Mixed-criticality Systems Research Articles

Multiple DAGs Dynamic Scheduling for Mixed-Criticality Systems with Communication Contention

Multiple DAGs Dynamic Scheduling for Mixed-Criticality Systems with Communication Contention

Reliability guaranteed energy minimization on mixed-criticality systems

This paper studies the energy minimization problem in mixed-criticality systems that have stringent reliability and deadline constraints. We first analyze the resource demand of a mixed-criticality task set that has both reliability and deadline requirements. Based on the analysis, we present a heuristic task scheduling algorithm that minimizes system’s energy consumption and at the same time also guarantees system’s reliability and deadline constraints. Extensive experiments are conducted to evaluate and validate the performance of the proposed algorithm. The empirical results show that the algorithm further improves energy saving by up to 10% compared with the approaches proposed in our earlier work.

Resource Synchronization and Preemption Thresholds Within Mixed-Criticality Scheduling

In a mixed-criticality system, multiple tasks with different levels of criticality may coexist on the same hardware platform. The scheduling algorithm EDF-VD (Earliest Deadline First with Virtual Deadlines) has been proposed for mixed-criticality systems, which assumes tasks do not share any common resources. We present MC-SRP (Mixed-Criticality Stack Resource Policy), a resource synchronization protocol for EDF-VD, which allows resource sharing among tasks at the same criticality level and guarantees that each task is blocked at most once in each criticality mode. In addition, we present MC-SRPT (MC-SRP with Thresholds) for reducing the application stack size requirement in resource-constrained embedded systems.

Timing Analysis of TTEthernet Traffic

Over time, more and more systems are becoming mixed-criticality systems. As the complexity and size of these systems grow, computation/communication resources should be more efficient than with traditional systems. Time-triggered (TT) Ethernet is a communication infrastructure that enables the use of a single physical communication infrastructure for distributed mixed-criticality applications while providing timely determinism. TTEthernet distinguishes between two traffic categories: The standard event-triggered (ET) traffic and the TT traffic. The latter, for which higher priority is granted, is subject to strong timing guarantees because of strict-periodicity constraint which fixes start-time cycles of TT messages. In addition, messages in an ET Ethernet traffic, which are of lower priority, have a minimum time interval between their transmission. The focus of this paper is on the timing analysis of a TTEthernet traffic by proposing: (i) A feasibility condition allowing to assess the timing requirements of TT messages. (ii) A schedulability condition allowing to check the schedulability of ET messages by taking into account of TT messages scheduling and idle times.

Secure Separation of Shared Caches in AMP-Based Mixed Criticality Systems

The secure separation of functionality is one of the key requirements particularly in mixed criticality systems (MCS). Well-known security models as the multiple independent levels of security (MILS) aim to formalise the isolation of compartments to avoid interference and make them reliable to work in safety critical environments. Especially for in-car multimedia systems, also known as In-Vehicle Infotainment (IVI) systems, the composition of compartments onto a system-on-chip (SoC) offers a wide variety of advantages in embedded system development. The development of such systems implies often the combination of pre-qualified hardware- and software components. These components are CPU subsystems and operating systems, for example. However, the required strict separation can suffer due to the pre-qualified and therefore not reconfigurable hardware components. Particularly, this is true for shared cache levels in CPU subsystems. The phenomena of interference in the concurrent usage of shared last-level caches, are exploitable by adversaries. Therefore, this article identifies the attack surface and proposes a mitigation to prevent from the intentional misuse of the fixed cache association. Generally, the solution is based on a suitable mapping scheme in the intermediate address space of an asymmetric multiprocessing environment which implements the MCS. Furthermore, we evaluate the strength of the approach and show how the solution contributes to a separation property conformal system.

Preemptive Uniprocessor Scheduling of Mixed-Criticality Sporadic Task Systems

Systems in many safety-critical application domains are subject to certification requirements. For any given system, however, it may be the case that only a subset of its functionality is safety-critical and hence subject to certification; the rest of the functionality is non-safety-critical and does not need to be certified, or is certified to lower levels of assurance. The certification-cognizant runtime scheduling of such mixed-criticality systems is considered. An algorithm called EDF-VD (for Earliest Deadline First with Virtual Deadlines) is presented: this algorithm can schedule systems for which any number of criticality levels are defined. Efficient implementations of EDF-VD, as well as associated schedulability tests for determining whether a task system can be correctly scheduled using EDF-VD, are presented. For up to 13 criticality levels, analyses of EDF-VD, based on metrics such as processor speedup factor and utilization bounds, are derived, and conditions under which EDF-VD is optimal with respect to these metrics are identified. Finally, two extensions of EDF-VD are discussed that enhance its applicability. The extensions are aimed at scheduling a wider range of task sets, while preserving the favorable worst-case resource usage guarantees of the basic algorithm.

Schedulability analysis of a graph-based task model for mixed-criticality systems

We present a new graph-based real-time task model that can specify complex job arrival patterns and global state-based mode switching. The mode switching is of a mixed-criticality style, meaning that it allows immediate changes to the parameters of active jobs upon mode switches. The resulting task model generalizes previously proposed task graph models as well as mixed-criticality (sporadic) task models; the merging of these mutually incomparable modeling paradigms allows formulation of new types of tasks. A sufficient schedulability analysis for EDF on preemptive uniprocessors is developed for the proposed model.

Architectural Support for Cyber-Physical Systems

Cyber-physical systems are integrations of computation, communication networks, and physical dynamics. Although time plays a central role in the physical world, all widely used software abstractions lack temporal semantics. The notion of correct execution of a program written in every widely-used programming language today does not depend on the temporal behavior of the program. But temporal behavior matters in almost all systems, and most particularly in cyber-physical systems. In this talk, I will argue that time can and must become part of the semantics of programs for a large class of applications. To illustrate that this is both practical and useful, we will describe a recent effort at Berkeley in the design and implementation of timing-centric software systems. Specifically, I will describe PRET machines, which redefine the instruction-set architecture (ISA) of a microprocessor to embrace temporal semantics. Such machines can be used in high-confidence and safety-critical systems, in energy-constrained systems, in mixed-criticality systems, and as a Real-Time Unit (RTU) that cooperates with a general-purpose processor to provide real-time services, in a manner similar to how a GPU provides graphics services.

Architectural Support for Cyber-Physical Systems

Cyber-physical systems are integrations of computation, communication networks, and physical dynamics. Although time plays a central role in the physical world, all widely used software abstractions lack temporal semantics. The notion of correct execution of a program written in every widely-used programming language today does not depend on the temporal behavior of the program. But temporal behavior matters in almost all systems, and most particularly in cyber-physical systems. In this talk, I will argue that time can and must become part of the semantics of programs for a large class of applications. To illustrate that this is both practical and useful, we will describe a recent effort at Berkeley in the design and implementation of timing-centric software systems. Specifically, I will describe PRET machines, which redefine the instruction-set architecture (ISA) of a microprocessor to embrace temporal semantics. Such machines can be used in high-confidence and safety-critical systems, in energy-constrained systems, in mixed-criticality systems, and as a Real-Time Unit (RTU) that cooperates with a general-purpose processor to provide real-time services, in a manner similar to how a GPU provides graphics services.

MultiPARTES: Multi-core partitioning and virtualization for easing the certification of mixed-criticality systems

The consumer market is continuously pushing for smarter, faster, more durable and cheaper products with ever more complex and sophisticated functionality. Other fields such as safety–critical and dependable applications are not unaware of these requirements, and even impose others (e.g. certification). In the current multi-core era, industry and research entities are facing the important challenge of fulfilling all these requirements, which often impose the necessity for integrating components with different levels of dependability in a single hardware platform. In this scenario, new concerns appear with respect to safety certification of the resulting mixed-criticality systems (e.g. temporal and spatial isolation). This article describes the research effort that is being conducted within the FP7 MultiPARTES project, which is one of the initiatives launched by the European Commission to explore new solutions for developing certifiable mixed-criticality systems using heterogeneous multi-cores. The article explains the proposed development toolset for such systems, presents a proof-of-concept implementation and shows its applicability in a real-world application that needs to be certified, namely a wind-power turbine.

Efficient schedulability analysis for mixed-criticality systems under deadline-based scheduling

Safety-critical avionics systems which become more complex and tend to integrate multiple functionalities with different levels of criticality for better cost and power efficiency are subject to certifications at various levels of rigorousness. In order to simultaneously guarantee temporal constraints at all different levels of assurance mandated by different criticalities, novel scheduling techniques are in need. In this paper, a mixed-criticality sporadic task model with multiple virtual deadlines is built and a certification-cognizant dynamic scheduling approach referred as earliest virtual-deadline first with mixed-criticality (EVDF-MC) is considered, which exploits different relative deadlines of tasks in different criticality modes. As for the corresponding schedulability analysis problem, a sufficient and efficient schedulability test is proposed on the basis of demand-bound functions derived in the mixed-criticality scenario. In addition, a modified simulated annealing (MSA)-based heuristic approach is established for virtual deadlines assignment. Experiments performing simulations with randomly generated tasks indicate that the proposed approach is computationally efficient and competes well against the existing approaches.

Fault-tolerant and real-time scheduling for mixed-criticality systems

The design and analysis of real-time scheduling algorithms for safety-critical systems is a challenging problem due to the temporal dependencies among different design constraints. This paper consi...

A virtualized separation kernel for mixed criticality systems

Multi- and many-core processors are becoming increasingly popular in embedded systems. Many of these processors now feature hardware virtualization capabilities, such as the ARM Cortex A15, and x86 processors with Intel VT-x or AMD-V support. Hardware virtualization offers opportunities to partition physical resources, including processor cores, memory and I/O devices amongst guest virtual machines. Mixed criticality systems and services can then co-exist on the same platform in separate virtual machines. However, traditional virtual machine systems are too expensive because of the costs of trapping into hypervisors to multiplex and manage machine physical resources on behalf of separate guests. For example, hypervisors are needed to schedule separate VMs on physical processor cores. In this paper, we discuss the design of the Quest-V separation kernel, which partitions services of different criticalities in separate virtual machines, or sandboxes. Each sandbox encapsulates a subset of machine physical resources that it manages without requiring intervention of a hypervisor. Moreover, a hypervisor is not needed for normal operation, except to bootstrap the system and establish communication channels between sandboxes.

Mixed-Criticality Systems based on a CAN Router with Support for Fault Isolation and Selective Fault-Tolerance

In many application domains there is an increasing trend for mixed-criticality systems with functions of different assurance levels on shared computing platforms. Today's CAN-based platforms do not support the requirements of mixed-criticality systems. A single CAN bus provides low cost, real-time support and flexibility for applications where the communication service is not safety-relevant. Fault-tolerance extensions for CAN impose incompatibility to legacy applications, high cost and overhead for the entire CAN communication. This paper introduces a CAN infrastructure for fault isolation and selective fault-tolerance, which permits a balanced trade-off between cost and fault-tolerance for each subsystem of a mixed-criticality system. We introduce replicated CAN routers that perform fault isolation based on a priori knowledge of the permitted behavior of CAN nodes. Fault masking is supported selectively through the redundant transmission of messages from safety-critical subsystems. The CAN routers perform input agreement on pending messages for replica deterministic behavior, as well as output agreement on the delivery status of messages. Software layers hide the fault-tolerance mechanisms to establish compatibility to legacy software. The benefits of the proposed communication infrastructure are demonstrated in a simulation of an example system.

Mixed Criticality in Control Systems

The complexity of industrial embedded systems is increasing continuously. Companies try to keep a leading position by offering additional functionalities and services. Systems are to be composed by multiple sensor, actuation and computation subsystems running in a coordinated way on a distributed platform. Due to the increment in processor power, it is possible to allocate a large number of functions in the same platform. This gives rise to mixed-criticality systems, when components with different criticality levels coexist in the same processor. This approach can lead to prohibitive certification costs. A better approach is to rely on partitioned systems, based on a hypervisor that isolates each of the virtual machines in the system. Components with different criticality levels are allocated to different partitions, in order to prevent interferences. The aim of this paper is to introduce mixed-criticality systems, to introduce the most challenging research topics, and to provide some background on the most promising techniques and research activities.

Mixed-criticality design of a satellite software system

The continuous increment of processors computational power and the requirements on additional functionality and services are motivating a change in the way embedded systems are built. Components with different criticality level are allocated in the same processor, which give rise to mixed-criticality systems. The use of partitioned systems is a way of preventing undesirable interferences between components with different criticality level. An hypervisor provides these partitions or virtual machines, ensuring spatial, temporal and fault isolation between them. The purpose of this paper is to illustrate the development of a mixed-critical system. The attitude control subsystem is used for showing the different steps, which are supported by a toolset developed in the context of the MultiPARTES research project

Fixed-priority global scheduling for mixed-criticality real-time systems

There has been a growing interest in recent years in mixed-criticality real-time systems in which tasks are attributed different levels of criticality based on the degree to which their deadlines must be assured. While most of the initial efforts on mixed-criticality systems targeted single-processor systems, the research community has recently started to investigate multiprocessor mixed-criticality real-time systems. In this paper we investigate how global, fixed-priority algorithms can be applied in the context of multiprocessor mixed-criticality systems. We identify the two key dimensions of the problem – priority assignment and schedulability testing, and consider candidate algorithms for each dimension. We also propose a new and simple priority assignment policy called CPRatio that considers both task criticality and timing constraints to improve the schedulability of mixed-criticality task sets. We experimentally evaluate the performance of priority assignment strategies and schedulability tests in the global multiprocessor mixed-criticality scheduling context.

On real-time partitioned multicore systems

Partitioning is a common approach to developing mixed-criticality systems, where partitions are isolated from each other both in the temporal and the spatial domain in order to prevent low-criticality subsystems from compromising other subsystems with high level of criticality in case of misbehaviour. The advent of many-core processors, on the other hand, opens the way to highly parallel systems in which all partitions can be allocated to dedicated processor cores. This trend will simplify processor scheduling, although other issues such as mutual interference in the temporal domain may arise as a consequence of memory and device sharing. The paper describes an architecture for multi-core partitioned systems including critical subsystems built with the Ada Ravenscar profile. Some implementation issues are discussed, and experience on implementing the ORK kernel on the XtratuM partitioning hypervisor is presented.

Multi-layered scheduling of mixed-criticality cyber-physical systems

In this paper, we deal with the schedule synthesis problem of mixed-criticality cyber-physical systems (MCCPS), which are composed of hard real-time tasks and feedback control tasks. The real-time tasks are associated with deadlines that must always be satisfied whereas feedback control tasks are characterized by their Quality of Control (QoC) which needs to be optimized. A straight-forward approach to the above scheduling problem is to translate the QoC requirements into deadline constraints and then, to apply traditional real-time scheduling techniques such as Deadline Monotonic (DM). In this work, we show that such scheduling leads to overly conservative results and hence is not efficient in the above context. On the other hand, methods from the mixed-criticality systems (MC) literature mainly focus on tasks with different criticality levels and certification issues. However, in MCCPS, the tasks may not be fully characterized by only criticality levels, but they may further be classified according to their criticality types, e.g., deadline-critical real-time tasks and QoC-critical feedback control tasks. On the contrary to traditional deadline-driven scheduling, scheduling MCCPS requires to integrate both, deadline-driven and QoC-driven techniques which gives rise to a challenging scheduling problem. In this paper, we present a multi-layered schedule synthesis scheme for MCCPS that aims to jointly schedule deadline-critical, and QoC-critical tasks at different scheduling layers. Our scheduling framework (i) integrates a number of QoC-oriented metrics to capture the QoC requirements in the schedule synthesis (ii) uses arrival curves from real-time calculus which allow a general characterization of task triggering patterns compared to simple task models such as periodic or sporadic, and (iii) has pseudo-polynomial complexity. Finally, we show the applicability of our scheduling scheme by a number of experiments.

Architecture for adaptive resource assignment to virtualized mixed-criticality real-time systems

System virtualization is a powerful approach for the creation of integrated systems, which meet the high functionality and reliability requirements of complex embedded applications. It is in particular well-suited for mixed-criticality systems, since the often applied pessimistic manner of critical system engineering leads to heavily under-utilized resources. Existing static resource management approaches for virtualized systems are inappropriate for the dynamically varying resource requirements of upcoming adaptive systems. In this paper, we propose a dynamic resource management protocol for system virtualization that factors criticality levels in and allows the addition of subsystems at runtime. The two-level architecture offers flexibility across virtual machine borders and has the potential to improve the resource utilization. In addition, it provides the capability to adapt at runtime according to defects or changes of the environment.