Mixed Criticality Research Articles

SLOPE: Safety LOg PEripherals implementation and software drivers for a safe RISC-V microcontroller unit

The focus of this manuscript is related to the main safety issues regarding a mixed criticality system running multiple concurrent tasks. Our concerns are related to the guarantee of Freedom of Interference between concurrent partitions, and to the respect of the Worst Case Execution Time for tasks. Moreover, we are interested in the evaluation of resources budgeting and the study of system behavior in case of occurring random hardware failures. In this paper we present a set of Safety LOg PEripherals (SLOPE): Performance Monitoring Unit (PMU), Execution Tracing Unit (ETU), Error Management Unit (EMU), Time Management Unit (TMU) and Data Log Unit (DLU); then, an implementation of SLOPE on a single core RISC-V architecture is proposed. Such peripherals are able to collect software and hardware information about execution, and eventually trigger recovery actions to mitigate a possible dangerous misbehavior. We show results of the hardware implementation and software testing of the units with a dedicated software library. For the PMU we standardized the software layer according to embedded Performance Application Programming Interface (ePAPI), and compared its functionality with a bare-metal use of the library. To test the ETU we compared the hardware simulation results with software ones, to understand if overflow may occur in internal hardware buffers during tracing. In conclusion, designed devices introduce new instruments for system investigation for RISC-V technologies and can generate an execution profile for safety related tasks.

Providing spatial isolation for Mixed-Criticality Systems

Hard real-time systems, characterized by stringent timeliness requirements, occur in an increasing variety of industrial sectors. Some such domains carry important safety-critical concerns, notably avionics, space, and automotive. One common design trend across those domains seeks to reduce the number of computing devices embedded in them by integrating software applications of different criticality levels into one and the same onboard computer. A safety-savvy design approach however requires isolation among components of different criticality, to prevent unintended reciprocal interference across them. Isolation is traditionally achieved through partitioning. Partitioning, however, incurs low resource utilization as cautionary margins are used to inflate partition budgets over their anticipated needs. This situation has prompted research into alternative ways to integration that can safely afford higher levels of utilization. The Mixed-Criticality (MC) approach, which concentrates on the CPU scheduling problem, has yielded a large body of research results that show considerable gains in sustained utilization, but it has yet to meet all of the isolation requirements of safety-critical systems. This work presents a solution to augment a state-of-the-art MC solution with efficient and effective spatial isolation capabilities. Experimental results show that our solution provides adequate guarantees of temporal and spatial isolation with very small runtime overhead.

IMC-PnG: Maximizing runtime performance and timing guarantee for imprecise mixed-criticality real-time scheduling

Mixed-Criticality (MC) systems have successfully overcome the limitation of traditional real-time systems based on pessimistic Worst-Case Execution Times (WCETs), by using different WCETs depending on different criticalities. One of the important yet unsolved problems of current MC systems is to achieve two goals (G1 and G2) for low-criticality tasks without compromising timing guarantees for high-criticality tasks: (G1) providing a certain (degraded) level of timing guarantees for all low-criticality tasks; (G2) while maximizing the fully-serviced (non-degraded) execution of low-criticality tasks. To address the problem, we propose IMC-PnG, an MC scheduling framework, which employs two salient features: a task-level virtual-deadline assignment under the imprecise computing model with efficient resource utilization (supporting G1), and an online scheduling algorithm that dynamically changes criticality levels of individual tasks at runtime (supporting G2). In simulation results with random workloads, we showed that IMC-PnG has up to 12.10% higher schedulability and up to 42.10% higher runtime performance (measured by the fully-serviced ratio of low-criticality tasks) than the existing approaches.

CAMP: a hierarchical cache architecture for multi-core mixed criticality processors

CAMP proposes a hierarchical cache subsystem for multi-core mixed criticality processors, focusing on ensuring worst-case execution time (WCET) predictability in automotive applications. It incorporates criticality-aware locked L1 and L2 caches, reconfigurable at mode change intervals, along with criticality-aware last level cache partitioning. Evaluation using CACOSIM, Moola Multicore simulator, and CACTI simulation tools confirms the suitability of CAMP for keeping high-criticality jobs within timing budgets. A practical case study involving an automotive wake-up controller using the sniper v7.2 architecture simulator further validates its usability in real-world mixed criticality applications. CAMP presents a promising cache architecture for optimized multi-core mixed criticality systems.

Evaluating virtualization for fog monitoring of real-time applications in mixed-criticality systems

Technological advances in embedded systems and the advent of fog computing led to improved quality of service of applications of cyber-physical systems. In fact, the deployment of such applications on powerful and heterogeneous embedded systems, such as multiprocessors system-on-chips (MPSoCs), allows them to meet latency requirements and real-time operation. Highly relevant to the industry and our reference case-study, the challenging field of nuclear fusion deploys the aforementioned applications, involving high-frequency control with hard real-time and safety constraints. The use of fog computing and MPSoCs is promising to achieve safety, low latency, and timeliness of such control. Indeed, on one hand, applications designed according to fog computing distribute computation across hierarchically organized and geographically distributed edge devices, enabling timely anomaly detection during high-frequency sampling of time series, and, on the other hand, MPSoCs allow leveraging fog computing and integrating monitoring by deploying tasks on a flexible platform suited for mixed-criticality software, leading to so-called mixed criticality systems (MCSs). However, the integration of such software on the same MPSoC opens challenges related to predictability and reliability guarantees, as tasks interfering with each other when accessing the same shared MPSoC resources may introduce non-deterministic latency, possibly leading to failures on account of deadline overruns. Addressing the design, deployment, and evaluation of MCSs on MPSoCs, we propose a model-based system development process that facilitates the integration of real-time and monitoring software on the same platform by means of a formal notation for modeling the design and deployment of MPSoCs. The proposed notation allows developers to leverage embedded hypervisors for monitoring real-time applications and guaranteeing predictability by isolation of hardware resources. Providing evidence of the feasibility of our system development process and evaluating the industry-relevant class of nuclear fusion applications, we experiment with a safety-critical case-study in the context of the ITER nuclear fusion reactor. Our experimentation involves the design and evaluation of several prototypes deployed as MCSs on a virtualized MPSoC, showing that deployment choices linked to the monitor placement and virtualization configurations (e.g., resource allocation, partitioning, and scheduling policies) can significantly impact the predictability of MCSs in terms of Worst-Case Execution Times and other related metrics.

McDVFS: cycle conserving DVFS scheduler for multi-core mixed criticality systems

Multi-core architectures have grown to be a popular choice for deploying Mixed Criticality Systems (MCS). The focus of research in MCS has been to provide timing assurances for jobs with different criticality levels. Due to their significant processing demands and energy-aware/constrained nature, energy conservation in these systems is becoming mandatory. This article presents, mcDVFS, an energy management technique based on Dynamic-Voltage-and-Frequency-Scaling for multi-core MCS. mcDVFS achieves significant energy reduction while maintaining timing guarantees. It also prioritizes quality of service whenever feasible. Extensive experimental simulations show energy savings of ≈ 52% and 34% when compared to EDF-VD and EDF-VD with QoS.

Scheduling Complex Cyber-Physical Systems with Mixed-Criticality Components

Two emerging trends for designing a complex, cyber-physical systems are the component-based and mixed-criticality (MC) approaches. A component-based approach independently develops individual components and subsequently integrates them to reduce system complexity. This approach provides strong isolation among components but incurs resource inefficiency. Alternatively, an MC approach integrates components of different criticality with different levels of guarantee for resource efficiency, while components are not isolated. To leverage MC and component-based approaches, we investigate how to balance component isolation and resource efficiency under component-based MC systems. We introduce the concept of component-MC schedulability, where isolated tasks are protected from external events outside the component, and shared tasks may be suspended for the critical events of other components. Under component-MC schedulability, we propose a component-based mixed-criticality scheduling framework with dynamic resource allocation (CMC-DRA), which suspends low-criticality tasks differently depending on internal or external component behavior. We also develop scheduling semantics and analyze the schedulability for CMC-DRA. Through simulation on synthetic workloads, we demonstrate that CMC-DRA has up to 88.3% higher schedulability than existing approaches and reduces the deadline miss ratio by up to 47.7%.

DVFS-based energy-aware scheduling of imprecise mixed-criticality real-time tasks

Energy-aware mixed-criticality (MC) real-time scheduling has attracted the attention of many researchers. However, they only focus on the conventional MC task model, in which all low-criticality (LO) tasks are discarded in the high-criticality (HI) mode. In this work, we focus on an imprecise mixed-criticality (IMC) task model that provides degraded service for LO tasks in HI mode. Firstly, we address the energy minimization problem of scheduling IMC task sets with dynamic voltage and frequency scaling (DVFS). Secondly, we present an energy-aware IMC scheduling algorithm (EA-IMC) to solve this problem while it schedules tasks with the energy-efficient speed of the LO mode SLO, and the maximum processor speed Smax in HI mode. Finally, the experiments are applied to evaluate the EA-IMC algorithm and the experimental results show that it can achieve on average 24.55% energy reduction compared with the existing algorithms.

Multi-Core Time-Triggered OCBP-Based Scheduling for Mixed Criticality Periodic Task Systems.

Mixed criticality systems are one of the relatively new directions of development for the classical real-time systems. As the real-time embedded systems become more and more complex, incorporating different tasks with different criticality levels, the continuous development of mixed criticality systems is only natural. These systems have practically entered every field where embedded systems are present: avionics, automotive, medical systems, wearable devices, home automation, industry and even the Internet of Things. While scheduling techniques have already been proposed in the literature for different types of mixed criticality systems, the number of papers addressing multiprocessor platforms running in a time-triggered mixed criticality environment is relatively low. These algorithms are easier to certify due to their complete determinism and isolation between components of different criticalities. Our research has centered on the problem of real-time scheduling on multiprocessor platforms for periodic tasks in a time-triggered mixed criticality environment. A partitioned, non-preemptive, table-driven scheduling algorithm was proposed, called Partitioned Time-Triggered Own Criticality Based Priority, based on a uniprocessor mixed criticality method. Furthermore, an analysis of the scheduling algorithm is provided in terms of success ratio by comparing it against an event-driven and a time-triggered method.

SACRED

Collaborative research is an opportunity to bring creative minds together and blend multiple disciplines to churn out innovative solutions. In this era of massive social media and information overload, a streamlined process framework with best practices and procedures is a requirement for genuine scientific collaboration. The main aim of this work is to bring forth a software-centric framework for harmonizing research. SACRED is the outcome of experiences gained during the development of ‘ARMS'-An Analysis Framework for Mixed Criticality Systems. ARMS is a collaborative platform to disseminate research and literature in real-time mixed criticality systems. ARMS is hosted on Amazon Amplify with the user interface implemented using the ReactJS framework. SACRED summarizes the software-centric process, practices and procedures followed, and renders it for similar collaborations in the future.

Precise Mixed-Criticality Scheduling on Varying-Speed Multiprocessors

While traditional real-time systems analysis requires single pessimistic estimates to represent system parameters, the mixed-criticality (MC) design proposes to use multiple estimates of system parameters with different levels of pessimism, resulting in low critical workloads sacrificed at run-time in order to provide guarantees to high critical workloads. Shortcomings of the MC design were improved recently by the precise MC scheduling technique in which the processor speed is increased at run-time to provide guarantees to both low and high critical workloads. Aiming to extend the precise MC scheduling to multiprocessor computing platforms, this paper proposes three novel scheduling algorithms that are based on virtual-deadline and fluid-scheduling approaches. We prove the correctness of our proposed algorithms through schedulability analysis and also present their theoretical effectiveness via speedup bounds and approximation factor calculations. Finally, we evaluate their performance experimentally via randomly generated task sets and demonstrate that the fluid-scheduling algorithms outperform the virtual-deadline algorithm.

Task models for mixed criticality systems - a review

Task models for mixed criticality systems - a review

BOT-MICS: Bounding Time Using Analytics in Mixed-Criticality Systems

An increasing trend for reducing cost, space, and weight leads to modern embedded systems that execute multiple tasks with different criticality levels on a common hardware platform while guaranteeing a safe operation. In such mixed-criticality (MC) systems, multiple worst case execution times (WCETs) are defined for each task, corresponding to the system operation mode to improve the MC system’s timing behavior at runtime. Determining the appropriate WCETs for lower criticality (LC) modes is nontrivial. On the one hand, considering a very low WCET for tasks can improve the processor utilization by scheduling more tasks in that mode, on the other hand, using a larger WCET ensures that the mode switches (which causes by task overrunning) are minimized, thereby improving the quality of service for all tasks, albeit at the cost of processor utilization. Hitherto, no analytical solutions are proposed to determine WCETs in LC modes. In this regard, we propose a scheme to determine WCETs by the Chebyshev theorem, to make a tradeoff between the number of scheduled tasks at design-time and the number of dropped low-criticality tasks at runtime as a result of frequent mode switches. To have a tight bound of execution times and mode switching probability, we also propose a distribution analytics-based scheme, in which the mode switching probability is obtained based on the cumulative distribution function. Our experimental results show that our scheme improves the utilization of state-of-the-art MC systems by up to 72.27%, while maintaining 24.28% mode switching probability in the worst case scenario. Besides, the results of running embedded real-time benchmarks on a real platform show that the distribution-based scheme can improve the utilization by 7.30% while bounding the mode switching probability by 4.85% more, compared to the Chebyshev-based scheme.

Energy-Aware Nonpreemptive Scheduling of Mixed-Criticality Real-Time Task Systems

Energy-aware real-time scheduling for mixed-criticality (MC) systems with different criticality levels has drawn many researchers’ attentions. However, most of the studies focus on the preemptive MC task model and few studies consider the nonpreemptive MC task model, in which all jobs cannot be preempted until completion. In this article, we address the energy minimization problem for MC systems with nonpreemptive dynamic priority scheduling. First, we develop schedulability test of nonpreemptive earliest deadline first (NP-EDF) in single processor MC systems. Second, we extend the results to nonpreemptive earliest deadline first with virtual deadline (NP-EDFVD), which is the first attempt for nonpreemptive dynamic priority scheduling in single processor MC systems. Third, the energy-aware nonpreemptive scheduling algorithm (EANPS) based on NP-EDFVD is proposed to solve the energy minimization problem for MC systems with nonpreemptive dynamic priority scheduling. Finally, an industrial use-case and extensive simulations are used to validate the performance of the proposed algorithm, and the experimental results show that the EANPS algorithm consumes average 25.72% less energy than that of NP-EDFVD.

Energy aware fixed priority scheduling in mixed-criticality systems

Most of studies about energy management for MC systems are based on dynamic priority scheme. The disadvantages of dynamic priority scheme are high system overhead and poor predictability. Unlike previous studies, we focus on the problem of scheduling mixed-criticality (MC) periodic tasks with minimizing energy consumption in MC systems based on fixed priority scheme. Firstly, we explain a criticality rate monotonic scheduling (CRMS) and propose the sufficient schedulability condition of CRMS. Secondly, we compute the energy minimization uniform scaled speed and present an optimal static solution algorithm based on CRMS. The extra workload of the high criticality level (HI) task executes with the maximum processor speed in the high criticality mode (HI-mode). But this algorithm does not exploit the slack time generated from the HI task in the low criticality mode (LO-mode). For energy efficiency, we propose a dynamic fixed priority energy minimization algorithm which exploits the slack time generated from the HI task in LO-mode to save energy. In addition, it combines a dynamic voltage and frequency scaling technique and a dynamic power management technique to reduce energy consumption. Finally, the experiments are applied to evaluate the performance of the proposed algorithm and the experimental results show that the proposed algorithm can save up 23.89% energy compared with other existing algorithms.

Necessary Feasibility Analysis for Mixed-Criticality Real-Time Embedded Systems

As multiple software components with different safety-criticality levels are integrated on a shared computing platform, a real-time embedded system becomes a mixed-criticality (MC) system, which should provide timing guarantees at all different levels of assurance to software components with different criticality levels. In the real-time systems community, the concept of an MC system is regarded as a promising, emerging solution to solve an inherent challenge of real-time systems: pessimistic reservation of computing resources, which yields a low resource-utilization for the sake of guaranteeing timing requirements. Since a timing guarantee should be provided before a real-time system starts to operate, its feasibility has been extensively studied for single-criticality systems; however, the same cannot be said for MC systems. In this article, we develop necessary feasibility tests for MC real-time embedded systems, which is the first study that yields non-trivial results for MC necessary feasibility on both uniprocessor and multiprocessor platforms. To this end, we investigate characteristics of MC necessary feasibility conditions, and identify new challenges posed by the characteristics. By addressing those challenges, we develop two collective necessary feasibility tests and their simplified versions, which are able to exploit a tradeoff between capability in finding infeasible task sets and time-complexity. The simulation results demonstrate that the proposed tests find a number of additional infeasible task sets for both uniprocessor and multiprocessor platforms, which have been proven neither feasible nor infeasible by any existing studies.

Learning-Oriented QoS- and Drop-Aware Task Scheduling for Mixed-Criticality Systems

In Mixed-Criticality (MC) systems, multiple functions with different levels of criticality are integrated into a common platform in order to meet the intended space, cost, and timing requirements in all criticality levels. To guarantee the correct, and on-time execution of higher criticality tasks in emergency modes, various design-time scheduling policies have been recently presented. These techniques are mostly pessimistic, as the occurrence of worst-case scenario at run-time is a rare event. Nevertheless, they lead to an under-utilized system due to frequent drops of Low-Criticality (LC) tasks, and creation of unused slack times due to the quick execution of high-criticality tasks. Accordingly, this paper proposes a novel optimistic scheme, that introduces a learning-based drop-aware task scheduling mechanism, which carefully monitors the alterations in the behaviour of the MC system at run-time, to exploit the generated dynamic slacks for reducing the LC tasks penalty and preventing frequent drops of LC tasks in the future. Based on an extensive set of experiments, our observations have shown that the proposed approach exploits accumulated dynamic slack generated at run-time, by 9.84% more on average compared to existing works, and is able to reduce the deadline miss rate by up to 51.78%, and 33.27% on average, compared to state-of-the-art works.

Supporting ultra-low latency mixed-criticality communication using hardware-based data plane architecture

Recent advances in embedded computing and networking technologies have led to a growing presence of Cyber–Physical Systems (CPS). An important trend is that recent CPS are typically composed of Mixed-Criticality (MC) systems that integrate multiple components with different criticality levels into shared networked systems and schedule them with different policies according to the system mode. In order to enable such MC scheduling, it is essential that CPS networking systems support mode detection and transition mechanisms. However, to the best of our knowledge, no study has focused on supporting such key mechanisms considering the crucial emerging CPS requirements: high bandwidth and ultra-low latency (ULL). To address this, we propose MC-HDP, an Ethernet-based CPS networking system that can provide such mode management mechanisms capable of meeting the ULL requirement (i.e., μs-level). The proposed system extends Ethernet switches by employing hardware-based internal components, carefully designed to reduce and bound delay/overhead for mode detection and transition. Based on the system design, we derive an analytic delay bound for mode changes. For evaluation, we implemented a prototype of MC-HDP on top of NetFPGA-SUME and built a precise measurement environment using an in-house ULL packet generating tool. The evaluation result shows that MC-HDP achieves μs-level mode change delay (i.e., up to 4.66 μs in our setup), while the state-of-the-art mixed-criticality SDN and the standard SDN systems result in up to 2.63 and 117.2 ms of the mode change delays, respectively. The result proves that MC-HDP is highly effective in supporting the MC scheduling with ULL requirements, based on this improved mode change delay faster than the standard SDN by four orders of magnitude.

Sharing Method of Online Teaching Resources of Spoken English Based on Deep Learning

In order to improve the sharing effect of online teaching resources of spoken English, this paper considers the sharing of resources among tasks in a mixed criticality system based on fixed task priority scheduling. Moreover, this paper extends the traditional PCP protocol and proposes a resource sharing protocol suitable for the AMC scheduling model in a verifiable hybrid criticality system. In addition, with the support of deep learning, this paper analyzes the worst blocking time and the worst response time of the task at each stage. Finally, this paper analyzes the sharing methods of online teaching resources of spoken English in combination with deep learning methods and constructs a corresponding intelligent teaching resource sharing system. The experimental research results show that the sharing method of online teaching resources of spoken English based on deep learning has a good resource sharing effect.

Formal Specification and Verification of Data Separation for Muen Separation Kernel

Introduction: Development of integrated mixed-criticality systems is becoming increasingly popular for application-specific systems, which needs separation mechanism for available onboard resources and the processors equipped with hardware virtualization. Hardware virtualization allow the partitions to physical resources, which include processor cores, memory, and I/O devices, among guest virtual machines (VMs). For building mixed criticality computing environment, traditional virtual machine systems are inappropriate because they use hypervisors to schedule separate VMs on physical processor cores. In this article, we discuss the design of an environment for mixed-criticality systems: The Muen an x86/64 separation kernel for high assurance. The Muen Separation Kernel is an Open Source microkernel which has no runtime errors at the source code level. The Muen separation kernel has been designed precisely to encounter the challenging requirements of high-assurance systems built on the Intel x86/64 platform. Muen is under active development, and none of the kernel properties of it has been verified yet. In this paper, we present a novel work of verifying one of the kernel properties formally. Method: The CTL used in NuSMV is a first-order modal along with data-depended processes and regular formulas. CTL is a branching-time logic, meaning that its model of time is a tree-like structure in which the future is not determined; there are different paths in the future, any one of which might be an actual path that is realized . This section shows the verification of all the requirements mentioned in section 3. In NuSMV tool the command used for verification of the formulas written in CTL is checkctlspec -p ”CTL-expression”. The nearest quantifier binds each occurrence of a variable in the scope of the bound variable, which has the same name and the same number of arguments. Result: Formal methods have been applied to various projects for specification and verification purpose. Some of them are the SCOMP , SeaView , LOCK,and Multinet Gateway projects. The TLS was written formally. Several mappings were done between the TLS and the SCOMP code: Informal English language to TLS, TLS to actual code , and TLS to pseudo-code. The authors present an ACL2 model for a generic separation kernel also known as GWV approach. Conclusion: We consider the formal verification of data separation property which is one of the crucial modules to achieve the separation functionality. The verification of the data separation manager is carried out on the design level using the NuSMV tool. Furthermore, we present the complete model of the data separation unit along with its code written in the NuSMV modelling language. Finally, we have converted the non-functional requirements into the formal logic, which then has verified the model formally.