Exact Response Time of FlexRay Communication Protocol

Transcription

1 Exact Response Time of FlexRay Communication Protocol Lucien Ouedraogo and Ratnesh Kumar Dept. of Elect. & Comp. Eng., Iowa State University, Ames, IA, 501, USA s: (olucien, Abstract A method for determining worst-case response-time properties of the FlexRay protocol frames is proposed by Pop et al. in 2008, where the determination of the worst-case response time of frames transmitted in the dynamic segment is formulated as iterative sequences of an Integer Linear Programming (ILP) problems. In this paper, we show that the analysis method of Pop et al. provides pessimistic results of the worst-case response time of frames transmitted in the dynamic segment. Then, we propose a new ILP formulation that computes the exact value of the worst-case response time of FlexRay frames transmitted in the dynamic segment. Further our approach is non-iterative requiring a solving of a single ILP for computing respectively the number of cycles a frame is delayed access to the bus and the delay spent in the unfilled cycle before the transmission of the frame starts. Index Terms FlexRay, In-vehicle networks, Timing analysis. I. INTRODUCTION Next generation vehicles will comprise a large number of Electronic Control Units (ECUs) whose integration must satisfy safety- and time-critical requirements for implementation of x-by-wire functionalities. Traditional protocols such as Controller Area Network (CAN), which is actually the most popular network protocol used in the automotive industry for in-vehicle communication, do not provide enough bandwidth and determinism to support x-by-wire functionalities. The FlexRay protocol [1], developed by a large consortium of car manufacturers, is a new communication protocol intended to be used for high speed, deterministic and fault-tolerant invehicle communication. Compared to pure TDMA-based protocols that are suitable for transmission of time-triggered (TT) messages or CSMAbased protocols such as CAN that are suitable for transmission of event-triggered (ET) messages, FlexRay combines the advantages of these two mechanisms by allowing transmission of TT messages and ET messages in dedicated segments that improve the bus utilization. In FlexRay, the communication is divided into periodic cycles where every cycle comprises a static () segment and a dynamic (DYN) segment. In the segment, a Time Division Multiple Access (TDMA) scheme is used and thus this segment is suited for transmission of highly deterministic and/or periodic messages. On the other hand, in the DYN segment, a Flexible TDMA (FTDMA) mechanism is used and thus, this segment is suited for transmission of The research was supported in part by the National Science Foundation under the grants NSF-ECS-06570, NSF-ECCS-08763, NSF-CCF , and NSF-ECCS and by the Fond québecois de la recherche sur la nature et les technologies /11/$26.00 c 21 IEEE ET messages by priority assignment. In order to be used for applications with hard real-time requirements, where failure to meet a deadline can be catastrophic, techniques for determining the timing properties of messages transmitted on a FlexRay communication channel are needed. The end-to-end delay of a message is the duration of the time interval between the instant of the transmission request issued by the application on the sending node and the instant of delivery of the message to the application on the receiving node. The end-to-end delay involves response time of application processes due to tasks scheduling in sending and receiving nodes and the delay for accessing the medium and transmitting the message. This later delay is referred to as the response time of the message. This paper provides an analytical analysis of FlexRay messages response time. Its main contribution is an analytical description and efficient computation of the exact worst-case response time of messages transmitted in the dynamic segment of a FlexRay network. The authors of [2] propose an analytical framework based on real-time calculus for performances analysis of FlexRay. They propose model of the arrival and service curve of tasks from which performance criteria such as worst-case response time and end-to-end delay can be computed. Probabilistic approaches have also been proposed for timing analysis of FlexRay (see [3] for example), but these methods allows for the determination of the average values instead of the exact values of the response time of DYN messages, and thus cannot be used for time critical systems analysis and design. The authors of [4] present a timing analysis for FlexRay communication networks: For the DYN segment, they propose a method for computing the worst-case response time. The computation is shown to be similar to a bin covering problem and thus computationally hard, and an optimal solution can be computed using an ILP formulation (NP-hard problem). The ILP formulation proposed in [4] is also pessimistic and the worst-case response time may be less than the value computed. This is a result of the fact that the ILP is executed iteratively in order to account for all possible occurrences of higher priority DYN messages in a given interval of time, but there is no condition that enforces the satisfaction of minimum inter-arrival time of multiple instances of messages. In this paper, we propose a new ILP formulation that takes into account minimum inter-arrival time of messages and allows to compute the exact value of the worst-case response time of DYN messages. Moreover our ILP formulation is

2 non-iterative and it allows to compute the number of filled cycles in the worst-case response time in only one execution, contrary to the formulation of [4] in which the ILP program is solved iteratively until all the possible instances of higher priority DYN messages are taken into account. Thus we are able to provide a more efficient solution (that requires a single execution of ILP as opposed to multiple executions) that is exact (as opposed to pessimistic). The paper is organized as follows. In Section II, we describe the FlexRay Protocol. In Section III, we present in detail the analysis of FlexRay messages response time, and Section IV contains our concluding remarks. II. THE FLEXRAY PROTOCOL A. Overview of the FlexRay Protocol A FlexRay communication system consists of nodes communicating through one or two channels. A node consists of a host computer (CPU) running software processes (collection and processing of data) and a communication controller (CC) which implement the FlexRay protocol services. The CPU and the CC communicate through a controller-host interface. The communication in a FlexRay system takes place in periodic cycles, where a cycle is itself divided into four possible parts: a mandatory static () segment, an optional dynamic (DYN) segment, an optional symbol window (SW) and a mandatory network idle time (NIT). The segment uses a static Time Division Multiple Access (TDMA) scheme for the media access control. Therefore, the segment is divided into equal length slots. On the other hand, the DYN segment uses flexible TDMA, a dynamic mini-slotting based scheme: The DYN segment is divided into equal length minislots of smaller durations compared to the slots of the segment. The SW and the NIT are used respectively for transmission of predetermined symbol(s) and for clock synchronization. Arbitrations within the static segment and the dynamic segment are based on the unique assignment of frame identifiers to the nodes and a counting scheme for the slots. Each node is allowed to transmit frames in its assigned slots. The frame identifier determines the transmission slot i.e. in which segment and when within the respective segment the frame shall be sent. The counting scheme assigns a number to every slot (starting from 1 for the first slot in each segment), and each node has knowledge of its turn by comparing the slot counter to its frame identifiers. During a cycle, the duration of a DYN slot depends on whether or not communication takes place: The DYN slot consists of only one minislot if no communication takes place, and otherwise the DYN slot consists of the number of minislots necessary for transmitting the frame. Moreover, a DYN frame is transmitted in a cycle if there is enough space until the end of the cycle for transmitting the frame. To ensures this arbitration, the nodes are synchronized to the same clock so that each node knows and waits for its turn to transmit on the bus. Fig. 1(a) presents a FlexRay communication system consisting of three nodes connected to a dual-channel bus network (channel A and channel B). Other topologies such as single channel bus, single- or dual-channel star network and hybrid combination of bus-star are supported by the FlexRay protocol. For the Example of Fig. 1(a), nodes N 1 and N 3 use both channels A and B for communication while node N 2 uses only channel A. Fig. 1(b) presents a FlexRay bus cycle where the segment is divided into four slots and the DYN segment has eight minislots. Fig. 1(b) presents two bus cycles in which and DYN messages are transmitted. frames (or messages) m1 and m2 are transmitted in the first cycle in slots 1 and 3, while messages m1 (second instance of the same frame transmitted in the first cycle), m2 and m4 are transmitted in the second cycle in slots 1, 2 and 3 respectively. On the other hand, two DYN messages m a and m b are transmitted in the first cycle in DYN slots 1 and 4 respectively, while two other DYN messages m c and m d are transmitted in the second cycle in DYN slots 2 and 4 respectively. We can observe that the length of slots is fixed and the transmitted frame can occupy all or a part of the slot, contrary to DYN slots that expand to the number of minislots needed to transmit the frames. B. FlexRay protocol messages parameters At the design phase, the designer of a FlexRay communication system has to decide the parameters of a bus cycle which are the length of a cycle (which we refer as ), the length of the segment (which we refer as T ) obtained by deciding the length of a slot and the number of slots, the length of the DYN segment (which we refer as ) obtained by deciding the length of a minislot (which we refer as T ) and the number of minislots (which we refer as N ), and the lengths of SW and NIT. At the processes level, the designer also has to decide the assignment of frames identifier to nodes and messages, and the priority of DYN messages with same frame identifier. Another parameter to be decided by the designer is platesttx Ni that indicates the last minislot in which noden i can start transmission of a frame.platesttx Ni is determined from the largest DYN frame sent by node N i the value platesttx Ni, if m is transmitted by node N i. The transmission time C m of a FlexRay frame m can be computed knowing the total frame size and the transmission time of one bit [5]. In the sequel, we denote by ID m the frame identifier of a DYN message m (it specifies the minislot to which m is assigned to, i.e. in which the transmission of m can start). A DYN message m has a higher priority than a DYN message m if either m has a lower frame identifier than m, i.e. ID m < ID m, or ID m = ID m and m is assigned a higher priority than m. We denote by lf(m) the set of messages having lower frame identifier than m (and hence higher priority than m), by hp(m) the set of messages having the same frame identifier than m but of higher priority and by Dom(m) = lf(m) hp(m) the priority ordered list of all the messages that dominate m in priority. The structure of FlexRay protocol puts constraints on a set of messages that can be transmitted in a single cycle as captured by the following definition. at run-time. We denote by T last m

3 Nodes N 1 CPU CHI CC N 2 CPU CHI CC N 3 CPU CHI CC T FlexRay bus (a) A FlexRay system Channel A Channel B Static segment Dynamic segment (b) FlexRay communication cycle 7 8 SW NIT T m1 ma m b NIT SW Minislot counter T m1 m2 m4 m c m d (c) FlexRay messages allocation SW NIT Figure 1. FlexRay system and Messages allocation Definition 1 (Transmissible set of messages): A set M of DYN messages is said to be transmissible in one cycle if no two messages in M have the same frame identifier and all the messages in M fit together in one DYN segment, i.e. the transmission of every message m M starts in its assigned minislot before Tm last is passed. For a message m, let φ m denote the number of extra minislots (in addition to its assigned minislot) required for the communication of m, i.e. φ m = C m 1, where C m denotes the communication time of m in the units of T (C m = C m /T ). When a DYN messagem is transmitted, the position in the segment of the dynamic minislot counter of messages with identifiers greater than ID m is shifted by the value φ m. Therefore, after the transmission of a set M of higher priority messages in a cycle, the transmission of a message m in the same segment can start in minislot ID m + m M φ m. However, this value must be smaller than Tm last, otherwise m cannot fit in the same cycle as messages in M. In other words, M Dom(m) and m are transmissible in one cycle iff M is transmissible in one cycle and: m M : [ID m ID m ] [ID m + m M φ m T last m ] (1) When M is transmitted in a cycle j, and M {m} is not transmissible in that cycle, we say that j is filled by M for m. III. RESPONSE TIME ANALYSIS OF FLEXRAY MESSAGES A. Response time decomposition of FlexRay messages The end-to-end delay D m of a message m is given by: D m = J m +R m +P m = J m +(Q m +C m )+P m, (2) where: J m is the jitter of the sender-process, and corresponds to the worst-case response time of the sender-process. R m is the worst-case response time ofm and corresponds to the delay from the moment m is queued ready for transmission in the CC of the sender node to the moment m arrives at the CC of the receiving node. R m can be decomposed in two parts as follows: R m = Q m + C m where: (i) Q m is the queuing delay of m and corresponds to the maximum delay message m spends in the CC of the sender node contending to access the bus, and (ii) C m is the transmission time of m. P m is the worst-case response time of the receiver process. J m andp m depend entirely on the scheduling of the tasks in the application layers of the sender and receiver, and methods for determining their values are known (see for example [6] for EDF-based scheduling). Our analysis concerns only the delays related to the FlexRay protocol, and so we only focus on the analysis ofr m. For the segment, analysis techniques for TDMA access scheme are known and can be used [7]. For the DYN messages, we proceed along the approach considered in [4]. The worst case response time of a DYN message m can be decomposed as follows (see Fig. 2): R m = Q m +C m = (B m +W m )+C m, (3) where: (i) B m is the blocking time and corresponds to the longest delay suffered during one bus cycle if the message is generated by its sender after its slot has passed; and (ii) W m is the interference delay and correspond to the worst-case delay caused by the segment and transmission of higher priority DYN messages. The worst case blocking time B m is experienced when no message in lf(m) is transmitted in the current bus cycle and message m arrives just after the beginning of its minislot. Then B m is given by the following equation [4]: B m = (T +(ID m 1) T ). (4) The transmission of m in a cycle may not be possible due to two factors: (i) transmission of a message in hp(m), and (ii) transmission of messages in lf(m) that fills the bus for m. Therefore, W m can be decomposed in two parts as follows: W m = Cy m +W m, (5)

4 R m W m T B m Cy m X W m C m Dyn slot counter Minislot counter m1 m2 m1 m time Figure 2. Response time of a DYN message where: (i) Cy m is the number of bus cycles for which the transmission of m is not possible because of transmission of higher priority messages; and (ii) W m is the time that passes before the transmission of m begins in the bus cycle where m can be transmitted. We can observe that the arrival pattern of messages in Dom(m) that will cause the worst-case interference delay W m is the one that fills each bus cycle k for m with a set of transmissible messages M k Dom(m) such that the number of filled cycles is maximized. If M denotes the set {M Dom(m) M is transmissible in one cycle and m M φ m + ID m > Tm last }, finding W m is tantamount to finding a maximum set of contiguous elements of M that are together feasible (e.g., meet the set of constraints of Subsection III-C). B. Pessimistic analysis of [4] [4] estimates the worst-case response time by iteratively solving a series of ILPs. In the first instance of the ILP, only a single instance of each message is considered for estimating the worst-case response time. If a second instance of some messages can arrive within this period, then a second instance of ILP is solved by including the additional instances of such messages. The process is repeated until it converges (no additional arrivals of any of the messages is possible in the already estimated response time). It turns out that this iterative process is conservative (i.e., overestimates the worst case response time) since it ignores the constraints on interarrival times. Consider for example the setting of Fig. 3, where the DYN messages m1, m2, and m are assigned identifier as illustrated in Fig. 3a. We suppose that the length of a cycle is equal to 20 T and that T = 1.9 = 38 T. m and cannot fit in the same cycle (ID m +φ = 11 > = 9), and m together with any combination (of 2 or more messages) of m1, m2 and cannot fit in the same cycle (ID m + Φ {m1,m2} = 11 > Tm last ). {m1,m2,} is transmissible in one cycle and thus, if an instance of these messages is transmitted in cycle k, its arrival time is no later than the beginning of its slot in cycle k 1. If we compute R m for m of Fig. 3 using the method of [4] (we consider without loss of generality that J m = 0 in the sequel), we obtain as final result R m = 7 + C m after five iterations where two instances of m1 and m2 and four instances of are transmitted (and fill six cycles) before m gets transmitted (in the 7th cycle). Figs. 3b-3e illustrate examples of messages transmission patterns for respectively T last m the 1st, 2nd, 3rd and 4th iterations. However, the message transmission pattern illustrated by Fig. 3d is not possible in practice due to the minimum interarrival time of messages. Indeed, a new instance of cannot be ready in the fourth cycle before its minislot because: (i) the arrival time of the instance of transmitted in the third cycle is after the minislot of in the second cycle where is transmissible (otherwise will be transmitted in the second cycle), and (ii) the arrival time of the second instance of satisfying its minimum inter-arrival time is at the beginning of the fifth minislot in the fourth cycle, i.e. after the minislot of. The only possible arrival pattern that satisfy the minimum inter-arrival time of messages is that the 2 instances of are transmitted in the first two cycles and the third instance of is transmitted in the fourth cycle (m1 and m2 transmitted in the third cycle). In the same way, the message transmission pattern illustrated by Fig. 3e, as well as any other ordering of the 5 filled cycles that satisfy the minimum inter-arrival time of m1, m2 and is not possible. For the illustrated pattern for example, an instance of m1 cannot be ready in the fourth cycle if one has already been transmitted in the second cycle (at least 2 cycles must separate the cycles in which the 2 instances of m1 are transmitted). The same observation can be made for the final solution with 6 filled cycles. Following the above analysis, the method of [4] yields a pessimistic solution (R m = 7 + C m ) that is not possible in practice. This solution also means that m is not schedulable if we consider for example that the deadline of m is equal to T m as the result satisfies R m > T m. For this example, R m in practice is equal to 5 +C m (stop after the third iteration as the result of the fourth iteration is not possible in practice) and then m becomes schedulable because R m < T m. We will propose an ILP formulation that takes into account the requirements on minimum inter-arrival time and that allows to obtain the optimal (exact) solution for W m. Another significantly important advantage of our formulation to notice is that only two executions of two ILPs programs that computes respectively Cy m and W m are performed, contrary to the formulation in [4] in which two ILPs programs are executed iteratively multiple times. This means our approach is not only optimal but also computationally much more efficient. C. Optimal solution for W m Given the set of messages Dom(m) = {m 1,...,m i,...,m p 1 } ordered in decreasing priority and m p = m, the objective of our ILP program is to compute

5 a) m1 m2 m C m1 = 3 C m2 = 3 Plt =9 m1 Plt m2=9 Plt =7 Plt m =9 C = 5 T = 1.9 C m = 3 T m1 = 4Tbus T m2 = 4Tbus T m = 5.5 b) m1 m2 m c) m m1 m2 T d) m1 m2 m m1 T m1 m1 e) m1 m2 m1 m2 m Figure 3. Results and Flaws of previous analysis Cy m (= W m / ), i.e., maximize the number of filled cycles for m. First, we determine an upper bound R m for the response time R m beyond which the message m is deemed unschedulable: R m is taken to be the deadline of m. Then an upper bound U for Cy m is given by Rm Bm, and so the ILP maximization need not explore for a solution beyond this upper bound (as captured in 16). In the sequel, for simplicity we use index i to signify message m i, for example ID i represents ID mi. Let the binary constant f ik = 1 iff ID i = ID k, for i,k = 1,...,p. The binary decision variable x j i takes the value 1 iff message i is transmitted in cycle j, and the binary decision variable u j i is set to 1 iff message i is not transmissible in cycle j. The following equation captures the non-transmissibility condition and defines u j i : [u j i = 1] [ x j k φ k+id i > Ti last ] [ x j k f ik > 0], i,j. (6) The first conjunct states that the messages with lower identifier than m i fill the bus beyond the last time m i can be sent, whereas the second conjunct states that a message with same identifier ID i but of higher priority than message m i is sent in the same cycle. (6) can be expressed by linear equations as follows. The following equation captures the forward implication of (6): [ x j k φ k +ID i ] > [(u j i x j k f ik)t last i ], i,j, (7) and the following two equations capture the backward implication of (6): [ x j k φ k+id i ] [(1 u j i )Tlast i +u j i N ], i,j, (8) x j k f ik u j i 0, i,j. (9) Since in any cycle, only transmittable messages can be transmitted (property of the protocol), we have the constraint: x j i 1 uj i, i,j. (10) Next to capture the constraint of minimum inter-arrival times of messages, consider a cycle j, and suppose that a message i is transmissible in this cycle (u j i = 0), and in next k cycles q 2 instances of message i are transmitted (0 = x j i = ( k l>0 xj+l i q) = (x j+k i 1)). See for illustration Fig. 4 where is transmissible in cycle 2, and two copies of message are transmitted in next two cycles 3 and 4. Then the first copy of message i must have arrived after the minislot of cycle j in which it could be transmitted (recall message i is transmissible in cycle j but didn t get transmitted in that cycle: u j i = x j i = 0), and the last copy of message i must have arrived before the minislot of cycle j + k in which it got transmitted (recall there are a total of q transmissions in a total of k cycles beyond the cycle j). Thus if we let j,k i denote the time-interval between the two minislots of cycles j and j+k in which message i could be/got transmitted (see Fig. 4), then this interval must be long enough to accommodate the arrival of q copies of message i, i.e., j,k i > (q 1)T i, wheret i is the minimum inter-arrival time of message i. Thus the following constraint must hold: where j,k i [u j i = 0] [xj i = 0] [xj+k i = 1] k 1)T i ], i,j,k. [ j,k i > ( l>0 x j+l i [x j+k (11) := k +[ n x j n]φ n ] T. (12) n<i (11) can be written in a linear form as follows: k [ j,k i ( x j+l i 1)T i ] > [u j i +xj i +(1 xj+k i )] l>0 [k (13) n (k 1)T i ]/3. n<iφ

6 T 0,3 3 T 2,2 3 m1 m2 Cycle Figure 4. Satisfaction of minimum inter-arrival time of messages, using configuration of Fig. 3 (13) captures the implication when u j i = xj i = 1 xj+k i = 0 and trivially holds otherwise. Also, the minimum inter-arrival time constraint should also hold for any sequence of arrivals (and not just for the ones that happen to occur after a cycle-j where u j i = xj i = 0). To accommodate this, we introduce an empty cycle 0 and allow j to take the value 0, and set: x 0 i = u0 i = 0, i. (14) For maximizing the filled cycles for message m p, its filled cycles must be contiguous: [u j p uj+1 p ], j. (15) Finally the objective function of the ILP for computing the optimal value of Cy m is: Maximize u j p, (16) j=1,...,u where U is the upper bound of Cy m. The objective function given by (16) and the set of constraints given by (6)-(15) form an instance of an ILP program. The result of the maximization gives the maximum number of cycles Cy m that can be filled by messages in Dom(m). To obtain W m, we can modify the objective function of the above ILP program to: Maximize p 1 x Cy m +1 i φ i, (17) i=1 to maximize the total extra communication time of higher priority messages sent in cycle Cy m +1 in which the message m can also be sent, and add an additional constraints that forces the first Cy m cycles to be filled for m: u j p = 1, 0 < j Cy m. (18) Let us illustrate our ILP solution with the simple example of Fig. 3. For this example, we have R m = T m = 5.5 and then the upper bound of Cy m is equal to 6. The solution of our ILP for computing Cy m that satisfies all the constraints is such that x 1 3 = x 2 3 = x 4 3 = 1 and x 3 1 = x3 2 = 1 which implies uj 4 = 1, j = 1,...,4 (we suppose m = m4) and Cy m = 4. This assignment of variables satisfies constraints (6)-(15), in particular constraint (11) as 0,2 3 = 2 > T 3 = 1.9. Contrary to [4], our ILP solution will not accept assignment of variables leading to the message transmission pattern illustrated by Fig. 3d because it does not satisfy constraint (11) as 2,2 3 = 1.8 < T 3 = 1.9. In the same way and contrary to the solution of [4], our ILP solution will not accept the message transmission pattern of Fig. 3e, which gives Cy m = 5, because it does not satisfy constraint (11), for example 1,4 1 = 3 < T 1 = 4. Obviously, the final solution Cy m = 6 using the method of [4] for this example is not accepted by our ILP for the same reasons. Thus for the Example of Fig. 3, the worst-case response time contains two less filled cycles compared to the solution proposed in [4]. IV. CONCLUSION In this paper, we proposed an analytical method for determining the worst-case response time of FlexRay dynamic messages. We showed that the previous analysis method proposed in [4] is pessimistic because the proposed iterative Integer Linear Programming (ILP) formulation of the problem doesn t consider minimum inter-arrival time of messages separating instances of messages. This previous method could then lead to making conservative decisions about schedulability of dynamic messages, because schedulable messages could be viewed as unschedulable. This paper provides a method for computing the exact worst-case response time of FlexRay dynamic messages. We proposed a new ILP formulation of the problem that ensures that arrival times of messages respect their minimum inter-arrival times. Moreover, in contrast to [4], our method is computationally efficient in the sense that it doesn t necessitate iterative solutions of ILP programs. REFERENCES [1] FlexRay Communications System Protocol Specification Version 2.1, FlexRay Consortium, Dec. 2005, [2] D. B. Chokshi and P. Bhaduri, Performance analysis of flexray-based systems using real-time calculus, revisited, in Proceedings of the 20 ACM Symposium on Applied Computing. New York, NY, USA: ACM, 20, pp [3] B. Kim and K. Park, Probabilistic delay model of dynamic message frame in flexray protocol, IEEE Transactions on Consumer Electronics, vol. 55, no. 1, pp , Feb [4] T. Pop, P. Pop, P. Eles, Z. Peng, and A. Andrei, Timing analysis of the flexray communication protocol, Real-Time Syst., vol. 39, no. 1-3, pp , [5] J. Ben, B. Yongming, and L. Anhu, A method for response time computation in flexray communication system, in Proc. IEEE International Conference on Intelligent Computing and Intelligent Systems ICIS 2009, vol. 3, Nov , 2009, pp [6] J. C. Palencia and M. G. Harbour, Response time analysis of EDF distributed real-time systems, J. Embedded Comput., vol. 1, pp , April [7] P. Pop, P. Eles, and Z. Peng, Schedulability-driven communication synthesis for time triggered embedded systems, Real-Time Syst., vol. 26, no. 3, pp , 2004.