CSS: Conditional State-based Scheduling for Networked Control Systems

Transcription

1 In Proc. of the IEEE International Conference on Embedded and Real-Time Computing Sytem and Application (RTCSA), Seoul, South Korea, Augut Revied verion. CSS: Conditional State-baed Scheduling for Networked Control Sytem Xi Chen, Akramul Azim, Xue Liu, Sebatian Fichmeiter School of Computer Science, McGill Univerity, Department of Electrical and Computer Engineering, Univerity of Waterloo Abtract Modern indutrial networked control ytem (NCS) tend to be complicated and have dynamic workload by holding a variety of application via a hared network. The tatic network cheduling algorithm fit mot NCS due to their determinitic characteritic and timing guarantee, but they cannot handle dynamic workload for lack of making onthe-fly deciion. The conditional tate-baed cheduling add the dynamim in the tatic cheduling algorithm by automata or more explicitly tate chart like formalim with conditional tranition. In thi paper, we propoe CSS cheme that applie the conditional tate-baed cheduling to dynamically chedule different application in the indutrial NCS. CSS aim at the time-triggered network in the NCS and ue time diviion multiple acce (TDMA) method to let the application acce the network. To enhance the calability of the NCS, we deign CSS a a decentralized cheme where each application in NCS ha a local cheduler to make it chedule deciion. Appropriate algorithm are applied to enure the cheduling deciion made by the local cheduler are conitent and the deired ytem performance can be achieved. Simulation reult demontrate the effectivene of the propoed cheme compared to the tatic TDMA ued in real-time network. Index Term NCS, conditional tate-baed cheduling, dynamic TDMA, decentralized cheduling. I. INTRODUCTION Recent year have een the increaing demand of the networked control ytem (NCS) in indutry uch a automotive, factory automation, avionic, and robotic that require high reliability and efficiency. By introducing the network a a hared communication medium among the tranmiion component like enor, controller and actuator in the control application, the ytem performance of the NCS can be influenced by network-induced tranmiion delay. How to deign the network cheduling to properly allocate the network bandwidth among the control application in NCS i important. Traditional network cheduling like the rate monotonic cheduling [1] or round robin are tatic, and they work in the NCS with predefined workload and can provide afety a well a timing guarantee. However, modern indutrial NCS tend to be complicated with abundant application co-exiting in the network, which may reult in the dynamic workload. One typical cae i the automobile market that launche a variety of new car model with increaing functionalitie to cater the uer demand. Beide the critical control application in the car like the active teering and drive control that hould be executed periodically, the other non-critical application uch a window open/cloe or DVD player in the network may activate aperiodically, cauing workload variation. Under the dynamic workload, cheduling all the application tatically may ue the network reource inefficiently and degrade the ytem performance. To handle the dynamic workload in NCS, cheduling algorithm making on-the-fly deciion are the topic-of-interet. Several dynamic cheduling algorithm [2] [5] were propoed toward the priority-baed field bu like Control Area Network (CAN). However, there are not many reearch effort on the dynamic network cheduling deign for NCS that ue timetrigged network a the hared communication medium. The time-triggered network like TTCAN [6], FlexRay [7], [8] and real-time Ethernet [9] emerge in indutry recently and ha the potential to replace the priority-baed field bu in future due to it determinitic characteritic and timing guarantee. Some of the time-triggered network upport dynamic cheduling partially. For example, FlexRay and TTCAN reerve a dynamic egment with limited time lot in every communication cycle to chedule the aperiodic application. Some of the timetriggered network upport dynamic cheduling completely. For example, the real-time Ethernet can make flexible chedule deciion in each time lot. Comparing both type of timetriggered network, the latter provide better flexibility and calability. We focu on the NCS with a time-triggered network that can upport dynamic cheduling completely to deign the network cheduling algorithm. The conditional tate-baed cheduling cheme [9] [11] repreent recent development to improve the network cheduling in real-time ytem. The conditional tate-baed chedule are realized by automata [12] or more explicitly tate chart like formalim with conditional tranition [10], [11]. Network code language permit developer to expre uch conditional tate-baed communication chedule, and the pecification, analyi, and verification are examined. Therefore, the conditional tate-baed cheduling inherit the determinitic property of the tatic cheduling but ha more flexibility than the tatic cheduling to handle the varying workload by adding dynamim. In thi paper, we propoe CSS, which i a conditional tate-baed cheduling cheme excluively for indutrial NCS. Given an NCS with multiple application and a time-triggered network a the hared communication medium, the goal of CSS i to achieve a good overall ytem performance of the NCS while providing the wort-cae guarantee, even under the exitence of the dynamic workload or meage tranmiion failure. To enhance the calability of the NCS, CSS leverage a ditributed conenu to chedule all the

2 Control Network Controller 1 Plant 1 Controller n Workload Senor 1 Senor n Time Plant n Non-Control Application Control Application 1 Control Application n Fig. 1: Networked Control Sytem application. Each application in NCS ha the local cheduler to make it chedule deciion. The chedule deciion are made according to the pecific condition, which i deigned to enure the tability and improve the performance of the critical application. Moreover, the chedule deciion let the noncritical application acce the network in a bet-effort way. We deign the meage communication principle in NCS o that the chedule deciion made by the local cheduler are conitent. We imulate a three-ervo target-tracking ytem a a cae tudy, and the reult demontrate the effectivene of the propoed chedule compared with the tatic cheduling. The organization of the paper i a follow: Section II provide the ytem model of NCS with time-triggered network. Section III give detail of CSS cheme deign. Section IV theoretically analyze the tability of NCS under CSS cheme. Section V evaluate the performance of the propoed cheme. Section VI introduce the related work. Section VII ummarize the paper. II. OVERVIEW OF NCSS WITH TIME-TRIGGERED NETWORK In our NCS a hown in Fig. 1, all the application are connected via a time-triggered network. The application in NCS conit control and non-control application. We aume all the control application like the teering and break control in the car are periodic and critical, and all the non-control application like the maintenance, diagnotic and entertainment application are aperiodic and non-critical. Each control application in our NCS ha a linear plant, a controller deigned in the continuou time domain, and we aume the actuator i directly integrated in the plant. The enor of each plant ample the plant tate and end them in one meage to the controller via the hared network. The controller then compute the control input correponding to the enor ample and end it directly to the plant for execution without uing the hared network. Since the control application dynamic are conidered continuou, the acce interval of the control application to the network i much larger than the ampling period of the plant enor and the proceing time of the controller. Therefore, we aume the enor can tranmit the latet plant data to the controller a long a it accee the network, and the controller can react immediately when receiving the meage from the network. To enure the tability of the control application, the maximum acce interval of the control application to the network hould be bounded. The time-triggered network in the NCS i configured with a global clock. All the tranmiion component in the network have ynchronized clock. We ue tranmiion component to denote all the component in NCS that end or receive meage via the network like the enor and controller in each control application. The network ue TDMA to chedule meage from the tranmiion component. At each time lot, only the tranmiion component from one application can acce the network and tranmit meage. We aume the meage tranmiion time i hort and can be bounded by one time lot. A. Application in NCS Conider an NCS with n control application and m noncontrol application. Each application ha a unique index i, i = 1,..., n + m. We aign indexe from 1 to n to control application, and each control application i denoted by C i, i = 1,..., n. We aign the indexe from n+1 to n+m to the m non-control application, and each non-control application i denoted by E i, i = n + 1,..., n + m. All the application compete for uing the network. Each control application C i, i = 1,..., n can be formulated a a tate-pace function: x i (t) = A i x i (t) + B i u i (t) u i (t) = K i x i (t). (1) The ytem tate i x i (t) R v. The control input i u i (t) R d. The tate matrix A i, the input matrix B i, the feedback matrix K i have correponding dimenion and are given at the deign time. The cloed-loop tate matrix of C i i Āi = A i B i K i. The quality of control (QoC) of each control application C i depend on two parameter: the control error and the tability. We define the control error e i (t) a e i (t) = x i (t) x i (t p ), where t p i the time point when C i ue the network at the pth time, and p = 1, 2,.... When t [t p, t p+1 ], e i (t) i expreed a e i (t) = A i e i (t) + Āix i (t p ). (2) From Eq.(2), we derive e i (t) = Āix i (t p )(t t p ) + t t p A i e i ()d. (3) The control error ha an exponential relation with the time delay for the control application to acce the network. We

3 define the caled control error a ei(t) x i(t p), and the time delay for C i to acce the network i l i = t t p, t [t p, t p+1 ]. (4) From Eq.(2,3) and according to [13], we get e i (t) x i (t p ) Ā i A i (e Ai (t tp) 1). (5) e i(t) From Eq.(3,4,5) we have the caled control error x = i(t p) 0 when l i = 0, and ei(t) x increae with l i(t p) i exponentially when l i > 0. Since the caled control error reflect the control performance, we define the performance metric function J i (l i ) a { 0, li = 0, J i (l i ) = Āi (6) A i e Ai li, l i > 0. Beide the performance metric of C i, the tability i cloely related to the time delay l i. To enure the tability of C i, l i can never exceed it upper bound h i. We hould enure l i h i, (7) where h i can be computed from [13], [14]. We rewrite Theorem 2.15 in [13] for computing upper bound on the acce interval a follow: Theorem II.1. Define h max a the maximum acce interval et at the NCS deign tage for control application C i and h max atifie h max < 1 A i ln( λ min (Q i ) A i 2λ max (P i ) B i K i Ā i + 1), (8) where P i and Q i are ymmetric poitive definite matrice uch that Ā T i P i + P i Ā i = Q i, (9) and λ min (Q i ) i the minimum eigenvalue of Q i λ max (P i ) i the maximum eigenvalue of P i. Define the polynomial while p(x) = λ max (P i )(Ri 2 + 2R i)x 4 2λ max (P i )(Ri 2 + 2R i)x 3 +[λ max (P i )Ri 2 λmin(qi) 2 Āi ]x2 + λmin(qi) 2 Āi, (10) where R i = BiKi (e Ai hmax 1) A i. Let x be the real root of p(x) greater than 1 (if exit). The ytem i exponentially table if { } 1 min h h i = max, Āi ln x, if x exit, (11) h max, otherwie where h i i the upper bound of the delay l i. Since C i controller i deigned ignoring the network and can enure the tability of C i in the continuou time domain, there alway exit P i and Q i that atify Eq.(9). Therefore, the exitence of h i can be enured. Proof of Theorem II.1 refer to [13]. There are non-control application in the network. Each non-control application E i, i = n+1,..., n+m aperiodically activate and doe not have an explicit deadline. B. Bandwidth Utilization of The Application in NCS Each application in NCS ue a portion of network bandwidth during the runtime. We ue u i to denote bandwidth utilization of each application with index i, i = 1,..., n + m, which i the percentage of the network bandwidth taken by thi application. Each control application C i, i = 1,..., n hould be given at leat one time lot in a time pan h i to tay table, hence the lower bound for the bandwidth utilization of C i i u i = 1, where v i to get the maximum integer hi le than or equal to v. We etimate the wort-cae bandwidth utilization of each non-control application E i at deign time, denoted a ū i, i = n + 1,..., n + m. If E i poradically activate with a minimum inter-activate period d i, we etimate ū i = 1. If E i activate randomly and the probability E i di activate in each time lot follow a ditribution like Poion ditribution or Pareto ditribution, we can ue the mean value of the ditribution plu it variance a ū i. In NCS, we aume the non-control application are le afety-critical than the control application. For example, the window open/cloe i le important than the teering control in a car. At the deign time, we hould make ure the total bandwidth utilization of the non-control application in the wort cae doe not exceed a threhold that jeopardize the tability of the control application, n+m i=n ū i 1 n u i. (12) We can ue the admiion control at the deign time to prevent the non-control application from joining the network if the bandwidth utilization contraint in Eq.(12) i violated. However, even when the bandwidth utilization contraint in Eq.(12) can be atified, it i not ufficient to provide tability guarantee of the control application. To enure the tability of the control application, the network cheduling algorithm hould be properly deigned. III. NETWORK SCHEDULING DESIGN We ue the conditional tate-baed cheduling cheme a the underpinning mechanim to contruct CSS cheme which i dedicated for cheduling control and non-control application in NCS. Each application ha the local cheduler to deicide whether all the tranmiion component in thi application can ue the network or not at each time lot. We develop the algorithm to enure the chedule deciion made by the local cheduler are conitent. The goal of the propoed network cheduling cheme i to provide a good overall ytem performance while guarantee the tability of the control application. A. Sytem Configuration We deign CSS for NCS that ue time-triggered network. We aume the communication medium provide a reliable atomic broadcat ervice; therefore, either all tranmiion component receive a meage or none of them do when meage fail to be tranmitted. Moreover, we aume that the network upport the priority-baed arbitration. For the network that doe not upport the arbitration mechanim, we

4 Component in E i (Local Scheduler) Data Storage Network-Code Machine ack mgi ntf mg i Priority Queue Controller in C (Local Scheduler) Data Storage Network-Code Machine ntf mg I nml mg I C z' Arbitrator ntf mg I Shared Communication Medium I ack mg I I = zori = z' C 1 Cyclic Sequence D D C I Plant ntf mg I Fig. 2: Framework of CSS Scheme C I C z Senor nml mg I ack mg I add an independent proceor in the network to act a the network arbitrator. CSS leverage a ditributed conenu to chedule all the application in NCS. Each application in NCS ha it local cheduler to implement the conditional tate-baed cheduling. To avoid additional hardware cot, we uually ue an exiting tranmiion component in an application to act a the local cheduler. For example, we chooe the controller in each C i a the local cheduler of C i. The local cheduler in each application decide whether all the tranmiion component in the application can ue the network or not at each time lot. An exiting tranmiion component i extended to a local cheduler by aigning data torage (i.e. RAM of the proceor) for toring cheduling-relevant data and by intalling Network- Code Machine (NCM), a programme reponible for making cheduling deciion. In each time lot, the local cheduler invoke NCM to update the variable in the data torage and check whether thee variable atify a pecific condition or not. The local cheduler will inform all the other tranmiion component in the application to ue the network only if the pecific condition i atified. B. Framework of CSS CSS allow the developer to define a tatic chedule for the control application that enure the tability of all the control application without the exitence of the non-control application. Since the non-control application exit and aperiodically activate in NCS, CSS allow the developer to define the pecific condition that can be leveraged by the local cheduler to make on-the-fly change to the predefined chedule. The pecific condition i deigned to improve the overall control performance of the control application and at the ame time to chedule the non-control application in a bet-effort way. The framework of CSS i hown in Fig. 2. 1) Scheduling the Control Application: We adopt the tatic TDMA with cyclic equence a the predefined chedule for all the control application in NCS, where all the control application take turn to ue the network and each C i, i = 1,..., n ha it predeceor C i and ucceor C i. A communication cycle i the time pan during which all the control application are cheduled according to the cyclic equence once. The predefined chedule aign only one time lot for each C i to acce the network in each communication cycle. Therefore, the acce interval for each control application C i to ue the network i n time lot, and we et the time lot length a a value to enure the tability of all the control application under the predefined chedule, < min i {1,...,n} h i n. (13) The tatic chedule guarantee fairne to chedule the control application but i brittle to handle the dynamic workload caued by the non-control application. A an improvement, CSS cheme can make conditional tranition on the predefined chedule. In each communication cycle, CSS cheme flexibly add ome time lot to chedule the control application with large control error or the activated non-control application. Such added time lot are denoted a the extra time lot. For example, if more than one time lot aigned to a control application C i in a communication cycle, the time lot other than the firt one are extra time lot. Moreover, we extend the concept of "extra time lot" to include the lot aigned to the non-control application for meage tranmiion and the lot with meage tranmiion failure. At each time lot during the runtime, we want to improve the ytem performance by chooing a control application to ue the network. The ytem performance Q i the overall performance cot of the control application, n n Ā i Q = J i (l i ) =. (14) A i e Ai li The maller Q indicate the better performance. We ue Q i (k) to denote the ytem performance at the kth time lot (k = 1, 2,..., Total Runtime ) by chooing C i to chedule. To improve the ytem performance under the cyclic tructure, CSS need to chedule the one that can reult in the maller Q i (k) from two adjacent control application. Suppoe we are currently at the kth time lot, and C z i the current control application, which i the control application currently uing the network or mot recently acceed the network (if the current time lot, namely the kth time lot, i aigned to a non-control application). The local cheduler in C z and C z ( the ucceor of C z, z = (z mod n) + 1) hould decide which control application of them can ue the network in the (k + 1)th time lot baed on the following contraint Q z (k + 1) Q z (k + 1) < 0. (15) If the contraint in Eq.(15) i not atified, C z will be cheduled. Otherwie, we want to chedule C z. However, cheduling C z will introduce an extra time lot in the current communication cycle. Under the cyclic tructure, the acce interval of a control application C i to the network i at leat n time lot. Any extra time lot inerted during the time delay of C i will prolong the acce interval (n time lot) by 1 time lot, which may jeopardize the tability of C i. We denote the number of the extra time lot in the time delay of C i a b i, where b i = 0 when C i accee the network with ucceful meage tranmiion, and b i = b i +1 when an extra time lot i introduced during the acce delay of C i. When we prefer

5 to chedule C z at the (k + 1)th time lot, we need to check the following contraint (n + b (k) i + 1) h i, i = 1,..., n (16) to enure the tability of all the control application. Eq.(16) i derived by replacing l i with acce interval (n + b (k) i + 1) of C i in Eq.(7). Only when the contraint in Eq.(15) and Eq.(16) are both atified can we chedule C z at the (k + 1)th time lot. The chedule deciion are made by the local cheduler according to the performance contraint defined in Eq.(15) and the tability contraint defined in Eq.(16). The performance contraint in Eq.(15) involve the computation to the performance cot of all the control application, which can be implified. We ue variable I to tore the index of the current control application and ue l (k) i a the time delay l i (defined in Eq.( 4)) at the kth time lot. Under the cyclic equence, we ue o a the index of the communication cycle where the kth time lot lie in, and we have (I i + b (k) l (k) i ), i I, i = (I + b (k) i ), i > I & o = 1, (17) (n i + I + b (k) i ), i > I & o > 1. Conider the ituation when k i not in the firt cycle (o > 1) and I equal to z at the kth time lot. If C z i choen to be cheduled at the (k + 1)th time { lot, I will remain to be z and b (k+1) i will become b (k+1) 0, i = z i = b (k) i + 1, i z. If C z i choen to be cheduled at the (k+1)th { time lot, I will become z and b (k+1) i will become b (k+1) 0, i = z i = b (k) i + 1, i z. From Eq.(17), the contraint in Eq.(15) i equivalent to Q z (k + 1) Q z (k + 1) = [ = Āz A z e A z (n+b(k) z ) + i/ {z,z } [ Āz e Az (b(k) z +1) A z + Āz A z e A z (n+b(k) z i/ {z,z } ) Āz A z e Az (b(k) Āi A i e Ai (l(k) i +) ] Āi A i e Ai (l(k) i +) ] z +1) < 0. The contraint in Eq.(18) can be further implified a (18) ln( a z ) < ( A z (b (k) z +1) A z (n+b (k) z )), o > 1, (19) a z where a z = A z and a z = Āz A z can be derived at the deign time. Conider the ituation when k i in the firt cycle (o = 1), by uing a imilar deduction a given above, the contraint in Eq.(15) can be implified a Āz ln( a z ) < ( A z (b (k) z a z Āz + 1) A z (z b (k) z )), o = 1, (20) where a z = A z and a z = Āz A z. By implifying the performance contraint from Eq.(15) to Eq.(19) and Eq.(20), we can ee that no matter C z or C z i cheduled in the (k+1)th time lot, the time delay l (k+1) i for i / {z, z } will be the ame, reulting in the ame performance cot J i ((k + 1)) from Eq.(6). A a conequence, to compare Q z (k + 1) with Q z (k +1), we only need to conider the performance cot of C z and C z. The local cheduler of C z and C z take O(n) computing complexity to check the following condition D, ln( a z az ) < A z (b (k) z + 1) A z (z b (k) z ), o = 1, D ln( a z az ) < A z (b (k) z + 1) A z (n + b (k) z ), o > 1, (n + b (k) i + 1) h i for i = 1,..., n. (21) If condition D i atified, the local cheduler in both control application C z and C z can conitently decide C z hould ue the network in the (k + 1)th time lot. Otherwie, they can conitently decide that C z hould ue the network. At each time lot, only the local cheduler from the current control application C I and it ucceor C I need to check the condition D to make the chedule deciion, while the cheduler of the other control application do not need. 2) Scheduling the Non-control Application: The noncontrol application in the network can aperiodically activate. Comparing with the control application, the non-control application are le afety-critical and do not have hard deadline. We ue admiion control in Eq.(12) (a introduced in ubection II-B) to accept the non-control application at the deign time, but the admiion control i not ufficient to guarantee the tability of the control application. Therefore, we deign a bet-effort cheduling to the noncontrol application during the runtime to provide tability guarantee. In the bet-effort cheduling, an extra time lot can be aigned to an activated non-control application only if introducing thi extra time lot doe not jeopardize the tability of any control application. When a non-control application E i, i = n+1,..., n+m want to ue the network in the (k +1)th time lot, the local cheduler of E i need to check the tability contraint in Eq.(16). Thi i becaue cheduling E i will turn the (k+1)th time lot to be an extra time lot, which increae b i by 1 for all the control application and may caue them untable. If the tability contraint in Eq.(16) atifie, E i can be cheduled in the (k + 1)th time lot. Otherwie, E i will continue to check the tability contraint in Eq.(16) in the following time lot until it can find a valid one to acce the network. 3) Priority-baed Arbitration: In NCS, the control application do not know when a non-control application activate. Whenever a non-control application E i activate and decide to ue the network in a time lot, it will conflict with a control application C z or C z. To olve thi problem, we ue prioritybaed arbitration in the network. For the network that doe not upport arbitration mechanim like real-time Ethernet, we intall an independent proceor in the network to act a an network arbitrator. When the local cheduler in an application decide to ue the network, it will end a meage to the arbitrator. the arbitrator in the network will forward the one with the highet priority to it detination node and dicard the meage from the other local cheduler. All the control application have the ame priority, which i lower than the prioritie of the non-control application. For the non-control application, the one with more importance to the ytem will be given a higher priority. We aign the higher prioritie to the non-control application than the control application for two reaon. One i that the non-control application

6 TABLE I: Variable in Local Scheduler Name Content Specification a [ A 1,..., A n ] T R n tore A i, i = 1,..., n, time-invariant. ā [ Ā1,..., Ān ] T R n tore Ā1,i = 1,..., n, time-invariant. b [b 1,..., b n] T R n tore b i, i = 1,..., n, time-variant. h h = [h 1,..., h n] T R n tore h i, i = 1,..., n, time-invariant. I I R tore index of "currentcontrol application", timeinvariant. r i r i R tore priority of the application, time-invariant. acc boolean acc =true the application can acce the network, otherwie cannot, time-variant. i I R tore index of the application, time-invariant. i i R tore index of C i ucceor (control application only), time-invariant. i i R tore index of C i predeceor (control application only), time-invariant. b (p) b (p) R tore b i in the previou time lot (control application only), time-variant. doe not jeopardize the tability of the control application when it decide to ue the network by checking Eq.(16). The other reaon i that the non-control application ha no chance to ue the network if higher prioritie are given to the control application, ince there i alway one application C I qualified to ue the network by checking Condition D in Eq.(21) at each time lot. C. Meage Communication Principle in CSS We deign the meage communication principle in CSS to enure the conitency of the local chedule deciion, even under the tranmiion failure of meage. 1) Data Structure: We aign the proceor memory in each local cheduler to tore the variable related to the network cheduling cheme. The pecification of the variable i hown in Table I. We ue ri E and ri C to indicate the priority r i of the non-control application and control application, repectively. We ue the lower number to denote higher priority, therefore we have ri E < ri C. Note that re i rj E for i j, and r1 C = r2 C = = rn C. All the time-invariant variable a hown in Table I are configured at the deign time, and the time-variant variable hould be updated online. The variable {l, b, I} in each local cheduler are initialized a { 0,0,1} at the firt time lot with l R n and b R n. 2) Meage Tranmiion Sequence: Each application in NCS ha two tranmiion component, namely the ource component (SC) and the detination component (DC). In the control application C i, SC i the enor and DC i the controller. In the non-control application E i, SC and DC are defined by the engineer at the deign time according to the functionality of each tranmiion component. Each application chooe one of it tranmiion component to act a the local cheduler. The local cheduler i reponible to notify both SC and DC in the application to ue the network. After receiving the notification from the local cheduler, SC and DC in the application begin to end/receive the meage that contain the data in need. When DC in the application receive a meage with data in need from SC, we aume one meage tranmiion finihe and DC broadcat an acknowledgement meage over the network to inform all the application in NCS about the ucceful meage tranmiion. There are three type of meage in the network: Notification Meage mg ntf i : The notification meage i to notify the tranmiion component of the ith application in NCS to ue the network at the current time lot. It only contain the application index i and priority r i. Normal Meage mgi nml : The normal meage i to tranmit ueful data like the plant tate between the component of the ith application, which contain application index i, the priority r i and the data in need. ACK Meage mgi ack : The ACK meage i to indicate all the other application in the network that the meage tranmiion in the ith application at the current time lot i ucceful. It only contain the application index i and priority r i. The meage tranmiion equence in each application i ummarized by Algorithm 1. We ue the abbreviation AP i to denote the application with index i, and ue NA to denote the network arbitrator. The meage tranmiion equence can finih in one time lot when AP i ue the network. Algorithm 1 Meage Tranmiion Sequence in AP i if AP i (C i or E i ) can ue the network then Local cheduler of AP i end mg ntf i to NA. if mg ntf i ha the mallet r i in NA then NA forward mg ntf i to SC in AP i. NA delete all mg ntf j (j i in the queue). if SC in AP i receive mg ntf i then SC in AP i end mgi nml to DC in AP i. if DC in AP i receive mgi nml then DC in AP i broadcat mgi ack over the network. 3) Working Principle of Local Scheduler: The local cheduler in each control or non-control application need to update the variable lited in Table I and check the pecific condition to make chedule deciion. At firt, the local cheduler end the notification meage if the application can ue the network. The meage tranmiion equence a hown in Algorithm 1 i executed in the network. Upon receiving the ACK meage broadcated in the network, local cheduler update the timevariant variable in Table I. After that, the local cheduler check the condition baed on the newly updated variable to decide whether the application can ue the network or not in the next time lot. We ue Algorithm 2 to demontrate how the local cheduler in AP i work. In the algorithm, we ue

7 AP i.ls to denote the local cheduler of AP i. IV. STABILITY ANALYSIS OF NCS UNDER CSS NETWORK SCHEDULING SCHEME In thi ection, we provide theoretical proof that CSS can enure the tability of all control application C i (i = 1,..., n) in NCS. Theorem IV.1. Given the NCS with n control application C i, i = 1,..., n and m non-control application E i, i = n + 1,..., n + m, the upper bound of the network-acceing delay for each control application C i a h i, all the control application are table under CSS network cheduling cheme when meage tranmiion failure doe not occur. Proof: In CSS, the time lot length in the time-triggered network i choen according to Eq.(13), hence we have n < min h i, (22) i {1,...,n} Moreover, we give extra time lot to C i or E i only if the contraint in Eq.(16) atifie. If meage can alway be tranmitted uccefully in the network, every control application C i can acce the network at leat once in any period with length h i during the runtime. Since h i i choen according to Eq.(11), the tability of C i can be enured according to the proof of Theorem 2.15 in [13]. Therefore, CSS can enure the tability of the control application in NCS without conidering the meage tranmiion failure. If the meage tranmiion alway ucceed, from Theorem IV.1 we can ee that CSS cheme can enure the tability of all the control application even when workload varie due to the exitence of the non-control application. However, when meage tranmiion fail randomly, CSS cheme, a all of the network cheduling algorithm, cannot enure the tability of C i ince the meage tranmiion failure i unpredictable and can happen frequently (i.e. the extreme cae i when all the meage tranmiion fail). When meage tranmiion failure happen in the network, CSS cheme i a bet-effort cheme that provide extra time lot to thoe control application with large error due to packet dropout. Lemma IV.2. Suppoe in an NCS with n control application C i, i = 1,..., n and m non-control application E i, i = n + 1,..., n + m, the upper bound of the network-acceing delay for C i i h i, and the maximum error e i of C i in any interval with length h i can be trictly bounded by β i [0, ). Then, CSS cheme can guarantee that for any time t > t 0 + min i {1,...,n} hi with t 0 a the beginning of the runtime and a the time lot length we have n n e i (t) β i, (23) where β i i et according to Eq.(26). Proof: From Theorem IV.1 and Theorem II.1, CSS can enure the exponential tability of C i. Suppoe the equilibrium Algorithm 2 Working Principle of Local Scheduler in AP i CurrentSlot = k if acc = true then AP i tranmit meage (Algorithm 1) if AP i.ls uccefully receive mgj ack then if j > n then {j i index of E j } b = b + [1,..., 1] ele {j i index of C j } if i = j&i = j then {CurrentSlot i extra lot given to C i } AP i.ls update local variable: b (p) = b i, b i = 0, b q = b q + 1 for q i. ele if i = j & I j then {CurrentSlot given to C i i not extra lot} AP i.ls update local variable: I = i, b (p) = b i, b i = 0. ele if i j & I = j then {CurrentSlot i extra lot given to C j } AP i.ls update local variable: b j = 0 and b q = b q + 1 for q j. ele if i j & I j then {CurrentSlot given to C j i not extra lot} AP i.ls update local variable: b j = 0 and I = j. ele b = b + [1,..., 1]. if AP i i control application then if i = I or i = I then AP i.ls check condition D in Eq.(21) if (Condition D atifie and i = I) (Condition D doe not atify and i = I) then acc = true ele acc = fale ele if AP i activate now then AP i check tability contraint in Eq.(16) if Eq.(16) atifie then acc = true ele acc = fale

8 of x i (t) i 0, according to the definition of exponential tability, there exit contant a, b uch that x i (t) a x i (t 0 ) e bt, t, t 0 0. (24) For any period [t, t + h i ], according to Eq.(5) and Eq.(24), the error of C i can be bounded by e i (t) Āi A i (e Ai hi 1) x i (t) a Āi A i (e Ai hi 1) x i (t 0 ) (25) We et the bound for e i during the time interval h i a β i, Āi β i = a A i (e Ai hi 1) x i (t 0 ), (26) min i {1,...,n} hi For any interval that contain time lot, the length of the interval doe not exceed min h i, hence e i for i {1,...,n} i = 1,..., n during the interval doe not exceed β i. Therefore, min i {1,...,n} hi for any t > t 0 +, we have the inequality in Eq.(23). From Lemma IV.2 we can ee CSS cheme can provide bounded error of all C i. Note that Lemma IV.2 work when there i no meage tranmiion failure happen. V. PERFORMANCE EVALUATION In thi ection, a three ervo target tracking ytem i deigned to evaluate the performance of the CSS cheme. A. Simulation Setup In the network controlled ytem, there are three ervo deigned to track a given trajectory r(t). The trajectory r(t) i a quare wave with amplitude 1m and changing period 1ec, { 1, t [0, 1) r(t) =. (27) 0, t [1, 2] In each ervo control application, the ervo tate are tranmitted by the enor to the controller through the network. The ervo control application ha the tate pace function in Eq.(1), and the (A i, B i, K i ) a well a the cloed-loop pole are given in Table II. Note that the delay bound h i i not computed from Eq.(11) but given according to the real performance of each control application, ince Eq.(11) tend to provide a conervative delay bound that i ufficient for the tability but i uually much maller than the bound in the real cae. Since we want to tet the target-tracking performance of the ervo control application, we ue y i (t) = [1 0]x i (t) a the output of each ervo. We define the overall target-tracking error of the three ervo a f(t), f(t) = 3 y i(t) r(t). The metric for ytem performance i the average value of f(t) during the whole run time, denoted a average integration error (AIE), AIE = 1 Total Runtime Total Runtime f(t)dt (28) 0 The maller the AIE, the better the cheduling cheme. We ue the dynamic TDMA plugin in TrueTime imulator [15] to contruct CSS to chedule application in NCS. The network bandwidth i configured a 250 Kbp. The packet TABLE II: Configuration of the Three Servo Motor No. [ A i ] [ B i ] K i pole h i [ ] 18 ± 21.82i [ ] [ ] [ ] 34 ± 36.66i [ ] [ ] [ ] 42 ± 49.08i ize i 135 bit per packet, and the time lot i et a 4mec. Beide the three ervo target-tracking control application, there i one non-control application in the NCS, which end real-time traffic aperiodically to the network. Moreover, the NCS may uffer meage tranmiion failure. B. Performance of CSS under Dynamic Workload We imulate the performance of CSS under dynamic workload. In our imulation, the probability that the non-control application activate in each time lot, denoted by p, follow a uniform ditribution with mean E(p) [0, 1]. Therefore, changing E(p) will change the bandwidth utilization of the non-control application during the runtime, hence change the total bandwidth utilization of the three ervo target-tracking control application. From Table II, we can compute the lower bound of the bandwidth utilization for the three ervo targettracking control application: m u i = % according to Eq.(12). No cheduling policy can work if the non-control application take more than 38% bandwidth. To tet the performance of the three control application under different bandwidth utilization, we run four time of imulation and configure E(p) in the four run a 0.1, 0.2, 0.3 and 0.38 repectively, reulting in the portion of bandwidth available to the control application a 90%, 80%, 70% and 62% correpondingly. The output of the three ervo and the targettracking error during the runtime in the four run are hown in Fig. 3. Table III give the AIE of the NCS in the four run. With the decreae of the bandwidth utilization of the control application, the AIE of the NCS increae. The three ervo track the given trajectory r(t) with high accuracy and low overhoot in the firt three run (the bandwidth utilization i configured a 90% or 80% or 70%). However, when the bandwidth utilization fall to 62%, the target tracking performance of ervo2 and ervo3 are not ideal, and AIE become larger than the value in the firt three run, but CSS can till make the three control application to be table. The experiment reult how the effectivene of CSS for cheduling application in NCS under dynamic workload. C. Comparion between CSS and Static Cyclic Scheduling under Meage Tranmiion Failure NCS with time-triggered network may uffer meage tranmiion failure. We evaluate the performance of CSS cheme and the tatic cyclic cheduling algorithm when the meage tranmiion failure happen in the network. The tatic cyclic cheduling ue tatic TDMA with cyclic equence to chedule the control application, and each control application i aigned only one time lot in a communication cycle. Since the tatic cyclic cheduling can not handle the dynamic workload from the non-control application, we deactivate the non-control application to compare the performance

9 (a) 90% (b) 80% (c) 70% (d) 62% Fig. 3: The Output of Servo and The Overall Target-Tracking Error of CSS under Different Bandwidth Utilization TABLE III: Average Integration Error (AIE) of CSS under Different Bandwidth Utilization of the Control Application Bandwidth Utilization 90% 80% 70% 62% AIE (m) of CSS and the tatic cyclic cheduling. In our imulation, the probability that the meage tranmiion failure happen in each time lot, denoted by q, follow a uniform ditribution with mean E(q) [0, 1]. Firt, we configure E(q) a 15% and tet the performance of CSS and the tatic cyclic cheduling a hown in Fig.4(a). While CSS can provide a mall overall target-tracking error of the three ervo, the tatic cyclic cheduling cannot. The output of ervo 2 deviate from the target trajectory at around t=1ec when r(t) uddenly change from 1m to 0m. To compare the performance of CSS and the tatic cyclic cheduling under an intenive packet dropout ituation, we configure E(q) a 30%. A hown in Fig. 4(b), CSS can till provide the deired output, but the tatic cyclic cheduling caue large target-tracking error of ervo2 and ervo3 during the runtime. Thi i becaue ervo2 and ervo3 are more enitive to the acce delay and meage tranmiion failure, intead of cheduling them according to the fixed equence, CSS can flexibly add extra time lot in each cycle to them. AIE of the CSS and tatic cyclic cheduling under different meage tranmiion probability i given in Fig. 5. CSS provide a better ytem performance with maller control error than the tatic cyclic cheduling when meage failure happen in the network. VI. RELATED WORK There i a large body of literature on cheduling of realtime traffic within control network. To be pecific, Branicky et al. [1] applied the rate monotonic cheduling (RMS) algorithm to chedule a et of control application in NCS. Ren et (a) 15% (b) 30% Fig. 4: Performance of CSS and Static Cyclic Scheduling under Different Meage Tranmiion Failure Probability r (m) tegration Error Average Int CSS Scheme Static Cyclic Scheduling % 30% Meage Tranmiion Failure Probability Fig. 5: Average Integration Error (AIE) under Different Meage Tranmiion Failure Probability

10 al. [16] provided a QoS management cheme for parallel NCS. Hong [17] propoed a cheduling algorithm to adjut the data ampling time o that the performance requirement of each control loop i atified while the utilization of network reource i ignificantly increaed. Later, an extenion of thi algorithm for the bandwidth allocation applicable to the CAN protocol wa provided in [18], which can atify the performance requirement of real-time application ytem and fully utilize the bandwidth of CAN. Rehbinder and Sanfridon [19] provided an optimal off-line cheduling method by leveraging the control theory. However, thee algorithm are tatic without conidering the workload variation. Many reearcher propoed dynamic method for co-deign of network cheduling and control application. For example, Walh and Ye [3] preented a dynamic arbitration technique to grant network acce to the control loop with the highet error uing maximum-error-firt with try-once-dicard (MEF-TOD). Yepez et al. [4] provided a large error firt (LEF) cheduling algorithm baed on the continuou feedback from the QoC of the control application. Similar to [4], Xia et al. [5] propoed a cheduling algorithm baed on the importance of each control application. However, thee dynamic cheduling algorithm in [3] [5] need a centralized cheduler to make the chedule deciion and focu on the priority-baed network like CAN. Dynamic TDMA like the conditional tatic cheduling [6], [20] wa propoed to chedule the dynamic workload in embedded ytem with time-triggered network. How to apply the dynamic TDMA to chedule the application in NCS and provide tability guarantee i not addreed. In thi paper, we apply the conditional tate-baed cheduling to chedule application NCS and propoe CSS cheme. CSS target at the time-triggered network and ue a ditributed agreement to chedule multiple application in NCS. VII. CONCLUSION To handle workload variation in NCS, we provide a novel cheduling cheme, CSS, to dynamically allocate the network reource among all the control and non-control application. CSS aim at the time-triggered network, and it i a conditional tate-baed cheduling cheme that can make on-thefly change to the pre-defined cheduling equence. CSS ue the ditributed conenu to make the chedule deciion, where each application in NCS ha the local cheduler to decide whether the tranmiion component in the application can ue the network or not in each time lot. The chedule deciion hould be made to improve the overall performance of an NCS and at the ame time enure the tability of all the control application in the network. Algorithm and meage communication principle are deigned to enure the conitency of the local chedule deciion. A ervo target tracking ytem i imulated to evaluate the propoed cheduling cheme. Simulation reult demontrate the advantage and applicability of CSS in networked control ytem. ACKNOWLEDEMENTS. Thi work wa upported in part by NSERC DG , NSERC DG , FQRNT grant 2010-NC , ORF-RE03-045, ORF-RE04-036, ORF-RE04-039, APCPJ , CFI Leader Opportunity Fund 23090, CFI and CMC, ISOP IS , and the indutrial partner aociated with thee project. REFERENCES [1] M. Branicky, S. Phillip, and W. Zhang, Scheduling and Feedback Co- Deign for Networked Control Sytem, in Proceeding of the 41t IEEE Conference on Deciion and Control, vol. 2, pp , [2] P. Martí, A. Camacho, M. Velaco, and M. El Mongi Ben Gaid, Runtime Allocation of Optional Control Job to a Set of CAN- Baed Networked Control Sytem, IEEE Tranaction on Indutrial Informatic, vol. 6, no. 4, pp , [3] G. Walh and H. Ye, Scheduling of Networked control Sytem, IEEE Control Sytem Magazine, vol. 21, no. 1, pp , [4] J. Yépez, P. Martí, and J. Fuerte, Control Loop Scheduling Paradigm in Ditributed Control Sytem, in Proceeding of the 29th Annual Conference of the IEEE Indutrial Electronic Society (IECON), vol. 2, pp , [5] F. Xia, X. Dai, Z. Wang, and Y. Sun, Feedback Baed Network Scheduling of Networked Control Sytem, in Proceeding of International Conference on Control and Automation(ICCA), pp ,2005. [6] K. Schmidt and E. Schmidt, Sytematic Meage Schedule Contruction for Time-Triggered CAN, IEEE Tranaction on Vehicular Technology, vol. 56, no. 6, pp , nov [7] A. Ghoal, H. Zeng, M. Di Natale, and Y. Ben-Haim, Computing Robutne of FlexRay Schedule to Uncertaintie in Deign Parameter, in Deign, Automation Tet in Europe Conference Exhibition (DATE 10), march 2010, pp [8] H. Zeng, M. Di Natale, A. Ghoal, and A. Sangiovanni-Vincentelli, Schedule Optimization of Time-Triggered Sytem Communicating Over the FlexRay Static Segment, IEEE Tranaction on Indutrial Informatic, vol. 7, no. 1, pp. 1 17,2011. [9] S. Fichmeiter, R. Traumuth, and I. Lee, Hardware Acceleration for Conditional State-Baed Communication Scheduling on Real-Time Ethernet, IEEE Tranaction on Indutrial Informatic,, vol. 5, no. 3, pp , [10] P. Pop, P. Ele, and Z. Peng, Performance Etimation for Embedded Sytem with Data and Control Dependencie, in Proceeding of the Eighth International Workhop on Hardware/Software Codeign,, 2000, pp [11] S. Fichmeiter, O. Sokolky, and I. Lee, A Verifiable Language for Programming Real-Time Communication Schedule, IEEE Tranaction on Computer,, vol. 56, no. 11, pp , [12] R. Alur and G. Wei, Regular Specification of Reource Requirement for Embedded Control Software, in IEEE Real-Time and Embedded Technology and Application Sympoium, 2008, pp [13] W. Zhang, Stability Analyi of Networked Control Sytem, Ph.D. diertation, Electrical Engineering and Computer Science, Cae Wetern Reerve Univerity. May [14] W. Zhang, M. Branicky, and S. Phillip, Stability of Networked Control Sytem, IEEE Control Sytem Magazine, vol. 21, no. 1, pp , [15] D. Henrikon, A. Cervin, and K. Årzén, TrueTime: Simulation of Control Loop under Shared Computer Reource, in Proceeding of the 15th IFAC World Congre on Automatic Control. Barcelona, Spain, [16] X. Ren, S. Li, Z. Wang, M. Yuan, and Y. Sun, A QoS Management Scheme for Paralleled Networked Control Sytem with CAN Bu, in Proceeding of the 29th Annual Conference of the IEEE Indutrial Electronic Society (IECON), vol. 1, pp , [17] S. Hong, Scheduling Algorithm of Data Sampling Time in the Integrated Communication and Control Sytem, IEEE Tranaction on Control Sytem Technology, vol. 3, no. 2, pp , [18] S. Hong and W. Kim, Bandwidth Allocation Scheme in CAN Protocol, IEEE Proceeding Control Theory and Application, vol. 147, no. 1, pp , [19] H. Rehbinder and M. Sanfridon, Integration of Off-Line Scheduling and Optimal Control, in Proceeding of the 12th Euromicro Conference on Real-Time Sytem, vol. 1, pp , [20] U. Kekin, Time-Triggered Controller Area Network (TTCAN) Communication Scheduling: A Sytematic Approach, Ph.D. diertation, Middle Eat Technical Univerity, 2008.