Real-time scheduling algorithm schedulability modeling and verification method, system and application based on event-b formalization

Abstract

The application discloses a kind of based on Event-B formalization real-time scheduling algorithm schedulability modeling and verification method, comprising: step 1: the operating system environment model of running scheduling algorithm is established, and simulates task state switching and scheduling selection action;Step 2: the schedulability requirement of real-time scheduling algorithm is modeled in Event-B model;Step 3: by instantiating the task set in model, the schedulability is verified;Step 4: detect whether the model will reach deadlock state, determine whether the model meets the schedulability requirement;Step 5: set mechanism reduces the state space of model to finite, detect model deadlock, according to the detection result reflects whether the model has schedulability.The application realizes the schedulability modeling and verification method of real-time scheduling algorithm based on Event-B formalization, formalizes modeling to schedulability and uses model detection to verify the schedulability of the model built.The application also discloses a system for implementing the above modeling and verification method and application.

Description

Technical Field

[0001] This invention belongs to the field of scheduling algorithm verification technology, and relates to a method, system and application for modeling the schedulability of real-time scheduling algorithms using the Event-B method and verifying the schedulability properties by combining model detection. Background Technology

[0002] A real-time operating system (RTOS) is a special type of operating system designed to run real-time applications with strict time constraints. Failure to meet these constraints often leads to system errors and malfunctions. ROS are frequently used in time-critical fields such as aviation, medical devices, and transportation.

[0003] Real-time scheduling algorithms require the schedulability of periodic tasks and the improvement of response time for non-periodic tasks. The schedulability of real-time scheduling is the foundation of real-time systems. The schedulability of the system can be reflected by the reachability of the special unschedulable states of the model built by testing the specific system environment and scheduling algorithm. Existing methods are often targeted at specific scheduling modules and algorithms, which are difficult to model and lack a progressive modeling process from simple to specific.

[0004] Event-B, as a formal method for modeling and verification, possesses rigorous and precise mathematical logic and semantics. The Rodin platform, serving as the modeling environment for Event-B, integrates various model checking and automated verification tools. It allows observation of model behavior trajectories from multiple schedules. Based on Event-B's refinement principles, it models real-time scheduling algorithms and, through route refinement, gradually adds model details and covers verification requirements on top of the abstract model. While Event-B lacks explicit support for modeling time attributes, it can simulate clocks using the classic trigger-response pattern and formally define time-related constraints and properties. Furthermore, the Rodin platform's built-in model detector can be used to verify schedulable properties through model checking methods. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the purpose of this invention is to provide a method, system, and application for modeling and verifying the schedulability of real-time scheduling algorithms based on the Event-B formal approach.

[0006] The schedulability of a scheduling algorithm refers to the property that a set of tasks can be effectively scheduled by a given scheduling algorithm under given system resource constraints. Scheduling capability is commonly used in real-time systems and parallel computing.

[0007] The primary goal of schedulability is to ensure that every task in a set of tasks can be scheduled and executed in the system according to its deadline requirements. If a set of tasks is schedulable, then a scheduling scheme can be found that ensures all tasks meet their deadlines and that system resources are fully utilized.

[0008] Scheduling availability assessment depends on task execution time, deadlines, and system resource constraints. Common schedulability analysis methods include analysis of periodic task models and preemptive scheduling algorithms. These methods determine whether a set of tasks satisfies the constraints of the scheduling algorithm, thus determining schedulability.

[0009] For real-time systems, schedulability is crucial because it involves timely task response and meeting real-time requirements. If a set of tasks is not schedulable, it may cause tasks to miss deadlines, leading to unpredictable system behavior and performance degradation.

[0010] In summary, the schedulability of a scheduling algorithm refers to whether a set of tasks can meet the deadline requirements under given system resource constraints and be executed through an effective scheduling method.

[0011] The innovation of this invention lies in the formal modeling of real-time scheduling algorithms using the Event-B formal language. The models constructed in steps 1 and 2 can meet the environmental and functional requirements of real-time scheduling algorithms. Furthermore, the invention verifies the schedulability properties that real-time scheduling algorithms are concerned with within a unified formal model. In subsequent steps 3, 4, and 5, this invention provides a verification method that transforms the complex schedulability problem into a model deadlock problem and detects the deadlock of the model using existing automated model detection tools.

[0012] This invention utilizes the Event-B modeling platform Rodin to perform multi-layered refined modeling of real-time scheduling algorithms. It summarizes and extracts the requirements that real-time scheduling algorithms must satisfy, classifies these requirements according to environmental and functional requirements, and refines them layer by layer based on the implementation relevance and complexity of the classified requirements. It establishes invariants to represent the schedulability properties satisfied by real-time scheduling algorithms, strictly constrains the periodic time that is of most concern to real-time scheduling algorithms, transforms the verification of schedulability properties into the verification of deadlock in the model, and uses model checking methods to detect deadlock in the formal model. Based on the deadlock detection results, it verifies the schedulability of the system.

[0013] In this invention, the verification of schedulability properties is transformed into the verification of deadlock in the model, which means determining the schedulability of the system by verifying whether the model will enter a deadlock state.

[0014] In this invention, the schedulability requirements of real-time scheduling algorithms are represented by establishing an Event-B model, and invariants are defined to describe this property. However, simply defining invariants cannot fully guarantee the schedulability of the model, because under certain parameter sets, the model may experience deadlock, meaning the system cannot continue execution according to the scheduling process, resulting in the task failing to complete.

[0015] Therefore, to further verify the schedulability of the model, this invention introduces the ProB model checker to detect whether the model will enter a deadlock state. By finiteening the model's state space—that is, restricting the range of values ​​for the model's variables and events—model checking techniques are then used to analyze the model's behavior. If the model cannot proceed under any event execution trajectory, i.e., a deadlock state occurs, then it can be concluded that the model does not meet the schedulability requirements.

[0016] Therefore, transforming the verification of schedulability properties into the verification of model deadlock is a transformative approach. By detecting whether the model will enter a deadlock state, we can indirectly determine whether the system satisfies schedulability. This transformation can simplify the schedulability verification process and leverage model checking techniques to provide more comprehensive analysis and evaluation, ensuring that the system can meet scheduling requirements under a given task set.

[0017] Specifically, the method for modeling and verifying the schedulability of real-time scheduling algorithms based on the Event-B formal method proposed in this invention includes the following steps:

[0018] Step 1: Use Event-B to model the operating system environment model that runs the scheduling algorithm. Use constants and axioms to construct the static settings and requirements that the environment must meet, and use events to simulate the switching between operating system task states and the scheduling selection actions.

[0019] Step 2: In the Event-B model, model the schedulability requirements of the real-time scheduling algorithm. This means that for any periodic task in a given system, its strict time constraint property must be ensured, guaranteeing that its completion time is earlier than its specified deadline within each period after creation. Schedulability is formally defined using invariants in the Event-B language. The proof obligation arising from proving the invariants of the schedulability property ensures that any change to system variables by any event will not cause the model to violate schedulability.

[0020] Step 3: Scheduling requires that, given a task set, periodic tasks within that set can complete their execution within each cycle before their defined deadlines. Therefore, to verify schedulability, the task set in the model needs to be instantiated within the model's Context. The model's Context, as part of the model, describes the system's background and environment; it contains definitions of constants, types, functions, and axioms used in the system, providing the necessary background information and infrastructure for the model. The model can reference constants, types, functions, and axioms declared in the Context for specific modeling and reduction within the model. By describing the system's background and environment as Context, the model becomes clearer, more readable, and maintainable, while providing a foundation for consistency and correctness.

[0021] Step 4: In Step 2, the Event-B abstract model in the refined route formally represents the schedulability of the scheduling algorithm using invariants, and ensures that periodic tasks maintain their schedulability through abstract conditions in the triggering conditions of clock-progression events. The clock-progression event refers to the event that simulates the advancement and updating of system time in a real-time system. The clock-progression event determines the time point and order of task execution to meet the time constraints and scheduling requirements of the tasks. By simulating clock-progression events, the real-time scheduling algorithm can be modeled and verified, and the schedulability and performance of the system can be evaluated. However, for a given set of tasks, maintaining the schedulability invariant in clock-driven events may lead to a deadlock state, meaning that clock-driven events cannot be executed according to the scheduling process, and other events are also in an unexecutable state. This situation indicates that although the abstract model maintains the schedulability property, the model under this specific parameter set still does not satisfy the schedulability property due to deadlock. Therefore, the ProB model checker built into the Rodin platform can be used to detect whether the model will reach a deadlock state. The ProB model checker searches the model space and detects whether the model will advance to a deadlock state during the random execution of events. The occurrence of a deadlock state can be used to reflect whether the model will lose schedulability under a certain event execution trajectory. To ensure that the deadlock in the model is caused by the schedulable variables and event triggering conditions introduced during the refinement process in step 2, it is necessary to prove that the previously abstracted model is deadlock-free. This can be achieved by generating theorems using Rodin's internal deadlock-free theorem generator. The deadlock-free property of the model can be verified by proving the theorem on the deadlock-free property of the formally represented Event-B model. This theorem formally defines the deadlock-free property of the model through invariants. By proving the correctness of this theorem, it can be shown that the model satisfies the deadlock-free property.

[0022] Step 5: The principle of deadlock detection by the ProB model checker is to traverse all finite possible state spaces of the Event-B model and detect executable Event-B events in each state space based on the variable values ​​of the current state space and the guard conditions of the model events. If all finite state spaces have executable events, then the model can be considered deadlock-free in the finite state space. The deadlock detection principle of ProB model detection requires that the model's state space be finite. In step 2, a time variable is introduced into the Machine, and its value increases within the real number range. Therefore, the model's state space is infinite. To apply ProB model detection, a mechanism needs to be added to the model's Machine. Specifically, an event to reset system variables needs to be added. The guard condition for this event is that the time variable reaches a given upper limit value. The event's action is to reset the values ​​of all system variables. This ensures that the range of change of system variables is finite, and that the model's state space is finite. Deadlock is detected within this finite state space, and the detection results reflect whether the model is schedulable: if no deadlock state is found during the detection process, the model is schedulable; if a deadlock state is found, the model is not schedulable.

[0023] In Event-B, a machine is a component used to describe the behavior and state of a system, including definitions of system state variables, events, and invariants, as well as constraints and rules associated with these definitions. Step 1 further includes the following steps:

[0024] Step 11: Declare a custom task type set and a custom task status type set in the Event-B Context, and classify the task types in the task set according to whether they are periodic tasks based on the requirements of the real-time scheduling algorithm.

[0025] Step 12: In the Event-B Machine, declare the ready, blocked, and running sets of system tasks using variables, and add auxiliary variables to control the scheduling process. Model the state transitions of tasks corresponding to events and the actions selected for scheduling, and refine and distinguish the same action for different types of tasks according to the task type.

[0026] Step 2 further includes the following steps:

[0027] Step 21: In the Event-B Context, declare a constant representing the execution time of the task;

[0028] Step 22: In the Event-B Machine, define the schedulability of the real-time scheduling algorithm, add variables to represent the creation timestamp and end timestamp of the periodic task, establish invariants for the schedulability property, and formalize the schedulability property that the periodic task must ensure that its completion time is earlier than its specified deadline in each period using invariants.

[0029] Step 3 includes instantiating the multi-layer formal model obtained in step 2 into a specific task set, assigning the constants declared in the Context of each layer, including the number of tasks in the system and the execution time and priority of each task, to the specific task set, limiting the space and size of the constants, so that the constants become a fixed value with a known value or corresponding relationship.

[0030] Step 4 includes defining the deadlock-free property of the model in Step 1 using the invariant introduced in Step 2. The formula is the disjunction of all guard conditions for each event in the model, that is, all events in the system satisfy a certain condition. The correctness of the theorem is proved by theorem proof, ensuring that the model satisfies the deadlock-free property before the introduction of the schedulability property.

[0031] In Event-B, a guard condition is a precondition for an event. It's a logical expression describing the preconditions or constraints that prevent the event from occurring. An event can only be activated and executed if the guard condition is met. By taking the disjunction of the guard condition for each event, the overall guard condition for all events in the system can be constructed.

[0032] Step 5 includes setting a system variable reset mechanism and adding a reset event. Its function is to reinitialize the model's time variable when the model's clock variable reaches a certain threshold, ensuring that the number of changes in the variables in the model is limited, reducing the model's state space to a finite number, and performing model detection on the Machine model of the newly instantiated Context observed within this finite state space. The reachability of the deadlock state detected by the model detector reflects the schedulability of the Event-B model under the current initial conditions. The deadlock state of the model is checked by the model detector, and the schedulability of the system under the instantiated task set is reflected by whether the model will have a deadlock state.

[0033] The present invention also provides a system for implementing the above-described modeling and verification method, the system comprising:

[0034] The module includes: model building and simulation module, requirement modeling module, schedulability verification module, model testing module, and deadlock detection module.

[0035] The model building and simulation module is used to establish an operating system environment model for running the scheduling algorithm and to simulate task state switching and scheduling selection actions.

[0036] The requirement modeling module is used to model the schedulability requirements of real-time scheduling algorithms;

[0037] The schedulability verification module is used to verify schedulability by instantiating the task set in the model;

[0038] The model detection module is used to detect whether the model will reach a deadlock state;

[0039] The deadlock detection module is used to detect the deadlock of the model after the state space is reduced, reflecting whether the model is schedulable.

[0040] This invention also provides the application of the above-mentioned method or system in the modeling and verification of the schedulability of real-time scheduling algorithms.

[0041] The beneficial effects of this method include: This invention successfully establishes a formal model of a real-time scheduling algorithm through an Event-B formal method based on a refinement approach. The Event-B modeling method based on hierarchical refinement can progressively cover the requirements of interest, refining the requirements in multiple layers. Each layer only incrementally models the part corresponding to the requirements at that layer. This differs from existing scheduling modeling work that directly models specific schedulers or scheduling algorithms, reducing the complexity of modeling. Furthermore, the refinement characteristics of the Event-B model give it a certain degree of versatility and extensibility. Different specific models can be refined based on a certain abstract model. Model 0 of this invention, as the most basic scheduling environment model, can be refined to implement different actual scheduling environments. In this invention, the subsequent refinement direction is the real-time scheduling environment. The model obtained in this invention embodies task state switching and scheduling actions through variables and events. It formalizes the schedulability properties that real-time scheduling algorithms care about using invariants. By proving the correctness of the obligation, it ensures that the execution of events in the model does not violate schedulability. It is applied to the schedulability verification of a specific task set. After instantiating the model, a new mechanism reduces the model's state space to a finite number. It also uses complex model detection methods to detect deadlock in the model after introducing schedulability. Theorem proofs ensure that the model before introducing schedulability satisfies deadlock-free properties. Deadlock reflects the schedulability of the model. The schedulability properties of the model are verified by combining refined routes and model detection methods. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is an overall flowchart of the real-time scheduling algorithm schedulability modeling and verification method based on the Event-B formal method of the present invention.

[0044] Figure 2 This is a schematic diagram illustrating the schedulability modeling and verification process of the real-time scheduling algorithm based on the Event-B formal method of this invention.

[0045] Figure 3 This is the result of deadlock detection performed on different instantiated models using a model detector in this invention.

[0046] Figure 4 This is a schematic diagram illustrating the variable states and event execution trajectories in the model used to find deadlock states in this invention. Detailed Implementation

[0047] The present invention will be further described in detail below with reference to the specific embodiments and accompanying drawings. Except for the contents specifically mentioned below, the processes, conditions, and experimental methods for implementing the present invention are all common knowledge and general knowledge in the art, and the present invention does not have any particular limitations.

[0048] This invention provides a method for modeling and verifying the schedulability of real-time scheduling algorithms based on the Event-B formal approach. This invention utilizes the Event-B formal language in the Rodin platform to formally model real-time scheduling algorithms, modeling the schedulability of system tasks of interest to the real-time scheduling algorithm, and analyzing the system's schedulability using model checking methods. The method includes: firstly, modeling the algorithm layer by layer using the Event-B language; secondly, constructing the static environment of the model according to the requirements of the real-time scheduling algorithm during the modeling process; thirdly, formally defining schedulability properties through invariants; and finally, proving... The error-free nature of the proof obligation for schedulability ensures that the schedulability of the model remains after the events are executed. After instantiating the model into a specific task set, the verification of the schedulability property is transformed into a deadlock problem of the specific model. The deadlock property of the model is systematically detected by Rodin's built-in ProB model checker. The deadlock-free nature of the model can verify that the schedulability property of the system is satisfied. This invention implements a schedulability modeling and verification method for real-time scheduling algorithms based on the Event-B formal method. It formally models schedulability and uses model checking to verify the schedulability of the built model.

[0049] The method for modeling and verifying the schedulability of the real-time scheduling algorithm in this invention includes the following steps:

[0050] Step 1: Establish an operating system environment model for running the scheduling algorithm, and simulate task state switching and scheduling selection actions;

[0051] Step 2: Model the schedulability requirements of the real-time scheduling algorithm in the Event-B model;

[0052] Step 3: Verify schedulability by instantiating the task set in the model;

[0053] Step 4: Detect whether the model will reach a deadlock state and determine whether the model meets the schedulability requirements;

[0054] Step 5: Set a mechanism to reduce the model's state space to a finite number of states, detect model deadlock, and reflect whether the model is schedulable based on the detection results.

[0055] Figure 2This invention relates to a real-time scheduling algorithm based on the Event-B formal method, outlining the modeling and verification process for its schedulability. The model is first refined to establish a two-layer formal model, comprising model M0 and model M1. Model M0 constructs the most basic scheduling environment model, without involving specific scheduling application environments. Model M1 refines model M0 by adding environmental requirements related to the real-time scheduling environment, thus specifying a scheduling model for real-time scheduling scenarios and satisfying the relevant environmental requirements. The refined real-time scheduling model M1 is then further refined to include schedulability functional requirements. The resulting refined schedulable model is then instantiated, with different task sets instantiated into different specific models. Models M0 and M1 can be proven to be deadlock-free through theorem proofs or model testing. Deadlock testing is then performed on the instantiated models, and the results reflect whether the system satisfies schedulability.

[0056] Figure 3 The results of deadlock detection on different instantiated models are obtained by using a model detector in the schedulability modeling and verification of the real-time scheduling algorithm based on the Event-B formal method of this invention. If the model detector cannot find a deadlock state in the finite space, as shown in the left figure, it indicates that the instantiated model is schedulable; if a deadlock state of the model is found in the finite space, as shown in the right figure, it indicates that the instantiated model is not schedulable.

[0057] Figure 4 This diagram illustrates the variable states and event execution trajectories in the model used to find deadlock states in the real-time scheduling algorithm based on the Event-B formal method of this invention, during the schedulability modeling and verification. The ProB model checker provides the values ​​of system variables at the time of deadlock and the event trajectory executed when that deadlock state is reached. Figure 4 In the example shown, according to the scheduling process designed by the model, the model is in a concurrent running state and should execute the task running event t_run_busy_peri on core 1. However, the guard condition related to schedulability for this event is not met. The figure shows that task p2 does not satisfy the logical formula. The failure of the logical formula means that if the event is executed, task p2 will miss its deadline, the system will lose schedulability, so the event cannot be executed and the system is in a deadlock state.

[0058] The proposed method for modeling and verifying the schedulability of real-time scheduling algorithms based on the Event-B formal approach is illustrated in the following flowchart: Figure 1 As shown, it includes the following steps:

[0059] Step 1: Model the abstract operating system environment model for the running scheduling algorithm using the Event-B language. In the Context, declare a custom task type set TASK and a custom task state type set STATUS. Classify the task types according to the requirements of the real-time scheduling algorithm, including periodic tasks, non-periodic tasks, and Server tasks involved in the real-time scheduling algorithm. In the Machine, declare the ready, blocked, and running sets of system tasks using variables. Define the variable clk to represent the clock attribute on each core (processor) in a multi-core (multi-processor) environment. Use events to correspond to the actions of task state switching and scheduling actions in the operating system, refining and distinguishing the same action for different types of tasks based on the task type.

[0060] Step 2: In the Event-B model, add the schedulability requirement for the real-time scheduling algorithm to obtain a multi-layered formal model containing the schedulability requirement: Periodic tasks must ensure their completion time is earlier than their specified deadline within each period. Add an `executeTime` constant to the `Context` of the Event-B model to represent the task's execution time; add a `trigger` variable to the `Machine` of the Event-B model to represent the timestamp of the periodic task's creation; add a `response` variable to represent the timestamp of the periodic task's completion. Combining the above constants and variables, formally define the schedulability property using the classic trigger-response pattern, and prove the proof obligations related to this invariant; the trigger-response pattern is used to describe the response behavior corresponding to the event triggering kernel in the system.

[0061] Step 3: In the Event-B model, the multi-layer formal model obtained in Step 2 is instantiated into a specific task set. The constants declared in the Context are instantiated, and the periodic tasks, non-periodic tasks, and Server tasks in the system are declared. Each task is assigned a constant value such as executeTime, priority, and period, so that the task set in the Context is a fixed and specific task set, and all parameters are known or within a range.

[0062] Step 4: In Step 2, the Event-B model formally represents the schedulability of the scheduling algorithm using invariants, and ensures that periodic tasks maintain their schedulability through abstract conditions in the triggering conditions of clock-driven events. However, for a given task set, maintaining the schedulability invariants in clock-driven events may lead to a deadlock state, i.e., the clock-driven events cannot be executed according to the scheduling process, and other events are also in an unexecutable state. This situation indicates that although the abstract model maintains the schedulability property, the model under this specific parameter set still does not satisfy the schedulability property due to deadlock. To detect the deadlock of the model, the ProB model checker built into the Rodin platform can search the model space to detect whether the model will advance to a deadlock state during the random execution of events. To ensure that the deadlock of the model is caused by the schedulability invariants and related events introduced in the refinement process of Step 2, it is necessary to prove that the previous abstract model is deadlock-free. The deadlock-free nature of the model is verified by proving the theorem of deadlock-free nature of the formally represented Event-B model.

[0063] Step 5: The ProB model checker detects deadlock by traversing all possible model states. If all states have executable events and all resulting new states have been traversed, then the model is deadlock-free. However, the current Event-B model, due to the introduction of a time attribute, has a clock variable `clk` that continuously increases within the real number range, resulting in an infinite number of system states. Therefore, the Machine part of the model needs some adjustments. A new event is added to represent the reset action of all system variables. When the system time reaches a specified threshold, this event is executed, reinitializing all system variables, including resetting the clock value. After introducing this event, the clock value will only change within a certain range, and the system state is thus transformed into a finite number of states. Deadlock detection is then performed within this finite number of system state spaces.

[0064] Model detection is performed on the Machine model of the newly instantiated Context, given a task set and initial conditions, such as... Figure 3 As shown, if ProB cannot find the deadlock state of the model within the finite state space, it can be considered that the system corresponding to the model is schedulable under the parameters of the task set and the initial conditions. If the model detector finds a counterexample, i.e., a deadlock state, within the finite space, then it can be considered that the model does not satisfy schedulability, and the model detector will... Figure 4 The diagram shows the state of system variables during deadlock and the event trajectory that leads to this deadlock state. Therefore, a model detector can be used to check the deadlock state of the model and the schedulable properties of the deadlock response.

[0065] This invention models real-time scheduling algorithms based on the Event-B method and verifies their schedulability. Its advantage lies in the fact that the Event-B method, based on a refined modeling approach, provides extensibility to the model. Building upon the abstract model, it can be further refined to specific scheduling algorithms. For example, the final layer of the model in this invention employs a monotonic rate priority allocation strategy. In subsequent refinement processes, the model can be refined to a specific real-time scheduling algorithm that uses a monotonic rate priority allocation strategy, such as the Sporadic Server algorithm. The schedulability of a given task set can then be verified using this specific real-time scheduling algorithm.

[0066] The scope of protection of this invention is not limited to the above embodiments. Any variations and advantages that can be conceived by those skilled in the art without departing from the spirit and scope of this invention are included in this invention and are protected by the appended claims.

Claims

1. A method for modeling and verifying the schedulability of a real-time scheduling algorithm based on Event-B formalization, characterized in that, Includes the following steps: Step 1: Establish an operating system environment model for running the scheduling algorithm, and simulate task state switching and scheduling selection actions; In step 1, the operating system environment model for running the scheduling algorithm is modeled using Event-B. Constants and axioms are used to construct the static settings and requirements that the environment must meet, and events are used to simulate the switching between operating system task states and the scheduling selection actions. Step 2: Model the schedulability requirements of the real-time scheduling algorithm in the Event-B model; In step 2, for any periodic task in the given system, it is guaranteed that its completion time is earlier than its specified deadline in each period after creation; schedulability is formally defined using invariants in the Event-B language, and the proof obligation generated by proving the invariants of the schedulability property ensures that any change to the system variables by any event in the model will not cause the model to violate schedulability. Step 2 includes the following steps: Step 21: In the Event-B Context, declare a constant representing the execution time of the task; Step 22: In the Event-B Machine, define the schedulability of the real-time scheduling algorithm, add variables to represent the creation timestamp and end timestamp of the periodic task respectively, establish invariants of the schedulability property, and formalize the schedulability property that the periodic task guarantees that its completion time is earlier than its specified deadline in each period using invariants. Step 3: Verify schedulability by instantiating the task set in the model; Step 4: Detect whether the model will reach a deadlock state and determine whether the model meets the schedulability requirements; In step 4, the ProB model checker built into the Rodin platform is used to detect whether the model will reach a deadlock state. The ProB model checker searches the model space and detects whether the model has progressed to a deadlock state during the random execution of events. The occurrence of a deadlock state is used to reflect whether the model will lose schedulability under a certain event execution trajectory. In step 4, in order to ensure that the deadlock of the model is caused by the variables and event triggering conditions that define schedulability introduced during the refinement process in step 2, the theorem on the deadlock-free nature of the formally represented Event-B model is proved to verify that the model is deadlock-free before the introduction of schedulability. In step 4, the deadlock-free property of the model in step 1 is defined by an invariant, the formula of which is the disjunction of all guard conditions for each event in the model. The correctness of the theorem is proved by theorem proof, ensuring that the model satisfies the deadlock-free property before the introduction of the schedulability property. Step 5: Set a mechanism to reduce the model's state space to a finite number of states, detect model deadlock, and reflect whether the model is schedulable based on the detection results; In step 5, in order to apply the ProB model checker, a mechanism is added to the model's Machine to ensure that the model's state space is finite. Within the finite state space, the deadlock of the model is systematically detected, and the deadlock detection results are used to reflect whether the model under the task set is schedulable. Step 5 includes: setting up a mechanism, adding a reset event, the function of which is to reinitialize the system variables when the system clock variable reaches a threshold, ensuring that the changes in system variables are finite, reducing the model's state space to a finite number, and performing model detection on the Machine model of the newly instantiated Context observed within this finite state space. The reachability of the deadlock state detected by the model detector reflects the schedulability of the Event-B model under the current initial conditions. The deadlock state of the model is checked by the model detector and the schedulability of the system under the instantiated task set is reflected by whether the model will have a deadlock state.

2. The method for modeling and verifying the schedulability of a real-time scheduling algorithm based on Event-B formalization as described in claim 1, characterized in that, Step 1 includes the following steps: Step 11: Declare a custom task type set and a custom task status type set in the Event-B Context, and classify the task types according to whether they are periodic tasks based on the requirements of the real-time scheduling algorithm. Step 12: In the Event-B Machine, declare the ready, blocked, and running sets of system tasks using variables, and add auxiliary variables to control the scheduling process. Model the state transitions of tasks corresponding to events and the actions selected for scheduling, and refine and distinguish the same action for different types of tasks according to the task type.

3. The method for modeling and verifying the schedulability of a real-time scheduling algorithm based on Event-B formalization as described in claim 1, characterized in that, Step 3 includes: instantiating the multi-layer formal model obtained in step 2 into a specific task set, assigning the constants declared in the Context of each layer, including the number of tasks in the system and the execution time and priority of each task, to the specific task set, limiting the space and size of the constants, so that the constants become a fixed value with a known value or corresponding relationship.

4. A system for implementing the modeling and verification method as described in any one of claims 1-3, characterized in that, The system includes: a model building and simulation module, a requirement modeling module, a schedulability verification module, a model detection module, and a deadlock detection module; The model building and simulation module is used to establish an operating system environment model for running the scheduling algorithm and to simulate task state switching and scheduling selection actions. The requirement modeling module is used to model the schedulability requirements of real-time scheduling algorithms; The schedulability verification module is used to verify schedulability by instantiating the task set in the model; The model detection module is used to detect whether the model will reach a deadlock state; The deadlock detection module is used to detect the deadlock of the model after the state space is reduced, reflecting whether the model is schedulable.

5. The application of the system as described in claim 4 in the modeling and verification of the schedulability of real-time scheduling algorithms.

6. The application of the method as described in any one of claims 1-3 in the schedulability modeling and verification of real-time scheduling algorithms.

Images