Christian El Salloum

Automotive Software Development for a Multi-Core System-on-a-Chip

There are many economic and technical arguments for the reduction of the number of Electronic Control Units (EC Us) aboard a car. One of the key obstacles to achieve this goal is the limited composability, fault isolation and error containment of todays single- processor architectures. However, significant changes in the chip architecture are taking place in order to manage the synchronization, energy dissipation, and fault-handling requirements of emerging billion transistor SoCs (systems-on-a-chip). The single processor architecture is replaced by multi-core SoCs that communicate via networks-on-chip (NoC). These emerging multi-core SoCs provide an ideal execution environment for the integration of multiple automotive ECUs into a single SoC This paper presents a model-based software development method for designing applications using these multi-core SoCs.

The ACROSS MPSoC -- A New Generation of Multi-core Processors Designed for Safety-Critical Embedded Systems

The European ARTEMIS ACROSS project aims to overcome the limitations of existing Multi-Processor System-on-a-Chip (MPSoC) architectures with respect to safety-critical applications. MPSoCs have a tremendous potential in the domain of embedded systems considering their enormous computational capacity and energy efficiency. However, the currently existing MPSoC architectures have significant limitations with respect to safety-critical applications. These limitations include difficulties in the certification process due to the high complexity of MPSoCs, the lacking temporal determinism and problems related to error propagation between subsystems. These limitations become even more severe, when subsystems of different criticality levels have to be integrated on the same computational platform. Examples of such mixed-criticality integration are found in the avionics and automotive industry with their desire to integrate safety-critical, mission critical and non-critical subsystems on the same platform in order to minimize size, weight, power and cost. The main objective of ACROSS is to develop a new generation of multicore processors designed specially for safety-critical embedded systems; the ACROSS MPSoC. In this paper we will show how the ACROSS MPSoC overcomes the limitations of existing MPSoC architectures in order to make the multi-core technology available to the safety-critical domain.

A Transient-Resilient System-on-a-Chip Architecture with Support for On-Chip and Off-Chip TMR

The ongoing technological advances in the semiconductor industry make Multi-Processor System-on-a-Chips (MPSoCs) more attractive, because uniprocessor solutions do not scale satisfactorily with increasing transistor counts. In conjunction with the increasing rates of transient faults in logic and memory associated with the continuous reduction of feature sizes, this situation creates the need for novel MP- SoC architectures. This paper introduces such an architecture, which supports the integration of multiple, heterogeneous IP cores that are interconnected by a time-triggered Network-on-a-Chip (NoC). Through its inherent fault isolation and determinism, the proposed MPSoC provides the basis for fault tolerance using Triple Modular Redundancy (TMR). On-chip TMR improves the reliability of a MPSoC, e.g., by tolerating a transient fault in one of three replicated IP cores. Off-chip TMR with three MPSoCs can be used in the development of ultra-dependable applications (e.g., X-by-wire), where the reliability requirements exceed the reliability that is achievable using a single MPSoC. The paper quantifies the reliability benefits of the proposed MPSoC architecture by means of reliability modeling. These results demonstrate that the combination of on-chip and off- chip TMR contributes towards building more dependable distributed embedded real-time systems.

Fundamental Design Principles for Embedded Systems: The Architectural Style of the Cross-Domain Architecture GENESYS

The GENESYS (Generic Embedded System) project is a European research project that aims to develop a cross-domain architecture for embedded systems. The requirements and constraints for such an architecture are documented in the ARTEMIS strategic research agenda in the form of seven key challenges. This paper presents the architectural style of GENESYS by listing the key architectural principles, such as: strict component orientation, separation of computation from communication, availability of a common time, hierarchical system structure, adherence to message passing, state awareness, fault isolation and integrated resource manage-ment. This paper explains how these architectural principles contribute to solve the seven key challenges in the ARTEMIS strategic research agenda.

The ACROSS MPSoC - A new generation of multi-core processors designed for safety-critical embedded systems

The European ARTEMIS ACROSS project aims to overcome the limitations of existing Multi-Processor System-on-a-Chip (MPSoC) architectures with respect to safety-critical applications. MPSoCs have a tremendous potential in the domain of embedded systems considering their enormous computational capacity and energy efficiency. However, the currently existing MPSoC architectures have significant limitations with respect to safety-critical applications. These limitations include difficulties in the certification process due to the high complexity of MPSoCs, the lacking temporal determinism and problems related to error propagation between subsystems. These limitations become even more severe, when subsystems of different criticality levels have to be integrated on the same computational platform. Examples of such mixed-criticality integration are found in the avionics and automotive industry with their desire to integrate safety-critical, mission critical and non-critical subsystems on the same platform in order to minimize size, weight, power and cost. The main objective of ACROSS is to develop a new generation of multicore processors designed specially for safety-critical embedded systems; the ACROSS MPSoC. In this paper we will show how the ACROSS MPSoC overcomes the limitations of existing MPSoC architectures in order to make the multi-core technology available to the safety-critical domain.

Recovery Mechanisms for Dual Core Architectures

Dual core architectures are commonly used to establish fault tolerance on the node level. Since comparison is usually performed for the outputs only, no precise diagnostic information is available, and error handling comes down to a reset of both cores. The strategy proposed in this paper allows a more fine-grained error handling. It is based on the following steps: (1) Identification of those registers that are actually relevant for recovering the last known correct core state. (2) Protection of these registers by additional comparators. (3) Use of the trap mechanism for recovering a consistent state of the complete core. (4) (Optional) provision of rollback capability for the relevant registers in order to relax the critical path constraints. In the paper these individual steps was discussed and motivated, and put them into context. In many cases the speed-up that was gained for the recovery was sufficient for using a dual core as a fail-operational instead of a fail-silent component with respect to transient faults. Rather than being restricted to a specific processor design our mechanisms can be employed in a wide variety of dual-core architectures

Modeling Time-Triggered Architecture Based Real-Time Systems Using SystemC

This paper proposes a SystemC based extension for the modeling of Time-Triggered Architecture (TTA) based real-time embedded systems. The extension called Executable Time-Triggered Model (E-TTM) supports the time-triggered model of computation and provides a time domain deterministic modeling framework based on SystemC. E-TTM can be used from the architectural design phase to support early functional, temporal and dependability assessments. This approach is illustrated with two case studies. The design and Simulated Fault Injection (SFI) of an odometry safety-critical embedded system, and the design and simulation of a real-time control-system integrated with a SystemC-AMS model of the plant.