper and lower bound can be added to constraint the values.

Beta Distribution

The Beta distribution is a statistical distribution whose shape is defined by alpha > 0 and beta > 0. That way, the Beta distribution can also be used to model other distributions like for example uniform, normal, or Bernoulli distribution. Since the curves can approach zero or infinity on either side, an additional upper and lower bound can be added to constraint the values.

Weibull Distribution

The Weibull distribution is a statistical distribution whose shape is mathematically defined by kappa > 0 and the scale of the distribution by lambda > 0. In the model, it is parameterized using the mean value, the lower and upper bound, and the probability that a real-valued random variable of that distribution will not take a value less than or equal to a specific value. To calculate the scale and shape parameter for the Weibull distribution from the model parameters, the equation of the mean (see Weibull distribution – Wikipedia is solved for the scale parameter, first. Then, the resulting equation for lambda is plugged into the equation of the cumulative distribution function (CDF) for the Weibull distribution. Finally, the lower and upper bound allow to shift this function and the remaining unknown shape parameter in the equation is numerically approximated until the value of the parameter that constraints the distribution regarding the per mill of remaining values is reached.

Histogram

A histogram represents a distribution containing a limited number of entries (e.g. extracted from a trace). Each entry thereby is an Interval with the extra attribute occurrences which holds the number instances within the interval. The intervals do not have to cover a continuous range nor do they need to have the same interval size. Histograms are useful if there is a limited number of possibilities of valuations, which covers most practical systems. See the following figure for an example of two runnables having a time histogram deviation of their execution times.

3.2.7 Statistic Elements

The contained elements are representing statistical values.
The values can be set either with a min, avg and max representation using the MinAvgMaxStatistic element.
The other possibility is to set a single value using the SingleValueStatistic element.
The minimum and maximum values are set as a normal int value, the average the single value as float.

3.2.8 Ticks

Ticks are used to express execution times in a basic way. The number of ticks characterizes the amount of computation that is necessary to execute e.g. a Runnable. The corresponding execution time can be easily calculated if the frequency of the executing ProcessingUnit (PU) is known.The corresponding execution time can be easily calculated if the frequency of the executing ProcessingUnit (PU) is knownexecution time can be easily calculated if the frequency of the executing ProcessingUnit (PU) is known. Depending on the capabilities of a PU the time to execute such an element will differ. If necessary the fundamentally different numbers for specific types of PUs can be stored as extended values in a map.

In the next picture Ticks are shown in more detail.

3.2.9 Counters

The Counter element describes an activation of a target element that happens only every n^th time.

If for example prescaler is 5 and offset is 2 it is executed on the 2^nd, 7^th, 12^th, … time.

Counters are available at the following elements:

• Call graph items:
  • ClearEvent
  • EnforcedMigration
  • InterProcessActivation
  • SchedulePoint
  • SetEvent
  • TerminateProcess
  • RunnableCall
  • WaitEvent
• Stimuli:
  • InterProcess
  • EventStimulus

3.3 Common Elements

The CommonElements model provides a central container for tags and classifiers. These elements are used in many sub models where references to Tags or Classifiers provide a mechanism to annotate objects.

3.3.1 Tags

Tags are a generic possibility to annotate objects in the AMALTHEA model.

3.3.2 Classifiers

Classifiers are used to define specific features or abilities of a core or a memory. They are used in the PropertyConstraintsModel to restrict the allocation to cores or the memory mapping.

3.4 Components Model

The AMALTHEA component model is central accessible through the ComponentsModel element.

It holds the following types:

• Component / Composite
• System

3.4.1 Components Model Elements

The elements of the Components Model inherit several capabilities from common elements.

Ports, Components, Composites and ComponentInstances are referable by unique names.
A Connector also has a name but the name is optional and does not have to be unique.

Component

The 'Component' class represents a component. Components could be created directly within the 'ComponentModel' and are used as a type for a component instance.

It contains several ports of type 'Port'. A component refers the classes 'OsEvent', 'Label', 'Runnable' and 'AbstractProcess' from the software model and the class 'Semaphore' from the OS model.

System and Composite

Systems are defined as top level elements within a component model. A system contains several Component- and
Connection-instances and is used to define the architecture of a technical system.

A 'Composite' is a special component type to aggregate Component- and Connection-instances compositely.
So it could be used to create hierarchical component structures.

System and Composite implement the interface 'ISystem'.
The following diagram shows the main elements to represent the hierarchical structure.

In general each inner port should be connected. If a port is intentionally left unconnected it has to be added to the list of 'groundedPorts'.

ComponentInstance and Connector

The 'ComponentInstance' and the 'Connector' can be created within a 'System' or a 'Composite'. 'ComponentInstances' are used to represent instances of component- or composite-types. The 'Connector' class is used to connect the component instances to each other via their Ports. The connector contains a source and target 'QualifiedPort'.

QualifiedPort

A 'qualified' port refers a 'ComponentInstance' and a 'Port'.
If the 'instance' link is null then the QualifiedPort refers to a port of the enclosing composite.

InterfacePort

The 'InterfacePort' class contains the attribute 'kind' to set the port direction.
The attribute 'interface name' can be used to refer to an external definition, e.g. described in detail with the Franca IDL.

3.4.2 Example

Diagram

The diagram of the example shows a composite 'A' that contains two component instances 'X' and 'Y' of type 'B'. The connections between the ports are named 'c1' to 'c4'. The grounded port 'in_3' of instance 'X' (intentionally left unconnected) is marked green. The second unconnected port 'in_2' of instance 'Y' is unspecified. It is marked red and has to be changed, either declared as grounded or connected to another port.

Model Editor

The same example is shown in the standard AMALTHEA editor.

3.4.3 Franca IDL

Franca is a common interface definition language (IDL). The initial version has been developed by the GENIVI consortium as part of the standardization of an In-Vehicle Infotainment (IVI) platform. The first public version of Franca was released in 2012 under the Eclipse Public License. Franca is approved as official Eclipse project.

The Franca IDL files can be edited in a textual editor that is provided by Franca.

AMALTHEA ports can specify the 'interface name' to refer to interfaces.

3.5 Configuration Model

The purpose of the configuration model is to provide a common mechanism for configuration purposes. The included configurations can contain elements for further processing or build steps.

The central element is the ConfigModel class.

Currently the only configuration object is EventConfig.

3.5.1 Event Configuration

The event configuration represents target events to trace, either in a simulation or on a target hardware platform. The EventConfig elements are contained in the ConfigModel class as list with the name eventsToTrace. Attributes of EventConfig are:

1. name: (optional) name of the element
2. event: reference to an existing events in the Events model

Sample

An example use case can be to trace all Process activate events. To express this in the configuration, one contained element must be of type EventConfig with the corresponding Event pointing to an already existent element. The Event is of type ProcessEvent and the ProcessEventType is set to activate. The other attributes are left blank to not limit the configuration to one Process with a given name for example.

The consumer of the configuration must then match and filter the relevant elements for further processing.

The following screenshot is showing this minimal configuration.

3.6 Constraints Model

The constraints model contains different kind of constraints. There are the runnable-sequencing-constraints that can be used to define a required order for the runnables of the Software Model, the affinity constraints for defining the constraints for the mapping of runnables, processes and schedulers, and the timing constraints for restricting the time span between events or the duration of event chains. Regarding to that, it is also possible to define event chains in this model.

3.6.1 Requirements

The Requirements are used to specify quality requirements for the dynamic architecture.
Requirements are divided into the following types depending on the entity type for which the requirement is specified:

• Architecture Requirements for components
• Process Chain Requirements for process chains
• Process Requirements for tasks and ISRs
• Runnable Requirements for runnables

The Severity attribute is used to describe the quality impact if the requirement is not fulfilled.
The Limit defines the metric, the value, and whether the value for the metric is an upper or a lower bound.
Depending on the metric unit, the following Limits can be distinguished:

• Count Requirement Limit for metrics that count system actions
• CPU Percentage Requirement Limit for metrics that specify relative CPU characteristics
• Frequency Requirement Limit for metrics that measure the frequency of system actions
• Percentage Requirement Limit for metrics that specify relative system characteristics
• Time Requirement Limit for metrics that describe time intervals

Time Metric groups all metrics that describe time intervals of an individual process instance or between two succeeding process instances and are defined as follows:

• ActivateToActivate : This metric indicates the distance between two successive activations of a task or isr. The ActivateToActivate metric of process instance n quantifies the time between the activation moment of process instance n and that of instance n+1.
  
• CoreExecutionTime : This metric quantifies the amount of time of a process instance between its start and termination in which it is actively executed on a specific processing unit.
• EndToEnd : This metric indicates the time interval between two successive ends of a process. The EndToEnd metric of process instance n quantifies the time between the termination moment of process instance n and that of instance n+1.
  
• EndToStart : This metric indicates the time interval between two successive process instances. The EndToStart metric of process instance n quantifies the time between the termination moment of process instance n and the start moment of instance n+1.
  
• GrossExecutionTime : This metric indicates the time interval between the start moment and the termination moment of a process instance.
  
• Lateness : This metric indicates whether a process instance misses its deadline. It quantifies the amount of time between the termination moment of the process instance and its deadline. Thus, the resulting lateness is negative and indicates that no deadline miss occurred if the termination moment of the process instance is before the deadline and vice versa.
  
• MemoryAccessTime : This metric quantifies the amount of time that is required by a process for transferring data from or to the memory.
• NetExecutionTime : The net execution time indicates the actual execution time of a process instance, i.e., the time it is occupying a processing unit. Thus, it quantifies the time from the start moment of a process instance to its termination moment excluding the time the process instance is interfered.
  
• OsOverhead : This metric indicates the amount of execution time that is consumed by functions that are part of the operating system.
• ParkingTime : This metric quantifies the amount of time that a process instance spends between its start and termination passively waiting for the access of a resource.
• PollingTime : This metric quantifies the amount of time that a process instance spends between its start and termination actively waiting for the access of a resource.
  
• ReadyTime : This metric quantifies the amount of time of a process instance between its start and termination in which it is not actively executed on any processing unit.
  
• ResponseTime : The response time of a task or ISR instance is defined as the time between the moment of its activation and its termination. Thus, it measures the whole life cycle of a process instance.
  
• RunningTime : This metric quantifies the amount of time of a process instance between its start and termination in which it is actively executed on any processing unit.
  
• StartDelay : This metric quantifies the delay of the start time of a process instance which is defined as the time interval between the activation moment of this process instance and its start moment.
  
• StartToStart : This metric indicates the time interval between two successive starts of a process. The StartToStart metric of process instance n quantifies the time between the start moment of process instance n and that of instance n+1.
  
• WaitingTime : This metric quantifies the amount of time that a process instance spends between its start and termination passively waiting for an OS event.
  

Count Metrics are metrics that describe absolutely how often system characteristics occur and are defined as follows:

• Activations : This metric quantifies the number of times a process is activated.
• BoundedMigrations : This metric quantifies the number of times a process instance starts executing on a processing unit that is different to the processing unit on which the previous process instance terminated.
• CacheHit : This metric quantifies the amount of times that data requested by a process is found in the cache memory.
• CacheMiss : This metric quantifies the amount of times that data requested by a process is not stored in the cache memory and has to be fetched from somewhere else.
• FullMigrations : This metric quantifies the number of times a process instance migrates from one processing unit to another triggered by a schedule point.
• MtaLimitExceeding : This metric quantifies the number of times a process is not activated during runtime because this would violate the maximum number of concurrently activated processes (MTA).
• Preemptions : This metric quantifies the number of times a process is preempted by another task or ISR.

Frequency Metric groups all metrics that describe the rate in which system characteristics occur and are defined as follows:

• CacheHitFrequency : This metric quantifies how often per unit of time data requested by a process is found in the cache memory.
• CacheMissFrequency : This metric quantifies how often per unit of time data requested by a process is not found in the cache memory.

CPU Percentage Metric groups all metrics that describe a ratio between the amount of time a processing unit is in a certain state for a specific process and the maximum capacity of the considered processing unit and are defined as follows:

• CPUBuffering : This metric quantifies the ratio between the amount of time a processing unit is in the state buffering for a specific process and the maximum capacity of the considered processing unit.
• CPULoad : This metric quantifies the ratio of the load of a processing unit caused by a process and the maximum capacity of the considered processing unit.
• CPUParking : This metric quantifies the ratio between the amount of time a processing unit is in the state parking for a specific process and the maximum capacity of the considered processing unit.
• CPUPolling : This metric quantifies the ratio between the amount of time a processing unit is in the state polling for a specific process and the maximum capacity of the considered processing unit.
• CPUReady : This metric quantifies the ratio between the amount of time a processing unit is in the state ready for a specific process and the maximum capacity of the considered processing unit.
• CPURunning : This metric quantifies the ratio between the amount of time a processing unit is in the state running for a specific process and the maximum capacity of the considered processing unit.
• CPUWaiting : This metric quantifies the ratio between the amount of time a processing unit is in the state waiting for a specific process and the maximum capacity of the considered processing unit.

Percentage Metric groups all metrics that describe a relationship between two system characteristics and are defined as follows:

• CacheHitRatio : This metric quantifies how often data requested by a process is found in the cache memory in comparison to how often it is not found.
• CacheMissRatio : This metric quantifies how often data requested by a process is not found in the cache memory in comparison to how often it is found.
• NormalizedLateness : This metric quantifies the lateness of a process instance in comparison to the process's maximum response time which is defined by its deadline.
• NormalizedResponseTime : This metric quantifies the response time of a process instance in comparison to the process's maximum response time which is defined by its deadline.
• OsOverheadRelative : This metric quantifies the amount of execution time that is consumed by functions that are part of the operating system in comparison to net execution time of the process in whose context the functions are called.

An example for a requirement is the deadline for a task. The deadline is specified by an upper limit for the response time of the respective task.

3.6.2 Runnable Sequencing Constraints

These constraints can be used to define execution orders of runnables or, in other words, the dependencies between runnables. These dependencies can result from data exchange or any functional dependency that is not necessarily visible by other model parameters.

The following requirements can be specified with this constraint:

• Execution sequence of runnables A ->B, meaning A has to be finished before B starts
• Scope on certain process/processes, when a runnable is executed multiple times in different process contexts
• Succession of runnables within a process (strict, loose)
• Position of sequence within a process (start, end, any position)

A RunnableSequencingConstraint contains a list of ProcessRunnableGroup elements and an enumeration RunnableOrderType describing the basic rule for the sequencing. In general, a runnable sequencing constraint is independent of the processes that execute the runnables. Via the attribute "processScope" it is possible to define that a sequencing constraint is only valid for runnables within just one process or a set of processes.

The ProcessRunnableGroups contain references to runnables that should be sequenced. The sequence is defined by the order of the runnable groups within the sequencing constraint. The order of the runnable references within a group is undefined.
To sequence two runnables it is consequently necessary to create a RunnableSequencingConstraint with two ProcessRunnableGroups, each referencing one of the runnables.
To describe that a set of runnables have to be executed before or after another runnable or set of runnables, it is possible to put more than one runnable reference in a group. As already mentioned, the order of the referenced runnables within a ProcessRunnableGroup is unimportant.

The following picture visualises a RunnableSequencingConstraint and multiple possible runtime situations. The constraint has two runnable groups, each depicted by an ellipsis. In this example, there is just one runnable in each group. The runnables in the groups must be executed in the order of the group ("R1" before "R2"). There is no restriction in which process context the runnables are executed. It is important that the order is correct and that the runnable of one group terminates before the runnable of the next group starts. The exemplary runtime situations shown in the lower part of the figure visualise situations that satisfy this constraint (blue) and those who violate the constraint (red).

The RunnableSequencingConstraint in the next figure has two processes set as a scope in its second group. That means that the runnable "R3" is allowed to be executed on the processes "P1" or "P3" (blue). But it is only expected to be executed one time in between (red)!

Each RunnableSequencingConstraint has a RunnableOrderType. It provides the following sequencing modes:

• successor
• immediateSuccessorAnySequence
• immediateSuccessorEndSequence
• immediateSuccessorStartSequence

The meaning of the mode "successor" is that the runnable groups of a sequencing constraint do not have to follow each other directly, i.e., runnables that are not part of the constraint can be executed in between.
In contrast to this, the modes starting with "immediateSuccessor" express that the runnables referenced by the runnable groups must execute in direct order, so without any runnable in between. With "StartSequence", "AnySequence" and "EndSequence" it is further constrained that the runnables of the constraint have to be executed at the beginning, at the end or at any position in a process.
Assuming that all runnables are executed on the same process, the mode "immediateSuccessorStartSequence" means that all runnables of the constraint have to be executed in the correct order at the beginning of the process.
The mode "immediateSuccessorEndSequence" is like "immediateSuccessorStartSequence", but here the runnable sequence must be executed at the end of the process.

3.6.3 Data Age Constraints

Data Age constraints are used to define when the information in a label becomes valid or invalid after its last update. Therefore a runnable and a label has to be set. The information update occurs when the runnable performs a write access on the label. It is possible to define the minimum time after the information of a label update becomes valid. This means that the information shall not be used for further calculations before this time is over. The maximum time on the other hand defines the time after the label update when the information becomes invalid. Beside of time it is possible to define a minimum and maximum cycle. The cycle is related to the activation of the process that executes the runnable.

• DataAgeTime: The Time object in the role of minimumTime must not contain a negative value!
• DataAgeTime: The Time object in the role of maximumTime must not contain a negative value!

3.6.4 Data Coherency Groups

A DataCoherencyGroup is used to define data coherency requirements for a group of labels.
The Direction hereby is used to specify if the labels have to be read or written coherently. Moreover, the scope attribute defines the context of the coherent read or write requirement. Possible scopes are components, processes, and runnables.

3.6.5 Data Stability Groups

A DataStabilityGroup is used to define that the values of labels have to be kept stable within a given execution context.
Currently, the following execution contexts are covered by the scope:

• Component
• Process
• Runnable

This means that it has to be guaranteed that the values of labels are identical either within the runnable, the process, or the component in which the denoted labels are accessed.

3.6.6 Event Chains

The concept for event chains is based on the Timing Augmented Description Language.

The EventChain consists of EventChainItems. These items are classified in two types:

1. EventChainReferences -> EventChain: Used to refer to already defined EvenChains.
2. EventChainContainers -> SubEventChain: Inner anonymous EventChains, which are only available in the context of the current EventChain.

An Event Chain object references always two events, a stimulus event and a response event. To define a simple event chain that just contains two events, one event chain object is enough. In this case it would just be a chain that with its stimulus as first event and the response as second event.
If more events are required it is necessary to add sub event chains. The stimulus is always the first event of an event chain, the response is always the last event. The events that are defined in the sub event chains are the events in between.

When adding EventChainItems there are two properties that decide on the semantics of the SubEventChains:

Simple structural example for sequence

Simple structural example for parallel paths

Structural example how to combine both

The picture below shows a simple example for an event chain of four events in a row.
The top level chain defines the first event (E1) and the last event (E4).
It contains a number of event chains. They describe the way from E1 to E4.
These sub event chains are added as sequence to the parent.
For this some rules has to be considered:
The stimulus of the first child event chain has to be the same as the stimulus of the parent (red in picture).
The stimulus of other child event chains have to be equal to the response of the previous chain (blue in picture).
The response of the last child event chain has to be the same as the response of the parent (green in picture).

As a stimulus or response event it is either possible to use an Entity Event or an Event Set.
An Entity Event is a single event regarding to an entity like a task or a runnable. So it can be e.g. the start of a runnable.
If a set of events is used, then all events of this group must occur fulfill the event chain. The order in which the events occur is not important.

3.6.7 Timing Constraints

Synchronization Constraints

An EventSynchronizationConstraint describes how tightly the occurrences of a group of events follow each other.
There must exist a sequence of time windows of width tolerance, such that every occurrence of every event in events belongs to at least one window, and every window is populated by at least one occurrence of every event.
The parameter multipleOccurrencesAllowed defines, whether for the constraint all occurrences have to be considered or just the subsequent ones.

An EventChainSynchronizationConstraint describes how tightly the occurrences of an event chain follow the occurrences of a different event chain.
The SynchronizationType defines which parts of the event chains have to be in sync, stimulus or response, and the width of a time window sets the allowed tolerance.
The parameter multipleOccurrencesAllowed defines, whether for the constraint all occurrences have to be considered or just the subsequent ones.

• SynchronizationConstraint: The Time object in the role of tolerance must not contain a negative value!

Repetition Constraint

A RepetitionConstraint describes the distribution of the occurrences of a single event, including jitter.
Every sequence of span occurrences of event must have a length of at least lower and at most upper time units.

• RepetitionConstraint: The Time object in the role of lower must not contain a negative value!
• RepetitionConstraint: The Time object in the role of upper must not contain a negative value!
• RepetitionConstraint: The Time object in the role of period must not contain a negative value!
• RepetitionConstraint: The Time object in the role of jitter must not contain a negative value!

Delay Constraint

• DelayConstraint: The Time object in the role of lower must not contain a negative value!
• DelayConstraint: The Time object in the role of upper must not contain a negative value!

A Delay Constraint imposes limits between the occurrences of an event called source and an event called target.
Every instance of source must be matched by an instance of target within a time window starting at lower and ending at upper time units relative to the source occurrence.
A MappingType defines whether there is a strong ( OneToOne ), neutral ( Reaction ), or weak ( UniqueReaction ) delay relation between the events:

• OneToOne : According to page 18f of TIMMO-2-USE Deliverable D11 'Language Syntax, Semantics, Metamodel V2', a constraint with this mapping type is satisfied if and only if source and target have the same number of occurrences and for each index i, if there is an i-th occurrence of source at time x there is also an i-th occurrence of target at time y such that lower ≤ y - x ≤ upper.
  This means that the source event and the target event have the same number of occurrences and no stray target occurrences are accepted.

• Reaction : According to page 17f of TIMMO-2-USE Deliverable D11 'Language Syntax, Semantics, Metamodel V2', a constraint with this mapping type is satisfied if and only if for each occurrence x of source, there is an occurrence y of target such that lower ≤ y - x ≤ upper.
  This means that multiple source event occurrences may be mapped to the same target event and stray target event occurrences are ignored.

• UniqueReaction : This mapping type is a mixture of the previous types by specifying that for every occurrence of the source event exactly one target event must occur within the defined time span. Thus, target events may not be shared between source events and stray target events violate the requirement. In contrast to the OneToOne mapping case, the source event is not mapped to the first source event but is dropped as a violation, if a target event is missed.

Event Chain Latency Constraint

An EventChainLatencyConstraint defines how long before each response a corresponding stimulus must have occurred ( Age ), or how long after a stimulus a corresponding response must occur ( Reaction ).
It always refers to an EventChain.

• EventChainLatencyConstraint: The Time object in the role of minimum must not contain a negative value!
• EventChainLatencyConstraint: The Time object in the role of maximum must not contain a negative value!

3.6.8 Affinity Constraints

Affinity constraints are used to define the mapping of executable objects to each other.
The objects that can be mapped are:

• Runnables
• Processes (Task or ISR)
• Labels

An affinity constraint can either be a pairing or a separation constraint. A pairing constraint contains one amount of objects and a target. The pairing constraints say "All these objects must run together on this target". A separation constraint contains two groups of objects and a target. It says "This group of objects is not allowed to be mapped with the other group of objects on the specific target". So the separation constraint can be used to forbid a combination of objects on a target. It can also be used to say "These objects are not allowed to be mapped on this target". In this case only one group of the separation constraint is used.

Each affinity constraint has one or more targets. The type of the target depends on the type that should be mapped.

Data Affinity Constraints

A DataConstraint is used to define the mapping of label objects to memory units.

Process Affinity Constraints

A ProcessConstraint is used to define the mapping of process (Task or ISR) objects to processing cores or scheduling units.

Runnable Affinity Constraints

A RunnableConstraint is used to define the mapping of runnable objects to processing cores or scheduling units.

3.6.9 Physical Section Constraints

A PhysicalSectionConstraint is used to to define the mapping of Section objects to Memories. This mapping of Section object to Memory objects specifies that corresponding PhysicalSectionMapping associated to this Section element can be allocated only in the mapped Memories.

Example: PhysicalSectionConstraint with the below properties has the following semantic:
	name: Ram1_Ram2_PhysicalSectionConstraint
	Memories : RAM1, RAM2
	Section : .abc.reini
Semantic: PhysicalSectionMapping for .abc.reini section can only be allocated either in RAM1 or RAM2 or in both. But not in other Memories.

3.7 Event Model

The event model provides the classes to describe the BTF-Events that can be used for the tracing configuration, for the modeling of event chains and for some timing constraints.

There are different event classes for the different entity types that can be traced:

In a running system, each entity can have different states. An event trace consists of the events that are visualizing the state-transitions of the traced entities. To define such an event in the model, each kind of event class contains an event-type-enumeration that provides the event-types for the state-transitions of its entity. The following picture shows the possible states of a process:

So for example the event-type-enumeration for a process event contains the events activate, start, resume, ...

A description of the individual events can be found in the following table:

If it is required to define an event like "start-event of some process" then it is enough to create a object of type ProcessEvent and set the event-type start.

It is also possible to restrict the definition of an event to a special entity. So it can be defined like "start-event of task T_1". Therefore it is possible to reference a process from ProcessEvent. In general, each event class can reference an entity of the corresponding type. In addition to that, each event class provides individual restrictions. So it is possible for ProcessEvent that the event is not only restricted to a special process, it can be also restricted to a core. So that would be like "start-event of task T_1 on core C_2". Another example is the class RunnableEvent, it allows to restrict the event to a runnable, the process that executes the runnable and the core that executes the process.

3.8 Hardware Model

The AMALTHEA hardware model is used to describe hardware systems which usually consist of several hierarchical elements which contain processing units, memories, connections etc. It is accessible through the HWModel element and contains following top level elements:

• Definitions
• Domains
• Features
• Structures

3.8.1 Class Diagrams

Hardware model elements

Hardware definitions and features

Hardware modules and access elements

Hardware paths and destinations

3.8.2 Element description

The following tables describe the different model elements and their attributes in detail. For several elements short examples are attached.

HwModel

The HwModel class is the root element of the hardware model. It always contains one or multiple HwStructures, PowerDomains and FrequencyDomains and optionally different HWFeaturesCategories for the HwModule definitions.

HwDefinition

Additional information about the definition concept in general can be found in the User Guide (see General Hardware Model Overview).

ProcessingUnitDefinition

For specifying a compute resource a ProcessingUnitDefinition is created, which is afterwards referenced by the number of ProcessingUnit instances of this kind. A ProcessingUnitDefinition can reference multiple HwFeatures to express different costs for different operations but only one HwFeature per HwFeatureCategory.

MemoryDefinition

For specifying a memory, a MemoryDefinition is created, which is afterwards referenced by the number of Memory instances of this kind.

CacheDefinition

For specifying a cache, a CacheDefinition is created, which is afterwards referenced by the number of Cache instances of this kind.

ConnectionHandlerDefinition

For specifying a bus or Interconnect etc., a ConnectionHandlerDefinition is created, which is afterwards referenced by the number of ConnectionHandler instances of this kind.

The figures shows an example of the attribute MaxConcurrentTransfers with the default value 1. This means that all ConnectionHandlers which are referencing this ConnectionHandlerDefinition can only handle 1 active transfer request at a time. All other requests have to wait until the current transfers has finished.

The next figure shows an example with a number of MaxConcurrentTransfers of 3. In this case the ConnectionHandler can handle up to 3 concurrent requests.

The value for MaxConcurrentTransfers has to be smaller or equal then the min(initiator ports, responder ports).

The values for DataRate, ReadLatency, and WriteLatency are default values for all ConnectionHandlers of this kind. For a specific InternalConnection in a ConnectionHandler instance other values can be assigned.

HwStructure

A HwStructure is a hierarchical element which can contain all kind of HwModules, HwConnections and other HwStructures. Different HwStructures can be connected via one or more HwPorts with other structures or modules of a top level HwStructures. By combining different HwStructures any kind of hierarchical system can be expressed. By setting the structure type attribute (e.g. Cluster, ECU) the structural level in the hardware is directly expressible.

The figure shows an example for creating a hierarchy within an E/E-architecture. The HwStructure System (which is called "System") is created as top level structure within the HwModel. It contains three other structures which represents different ECUs. The structures are connected via HwPorts, HwConnections and a ConnectionHandler. Usually structures in the model can be viewed as black boxes which can be connected via HwPorts. ECU3 allows a look inside, where additional structures for two SoCs are visible.

HwDomain

The figure shows an example for HwDomain ( FrequencyDomain and a PowerDomain). They are always created at the top level in the root element HwModel. Every basic component is able to reference a FrequencyDomain and a PowerDomain. (Note: The link between domains and modules are only references, there are no visible connections inside the model)

FrequencyDomain

A FrequencyDomain is inherited from HwDomain. This element describes a frequency domain which can be referenced by all elements of the type HwModule to define the default frequency value for operation. In future the FrequencyDomain should also contain possibleValues which should specify the different frequencies for different operation modes.

PowerDomain

A PowerDomain is inherited from HwDomain. This element describes a power domain which can be referenced by all elements of the type HwModule, to define the default voltage value for operation. In future the PowerDomain should also contain possibleValues which should specify the different voltages for different operation modes.

HwFeature

A HwFeature is an abstract element to represent any kind of special functionality of a ProcessingUnitDefinition. HwFeatures could be reused several times by different definitions and organized within HwFeatureCategories. Currently this HwFeatureCategories are directly referenced out of the Software Model in future the cost function ( Recipes) of an algorithm will be placed in an additional intermediate layer.
More information can be found in (see Hardware Concepts).

NOTE: The concepts "Recipe" and "Hardware Features" are work in progress. Changes to the already implemented HwFeatures are probable.

HwFeatureCategory

The HwFeatureCategory is an element to collect the same kind of HwFeatures with different values.
The HwFeatureCategories can be referenced by the ExecutionNeeds in the Software Model.

HwModule

ProcessingUnit

A ProcessingUnit is a HwModule that can be used to model a wide set of different hardware components like a GPU, hardware accelerator, CPU, etc. The capability and the functionality of a ProcessingUnit are represented by different HwFeatures within the ProcessingUnitDefinition. The ProcessingUnits are the master modules in the model and every ProcessingUnit can has their own access space. The ProcessingUnit can be referenced by AccessPaths and HwAccessElements.

Memory

A Memory is a component of type HwModule to express any kind memory like SRAM (Scratchpads), DRAM, Flash, etc. in the model, caches are modeled separately. The Memory element can be referenced as destination by a HwAccessElement.

Cache

A Cache is a component of type HwModule to express the special behavior of a Cache. It is used to create cache topologies within a system. The Cache can be referenced by AccessPaths to express if it is a cached or non-cached access. It is also the only HwModule which can be directly contained by a ProcessingUnit.

ConnectionHandler

A ConnectionHandler is a component of type HwModule which can be used whenever multiple HwConnections, (HwPorts) have to be combined. It is possible to represent whole bus systems or interconnects with a single ConnectionHandler, or elements like small routers within a NoC.

The figure shows an example where a ConnectionHandler is used as an interconnect within a SoC. Optional it is possible to model InternalConnections inside a ConnectionHandler to model explicit or restrict different connections. However it is also possible to use default read and write latencies of the whole ConnectionHandlerDefinition, individual latencies can be attached to InternalConnections. A short example where a ConnectionHandler is used as a CAN bus is illustrated in the structure example. For detailed models where all modules connected via HwConnections and different ConnectionHandlers, the ConnectionHandlers should be the only module where contentions in the hardware model can occur. A ConnectionHandler can be referenced by HwAccessPaths.

HwAccessElement

A HwAccessElement can be used to specify the access relationship between two ProcessingUnits or a ProcessingUnit and a Memory. With multiple HwAccessElements the whole access or even address space of a ProcessingUnit can be represented. A HwAccessElement represents always the view from a specific ProcessingUnit. There exist two different approaches to express latency or a data rate for a HwAccessElement: 1. directly using latencies or data rates or 2. modeling the exact path to the destination by attaching a HwAccessPath which references the specific connection elements like ConnectionHandlers, HwConnection, etc. For the second approach it is also possible to work directly with addresses.

HwPort

HwPorts are elements which can be connected via HwConnections. Every module can contain multiple HwPorts. Every communication, input or output is handled via a HwPort of a component. It is only allowed to have one HwConnection per HwPort, except the HwPort is categorized as delegated port which means it is just a hierarchical connection between HwStructures. In this case the ports can have two HwConnections. The second exception is if inside a ConnectionHandler, InternalConnections are used.In this case a HwPort can be directed with a HwConnection and InternalConnections. The following figure shows an example with delegated HwPorts and InternalConnections.

In case the BitWidth becomes important (e.g. to calculate the amount of data which is transfered over an ConnectionHandler) the minimum BithWidth of all included Ports have to be accounted.

For HwPorts it's always possible to select if the port is an initiator or a responder port. The following example shows that an initiator port is always connected to a responder port (comparable to TLM modeling).

In case of a delegated port (which is used as hierarchical port at a HwStructure) the PortType of the module inside the structure is reflected. The following figure shows four different examples. The ports which are delegated are marked grey.

HwConnection

A HwConnection is an element to model structural connections between two HwPorts. HwConnections are always placed within HwStructures. It is possible to directly annotate a read and write latency at a HwConnection. HwConnections can be referenced by HwAccessPaths. The HwConnection do not have a reference to a FrequencyDomain, the frequency is always provided by the element which is in front of the HwConnection in the HwAccessPath.

HwAccessPath

A HwAccessPath is an element to describe the connection route of a ProcessingUnit to its destination ( Memory or ProcessingUnit). The HwAccessPath is defined through an ordered list of IPaths interface elements ( HWConnections, Caches and ConnectionHandlers) and is a containment of an HwAccessElement. The figure shows an example of an HwAccessPath, how a ProcessingUnit is connected via two HwConnections and a ConnectionHandler with a Memory.

In the following example the possible memOffset attribute is explained. Every ProcessingUnit can access a Memory or other ProcessingUnit over a different address. The size of the Memory has to be equal or greater than endAddress minus the startAddress.

• memory_size >= endAddress – startAddress

In the case the the ProcessingUnit should not start at address 0 (from the memory point of view) the memOffset attribute can be used. With help of this attribute the access area for the memory can be changed, the following figure shows an example.

Enumerations

In the following all enums are listed. In the case an enum is used by any class the default value of that enum is always undefined. That means that in case of an enum there are no default values for interfaces or other kind of types. Moreover only new enums are explicitly mentioned in this report. Enums and classes which are already part of the existing Amalthea meta model are not described.

StructureType:

• _undefined_, System, ECU, Microcontroller, SoC, Cluster, Group, Array, Area, Region

CacheType:

• _undefined_, instruction, data, unified

VoltageUnit:

• _undefined_, V, mV, uV

PortType:

• _undefined_, initiator, responder

SchedPolicy:

• _undefined_, RoundRobin, FCFS, PriorityBased

WriteStrategy:

• _undefined_, none, writeback, writethrough

PuType:

• _undefined_, GPU, CPU, Accelerator

PortInterfaces:

• _undefined_, custom, can, flexray, lin, most, ethernet, spi, i2c, axi, ahb, apb, swr

HwFeatureType:

• _undefined_, performance, power, performance_and_power

MemoryType:

• _undefined_, DRAM, SRAM, FLASH, PCM

3.9 Mapping Model

The mapping model is intended to provide tools that use hardware and software models (e.g. code generators) information about the corresponding mappings and allocations. This information contains associations between

• schedulers and executable software: A scheduler manages and distributes executable software like runnables or tasks on its managed processing units
• schedulers and processing units: A scheduler can manage one or more processing units and deploy computations on these
• data and memories: Data (such as functions, variables, heap etc) is mapped on static and volatile memories

Note the mapping model is the only sub model of Amalthea with an attribute in the root element. The Address Mapping Type defines the interpretation of used addresses in the mapping model. Additional information can be found in the MemoryMapping section.

3.9.1 Overview

The Meta Model specifying the Mapping Model is shown below.

MappingModel

The MappingModel serves as a container for each of the mapping rules, i.e. Allocations (executable software and processing units which are allocated to schedulers) and Mappings (labels and software which is mapped to memories).

3.9.2 Allocations

SchedulerAllocation

The SchedulerAllocation describes the allocation of a Scheduler to processing units. This class consists of references to the respective Scheduler, which is specified within an existing OS model, and a processing units, which is specified in a hardware model. Schedulers with algorithm "Grouping" are not allocated since they take no decisions and produce no overhead.

RunnableAllocation

The RunnableAllocation is used to associate a Runnable, specified within an existing software model, with a Scheduler.

TaskAllocation

The TaskAllocation is used to associate a Task with its TaskScheduler.

ISRAllocation

The ISRAllocation is used to associate an ISR with an InterruptConroller. The attribute 'priority' can be used to assign a value for this specific allocation.

3.9.3 Mappings

MemoryMapping

The MemoryMapping is a class, describing the mapping of parts of the software model to Memory. It is used to associate specializations of the AbstractMemoryElement (i.e. Label, Runnable, TaskPrototype and Process). The target memory is specified by a reference to an explicit Memory within an existing hardware model. The position in memory can also be defined as address here. If the address is a absolute memory address, a offset address from the memories first address, or if the address information is not expected at all is defined by the Memory Address Mapping Type enumeration in the root element of the Mapping Model. The Additional attributes, e.g. to supply further information for a code generator, may be described by the containment attributeList.

PhysicalSectionMapping

The PhysicalSectionMapping class (can also be called as Physical Memory Section ) describes the following:

• mapping of various Section elements to a specific Memory
• mapping various Label and Runnable elements to a Physical Memory Section
• description of memory address location where the Physical Memory Section is allocated

Note for additional information (see Memory Sections)

3.10 Measurement Model

The measurement model provides the possibility to store runtime measurements. The main purpose is to exchange measured times, either as a series of single values or as derived statistical data.

Warning: This model has no connections to the configuration and should not be used for any kind of timing simulation inputs or automatic configuration tools. Its main purpose is to document a specific situation that has to be exchanged between development partners. Therefore the origin of the data should be clearly identifiable using additional info like "creator", "date" or "hardware" entered as custom attributes of MeasurementModel.

Changing the model should result in an invalidation of the measurement model. For use cases such as timing simulation the measurement model is of no importance and should be ignored.

Measurements refer to given elements of other model parts and can easily be exchanged (added, removed, updated).

3.11 OS Model

This part of the AMALTHEA model describes the provided functionality of an operating system. It mainly provides a way to specify how access is given to certain system resources. Therefore the concepts of scheduling, buffering, and semaphores are supported, which are described in detail in the following chapter.

3.11.1 Operating System

The basic element in the OS Model is the operating system. There can be multiple operating systems in one model. The operating system type can be used to describe a generic operating system. It is also possible to use the vendor operating system type to define a vendor specific OS. An operating system contains a number of task schedulers and interrupt controllers. A task scheduler controls the execution of a task on one or multiple processor cores. An interrupt controller is the controller for the execution of ISRs and can be also mapped to multiple cores. The mapping of tasks and ISRs to their controller and the mapping of the controller to the cores can be done in the Mapping Model. An operating system can also contain a description of the overhead it produces. For this there is a more detailed explanation below.

3.11.2 Scheduler

Interrupt controller and task scheduler have a scheduling algorithm. The picture below shows that both types are inherited of the scheduler type. Each scheduler has computation items. These items (a subset of the runnable items) characterize the runtime behavior (algorithmic overhead) of the scheduler.

Scheduling Algorithm

This is an abstract class for the different scheduling algorithms.

Further information

Details regarding proportionate fair ( Pfair) scheduling and the variants of the PD² Pfair algorithm can be found in the dissertation "Effcient and Flexible Fair Scheduling of Real-time Tasks on Multiprocessors" by Anand Srinivasan (see dissertation at University of North Carolina at Chapel Hill).

An overview regarding Reservation Servers is given in the lecture "Resource Reservation Servers" by Jan Reineke (see lecture at Saarland University).

Scheduling Parameters

The class SchedulingParameters contains predefined parameters that are relevant for many scheduling algorithms. If a parameter is not used in a given context the value is null. Additional parameters can be added as key-value pairs of class ParameterExtensions.

Scheduler Association

A hierarchy of schedulers can be specified with intermediate objects of class SchedulerAssociation. If set, the parent scheduler takes the initial decision who is executing. If the child-scheduler is not a grouping of tasks, it can take scheduling decisions if permission is granted by the parent. The association also contains the relevant parameters of the scheduler in the hierarchical context.

3.11.3 Os Overhead

It is possible to define the overhead that is produced by an operating system. The defined overhead can be assigned to an operating system definition. Each overhead information is defined as a set of instructions that has to be executed when the corresponding OS function is used. The instructions can be either a constant set or a deviation of instructions. It is possible to define the overhead for the ISR category one and two and for a number of operating system API functions.

ISR Overhead

• ISR category 1 & 2: Describes the overhead for ISRs of category one and two by adding a set of instructions that is executed at start and terminate of the ISR

API Overhead

There exists also an overhead for API calls. The following API calls are considered:

• API Activate Task: Runtime overhead for the activation of a task or ISR by another task or ISR (inside the activating process)
• API Terminate Task: Runtime for explicit task termination call (inside a task)

• API Schedule: Runtime for task scheduling (on scheduling request)

• API Request Resource: Runtime overhead for requesting a semaphore (inside a runnable)
• API Release Resource: Runtime overhead for releasing a semaphore (inside a runnable)

• API Set Event: Runtime overhead for requesting an OS event (inside a task or ISR)
• API Wait Event: Runtime overhead for waiting for an OS event (inside a task or ISR)
• API Clear Event: Runtime overhead for clearing an OS event (inside a task or ISR)

• API Send Message: Runtime overhead for cross-core process activation or event (inside a task or ISR)
• API Enforced Migration: Runtime overhead for migrating from one scheduler to another scheduler (inside a task or ISR)

• API Suspend OsInterrupts
• API Resume OsInterrupts

• API Request Spinlock
• API Release Spinlock

• API SenderReceiver Read
• API SenderReceiver Write

• API SynchronousServerCallPoint

• API IOC Read
• API IOC Write

3.11.4 OS Data Consistency

The OsDataConsistency class provides a way to configure an automatic data consistency mechanism of an operating system. It is used to cover the following two use cases:

• Provide a configuration for external tools that perform a data consistency calculation based on the stated information.
• Provide the results of a performed data consistency calculation which then have to be considered by external tools (e.g. by timing simulation).

To distinguish the different use cases and to consequently also indicate the workflow progress for achieving data consistency, OsDataConsistencyMode allows to define the general configuration of the data consistency. The following modes are available:

1. noProtection: data stability and coherency is NOT automatically ensured.
2. automaticProtection: data stability and coherency HAS TO BE ensured according configuration either via custom protection or via model elements.
   1. customProtection: data stability and coherency IS ensured according configuration but not via model elements.
   2. handeldByModelElements: data stability and coherency IS ensured via model elements.

The DataStability class defines for which sequence of runnables data has to be kept stable. Furthermore, it can be stated whether all data is considered for stability or just those accessed multiple times.

DataStabilityLevel:

• period - between consecutive activations
• process - within a Task or ISR
• scheduleSection - between Schedule points (explizit schedule points, begin and end of process)
• runnable - within a Runnable

The NonAtomicDataCoherency class defines for which sequence of runnables data has to be kept coherent. Like for data stability it can be stated whether all data is considered for coherency or just those accessed multiple times.

3.11.5 Semaphore

With this object, a semaphore can be described which limits the access of several processes to one resource at the same time.

3.12 PropertyConstraints Model

The scope of the Property Constraints model is to limit the design space by providing information about the specific hardware properties that parts of the software rely on, i.e. what properties or features have to be supplied by the respective hardware in order to be a valid mapping or allocation target.

This information comprises

• Core allocation constraints, which describe the constraints on cores.
• Memory mapping constraints, which describe the constraints on memories.

3.12.1 Structure

The figure below shows the Property Constraints model. In order to provide a better understanding of the model, interconnections between software model elements are not shown in this figure.

3.12.2 CoreAllocationConstraint

The CoreAllocationConstraint is an abstract class for describing constraints which affect the selection of a suitable Core.

RunnableAllocationConstraint

The RunnableAllocationConstraint is a specialization of the CoreAllocationConstraint. It is used to specify constraints on Core elements which are used in Runnable to Core allocations.

ProcessAllocationConstraint

The ProcessAllocationConstraint is a specialization of the CoreAllocationConstraint. It is used to specify constraints on Core elements which are used in the allocation of Process's specializations (i.e. Task and ISR), to Cores.

ProcessPrototypeAllocationConstraint

Tha same as ProcessAllocationConstraint but for process prototypes in an earlier phase of the development.

3.12.3 MemoryMappingConstraint

The MemoryMappingConstraint is an abstract class for describing constraints which affect the selection of a suitable Memory. The actual constraint on the core is described by the AbstractElementMappingConstraint.

AbstractElementMappingConstraint

The AbstractElementMappingConstaint is a specialization of the MappingConstraint. It is used to specify constraints on Memory elements which are used in the mapping of AbstractMemoryElement specializations (i.e. Label, Runnable, TaskPrototype or Process) to Memories.

3.12.4 Classifications

The specializations CoreClassification and MemoryClassification are used to describe the features that a hardware element ( Core or Memory) needs to provide in order to be a valid target. This is done by references to Classifiers, conditions (requires vs. excludes) and the kind of grouping (all of them vs. at least one of them).

3.12.5 Example

3.13 Stimuli Model

The Stimuli Model contains stimulus and clock objects.

3.13.1 Stimuli

A stimulus is responsible to activate processes. The following different types are available:

• SingleStimulus: Activates the process only once.
• ArrivalCurveStimulus: A list of time-borders in which a specified number of occurrences are expected.
• PeriodicStimulus: Periodic activations based on an offset, a recurrence and (optionally) a jitter.
• PeriodicSyntheticStimulus: Defines a periodically triggered stimuli depending on a defined list of occurrence times.
• PeriodicBurstStimulus: Defines a periodic burst pattern of the process.
• RelativePeriodicStimulus: Periodic activation based on offset and a recurrence.
  In contrast to PeriodicStimulus the recurrence is relative to the last occurrence and a deviation is mandatory.
• VariableRateStimulus: Periodic activations based on other events, like rotation speed.
• InterProcessStimulus: Activations based on an explicit inter-process activation.
  Contains a Counter element if activation is either shifted and / or happening every n^th time.
• EventStimulus: Activation triggered by an event, defined in the event model.
  Contains a Counter element if activation is either shifted and / or happening every n^th time.
• CustomStimulus: To describe own custom types of activations, including properties.

• PeriodicStimulus: The Time object in the role of offset must not contain a negative value!
• PeriodicStimulus: The Time object in the role of recurrence must not contain a negative value!
• PeriodicBurstStimulus: The Time object in the role of offset must not contain a negative value!
• PeriodicBurstStimulus: The Time object in the role of recurrence must not contain a negative value!
• PeriodicSyntheticStimulus: The Time object in the role of offset must not contain a negative value!
• PeriodicSyntheticStimulus: The Time object in the role of recurrence must not contain a negative value!
• TimestampList: The Time objects in the role of timestamps must not contain a negative value!
• SingleStimulus: The Time object in the role of occurrence must not contain a negative value!
• ArrivalCurveEntry: The Time object in the role of lowerTimeBorder must not contain a negative value!
• ArrivalCurveEntry: The Time object in the role of upperTimeBorder must not contain a negative value!

Single

Single allows to specify an activation at a single relative point in time. The single activation occurs after the time units specified by occurrence.

Arrival Curves

An arrival curve is described as a list of time-borders in which a specified number of activations are expected. The picture below shows an example for this. In the first picture there is a number of occurrences on a timeline.

In the picture below every distance between two activations is measured. The minimum and the maximum distance is added to the table as time-border for the occurrence of two activations. This means that after one activations there has to be at least a gap of one time-unit before the next activations can occur. It also means that there will be always a second activations within eight time units after the last activations. Basically this would be enough to describe an Arrival Curve Stimulus. But it is possible to create a more precise stimulus by describing additional time borders for greater number of occurrences. This is shown in the steps below.

The same as for two activations in the picture above is done here for three activations. Like already mentioned above, this is an additional restriction for occurrence of an activations.

And for four activations:

The picture below shows the table as arrival curve graph. The red line is the upper-time-border that shows the latest time where the activations will occur. The green line shows the earliest possible time where the activations can occur.

Common properties of fixed periodic stimuli

The abstract class FixedPeriodic defines the common attributes of Periodic, PeriodicSynthetic and PeriodicBurst. In general all period based Stimuli specify periodic occurrences based on an offset and a recurrence. The first occurrence happens after the time units specified by offset, and then every following occurrence happens after the time units specified by recurrence. This means, in general, an occurrence of instance i is happening at time t = offset + i * recurrence.

The following figure shows a Periodic Stimulus example with only a fix offset and recurrence time.

Periodic

In addition to the standard periodic behavior the Periodic Stimulus can be extended by a Jitter e.g. an Gaussian deviation. The activation time of each occurrence jitters according to the values of the distribution as depicted in the following figure. Depending on the Jitter distribution the upper bound of the current and the lower bound of the next activation can be close to each other or even overlap. The minDistance value allows the user to define the minimum distance between the current and the next activation.

The recurrence of a Periodic Stimulus is absolute. This means that a recurrence of 10ms points exactly to the next activation every 10ms. The Jitter describes the deviation of the occurrence around this absolute value.

PeriodicSynthetic

PeriodicSynthetic allows to specify a periodic activation of trigger patterns. It is defined by a list of List of occurrenceTimes, a period recurrence, and an offset. Each time value in occurrenceTimes specifies a single activation at a relative point in time. The moment in time these time values are relative and is defined the following way: an activation of instance i is triggered at time t = offset + floor(i / m) * recurrence + occurrenceTimes[i modulo m].

The following figure shows a Synthetic Stimulus example with two periodic activations after the time units T1 and T2.

PeriodicBurst

The PeriodicBurst Stimulus specifies a set of burst activations that are periodically repeated. This means that multiple activations occur very close to each other and this recurs in a periodic matter. The burst pattern has a fixed recurrence period and every burst results in multiple activations.

The number of occurrences per burst are specified via occurrenceCount. The occurrenceMinDinstance defines the minimal distance between them. The burstLength defines the maximum time the burst pattern can last. If the number of occurrences multiplied with the minimum distance between activations is bigger than the burstLength only the number of activations that fit into the burstLength are executed.

RelativePeriodic

In contrast to the Periodic Stimulus the RelativePeriodic Stimulus allows to specify relative recurrences. The next activation depends on the current activation time and the added deviation for the next step. The lower and upperBound are specified in the nextOccurrence deviation similar to the Jitter specification in the Periodic Stimulus.

VariableRateStimulus

With the VariableRate Stimulus the description of task activation based on e.g. the crankshaft rotation speed or other adaptive variable rate activations.

The step has to be defined as a base value for the following specifications.

In the deviation occurrencesPerStep the lower and upper frequency of the variable rate are described. The distribution can be used to describe the standard frequency occurrences. The user can describe that the frequency is distributed e.g. uniformly over the complete frequency band or as another example the occurrences happens mostly at the Boundaries of the frequency band that can be specified with the CornerCase samplingType in the distribution.

The user can set maxDecrease and maxIncrease values to describe the number of additional respectively reduced task activations that can occur within a predefined time step. With these values, the maximum acceleration and maximum deceleration of the stimuli can be calculated.

An additional feature for the variableRate Stimulus is the description of simulationScenario that specifies the progression of the variableRate over time.
In contrast to the generic specification via statistical values the scenario defines the computation via the samplingOffset and samplingRecurrence property that is modified by a factor based on a clock.

3.13.2 Clocks

The Clock is triggered based on logical clocks rather than the simulation time, thus providing a dynamic trigger pattern for a simulation. Clock defines the (variable) rate at which a stimulus will be fired. This rate follows a certain pattern defined by the subclasses: ClockFunction and ClockStepList.

ClockFunction

A clock function defines the clock period change via a continuous function. There are two functions available: Sine and Triangle. They can be chosen by setting the curveType property.

In the sine clock function the clock period increases and decreases smoothly following a sine wave pattern. The figure below depicts the attributes used to define the sine wave. Note that the sine wave always lies above the x-axis. Adding a positive or negative x-Offset will shift the wave horizontally. The clock fires a stimulus whenever the area under the sine curve is a multiple of one (an integral value). If used in a Scenario this factor can be defined via the samplingRecurrence attribute. As can be seen, the size of the area can be influenced by the yOffset and peakToPeak attributes. In the example shown in the figure the first stimulus is fired at 1.3s, second at 2.06s and so on.

The triangle clock function increases and decreases at a constant rate. The shape of this clock function is governed by the same attributes as the sine wave, only the underlying mathematical definition is different. In the example figure below, the first activation occurs at 0.828s, the second at 1.464s and so on.

ClockStepList

The list of clock steps defines the clock period change via a step function. Each ClockStep of that function is defined by a frequency and a time stamp. The optional period attribute of the clock step list can be used to repeat the pattern (exactly like the recurrence in the PeriodicSynthetic stimulus). If the period is not set, the clock rate will remain the same after the last clock step change. Considering the clock steps: <1Hz, 1s>, <3Hz, 3s>, <2Hz, 5s>, <0Hz, 6s>, <2Hz, 7s>, a sampling recurrence of 2, and a period of 9s, the clock step function will result in the plot depicted in the following figure.

Example

The engine crankshaft is a good example in which Clocks can be used to model the behavior. Let's suppose a scenario in which a stimulus is triggered each time the rotating crankshaft reaches a specific angle.

In this example, the engine speed steeply increases from 3000rpm to 6000rpm in 5s, then the speed again decreases to 3000rpm in 5s. An stimulus shall be triggered when the engine crankshaft reaches 30 degrees. Triggering should repeat every two rotations.

Steeply increasing and decreasing pattern fits to the triangle clock function. The equations below show the calculations for the triangle clock function. xOffset is added to make the triangle wave begin at the desired engine speed of 3000rpm:

• yOffset = min.ticks = 3000rpm = 50rps = 50Hz
• peakToPeak = max.ticks – min.ticks = 6000rpm – 3000rpm = 50Hz
• period = 2 * risingSteepTime = 2 * 5s = 10s
• xOffset = risingSteepTime / 2 = 2.5s

Task shall be triggered when the engine crankshaft reaches 30 degrees. Triggering should repeat for every two rotations. The scenario configuration for this example can then be derived as follows:

• samplingOffset = firstTriggerAngle = 30 ^o / 360 ^o = 0.0833
• samplingRecurrence = everySecondRotation = 2

The engine crankshaft reaches 30 degrees at 1.66ms. From then on, the crankshaft completes 2 rotations at 41.49ms and 4 rotations at 81ms.

3.13.3 Mode Value List and Execution Condition

It is possible to change mode label values when a stimulus is executed. The mode labels and their new values are stored in the set-mode-value-list. Via an execution-condition modes also determine if a stimulus is executed.

• ModeValue: The value string must be a valid element of the corresponding Mode!

The set-mode-value-list indicates: Each time the stimulus is executed all mode labels in this list are set to the corresponding value.

The execution-condition is used to determine if a stimulus is executed.

3.14 Software Model

The AMALTHEA software model is central accessible through the SWModel element.

3.14.1 Memory Information

Analyzing and mapping the software structure to available memories needs additional information of the included elements. This type of information targets the consumed size of memory of an element, represented by the size attribute of type DataUnit. The element AbstractMemoryElement is a generalized element that provides this data. The following image shows the structure and also the elements of the software model that are extending AbstractMemoryElement (the overview picture is only showing the hierarchy and not possible relationships between the elements):

3.14.2 Labels

The label element represents a data element. It is directly located in a defined area of a given memory.
It can be used as a parameter, a temporarily existing variable or representing a constant value.

The following attributes are describing a label:

3.14.3 Channels

The channel element has two different characteristics: it represents a data element in memory and also a way how runnables transmit larger amounts of data. A typical applications is the streaming of video data where a continuous sequence of images is sent in smaller chunks.

The following attributes are describing a label:

3.14.4 Data Types

General Information

The AMALTHEA data model supports meta information for data types. Therefore the element TypeDefinition exists in the software part of the model. It consists of the name and size to define a data type. BaseTypeDefinition has the additional possibility to define the representation of these data types in a target environment (e.g. AUTOSAR), represented by the Alias element.

The compound data types are data structures, based on given or defined base types.
In the literature they are also often named composite or derived types see Wiki.
The result of this type of definition is an own data type, which can be used as base data types.
They can consist of static structures or dynamic ones, like arrays or stacks.

The following compound data type definitions are currently supported:

• Pointer: Holds a reference to another type using its memory address
• Array: Contains a number of elements of the same data type. The size of an array can be fixed or expandable.
• Struct: Contains other data types in a structured way, often called fields or members. The fields can be accessed by their name.

Sample

In the picture below a small sample is modeled containing the following information:

• Boolean type with size of 8 bits and alias for AR (Boolean) and C (bool)
• Char16 type with size of 16 bits and alias for AR (Char16) and C (short)
• charArray consists of 4 elements of type Char16
• "hello world struct" with the attribute name (charArray) and valid (Boolean)

Note: The picture shows the element types for better understanding!

3.14.5 Activations

Activations are used to specify the intended activation behavior of Runnables and ProcessPrototypes. Typically they are defined before the creation of tasks (and the runnable to task mappings). So if there are no tasks defined, or if the mapping of runnables to tasks is not done, this is a way to document when the runnables should be executed.
Activations are independent of other top level elements in the AMALTHEA model. Single, periodic, sporadic, event or custom (free textual description only, no predefined semantic) activation pattern can be defined. This information can be used in the following development steps to create tasks, stimuli and the mappings to dedicated hardware.

• PeriodicActivation: The Time object in the role of min must not contain a negative value!
• PeriodicActivation: The Time object in the role of max must not contain a negative value!
• PeriodicActivation: The Time object in the role of offset must not contain a negative value!
• PeriodicActivation: The Time object in the role of deadline must not contain a negative value!
• SingleActivation: The Time object in the role of min must not contain a negative value!
• SingleActivation: The Time object in the role of max must not contain a negative value!

3.14.6 Tasks / ISR

The following figure shows the structure which describes Tasks and Interrupt Service Routines ( ISR) in the AMALTHEA software model. The abstract class Process generalizes ISRs and Tasks and provides the common attributes like the activation that is at runtime level represented by a Stimulus. A Task or ISR contains calls either to other Tasks (via inter process activation) or Runnables. These types of calls are included in the callGraph attribute.

3.14.7 Runnables and Services

Both elements, runnables and services, are an abstraction of an executable entity. They are both represented by the Runnable element and are distinguished by using the service attribute of type boolean.
Unlike tasks, which are activated in the context for the operating system, runnables are called by tasks or other runnables.

Runnables and Services in the AMALTHEA model can have call parameters. It is possible to specify the arguments of a service call and potential data dependencies. Based on these types of information, an additional analysis can be performed.

3.14.8 Runnables

The next picture shows the general structure of the Runnable element.

3.14.9 Call Graph

A CallGraph is the root container of CallGraphItems. In addition some of the items can also contain sub items. These items are implementing the interface ICallGraphItemContainer.

The following picture shows the structure of a Call Graph. The Call Graph Items are used to define detailed behavior. With the Switches it is possible to define alternative execution paths. The elements of the graph are executed in the order they are stored in the data model.

3.14.10 Call Graph Items

The CallGraphItems are describing the detailed behavior of a Process or Runnable. This can be either an abstraction of runtime or representing access to other elements like Runnables, Labels and Semaphore. An overview of the different possibilities is given in the next pictures.

Groups

A Group is used to structure the CallGraphItems. The boolean attribute isOrdered indicates if the execution order of the contained elements is fixed or random.

Mode Switch

With the ModeSwitch it is possible to define different execution paths. They can be used like if-else or switch-case statements in a programming language. A ModeSwitch uses the value of mode labels to decide which entry has to be executed. The first fulfilled condition determines the path to execute.
A ModeSwitchEntry object is used to represent an execution path. A mode condition is defined for each entry (via ModeConditionDisjunction).
At the ModeSwitch it is also possible to define a default path, which is executed if no condition of the ModeSwitchEntries fits to the current mode settings.

Probability Switch

Each entry (path) of a ProbabilitySwitch has a probability-value. As the name indicates, this is the value that defines the probability that the path is executed. It is computed as a fraction of its value divided by the sum of all ProbabilitySwitchEntries in the surrounding switch.

Ticks

Ticks allow to specify the required execution "time" in a basic way. They are the equivalent of cycles in the hardware domain and the execution time can easily be calculated if the frequency of the executing ProcessingUnit (PU) is known.
Detailed definition: see Ticks

Execution Need

ExecutionNeed allows to specify the required execution "time" in a more abstract way. Multiple NeedEntries can be used to specify execution characteristics. There is a map of default entries and (optional) maps of entries for specific hardware types (e.g. FPGA). These extended entries are also implemented as a map with a processing unit definition as the key.

A simple approach (equivalent to the RunnableInstructions in older versions of the AMALTHEA model) is the specification of the "number of generic instructions" that have to be executed. Together with the hardware feature "instructions per cycle (IPC)" and the frequency of a processing unit it permits the calculation of the execution time on a specific processing unit.

With the generic concept of ExecutionNeeds it is also possible to describe more detailed characteristics, e.g. instruction mixes of floating point operations, integer operations, load/store operations, etc., or any other relevant aspect.

Calls and AUTOSAR communication

Label Access

Channel Access

Common attributes:

Receive attributes:

Semaphore Access

Mode Label Access

• ModeLabelAccess: The value string must be a valid element of the corresponding Mode!

Custom Event Trigger

The Custom Event Trigger references an event of type Custom Event. The execution of a Custom Event Trigger entry triggers the corresponding event that can be observed by an Event Stimulus.

Enforced Migration

Each task is controlled by at least one task scheduler. A task scheduler is the resource owner of one or multiple processor cores (The task scheduler decides on which of its cores the task is executed). The Enforced Migration forces the task to switch to another task scheduler. Therefore the Enforced Migration entry contains a reference to the new task scheduler.

This element is used as a short notation to simplify the simulation of different design possibilities. It should normally be modeled as two separate tasks and an inter process trigger.

Inter Process Trigger

The Inter Process Trigger references a stimulus of type Inter Process Stimulus. The execution of an Inter Process Trigger entry triggers the processes that are mapped to this stimulus.

Schedule Point

At a Schedule Point, the process calls the scheduler that currently administrates it. This is used for cooperative task scheduling (see OSEK Specification 2.2.3, 2005).

Terminate Process

If a Terminate Process is reached during the execution of a Call Graph, the Task or ISR terminates immediately. It is not required to insert this element at the end of a Call Graph. It can be used to define an execution path (by using Switches) that terminates a process.

Wait/Clear/Set Event

The AMALTHEA Software Model contains a list of OS-Event objects. These can be used for task synchronization. Elements are Wait Event, Clear Event and Set Event.

With Wait Event the process waits for a number of events (defined in the Event Mask) to be set. Here it can be defined if the process waits just for one of the OS-Events (maskType = OR) or for all of them (maskType = AND). The waiting behaviour defines if the process is blocking the core when it waits (active) or not (passive).

Set Event sets/fires a list of OS-Events. Here it is possible to define a context for the OS-Event. If a process is referenced, then the OS-Events are set just for this process.

The execution of a Clear Event entry unsets all referenced OS-Events.

For more information about OS-Events, see the OSEK Specification 2.2.3, 2005.

Statistical Values

It is possible to add to different elements (as shown in the picture above) different types of statistical values. These values can be used to describe in more detail the following behaviors:

• RunEntityCallStatistic: Can be used to describe in more detail the dynamic call behavior of a RunnableCall. The value is representing how often the call is performed.
• LabelAccessStatistic: Describes in more detail the dynamic behavior accessing a Label by having cache misses or how often a read/write is performed.

3.14.11 Modes

The next diagram shows the overall picture, the sub chapters describe the details.

Modes are mainly used in Mode Conditions to describe the conditional execution of a ModeSwitchEntry, a Runnable or a Stimulus.

Modes and Mode Labels

The Mode element denotes the type and the possible values of a specific system state. The subclasses EnumMode and NumericMode describe the values that are allowed for the corresponding ModeLabel. In case of a EnumMode the initialValue has to be the name of one of the contained ModeLiterals. For NumericMode the initialValue has to be the string representation of an integer.

The Mode Label element represents a concrete representation of a specific Mode. Is is described using the following attributes:

Mode Changes

The value of the mode label can be changed using the set-mode-value-list of a Stimulus.

Another possibility is a write access within a Runnable via a Mode Label Access.

Mode Conditions

Mode conditions allow to specify dedicated states of the overall system.
Depending on the condition evaluation (via isSatisfiedBy()) switches can be executed or stimuli can be influenced.
The ModeValueMap represents the system state that has to be provided as an external input, e.g. from a simulation or analysis tool.

3.14.12 Process Prototypes

In addition to the Task elements, the AMALTHEA model contains an element process prototype.
This prototype can be used to define raw data of a task. It can be used to specify access to
labels (read, write) or other runnables/functions as possible with the normal task, but not the
order of the access. These prototypes are then processed by different algorithms. The algorithms are creating the tasks, are filling, verifying or modifying the data based on their different checks. The final result of this processing are tasks, which are corresponding to the data of the prototypes.

These tasks are representing the current state and can be further processed, for example to generate code or further simulation. With the process prototypes available in the model, it is possible to define the structure of the software in an early development phase. The implementation at that moment is open and not yet completed, but the general idea can be verified.
Another issue can be the distribution to a multi-core system, coming from a single-core system. Therefore the call graph can be analyzed and computed to get the right order and parallelization of the elements and dependencies.

3.14.13 Process Chains

The following figure shows the structure which describes Process Chains in the AMALTHEA software model. A process chain is used to group task and isrs together which are executing after each other and represent an end-to-end data processing path. The processes inside a process chain are connected via Inter Process Activations.

The following attributes are describing a process chain:

3.14.14 Custom Entities

The CustomEntity element defines a way to add not yet available elements of the software model in a generic way. The only contained attribute defines the type of the entity by setting it as a String. Additional properties can be set using the CustomAttributes.

3.14.15 Section

Section (Virtual Memory Section) is used to group the memory elements (Labels, Runnables). This is achieved by associating the Section element to Label & Runnable elements

Below are properties of Section element:

• name
• asilLevel

With this type of information available, the complexity of mapping software components to memories can be reduced. The next picture gives an overview about the general idea of the mapping with Sections.

3.14.16 Data Dependencies and Runnable Parameters

Overview

The purpose of following model elements is to describe a high level data flow. Parameters of runnables (or services) and specific call arguments allow to model a behavior that depends on the call tree but the detailed computation and the control flow within a runnable are not taken into account. Therefore only "potential" influences are modeled. The following picture shows this data flow with dashed lines.

Elements with data dependency

The data flow is specified with "depends on" references. Elements that can specify a dependency are:

• LabelAccess of type "WRITE"
• CallArgument that refers to an "IN" (or "INOUT") parameter
• RunnableParameter with direction "OUT" (or "INOUT")

Data Dependency

A data dependency defines the elements that can influence a value that is written or transferred. Possible origins are:

• Label
• RunnableParameter with direction "IN" (or "INOUT")
• CallArgument that refers to an "OUT" (or "INOUT") parameter

4 Developer Guide

4.1 Overview of Features and Plug-ins

4.1.1 Features

There are two top-level features of the AMALTHEA Tool Platform, the AMALTHEA Tool Platform and the AMALTHEA Tool Platform SDK features. The non-SDK feature contains everything you need to run the AMALTHEA tools and models. If you like to develop new tools on top of the models or extend the models you may need the SDK. It contains beside the runtime all sources.

The top-level feature itself contains basic platform plug-ins and tools as well as several sub-features. These are

• APP4MC Platform – Platform (includes all features and 3rd party libraries).
• APP4MC Docu – Basic Help (is extended by loading other features).
• APP4MC Examples – Examples that can be added by the example wizard.

• APP4MC Multicore – Algorithms for multicore development like partitioning and mapping.
• APP4MC Tracing – Record, analyze and transform runtime traces of the embedded system.
• APP4MC Validation – Model validations (can be selected and executed on demand).

• AMALTHEA Models – AMALTHEA models (EMF).
• AMALTHEA Edit – AMALTHEA model edit support.
• AMALTHEA Editors – Editors for the models.

• AMALTHEA Converters – Independent feature for AMALTHEA model migration.

• AMALTHEA Workflow Common – Basic elements to define workflows on the model.
• AMALTHEA Workflow – Defining workflows (based on MWE2 workflow engine).
• AMALTHEA Workflow Scripting – Defining workflows (based on EASE scripting).

• AMALTHEA Import – Import of the models.
• AMALTHEA Export – Exports of the models.

For all features there also exists an SDK containing the sources. If you install the AMALTHEA Tool Platform SDK, it contains all features as SDKs.

4.1.2 Plug-ins

The plug-ins are organized in various namespaces. The ids of most plug-ins containing models are within the namespace org.eclipse.app4mc.amalthea.model, whereas examples can be found in plug-ins named org.eclipse.app4mc.amalthea.example.

4.2 Model Validation

4.2.1 Validation framework

APP4MC contains a flexible framework based on standard EMF validations.

The main plugins:

org.eclipse.app4mc.validation.core

Basic interfaces and helper classes to organize and execute validations.

org.eclipse.app4mc.validation.ui

User interface components: profile selection dialog, marker helper.

org.eclipse.app4mc.amalthea.validations

AMALTHEA standard profile and validations

4.2.2 Validations

Validations have to implement the IValidation interface. Additional information is specified with annotations:

• @Validation

Example:

4.2.3 Profiles

Profiles have to implement the IProfile interface. Details are specified with the following annotations:

• @Profile
• @ProfileGroup
• @ValidationGroup

Example:

4.3 Model Workflow

4.3.1 Introduction

The APP4MC AMALTHEA platform provides the option to define a workflow on a model with different steps. AMALTHEA provides a simple API for implementing such a workflow. The definition of the workflow can be done either in plain Java or any other language, which is able to access Java classes.

The EASE framework provides a scripting environment inside of Eclipse with different script engines like Rhino (JavaScript), Jython or Groovy. AMALTHEA provides a sample and some convenient helpers based on EASE to define and execute such a workflow.

As an alternative APP4MC provides also an implementation for the Modeling Workflow Engine 2 (MWE2), coming from the Xtext framework. The definition of the workflow can be done in a textual syntax from MWE2, containing different components which are working on the given model.

AMALTHEA provides several plugins for this purpose:

org.eclipse.app4mc.amalthea.workflow.core

Includes basic API and some predefined workflow components, which can be used independent from any framework.

org.eclipse.app4mc.amalthea.workflow.ease

Provides some helper modules for EASE

org.eclipse.app4mc.amalthea.workflow.mwe2

Provides basic classes for usage with MWE2

4.3.2 General Structure

The plugin org.eclipse.app4mc.amalthea.workflow.core provides a general abstract class org.eclipse.app4mc.amalthea.workflow.core.WorkflowComponent which can be used to extend in the case to provide or implement an own workflow step.

It provides the following features:

• Defines the constant AMALTHEA_SLOT, which can be used to store and retrieve the AMALTHEA model from the org.eclipse.app4mc.amalthea.workflow.core.Context.
• Provides some convenient methods to retrieve the model from the context, get a copy of the model or store the model in the context.

The interface org.eclipse.app4mc.amalthea.workflow.core.Context provides convenient methods to store and retrieve data in a org.eclipse.app4mc.amalthea.workflow.core.WorkflowComponent.

The class org.eclipse.app4mc.amalthea.workflow.core.DefaultContext is a default implementation using an internal java.util.HashMap to store the data.

A sample workflow implementation with two components WorkfklowComponent1 and WorkflowComponent2 can look like the following structure.

Both classes are extending org.eclipse.app4mc.amalthea.workflow.core.WorkflowComponent.

The next step is to create a WorkflowDefinition, which needs to do the following steps:

1. Create an instance of a org.eclipse.app4mc.amalthea.workflow.core.Context using the org.eclipse.app4mc.amalthea.workflow.core.DefaultContext
2. Create an instance of WorkflowComponent1 and configure it if needed with the proper setter methods
3. Call the run method of WorkflowComponent1 and pass the context
4. Create an instance of WorkflowComponent2 and configure it if needed with the proper setter methods
5. Call the run method of WorkflowComponent2 and pass the context

Therefore using the context, data can be shared between the different workflow component implementations.
The following diagram is showing this flow in more detail:

4.3.3 Available Basic Components

The APP4MC AMALTHEA platform ships with some available workflow steps, which can be used out of the box.

Model Reader

The component org.eclipse.app4mc.amalthea.workflow.component.ModelReader reads a given list of files containing AMALTHEA models. The result model is stored in the AMALTHEA_SLOT as default. Please refer the JavaDoc for more details.

Simple configuration inside of a workflow can look like the following:

ModelReader reader = new ModelReader();
reader.addFileName("path to file");
reader.run(ctx);

Model Writer

The component org.eclipse.app4mc.amalthea.workflow.component.ModelWriter writes a given AMALTHEA model to either one file or several files. As default the current available model in the AMALTHEA_SLOT is taken.
The following parameters are available to set:

• boolean singleFile default true
• String outputDir
• String fileName, if output is set to split files the different models are separated by an additional suffix in the name indicating the contained model.

Sample configuration inside of a workflow:

ModelWriter writer = new ModelWriter();
writer.setOutputDir("path to dir");
writer.setFileName("output.amxmi");
writer.run(ctx);

Add Schedule Points

The component org.eclipse.app4mc.amalthea.workflow.component.AddSchedulePoints modifies a given model (default in the AMALTHEA_SLOT) in that way, that in the org.eclipse.app4mc.amalthea.model.sw.SWModel the contained org.eclipse.app4mc.amalthea.model.sw.Task elements are checked if the preemption is set to cooperative. If this is the case, it will add between the elements of the org.eclipse.app4mc.amalthea.model.sw.CallGraph new elements of type org.eclipse.app4mc.amalthea.model.sw.SchedulePoint.

Sample configuration inside of a workflow:

AddSchedulePoints addSchedulePoints = new AddSchedulePoints();
addSchedulePoints.run(ctx);

4.3.4 EASE modules

The purpose of using EASE is to provide one way to define and run a workflow for a model.
Therefore APP4MC provides some helper methods to be used in the EASE scripting environment.
The modules are provided by the plugin org.eclipse.app4mc.amalthea.workflow. ease .

Workflow Module

The workflow module provides some helpers regarding running a APP4MC workflow definition based on EASE.
The general module can be loaded with the following line:

loadModule('/APP4MC/Workflow')

EASE opens an own Eclipse console by default to show the output of the executed script when using right click and Run as -> EASE Script. Therefore if you are using Log4J for your logging, you can use the following provided methods to configure dedicated Log4J Loggers to use also the EASE console for output.

The following overview gives an overview about the available helper methods:

4.3.5 MWE2 Workflow