The Synthesis of Dependable Communication Networks for Automotive Systems

Transcription

1 06AE-258 The Synthess of Dependable Communcaton Networks for Automotve Systems Copyrght 2005 SAE Internatonal Nagarajan Kandasamy Drexel Unversty, Phladelpha, USA Fad Aloul Amercan Unversty of Sharjah, Sharjah, UAE ABSTRACT Embedded automotve applcatons such as drve-by-wre n cars requre dependable nteracton between varous sensors, processors, and actuators. Ths paper addresses the desgn of low-cost communcaton networks guaranteeng to meet both the performance and fault-tolerance requrements of such dstrbuted applcatons. We develop a fault-tolerant allocaton and schedulng method whch maps messages on to a lowcost multple-bus system to ensure predctable nterprocessor communcaton. The proposed method targets tme-dvson multple access (TDMA) communcaton protocols. Fnally, we present a case study usng some advanced automotve control applcatons to show that our approach uses the avalable network bandwdth effcently to guarantee message deadlnes. INTRODUCTION Embedded computers are beng ncreasngly used n automobles to replace safety-crtcal mechancal and hydraulc systems. Drve-by-wre s one example where tradtonal hydraulc steerng and brakng are replaced by a networked mcroprocessor-controlled electromechancal system [1]. Sensors measure the steerngwheel angle and brake-pedal poston, and processors calculate the desred road-wheel and brakng parameters whch are then appled va electro-mechancal actuators at the wheels. Other computerzed vehcle-control applcatons ncludng adaptve cruse control, collson avodance, and autonomous drvng are also beng developed [2]. These applcatons wll be realzed as realtme dstrbuted systems requrng dependable and tmely nteracton between sensors, processors, and actuators. Ths paper addresses the desgn of low-cost communcaton networks to meet both the performance and fault-tolerance requrements of such applcatons. The approach descrbed n ths paper syntheszes a faulttolerant (FT) network topology from applcaton requrements. Whle synthess methods such as [3] assume an underlyng CAN communcaton protocol and arbtrate bus access usng message (processor) prortes, we target TDMA communcaton protocols where processors are allotted transmsson slots accordng to a statc, perodc, and global communcaton schedule [4]. Examples nclude TTP [5] and FlexRay [6] that have recently emerged as possble networkng standards for n-vehcle networks. We restrct the network topology space to multple-bus systems such as the one n Fg. 1 where each processor P connects to a subset of the communcaton buses. A co-processor handles message communcaton ndependently wthout nterferng wth task executon on P. A multple-bus topology allows fault-tolerant message allocaton. Also, snce communcaton protocols for the embedded systems of nterest are typcally mplemented over low-cost physcal meda, ndvdual buses have lmted bandwdth. Therefore, multple buses may be needed to accommodate the message load. Fg. 1: A mult-bus system where each processor connects to a subset of the communcaton buses Gven a set of dstrbuted applcatons modeled as task graphs {G }, the proposed approach generates a communcaton network satsfyng both the performance and fault-tolerance requrements of each G. Messages are allocated and scheduled on the mnmum number of buses {B j } where each B j has a specfed bandwdth. The major features of our approach are as follows: It assumes a mult-rate system where each graph G may have a dfferent executon perod perod(g ). It targets a TDMA communcaton protocol.

2 It supports dependable message communcaton by establshng redundant transmsson paths between processors, thereby toleratng a bounded number of permanent bus falures. It uses network bandwdth effcently by reusng transmsson slots allotted to a processor between the multple messages sent by t. Fnally, usng representatve dstrbuted automotve control applcatons, we show that the proposed method guarantees predctable message transmsson whle reducng bandwdth utlzaton. The rest of ths paper s organzed as follows. Secton 2 presents an overvew of the proposed approach, whle Secton 3 dscusses some prelmnares ncludng task schedulng. The message allocaton method s developed n Secton 4, and Secton 5 presents the case study. We conclude the paper n Secton 6. DESIGN FLOW As the prmary objectve, we construct a network topology meetng the fault-tolerance and performance goals of the embedded applcatons. The secondary objectve s to mnmze hardware cost n terms of communcaton buses. An heurstc method s developed where a feasble network topology satsfyng performance goals s frst obtaned. Its cost s then reduced va a seres of steps whch mnmze the number of buses by approprately groupng (clusterng) messages whle preservng the feasblty of the orgnal soluton. The man steps of the proposed desgn approach are as follows. For a gven allocaton of task to processors {P }, the correspondng nter-processor messages are mapped to a low-cost network topology comprsng dentcal buses {B j }. Redundant routes are provded for messages wth specfc fault-tolerance requrements; for a k-fault-tolerant (k-ft) message m, k replcas or copes are allocated to separate buses. The network s syntheszed assumng a generc TDMA protocol, and can be modfed to accommodate specfc cases such as TTP and FlexRay. We assume that each task graph G must meet ts deadlne by the end of ts perod perod(g ). Frst, the graph deadlne s dstrbuted over ts tasks to generate a schedulng range [r, d ] for each task T where r and d denote ts release tme and deadlne, respectvely. The ntal network topology s obtaned by smply allocatng each nter-processor message m to a separate bus. Wthout bus contenton, m s transmsson delay s gven by the message sze and bus bandwdth, and the overall soluton s feasble f all tasks complete before ther respectve deadlnes. The next secton dscusses these prelmnary steps n greater detal. bus B j. A message m s grouped wth an exstng cluster C j f the resultng allocaton satsfes the followng requrements: (1) No two replcas of a k-ft message are allocated to C j. (2) All messages belongng to C j contnue to meet ther deadlnes. (3) The duraton (length) of the communcaton schedule correspondng to C j does not exceed a desgner-specfed threshold. Note that f a dedcated co-processor handles communcaton as n Fg. 1, the message transmsson schedule must be compact enough to ft wthn the avalable memory. The proposed clusterng approach also uses bus bandwdth effcently by sharng or re-usng transmsson slots between multple messages sent by a processor whenever possble. Each message cluster s allocated to a separate bus n the fnal topology. PRELIMINARIES Ths secton shows how to obtan the ntal soluton where tasks are assgned deadlnes and scheduled on processors, and messages allocated to separate communcaton buses. Deadlne Assgnment: Intally, only the entry and ext tasks havng no predecessors and successors, respectvely, have ther release tmes and deadlnes fxed. To schedule an ntermedate task T n the task graph, however, ts schedulng range [r, d ] must frst be obtaned. Ths s termed the deadlne assgnment problem where the deadlne D of the task graph G must be dstrbuted over each ntermedate task such that all tasks are feasbly scheduled on ther respectve processors. Deadlne dstrbuton s NP-complete and varous heurstcs have been proposed to solve t. We use the approach of [7] whch maxmzes the slack added to each task n graph G whle stll satsfyng ts deadlne D. We now descrbe the deadlne dstrbuton algorthm. Entry and ext tasks n the graph are frst assgned release tmes and deadlnes. A path path through G comprses one or more tasks {T }; the slack avalable for dstrbuton to these tasks s slack = D c where D s the deadlne of path and c the executon tme of a task T along ths path. The dstrbuton heurstc n [7] maxmzes the mnmum slack added to each T along path by dvdng slack equally among tasks. Durng each teraton through G, path mnmzng, where n slack denotes the number of tasks along path, s chosen and the correspondng slack added to each task along that path. The deadlnes (release tmes) of the predecessors (successors) of tasks belongng to path are updated. Tasks along path are then removed from the orgnal graph, and the above process s repeated untl all tasks are assgned release tmes and deadlnes. n The number of communcaton buses n the ntal soluton s then mnmzed va an teratve message clusterng procedure whch groups multple messages on

3 Fg. 2: (a) Example task graph; (b) and (c) paths selected for deadlne dstrbuton, and (d) the resultng schedulng ranges for each task We use the graph n Fg. 2(a) to llustrate the above procedure. Frst, the release tme of entry task T 1 and the deadlne of ext task T 5 are set to r 1 = 0 µs and d 5 = 2000 µs, respectvely. Next, we select the path T 1 T 2 T 4 T 5 shown n Fg. 2(b); the total executon tme of tasks along ths path s 800 µs, and as per the heurstc, a slack of ( ) 4 = 300 µs s dstrbuted to each task. Once ther release tmes and deadlnes are fxed, these tasks are removed from the graph. Fg. 2(c) shows the remanng path comprsng task T 3 whch has ts release tme and deadlne fxed by T 1 and T 4, respectvely. Fg. 2(d) shows the resultng schedulng range for each task. Task Schedulng: Once the schedulng ranges of tasks n the graph are fxed, each T may now be consdered ndependent wth release tme r and deadlne d, and scheduled as such. To tackle mult-rate systems, we use fxed-prorty schedulng where tasks are frst assgned prortes accordng to ther perods [8], and at any tme nstant, the processor executes the hghest-prorty ready task. Agan, the schedule s feasble f all tasks fnsh before ther deadlnes. Feasblty analyss of schedules usng smple closed-form processor-utlzaton-based tests has been extensvely studed under fxed-prorty schedulng. However, n addton to feasblty, we also requre task T s response tme w, gven by the tme nterval between T s release and fnsh tmes; the response tme s used n the next stage of our algorthm to determne the message delays to be satsfed by the network. For mult-rate task graphs, the schedules on ndvdual processors are smulated for duraton equal to the least common multple (LCM) of the graph perods. Snce ths duraton evaluates all possble nteractons between tasks belongng to the dfferent graph teratons, the worst-case response tme for each task T s obtaned. Fg. 3(a) shows a smple mult-rate system comprsng two task graphs wth perods 2000 µs and 3000 µs; Fgs. 3(b) and 3(c) show the task allocaton and schedulng ranges, respectvely. Fg. 3(d) shows the correspondng schedule for 6000 µs the LCM of the graph perods. Task response tmes wthn ths tme nterval are shown n Fg. 3(e). Multple teratons of a task are evaluated to obtan ts worst-case response tme. For example, n Fg. 3(e), the frst teraton of tasks T 1, T 2, and T 4 (n bold) has the maxmum response tme among the teratons wthn Fg. 3: (a) An example mult-rate system, (b) task-to-processor allocaton, (c) task schedulng ranges, (d) task schedule for the duraton of the least common multple of the task perods, and (e) the response tmes of dfferent task teratons over the smulated tme nterval

4 the gven tme duraton. The task schedulng on processors s successful f, for each task T, w d r. However, for the overall soluton to be feasble, all messages must also meet ther deadlnes. Intal Network Topology: A k-ft message m sent by task T has deadlne delay( m ) = d r w where w denotes T s worst-case response tme. Intally, the network topology allocates a separate communcaton bus for each message copy. Therefore, n ths topology, m experences no network contenton and ts transmsson delay s and B speed j speed ( m ) B j sze where sze(m ) denote the message sze n bts and bus bandwdth n kb/s, respectvely. The soluton s feasble f, for each m, delay(m ) s greater than the correspondng transmsson delay. MESSAGE CLUSTERING We now develop a clusterng approach to reduce the cost of the ntal network topology where multple messages are grouped on a sngle bus whle preservng the feasblty of the orgnal soluton. The fault-tolerance requrement of each k-ft message s also satsfed durng ths procedure. Frst, we brefly revew message transmsson n a typcal TDMA communcaton protocol such as FlexRay. Messages are transmtted accordng to a statc, perodc, and global communcaton schedule called a round, comprsng dentcal-szed slots. Each processor P j s allotted one or more sendng slots durng a round where both slot sze and the number of slots per round are fxed by the system desgner. Though successve rounds are constructed dentcally, the messages sent by processors Fg. 4: (a) Message allocaton resultng n a mssed deadlne; (b) a clusterng of multple messages resultng n mssed deadlnes, and (c) a clusterng guaranteeng deadlnes, obtaned after modfyng message perods approprately may vary durng a gven round. We now state the fault-tolerant message clusterng problem as follows. Gven a communcaton deadlne delay(m ) for each k-ft message m sent by processor P j, construct TDMA rounds on the mnmum number of communcaton buses such that durng any tme nterval correspondng to delay(m ), P j s allotted a suffcent number of transmsson slots to transmt m. Allocaton of messages to multple buses s related to bn-packng where messages are packed nto a bn (round) of fnte sze whle mnmzng the number of bns. The general bn-packng problem s NP-complete and heurstcs are typcally used to obtan a soluton [9]. We treat each m as a perodc message wth perod perod(m ) equal to ts deadlne delay(m ) and generate message clusters {C j }, such that the correspondng TDMA round round(c j ) satsfes the followng constrants: (1) No two replcas of a k-ft message m are allocated to C j. (2) The duraton of round(c j ) does not exceed a desgner-specfed threshold. (3) The slots wthn round(c j ) guarantee m s deadlne,.e., the tme nterval between successve sendng slots for m equals ts perod. Each message cluster C j s allocated to a separate communcaton bus n the fnal network topology. Our method also makes effcent use of bus bandwdth by mnmzng the number of transmsson slots needed to satsfy message deadlnes wthn a TDMA round by reusng slots between messages sent by a processor whenever possble. We assume an upper bound on TDMA-round duraton provded by the desgner n terms of the maxmum number of transmsson slots n max and slot duraton slot. Typcally, the choce of n max depends on the memory lmtatons of the communcaton co-processor such as the number of transmt and receve buffers. Each transmsson slot wthn a round has duraton speed = mn{ sze( m B µs. The message perod slot )} j delay(m ), orgnally expressed n µs, s now dscretzed as delay ( m ) slot and expressed n terms of transmsson-slot ntervals. To smplfy the notaton, we wll use delay(m ) to denote ths dscrete quantty from here on. To guarantee message m s deadlne, the correspondng slot allocaton must satsfy both ts perodcty requrement and a dstance constrant between successve m transmssons as the followng example llustrates. Fg. 4(a) shows an allocaton scenaro for message m 1 havng delay(m 1 ) = 2 slots wthn a TDMA round of duraton four slots where m 1 requres one slot for transmsson. Though m 1 s perodcty requrement may be satsfed by smply allocatng suffcent slots wthn each of ts perods, t results n mssed deadlnes. The nterval between successve m 1 transmssons may be as close to one and as far as three slots away. As Fg.

5 Fg. 5: Algorthm to synthesze the network topology 4(a) shows, n the worst case, m 1 may be allocated a transmsson slot just before the end of ts current perod and one mmedately at the start of ts next perod. Clearly, ths results n a deadlne volaton. Smlar problems may also occur when multple messages are clustered. Fgure 4(b) shows TDMA rounds correspondng to messages m 1 and m 2 wth perods perod(m 1 ) = 2 and perod(m 2 ) = 5 slots, respectvely. Transmsson slots are allocated n frst-ft (FF) fashon where messages are ordered n terms of ncreasng perod and the frst avalable slots allocated to each m wthn the round. The slot allocaton scheme n Fg. 4(b) results n a deadlne volaton where the mnmum and maxmum dstances between successve slots for m 2 are four and sx slots, respectvely. Therefore, to guarantee message m s deadlne, the correspondng allocaton must satsfy a maxmum dstance between successve m transmsson slots equal to perod(m ). Note that n the above example, message deadlnes may be satsfed by modfyng ther perods approprately. Fg. 4(c) shows the slot allocaton for both messages after m 2 s perod s modfed to four slots. It s easly checked that the dstance constrant of two and four slots for successve transmssons of m 1 and m 2, respectvely, s satsfed. The above dscusson suggests that the orgnal message perods may need modfcaton pror to allocatng slots wthn the TDMA round. We adopt a strategy where the message perods wthn a cluster are constraned to be harmonc multples of some base k perod p base,.e., perod( m ) = 2 p, a concept used when schedulng tasks n real-tme systems requrng a specfc temporal separaton between successve task executons [10]. We constran each m s perod to be the maxmum nteger perod( m ) n satsfyng: max base k k pbase delay( m ) < 2 pbase If mn{ perod( m )} p = denotes the smallest perod mn among the messages, then p mn 2 pbase pmn <. Fg. 5 shows the synthess algorthm to construct the network Fg. 6: The clusterng algorthm generatng the reduced-cost network topology topology. For each p base value between [ p mn 2, p mn ], message perods are modfed approprately, and clustered to generate the correspondng topology. Fnally, the best soluton, n terms of the number of clusters, s chosen. The CLUSTER procedure shown n Fg. 6 takes a set of messages s msg as nput, ther perods modfed and sorted n terms of ncreasng perod(m ), and returns the set of message clusters s clust as output. Durng each clusterng step, we choose a k-ft message m havng the mnmum perod wthn s msg and allocate t to k separate clusters. For each m, we obtan all feasble message-to-cluster allocatons by groupng m wth each C j n s clust and generatng round(c j m ). If needed, new clusters are created wthn s clust to accommodate all copes of m. If more than k feasble allocatons are obtaned, then the k best solutons are chosen based on effcent bandwdth use. The ALLOC procedure generates a feasble round(c j m ). It accepts an exstng message cluster C j and a message m and generates a feasble TDMA round (f possble) for the new allocaton C j m. As dscussed above, message m s perod perod(m ) s frst transformed to relate harmoncally to those n C j and the messages are sorted n ncreasng perod order. The duraton of the new round round(c j m ) s p = max{ perod( m )}. To allocate transmsson max C j slots for the new message m, ALLOC dvdes round(c j ) nto k dsjont tme ntervals {I k } where k = p perod( m ) and I k has duraton perod(m ). max Transmsson slots are then allotted wthn each nterval

6 Fg. 7: (a) Adaptve cruse control, (b) tracton control, and (c) electrc power steerng applcatons, and the correspondng flow-graph representatons usng the FF packng strategy. The dstance constrant between transmsson slots for m s guaranteed snce the allotted slots occur n the same postons wthn each nterval I k. Transmsson-Slot Reuse: Recall that durng clusterng, each message m s treated as perodc wth perod perod(m ). However, f the task T transmttng m does not execute at that rate, then the bus bandwdth s overutlzed. We can mprove bandwdth utlzaton by reusng transmsson slots among the multple messages sent by processor P j. The worst-case arrval rate arrval(m ) for each message m n a mult-rate system s obtaned durng schedulablty analyss by smulatng the correspondng task schedule. It s mportant to note that arrval(m ), expressed n terms of slot ntervals, depends on the executon rate of the sender task T. Let {m } be the set of messages sent by a processor wthn a message cluster C j. Now, assume message m new, also transmtted by the same processor, to be allotted slots wthn round(c j ). If each message m s allotted n transmsson slots wthn the tme nterval perod(m new ) n round(c j ), then the number of slots avalable for reuse by m new s n perod( m new ) arrval m ( ) reuse = n m m where arrval(m ) denotes the worst-case arrval rate of message m. Therefore, m new s allotted sze B Fg. 8: (a) The physcal archtecture ncludng taskto-processor allocaton and (b) the message attrbutes requred for network topology ( m ) new speed nreuse j slot perod(m new ). transmsson slots wthn Gven a set of clusters and a new message to be allocated to one, CLUSTER explores all possble clustermessage allocaton scenaros. Slot reuse s used as the decdng factor n selectng the best allocaton snce the cluster allocaton resultng n maxmum reuse mnmzes the bandwdth utlzaton. Fnally, when TDMA slots are shared between messages sent by a processor, the communcaton co-processor must correctly schedule ther transmsson,.e., gven a slot, decde whch message to transmt n t. Though ths paper does not address message-schedulng logc wthn the coprocessor, an earlest-deadlne frst approach seems approprate. n

7 Fg. 9: (a) Example TDMA round specfcatons and (b) communcaton schedules generated wthout slot reuse where message perods are modfed to relate harmoncally to (b) p base = 3, (c) p base = 4, and (d) p base = 5 slots, respectvely CASE STUDY We now llustrate the proposed synthess method usng some advanced automotve control applcatons as examples. These nclude adaptve cruse control (ACC), electrc power steerng (EPS), and tracton control (TC), and are detaled n Fgs. 7(a)-(c). The ACC applcaton automatcally mantans a safe followng dstance between two cars, whle EPS uses an electrc motor to provde necessary steerng assstance to the drver. The TC applcaton actvely stablzes the vehcle to mantan ts ntended path even under slppery road condtons. These applcatons demand tmely nteracton between dstrbuted sensors, processors, and actuators,.e., have specfc end-to-end deadlnes, and therefore requre a dependable communcaton network. Fg. 8(a) shows the physcal archtecture of the system where sensors and actuators are drectly connected to the network and the desgner-specfed task-to-processor allocaton, whle Fg. 8(b) summarzes the varous message attrbutes affectng network topology generaton. We assume 1-FT messages throughout. Columns two and three lst the sendng and recevng tasks for each message and the message sze sze(m ) n bts, respectvely, whle columns four and fve lst the communcaton delay delay(m ) for messages n µs, and transmsson-slot ntervals. These delay values are obtaned by frst assgnng deadlnes to tasks and then performng a schedulablty analyss on ther respectve processors. As summarzed n Fg. 9(a), we assume a verson of the FlexRay communcaton protocol havng a bandwdth of 250 kb/s and a mnmum transmsson-slot wdth of 50 µs. Snce m 2 and m 16 have the mnmum perod of fve slots among all messages, p base may assume values of three, four, or fve slots. Fgs. 9(a)-(c) show the communcaton schedules generated wthout slot reuse after modfyng the message perods to relate harmoncally to each of the above p base values. Those correspondng to p base values of four and fve slots compare best n terms of topology cost. We now show how to reduce bandwdth utlzaton by sharng transmsson slots between messages. As canddates for slot reuse, consder messages m 3 and m 10 sent by tasks T 3 and T 12, respectvely, where both tasks are allocated to processor P 2. In Fg. 10(a), where message perods are modfed usng p base = 3, m 3 and m 10 cannot share slots snce both have a perodcty of sx slots. In Fg. 10(b), however, when ther perods are modfed as perod(m 3 ) = 4 and perod(m 10 ) = 8 usng p base = 4 slots, reuse s possble. Note that the EPS applcaton comprsng T 3 transmttng m 3 has a 1500 µs perod-correspondng to the nter-nterval tme between successve m 3 transmssons. Therefore, n Fg. 10(b), m 3 requres only one of four allocated slots on bus B 1 (Task T 3, however, may request m 3 s transmsson anytme durng the round), and m 10 wth a perod of eght slots can reuse the one free slot avalable durng any

8 Fg. 10: (a) Communcaton schedules generated whle reusng transmsson slots for dfferent values of p base ; (a) p base = 3, (b) p base = 4, and (c) p base = 5 slots perod(m 10 ). A smlar argument holds for messages m 4 and m 9 sent by processor P 1. Fg. 10(c) shows the schedule correspondng to p base = 5 slots. Agan, slots are reused between messages {m 3, m 10 } and {m 4, m 9 }. Fnally, though the topologes shown n Fgs. 10(b) and (c) have the same cost (three buses each), Fg. 10(b) has a somewhat lower slot utlzaton of 89.5% compared to 90% for Fg. 10(c). Snce the empty slots n Fg. 10(b) may be used to transmt addtonal (non-crtcal) messages when compared to Fg. 10(c), we select the topology n Fg. 10(b) as the fnal soluton. CONCLUSION Ths paper has addressed the synthess of low-cost TDMA communcaton networks for dstrbuted embedded systems. We have developed a fault-tolerant clusterng method whch allocates and schedules k-ft messages on the mnmum number of buses to provde dependable transmsson. The proposed method was llustrated usng a case study nvolvng some advanced automotve control applcatons and t was shown that sharng transmsson slots among multple messages reduces bandwdth consumpton whle preservng predctable communcaton. Therefore, the method has the potental to reduce topology cost when appled to larger embedded systems. ACKNOWLEDGMENTS Ths research was supported n part by a contract from The Delph Corporaton. Portons of ths work appeared n SAFECOMP 2003, and the Journal of Relablty Eng., and System Safety, REFERENCES 1. E. A. Bretz EA, By-wre cars turn the corner, IEEE Spectrum, vol. 38, no. 4, pp , G. Leen and D. Heffernan, Expandng automotve electronc systems, IEEE Computer, vol. 35, no. 1, pp , T. Y. Yen and W. Wolf, Communcaton synthess for dstrbuted embedded systems, Proc. Int l Conf. Computer-Aded Desgn, pp , H. Kopetz, Real-tme systems: Desgn prncples for dstrbuted embedded applcatons, Kluwer Academc Publshers, Boston, H. Kopetz, TTP: A tme-trggered protocol for faulttolerant real-tme systems, Proc. IEEE Fault- Tolerant Computng Symp., pp , J. Berwanger et al., FlexRay: The communcaton system for advanced automotve control systems, Proc. SAE World Congress, Paper: , M. D. Natale and J. A. Stankovc, Dynamc end-toend guarantees n dstrbuted real-tme systems, Proc. Real-Tme Systems Symp., pp , X. Hu, J. G. D Ambroso, B. T. Murray, and D. L. Tang, Co-desgn of archtectures for automotve powertran modules, IEEE Mcro, vol. 14, no. 4, pp , D. S. Johnson, Fast algorthms for bn packng, J. Computer & System Scences, vol. 3, no. 3, pp , K. J. Ln and A. Herkert, Jtter control n tme trggered systems, Proc. Hawa Conf. System Scences, pp , 1996.