Sebastian Tobuschat

IDAMC: A NoC for mixed criticality systems

Increasing demand for performance and further integration promotes the use of multi- and many-core systems - also in safety-critical embedded systems. In this domain, hardware platforms obviously have to support real-time, predictability constrained applications such as an anti-lock braking system. However, the on-going trend to integrate multiple functions with different criticalities (mixed critical) on a single platform calls for a paradigm shift. Mixed-critical systems require special attention with respect to functional (access protection) and non-functional (performance) isolation. An additional layer of protection and guaranteed service on the underlying infrastructure enables the efficient adoption of such architectures in safety-critical domains. In this paper, we present the IDAMC, a many-core platform which provides mechanisms to integrate applications of different criticalities on a single platform.

A mixed critical memory controller using bank privatization and fixed priority scheduling

Mixed critical platforms are those in which applications that have different criticalities, i.e. different levels of importance for system safety, coexist and share resources. Such platforms require a memory controller capable of providing sufficient timing independence for critical applications. Existing real-time memory controllers, however, either do not support mixed criticality or still allow a certain degree of interference between applications. The former issue leads to overly constrained, and hence more expensive, systems. The latter issue forces designers to assume the worst case latency for every individual memory transaction, which can be very conservative when applied to determine the worst-case execution time (WCET) of a task that performs many memory requests. In this paper, we address both issues. The main contributions are: (1) A memory controller that allows a predetermined number of critical and non-critical applications to coexist, while providing an interference-free memory for the former. To achieve that, we treat the memory as a set of independent virtual devices (VDs). Therefore, we also provide (2) a partitioning strategy to properly map mixed critical workloads to VDs. We present experiments that show that our controller allows DRAM sharing with no interference on critical applications and minimal performance overhead on non-critical ones (they perform on average only 15% slower in the shared environment).

Supervised sharing of virtual channels in Networks -on-Chip

Networks-on-Chip (NoCs) for embedded multiprocessor architectures require special mechanisms for sharing resources such as links and queues in network routers. A widely used solution is virtual-channel flow control which prevents head-of-line blocking and isolates different data streams. However, the number of virtual channels (VCs) is limited by the available buffer space in the routers. Due to the evergrowing number of applications and mutual exclusive requirements it may not be possible to assign each application a unique VC. In this paper we present a Resource Broker (RB) which is an overarching mechanism that schedules NoC traffic. It allows predictable and efficient sharing of VCs without compromising isolation and Quality-of-Service guarantees. We show that by managing the NoC traffic with the RB, we drastically reduce blocking and improve the overall utilization and hence the system performance.

Workload-aware shaping of shared resource accesses in mixed-criticality systems

For mixed-criticality systems, safety standards (e.g. ISO 26262) require sufficient independence among different criticality levels, unless the entire system is certified according to the highest applicable level. We present a resource arbitration scheme that provides sufficient independence among different criticality levels w.r.t. timing properties. We exploit throughput and latency slack of critical applications by prioritizing non-critical over critical accesses and only switching priorities when necessary. By using an accurate representation of resource access patterns and workloads, the proposed arbitration scheme achieves an improved resource utilization compared to classical approaches that use simple access counters. The approach allows to provide service guarantees for critical applications, while reducing the adverse effects through strict prioritization on non-critical applications.

Real-time communication analysis for Networks-on-Chip with backpressure

Networks-on-Chip (NoCs) for safety-critical domains require formal guarantees for the worst-case behavior of all real-time senders. The majority of existing analysis approaches is capable of providing such guarantees only under the assumption that the queues in the routers never overflow, i.e., that no backpressure occurs. This leads to overly pessimistic guarantees or unfulfilled design requirements in many setups using commercially available NoCs where buffer space is limited. Therefore, we propose an alternative analysis methodology providing formal timing guarantees for packet latencies also in a NoC where backpressure occurs. The analysis allows exploiting the behavior of individual traffic streams to determine safe upper bounds on the latency of individual packets. The correctness of the analysis is evaluated experimentally through comparison with simulation results.

System-level timing feasibility test for cyber-physical automotive systems

For automotive systems there is a mismatch between worst-case timing analysis models and the perceived reality, diminishing their relevance, especially for the automotive powertrain domain. Strict worst-case guarantees are rarely needed in the powertrain domain. The reason is that a large amount of functionality is control software and this can tolerate sporadic deadline misses. For instance, certain control approaches can systematically account for sampling losses and still prove whether or not the controller is stable and adheres to required performance criteria. Typical worst-case analysis (TWCA) tackles this problem by providing formal guarantees on typical response-times including upper bounds on the number of violations of these. In this paper, we derive a system-level timing feasibility test exploiting the robustness of control applications based on TWCA. We extend the TWCA to cope with periodic tasks that have varying execution times. Taking the robustness of control applications into account, we derive upper bounds for the overload models of each task, along with possible typical worst-case execution times (TCET), as needed for the TWCA. We then use this information to find a feasible typical-case configuration such that all deadlines are reached and all robustness constraints are satisfied. To verify the approach and show the expressiveness, we apply it on a performance model of a full-blown modern engine management system provided by Bosch.

Efficient Latency Guarantees for Mixed-Criticality Networks-on-Chip

Abstract-Networks-on-Chip (NoCs) for future mixedcriticality systems must handle a growing variety of traffic requirements, ranging from safety-critical real-time traffic to bursty latency-sensitive best-effort traffic. Additionally, safety standards (e.g. ISO 26262) require sufficient independence among different criticality levels or a full system certification according to the highest applicable safety level. Hence, a NoC must provide performance isolation for safety-critical traffic, while sustaining low latency for best-effort traffic. This paper presents a run-time configurable NoC design enabling latency guarantees for safety-critical traffic with reduced adverse impact on the performance of best-effort traffic. In contrast to existing approaches, we prioritize best-effort over safety-critical traffic and only switch priorities when required. Doing this, we exploit the latency slack of safety-critical applications, while providing sufficient independence among different criticality levels w.r.t. timing properties. We present a formal analysis and an experimental evaluation, showing that the approach provides performance isolation for safety-critical applications, while reducing the adverse effects through strict prioritization on best-effort applications

Real-time analysis of priority-preemptive NoCs with arbitrary buffer sizes and router delays

Nowadays available multiprocessor platforms predominantly use a network-on-chip (NoC) architecture as an interconnect medium, due to its good scalability and performance. During the last decade, NoCs received a significant amount of attention from the real-time community. One promising category of approaches suggests to employ already existing hardware features called virtual channels, and dedicate them, exclusively, to individual communication traffic flows. In this way, NoCs become more amenable to the real-time analysis, which is an essential requirement for providing both safe and tight worst-case analysis methods, and consequently deriving real-time guarantees. In this manuscript, we present the approach which falls in the aforementioned category. Specifically, we propose a novel method for the worst-case analysis of the NoC traffic, assuming the existence of per-flow dedicated virtual channels. Compared to the state-of-the-art techniques, our approach yields substantially tighter upper-bounds on the worst-case traversal times (WCTTs) of communication traffic flows. By employing the proposed method, resource over-provisioning can be mitigated to a large extent, and significant design-cost reductions can be achieved. Moreover, we implemented a cycle-accurate simulator of the assumed NoC architecture, and used it to assess the tightness of derived WCTT bounds. Finally, we reached an interesting conclusion that bigger virtual channel buffers do not necessarily lead to better results, and in many cases can be counter-productive, which is a very important finding for system designers.

Adaptive load distribution in mixed-critical Networks-on-Chip

Modern Networks-on-Chip (NoCs) must accommodate a diversity of temporal requirements e.g. provide guarantees for real-time senders with the minimum impact on performance sensitive best-effort (BE) traffic. In this work, we propose a protocol-based adaptive load distribution which by selectively detouring BE traffic i.e. load balancing, allows to significantly improve NoCs performance without costly hardware extensions. The introduced method offers, during runtime, safe and efficient integration of mixed-critical workloads through the coupling of the flow control with the path selection based on the global NoC state. The requested real-time reliability of the interconnect is achieved through predictable synchronization with control messages supported by a formal analysis and an experimental evaluation.

Online monitoring for safety-critical multicore systems

Abstract Using multicore processors in safety-critical systems is a challenge as well as an opportunity. The real parallelism, which may affect synchronization and determinism, leads to a safety-challenge, because new possible interferences might arise. Additionally, redundant software execution is possible within multicore systems. In complex multicore architectures one of the most important challenges is to know the system behavior and the recognition of any variations from the normal system behavior has to be guaranteed. For those cases it is necessary to monitor several states of the system, configurations, timing, etc. To monitor such a complex system a lot of information from the inside of the system needs to be evaluated without affecting the rest of the MPSoC.