Jonas Diemer

Formal worst-case timing analysis of Ethernet topologies with strict-priority and AVB switching

Ethernet is increasingly recognized as the future communication standard for distributed embedded systems in multiple domains such as industrial automation, automotive and avionics. A main motivation for this is cost and available data rate. A critical issue in the adoption of Ethernet in these domains is the timing of frame transfers, as many relevant applications require a guaranteed low-latency communication in order to meet real-time constraints. Ethernet AVB is an upcoming standard which addresses the timing issues by extending the existing strict-priority arbitration. Still, it needs to be evaluated whether these mechanism suffice for the targeted applications. For safety-critical applications, this can not only be done using intuition or simulation but requires a formal approach to assure the coverage of all worst-case corner cases. Hence, we present in this paper a formal worst-case analysis of the timing properties of Ethernet AVB and strict-priority Ethernet. This analysis mathematically determines safe upper bounds on the latency of frame transfers. Using this approach, we evaluate different topologies for a typical use-case in industrial automation.

Back Suction: Service Guarantees for Latency-Sensitive On-chip Networks

Networks-on-chip for future many-core processor platforms face an increasing diversity of traffic requirements, ranging from streaming traffic with real-time requirements to bursty latency-sensitive best-effort traffic from general-purpose processors with caches. In this paper, we propose Back Suction, a novel flow-control scheme to implement quality-of-service. Traffic with service guarantees is selectively prioritized upon low buffer occupancy of downstream routers. As a result, best-effort traffic is preferred for an improved latency as long as guaranteed service traffic makes sufficient progress. We present a formal analysis and an experimental evaluation of the Back Suction scheme showing improved latency of best effort traffic when compared to current approaches even under formal service guarantees for streaming traffic.

IDAMC: A NoC for mixed criticality systems

Increasing demand for performance and further integration promotes the use of multi- and many-core systems - also in safety-critical embedded systems. In this domain, hardware platforms obviously have to support real-time, predictability constrained applications such as an anti-lock braking system. However, the on-going trend to integrate multiple functions with different criticalities (mixed critical) on a single platform calls for a paradigm shift. Mixed-critical systems require special attention with respect to functional (access protection) and non-functional (performance) isolation. An additional layer of protection and guaranteed service on the underlying infrastructure enables the efficient adoption of such architectures in safety-critical domains. In this paper, we present the IDAMC, a many-core platform which provides mechanisms to integrate applications of different criticalities on a single platform.

Modeling of Ethernet AVB Networks for Worst-Case Timing Analysis

Abstract Ethernet is currently explored as the upcoming network standard for distributed control applications in many different industries such as automotive, avionics and industrial automation. It offers higher performance and flexibility over traditional control bus systems such as CAN and ProfiBus. For distributed control applications, predictable communication timing is highly important which can be problematic using standard Ethernet. The new Ethernet AVB standard aims to improve this by a new scheduling algorithm based on traffic shaping. However, the current AVB standard lacks a formal timing guarantee which is important for safety-critical control applications. As a solution to this, we present a model for Ethernet AVB networks and a transformation into a timing analysis model. Based on the timing model, we apply a compositional performance analysis approach known from the analysis of distributed real-time systems to derive worst-case timing properties and hence timing guarantees of the original Ethernet AVB network. For this, we provide the required formalism for the analysis of the scheduling of Ethernet AVB.

IDAMC: A Many-Core Platform with Run-Time Monitoring for Mixed-Criticality

On a multi- or many-core platform that runs applications of different safety criticality (mixed-criticality), all applications have to be certified to the highest level of criticality, unless they are sufficiently isolated. Isolation enables individual certification of applications and cost-efficient re-certification of single applications after an update. We introduce a parameterizable and synthesizable many-core platform with a fast and scalable monitoring and control mechanism that supports safe sharing of resources. Our contribution is a step towards exploiting the benefits of multi- and many-core platforms for mixed-critical applications.

Exploiting Shaper Context to Improve Performance Bounds of Ethernet AVB Networks

New hard real-time Advanced Driver Assistance Systems such as the Collision-Avoidance System push the bandwidth requirements of the communication infrastructure to a new level. Controller Area Network (CAN) and FlexRay are reaching their limits. Ethernet-based automotive networks such as Ethernet AVB are capable of addressing these requirements. However, designing predictable Ethernet networks is more complex than the design of a traditional CAN bus. Formal real-time performance characteristics are key to a successful Ethernet integration. In this paper we present an improved Ethernet AVB performance analysis which exploits traffic-stream correlations. The results are significantly tighter compared to related work.

Improved formal worst-case timing analysis of weighted round robin scheduling for ethernet

Ethernet networks become increasingly popular in many distributed embedded applications. As an alternative to strict priority (SP) scheduling, weighted round robin (WRR) is supported by most commercially available Ethernet switches. In WRR scheduling the link capacity is distributed fairly among traffic streams according to preset weights on a per round basis. As WRR does not provide latency guarantees, formal timing verification is necessary in order to deploy WRR in real-time applications. In this paper, we present a formal method to analyze WRR scheduling in Ethernet networks. Compared to existing methods which overestimate by assuming unnecessarily high interference, our method will take actual load bounds into account, thus achieving tighter analysis results. Finally, we perform an evaluation of our approach against existing methods and also against SP scheduling.

Real-time communication analysis for networks with two-stage arbitration

Current on-chip and macro networks use multi-stage arbitration schemes which independently assign different resources such as crossbar inputs and outputs to individual traffic streams. To use these networks in real-time systems, their worst-case behavior must be proved analytically in order to ensure the required timing guarantees. Current analysis approaches, however, do not capture the multi-stage arbitration accurately. In this paper, we propose an analysis that maps the multi-stage arbitration to a schedulability analysis of multiprocessors with shared resources. This allows the exploitation of knowledge about the worst-case behavior of the individual traffic streams, which is required to provide non-symmetric guarantees. Using this scheduling analysis approach, a detailed analysis solution for a common multi-stage arbitration scheme (iSLIP) is presented. Finally, we evaluate the proposed approach experimentally and compare it to previous work.

Formal worst-case timing analysis of Ethernet TSN's time-aware and peristaltic shapers

Ethernet is considered as a future communication standard for distributed embedded systems in the automotive and industrial domains. A key challenge is the deterministic low-latency transport of Ethernet frames, as many safety-critical real-time applications in these domains have tight timing requirements. Time-sensitive networking (TSN) is an upcoming set of Ethernet standards, which (among other things) address these requirements by specifying new quality of service mechanisms in the form of different traffic shapers. In this paper, we consider TSNs time-aware and peristaltic shapers and evaluate whether these shapers are able to fulfill these strict timing requirements. We present a formal timing analysis, which is a key requirement for the adoption of Ethernet in safety-critical real-time systems, to derive worst-case latency bounds for each shaper. We use a realistic automotive Ethernet setup to compare these shapers to each other and against Ethernet following IEEE 802.1Q.

Exploring the worst-case timing of Ethernet AVB for industrial applications

Predictable and low-latency communication timing is one of the major challenges for employing Ethernet-based networks in industrial automation. The evolving Ethernet AVB standard appears to be a promising architecture, as it provides mechanisms for predictable timing with standard Ethernet hardware. However, the worst-case timing of Ethernet AVB still has to be evaluated. In this paper, we analyze the timing of Ethernet AVB using both simulation and a formal worst-case analysis based on Compositional Performance Analysis known from embedded computing systems. We investigate two industrial scenarios, a typical line topology and a more complex two-level network, and compare the results from analysis and simulation. This allows us get a good indication of the applicability of the current Ethernet AVB with respect to predictable low-latency timing in industrial automation networks. We also gain an understanding of the benefits and limitations of formal Compositional Performance Analysis compared to simulation in this context.