Peter Ulbrich

Consistent product line configuration across file type and product line boundaries

Creating a valid software configuration of a product line can require laborious customizations involving multiple configuration file types, such as feature models, domain-specific languages, or preprocessor defines in C header files. Using configurable off-the-shelf components causes additional complexity. Without checking of constraints across file types boundaries already at configuration time, intricate inconsistencies are likely to be introduced--resulting in product defects, which are costly to discover and resolve later on. Up to now, at best ad-hoc solutions have been applied. To tackle this problem in a general way, we have developed an approach and a corresponding plug-in infrastructure. It allows for convenient definition and checking of constraints across configuration file types and product line boundaries. Internally, all configuration files are converted to models, facilitating the use of model-based constraint languages (e.g., OCL). Converter plug-ins for arbitrary configuration file types may be integrated and hide a large amount of complexity usually associated with modeling. We have validated our approach using a quadrotor helicopter product line comprising three sub-product-lines and four different configuration file formats. The results give evidence that our approach is practically applicable, reduces time and effort for product derivation (by avoiding repeated compiling, testing, and reconfiguration cycles), and prevents faulty software deployment.

I4Copter: an adaptable and modular quadrotor platform

Quadrotor helicopters are micro air vehicles with vertical take-off and landing capabilities controlled by varying the rotation speed of four fixed pitch propellers. Due to their rather simple mechanical design they have grown to popularity as platform for various research projects. Despite most of them being individually highly successful, they are typically tailored to a specific purpose making it hard to utilise them for further research and education. In this paper, we present the novel design of the I4Copter quadrotor. It has been developed to provide a stable demonstration quadrotor platform for various kinds of research and education projects targeting cross-field challenges in real-time and embedded systems, distributed systems, robotics and cybernetics. The modular and open architecture of our platform allows an application-specific, fine-grained extension, adaption and replacement of software and hardware components. The safe extensibility is supported by strict temporal and spatial isolation between the software modules. We validated our approach by two distinct cross-field use cases: an evaluation platform for modularised control algorithms enabling trajectory tracking and an implementation that is resilient to transient hardware errors.

A Practitioner's Guide to Software-Based Soft-Error Mitigation Using AN-Codes

Arithmetic error coding schemes (AN codes) are a well known and effective technique for soft error mitigation. Although coding theory being a rich area of mathematics, their implementation seems to be fairly easy. However, compliance with the theory can be lost easily while moving towards an actual implementation - finally jeopardizing the aspired fault-tolerance characteristics. In this paper, we present our experiences and lessons learned from implementing AN codes in the Cored dependable voter. We focus on the challenges and pitfalls in the transition from maths to machine code for a binary computer from a systems perspective. Our results show, that practical misconceptions (such as the use of prime numbers) and architecture-dependent implementation glitches occur on every stage of this transition. We identify typical pitfalls and describe practical measures to find and resolve them. Our measures eliminate all remaining SDCs in the Cored voter, which is validated by an extensive fault-injection campaign that covers 100 percent of the fault space for 1-bit and 2-bit errors.

Experiences with software-based soft-error mitigation using AN codes

Arithmetic error coding schemes are a well-known and effective technique for soft-error mitigation. Although the underlying coding theory is generally a complex area of mathematics, its practical implementation is comparatively simple in general. However, compliance with the theory can be lost easily while moving toward an actual implementation, which finally jeopardizes the aspired fault-tolerance characteristics and effectiveness. In this paper, we present our experiences and lessons learned from implementing arithmetic error coding schemes (AN codes) in the context of our Combined Redundancy fault-tolerance approach. We focus on the challenges and pitfalls in the transition from maths to machine code for a binary computer from a systems perspective. Our results show that practical misconceptions (such as the use of prime numbers) and architecture-dependent implementation glitches occur at every stage of this transition. We identify typical pitfalls and describe practical measures to find and resolve them. This allowed us to eliminate all remaining silent data corruptions in the Combined Redundancy framework, which we validated by an extensive fault-injection campaign covering the entire fault space of 1-bit and 2-bit errors.

Escaping the Bonds of the Legacy: Step-Wise Migration to a Type-Safe Language in Safety-Critical Embedded Systems

Type-safe high-level languages such as Java have not yet found their way into the domain of deeply embedded systems, even though numerous attempts have been made to make these languages cost attractive. One major challenge that remains is the huge existing code base in many industries. Completely reengineering this code base is not viable for cost and time reasons. We present an approach that allows to isolatedly combine legacy software components and safe software components in an embedded system using the two most common communication idioms found in this domain. Our approach allows the developer to freely choose between hardware- and software-based isolation mechanisms. We demonstrate the feasibility of our approach by porting a non-trivial part of a real-world, hard real-time embedded avionics application. Our results show that the cost of this mixed-mode operation is on the same scale as the pure operation.

From Intent to Effect: Tool-Based Generation of Time-Triggered Real-Time Systems on Multi-core Processors

Although the manual creation of time-triggered schedules for multi-core real-time systems can be a daunting task, state-of-the-art scheduling algorithms are far from being widely used. This suggests that the availability of sound algorithms is only one side of the story: real-time systems have to be groomed substantially before they can serve as input to available algorithms. Moreover, systems engineers struggle with the temporal effects of their design decisions, in addition to the intended timing properties. Therefore, we believe that appropriate tools are the other side of the story. In this paper, we present the multicore extension of the Real-Time Systems Compiler, a compiler-based tool that analyses given event-triggered real-time systems and transforms them into time-triggered equivalents. We focus on the challenges and pitfalls in the transition from theory to practical implementation and present concrete solutions to resolve them. Existing algorithms need to be adapted for performance and, at model level, bound together appropriately to be applicable, for example. Our experiments substantiate the effectiveness and scalability of our approach, even for large tasks sets. Finally, lessons learned give an insight into implementation and hardware details and their impact on schedulability.

Taking control: Modular and adaptive robotics process control systems

Robotics systems usually comprise sophisticated sensor and actuator systems with no less complex control applications. These systems are subject to frequent modifications and extensions and have to adapt to their environment. While automation systems are tailored to particular production processes, autonomous vehicles must adaptively switch their sensors and controllers depending on environmental conditions. However, when designing and implementing the process control system, traditional control theory focuses on the control problem at hand without having this variability in mind. Thus, the resulting models and implementation artefacts are monolithic, additionally complicating the real-time system design. In this paper, we present a modularisation approach for the design of robotics process control systems, which not only aims for variability at design-time but also for adaptivity at run-time. Our approach is based on a layered control architecture, which includes an explicit interface between the two domains involved: control engineering and computer science. Our architecture provides separation of concerns in terms of independent building blocks and data flows. For example, the replacement of a sensor no longer involves the tedious modification of downstream filters and controllers. Likewise, the error-prone mapping of high-level application behaviour to the process control system can be omitted. We validated our approach by the example of an autonomous vehicle use case. Our experimental results demonstrate ease of use and the capability to maintain quality of control on par with the original monolithic design.

SysWCET: Whole-System Response-Time Analysis for Fixed-Priority Real-Time Systems (Outstanding Paper)

The worst-case response time (WCRT) – the time span from release to completion of a real-time task – is a crucial property of real-time systems. However, WCRT analysis is complex in practice, as it depends not only on the realistic examination of worst-case execution times (WCET), but also on system-level overheads and blocking/preemption times. While the implicit path enumeration technique (IPET) has greatly improved automated WCET analysis, the resulting values still need to be aggregated manually with the system-level overheads – an errorprone and tedious process that yields overly pessimistic results. With SysWCET, we provide an integrated approach for the automated WCRT analysis across multiple threads of execution, locks, interrupt service routines, and the real-time operating system (RTOS) in particular. Our approach spans a single IPET formulation over the whole system and exploits RTOS and scheduler semantics to derive cross-kernel flow facts in order to significantly reduce pessimism in the WCRT analysis. We evaluate our approach with a fully functional implementation of SysWCET for the automotive OSEK-OS standard (ECC1), including threads, alarms, interrupt-service routines, events, and PCP-based resource management.

The best of both: High-performance anc deterministic real-time executive by application-specific multi-core SoCs

Embedded multi-core processors improve performance significantly and are desirable in many application-fields. This in particular includes safety-critical real-time systems, which typically require a deterministic temporal behavior. However, even tasks without dependencies running on different cores can interfere due to, sometimes hidden, shared hardware resources, such as common memories or buses. Consequently, only a pessimistic assumption of the worst-case execution time (WCET) that incorporates interference can be given. Hence, the aspired performance gain fizzles out in the poor temporal analyzability. Based on the fact that in safety-critical systems all tasks and their dependencies are known at compile-time, this paper presents an approach to generate application-specific, deterministic multi-core processor architectures for these systems. Thereby safety-critical tasks are executed on dedicated Deterministic Execution Units (DEUs) including lightweight, deterministic processor cores, bus systems, memories and peripherals. The remaining soft real-time tasks are executed on a general purpose multi-core processor that offers performance over determinism. Consequently, timing analysis for hard real-time tasks is significantly simplified, since interferences caused by shared resources and scheduling are effectively eliminated. To show the benefits of our approach, an application-specific architecture for a flight controller was generated and compared to an ARM Cortex-A9 dual-core as reference. Overall, we were able to significantly improve temporal properties of safety-critical tasks while preserving the overall performance for soft real-time tasks.

Design by uncertainty: Towards the use of measurement uncertainty in real-time systems

Real-time systems usually incorporate a wide variety of challenges: A control engineer, for example, aims for the highest possible control quality achievable. Here, one key element is to minimise the uncertainty of the measurements. This, to put it simple, is the noise of sensor data, which has a negative effect on control. Although measurement uncertainty is well treated in control theory, it is usually ignored in common real-time architectures where temporal properties are the prevalent criteria. Consequently, the communication between control engineers and real-time specialists is rather one way, revolving around deadlines and sampling periods. However, on closer examination, many real-time properties are derived from the measurement uncertainty aspired by the control engineer. Conversely, temporal variations, virtually inevitable in practice, can be represented as measurement uncertainty as well. Tackling the measurement uncertainty should therefore be an interdisciplinary task: The control system respects the actual run-time conditions instead of estimating them. Likewise, the real-time system considers measurement uncertainty rather than blindly sticking to deadlines. In this paper we present an uncertainty-centric approach to leverage measurement uncertainty in real-time architectures, not only at design time but also at run-time. Using measurement uncertainty as an explicit interface minimises the gap between real-time specialists and control engineers and facilitates a modular and flexible system design. Our preliminary results are promising and show the ease of use and the applicability to existing systems.