Philip Axer

Building timing predictable embedded systems

A large class of embedded systems is distinguished from general-purpose computing systems by the need to satisfy strict requirements on timing, often under constraints on available resources. Predictable system design is concerned with the challenge of building systems for which timing requirements can be guaranteed a priori. Perhaps paradoxically, this problem has become more difficult by the introduction of performance-enhancing architectural elements, such as caches, pipelines, and multithreading, which introduce a large degree of uncertainty and make guarantees harder to provide. The intention of this article is to summarize the current state of the art in research concerning how to build predictable yet performant systems. We suggest precise definitions for the concept of “predictability”, and present predictability concerns at different abstraction levels in embedded system design. First, we consider timing predictability of processor instruction sets. Thereafter, we consider how programming languages can be equipped with predictable timing semantics, covering both a language-based approach using the synchronous programming paradigm, as well as an environment that provides timing semantics for a mainstream programming language (in this case C). We present techniques for achieving timing predictability on multicores. Finally, we discuss how to handle predictability at the level of networked embedded systems where randomly occurring errors must be considered.

Response-Time Analysis of Parallel Fork-Join Workloads with Real-Time Constraints

The advent of multi- and many-core processors comes with new challenges and opportunities for the designer of embedded real-time applications. By using parallel programming techniques (e.g. OpenMP) software engineers can leverage from the available hardware parallelism and speed up the algorithms. The inherent redundancy of multi-core architectures can also be used to implement fault-tolerance by executing code redundantly on multiple cores in parallel. Parallel programming and redundant execution are typical examples for fork-join tasks in which the program is partially parallelized. However, complex synchronization of parallel segments across multiple cores can cause unanticipated effects. This is especially problematic in hard real-time applications where data must be available in bounded time (e.g. stereo vision for pedestrian detection). The contribution of this work is a novel worst-case response time analysis which accounts for synchronization of fork-join tasks with arbitrary deadlines. We apply the analysis to the Romain framework which extends the L4 micro kernel by redundant multithreading targeted towards fault-tolerant embedded systems. By using formal analysis, we show that parallelizing workloads can lead to drastic performance impairments compared to traditional sequential execution if not done carefully.

Reliability analysis for MPSoCs with mixed-critical, hard real-time constraints

Methods such as rollback and modular redundancy are efficient to correct transient errors. In hard real-time systems, however, correction has a strong impact on response times, also on tasks that were not directly affected by errors. Due to deadline misses, these tasks eventually fail to provide correct service. In this paper we present a reliability analysis for periodic task sets and static priorities that includes realistic detection and roll-back scenarios and covers a hyperperiod instead of just a critical instant and therefore leads to much higher accuracy than previous approaches. The approach is compared with Monte-Carlo simulation to demonstrate the accuracy and with previous approaches covering critical instants to evaluate the improvements.

IDAMC: A NoC for mixed criticality systems

Increasing demand for performance and further integration promotes the use of multi- and many-core systems - also in safety-critical embedded systems. In this domain, hardware platforms obviously have to support real-time, predictability constrained applications such as an anti-lock braking system. However, the on-going trend to integrate multiple functions with different criticalities (mixed critical) on a single platform calls for a paradigm shift. Mixed-critical systems require special attention with respect to functional (access protection) and non-functional (performance) isolation. An additional layer of protection and guaranteed service on the underlying infrastructure enables the efficient adoption of such architectures in safety-critical domains. In this paper, we present the IDAMC, a many-core platform which provides mechanisms to integrate applications of different criticalities on a single platform.

Monitoring Arbitrary Activation Patterns in Real-Time Systems

Model-based verification of timing properties has become industrial practice in design processes of safety-critical hard real-time systems. To validate the correctness of the used verification model, systems are additionally monitored during regular operation. With a growing variety of activation patterns considered in verification, some of them with infinite range capturing arbitrary activation patterns, the known approaches to monitoring, which assume periodic streams, have become inapplicable or they suffer from large overhead due to piecewise continuous time monitoring. In this paper we present a light-weight monitoring approach for arbitrary activation patterns. It profits from the discrete time property of a minimum distance event representation which is used instead of the continuous time representation used in earlier approaches. The method has a configurable constant runtime overhead in terms of memory and computation and allows conservative monitoring of a given arbitrary minimum distance function. Furthermore, we provide conditions under which the monitoring function is exact.

Exploiting Shaper Context to Improve Performance Bounds of Ethernet AVB Networks

New hard real-time Advanced Driver Assistance Systems such as the Collision-Avoidance System push the bandwidth requirements of the communication infrastructure to a new level. Controller Area Network (CAN) and FlexRay are reaching their limits. Ethernet-based automotive networks such as Ethernet AVB are capable of addressing these requirements. However, designing predictable Ethernet networks is more complex than the design of a traditional CAN bus. Formal real-time performance characteristics are key to a successful Ethernet integration. In this paper we present an improved Ethernet AVB performance analysis which exploits traffic-stream correlations. The results are significantly tighter compared to related work.

Improved formal worst-case timing analysis of weighted round robin scheduling for ethernet

Ethernet networks become increasingly popular in many distributed embedded applications. As an alternative to strict priority (SP) scheduling, weighted round robin (WRR) is supported by most commercially available Ethernet switches. In WRR scheduling the link capacity is distributed fairly among traffic streams according to preset weights on a per round basis. As WRR does not provide latency guarantees, formal timing verification is necessary in order to deploy WRR in real-time applications. In this paper, we present a formal method to analyze WRR scheduling in Ethernet networks. Compared to existing methods which overestimate by assuming unnecessarily high interference, our method will take actual load bounds into account, thus achieving tighter analysis results. Finally, we perform an evaluation of our approach against existing methods and also against SP scheduling.

Improving formal timing analysis of switched ethernet by exploiting FIFO scheduling

Ethernet is an emerging technology in the automotive domain and is capable to overcome the bandwidth and scalability limits of traditional buses like CAN or FlexRay. Formal performance analysis methods are required to verify the timing, e.g. by providing upper bounds on end-to-end latencies, in safety-critical real-time systems, such as automotive control and advanced driver assistance systems. In many real-time capable Ethernet implementations such as IEEE 802.1Q or AVB, frames can be prioritized and frames of equal priority are scheduled in FIFO order at the switch ouput ports. In this paper, we show how to exploit Ethernets FIFO scheduling in a compositional formal performance analysis to derive tighter timing guarantees. In an automotive Ethernet setup, our proposed analysis leads to a significant reduction in end-to-end latency guarantees.

Sensitivity analysis for arbitrary activation patterns in real-time systems

Response time analysis, which determines whether timing guarantees are satisfied for a given system, has matured to industrial practice and is able to consider even complex activation patterns modelled through arrival curves or minimum distance functions. On the other side, sensitivity analysis, which determines bounds on parameter variations under which constraints are still satisfied, is largely restricted to variation of single-valued parameters as e.g. task periods. In this paper we provide a sensitivity analysis to determine the bounds on the admissible activation pattern of a task, modelled through a minimum distance function. In an evaluation on a set of synthetic testcases we show, that the proposed algorithm provides significantly tighter bounds, than previous exact analyses, that determine allowable parametrizations of activation patterns.

Improving formal timing analysis of switched ethernet by exploiting traffic stream correlations

Ethernet networks become increasingly popular in many distributed, embedded application domains. In safety-critical real-time systems, such as industrial control or driver assistance systems, formal performance analysis methods are required to verify the timing, e.g. by providing upper bounds on end-to-end latencies. These formal methods, however, often rely on overapproximations to keep the computational complexity at a tractable level. In distributed systems, these overapproximations can accumulate leading to overly conservative timing guarantees. Switched networks, such as Ethernet (especially with large topologies), are particularly prone to this effect. In this paper, we identify timing correlations between traffic streams in Ethernet networks and show how they can be exploited by a formal analysis to derive timing guarantees, which are up to 80% tighter.