Work in Progress: Efficient TSN network interface handling in a mixed criticality system

Safety-critical cyber-physical systems like autonomous cars require not only different levels of assurance, but also close interactions with dynamically-changing physical environments. While the former has been studied extensively by exploiting the notion of mixed-criticality (MC) systems, the latter has not, especially in conjunction with MC systems. To fill this important gap, we conduct an in-depth case study, demonstrating the importance of capturing current physical states, and introduce the problem of achieving efficient utilization of computing resources under varying physical states in MC systems. To solve this problem, we first develop a physical-state-aware MC task model, which is a generalization of the existing basic MC task model. We then propose new slack concepts tailored to the new task model, which enable efficient utilization of computing resources for MC systems. Finally, we develop a physical-state-aware dynamic slack management framework and demonstrate how to utilize the new MC task model and slack concepts towards efficient system utilization. We show, via a case study and in-depth evaluation, that the proposed framework makes 20x less low-criticality jobs dropped over a popular MC scheduling algorithm without compromising the MC-schedulability requirements.

Mixing tasks of different criticality levels on the same processor has become common in modern embedded systems. Scheduling these complex systems on multicore processors is difficult, especially when targeting high utilization. The overload in mixed criticality systems is one of the important problems that faces system designers and may force them to lower the cores utilization to avoid this risky problem. If a fully utilized system is overloaded and no solution is applied, many of coming jobs will miss their deadlines and the system may stay overloaded all the time and never return back to its normal behavior. So, the overload must be transient and the system should guarantee that it can return back its normal behavior shortly after overload happens. In this paper, we present a kernel-based solution for the overload in mixed criticality systems using virtual time. A virtual timer delays the release time and deadlines of tasks in an overload state for a short time to guarantee that it can return back as quickly as possible to its normal behavior. The proposed solution avoids using any user space invocation, as it detects the overload and recovers from it completely inside the kernel space. Our experiments show that the time to recover from overload once it happens is decreased using our proposed technique.

In the field of real-time systems, component-based models for mixed criticality systems (MCS) on multicore platform are gaining significant attention of the researchers from the recent past. The concept of mixed-criticality is firstly applied on single core systems but after gaining attention, it evolved to multicore platform. Initially, the tasks of MCS executes in low mode however if a task having high criticality does not its scheduling requirements complete its low mode, then the system switch to high mode. In high mode, only high critical tasks executes its high mode scheduling requirements, while all low tasks are discarded from further execution. In the realm of MCS, the component-based model have high importance and has been used in large and complex real-time systems. In component-based model, the component of a system is splatted into multiple components. In this study, a new component-based scheduling approach is proposed for multicore MCS. In the multicore mixed-criticality compositional framework, special emphasis is given on deriving the supply bound function, which represents available core supply, and the demand bound function, which indicates the requirements of resources for scheduling. A mixed-criticality multicore compositional framework (MMCF) is introduced for component-based MCS having tightened deadline. For the proposed strategy, a schedulability analysis is conducted, ensuring that the system can be scheduled only if the supply bound function is equal to or less than the demand bound function. On a 4-core platform, the scheduleability for the three scheduling strategies i.e. MMCF, MC-Partition, and Global are shown at different utilization levels of resource. 100% schedulability is shown by the proposed MMCF, MC-Partition, and global techniques for target utilizations of 0.7, 0.5, and 0.4, respectively. For a given utilization U=0.6, the proposed MMCF approach shows 100 % schedulability, while the MC-partition and global approaches show 90% and 20% schedulabilities respectively. It shows that the proposed MMCF approach schedules 10% and 80% more task sets than the MC-partition and global approaches respectively. The experimental results reveal that the proposed MMCF approach offers better schedulability than the other two approaches.

Mixed criticality systems are one of the relatively new directions of development for the classical real-time systems. As the real-time embedded systems become more and more complex, incorporating different tasks with different criticality levels, the continuous development of mixed criticality systems is only natural. These systems have practically entered every field where embedded systems are present: avionics, automotive, medical systems, wearable devices, home automation, industry and even the Internet of Things. While scheduling techniques have already been proposed in the literature for different types of mixed criticality systems, the number of papers addressing multiprocessor platforms running in a time-triggered mixed criticality environment is relatively low. These algorithms are easier to certify due to their complete determinism and isolation between components of different criticalities. Our research has centered on the problem of real-time scheduling on multiprocessor platforms for periodic tasks in a time-triggered mixed criticality environment. A partitioned, non-preemptive, table-driven scheduling algorithm was proposed, called Partitioned Time-Triggered Own Criticality Based Priority, based on a uniprocessor mixed criticality method. Furthermore, an analysis of the scheduling algorithm is provided in terms of success ratio by comparing it against an event-driven and a time-triggered method.

Multi-core architectures have grown to be a popular choice for deploying Mixed Criticality Systems (MCS). The focus of research in MCS has been to provide timing assurances for jobs with different criticality levels. Due to their significant processing demands and energy-aware/constrained nature, energy conservation in these systems is becoming mandatory. This article presents, mcDVFS, an energy management technique based on Dynamic-Voltage-and-Frequency-Scaling for multi-core MCS. mcDVFS achieves significant energy reduction while maintaining timing guarantees. It also prioritizes quality of service whenever feasible. Extensive experimental simulations show energy savings of ≈ 52% and 34% when compared to EDF-VD and EDF-VD with QoS.

Formal analysis of feature degradation in fault-tolerant automotive systems

An increasing trend in many safety-critical embedded system is to integrate multiple functional components into a shared hardware platform for better cost and power efficiency. This mixed criticality system offers challenges both for static schedulability analysis and run-time monitoring. In prior works, many papers studied the response-time analysis (RTA) scheduling of mixed criticality systems with dual-criticality levels. But in the real embedded systems, the criticality levels of the systems are always greater than two. In this paper we proposed a novel sufficient response-time analysis and optimal priority assignment scheme for fixed priority uniprocessor scheduling of mixed criticality system with arbitrary number of criticality levels. Evaluations illustrate the effectiveness of the scheme.

Embedded systems are pervasively used in many fields nowadays. In mixed-criticality environments (automotive, industry 4.0, drones, etc.) they need to run real-time applications with certain time and safety constraints alongside a rich operating system (OS). This is usually possible thanks to virtualization techniques, that leverage on hardware virtualization extensions on the machine. However, these hardware extensions might not cope with the security and safety requirements of the specific use case, and additionally, they might not always be available. A notable example is the emerging RISC-V architecture, that is today gaining a lot of traction in the mixed criticality field, but that does not offer today hardware virtualization extensions. In this paper VOSySmonitoRV is proposed as a mixed-criticality solution for RISC-V systems. VOSySmonitoRV allows the co-execution of two or more operating systems in a secure and isolated manner by running in the highest privileged machine level. A specific benchmark, measuring the interrupt latency and context switch time is done to assess the system performance in mixed criticality systems.

A trend in automotive infotainment software is to create a separation of components based on different domains (e.g. Navigation, Radio, etc.). This intends to limit susceptibility to errors, simplify maintainability and to organize development based on domains. Multi-OS environments create another layer of separation through hardware/software virtualization. Using a hypervisor for virtualization allows the development of mixed critical systems. However, we see a contradiction in current architectures, which on one side aim to separate everything into virtual machines (VMs), while on the other side allow inter-VM-connectivity. In the end all applications are composited into one homogeneous UI and the previous intent of separation is disregarded.In this paper we investigate current architectures for in-vehicle infotainment systems (IVIS), i.e. mixed critical systems for automotive purposes, and show that regulations and/or requirements break the previous intents of the architecture.

The increasing trend towards mixed-criticality in different domains demands a platform in which the physical integration of subsystems with different criticalities is accommodated. A fundamental prerequisite for such a platform is to establish temporal and spatial segregation between different subsystems in order to eliminate the interference on safety-critical functions, caused by non-safety-critical ones. Furthermore, as mixed-criticality systems often comprise heterogeneous subsystems, the platform shall support different timing models (e.g., periodic and sporadic activities). This paper introduces an extension layer for the Network Interface (NI) of a network-on-a-chip in order to establish the temporal and spatial partitioning over the entire chip. We describe how chip-wide temporally aligned activities of different NIs in combination with resource allocations assure the absence of interference for time-triggered messages and bounded latencies for rate-constrained messages. The chip-wide configuration of the NIs establishes guarding windows for time-triggered messages and traffic shaping of rate-constrained messages.

With a rapidly aging population, the healthcare community will soon face severe medical personnel shortage and rising costs. Pervasive Health Monitoring Systems (PHMS) can help alleviate this situation. PHMS provides continuous real-time monitoring of a person’s health using a (usually wireless) network of medical and ambient sensors/devices on the host (patients), called Body Area Networks (BANs). The sensitive nature of health information collected by PHMS mandates that patient’s privacy be protected by securing the medical data from any unauthorized access. The authors’ approach for addressing these issues focuses on a key observation that PHMS are cyber-physical systems (CPS). Cyber-physical systems are networked, computational platforms, deeply embedded in specific physical processes for monitoring and actuation purposes. In this work, they therefore present a novel perspective on securing PHMS, called Cyber Physical Security (CYPSec) solutions. CYPSec solutions are environmentally-coupled security solutions, which operate by combining traditional security primitives along with environmental features. Its use results in not only secure operation of a system but also the emergence of additional “allied” properties which enhance its overall capabilities. The principal focus of this chapter is the development of a new security approach for PHMS called CYPsec that leverages their cyber-physical nature. The authors illustrate the design issues and principals of CYPSec through two specific examples of this generic approach: (a) Physiological Signal based key Agreement (PSKA) is designed to enable automated key agreement between sensors in the BAN based on physiological signals from the body; and (b) Criticality Aware Access Control (CAAC) which has the ability to provide controlled opening of the system for emergency management. Further, they also discuss aspects such as altered threat-model, increased complexity, non-determinism, and mixed critical systems, that must be addressed to make CYPSec a reality.

In this paper, we revisit and refine our previous research on schedulability testing for fixed set of dual-critical jobs. Such systems can be tested for tight job termination time bounds using simulation, under the prerequisite that the scheduling policy be predictable. We give a more precise, less restrictive generalization of the notion of predictability to mixed criticality systems. We prove that this property is inherent for an important class of scheduling policies and that it justifies testing the system using basic scenarios.

A common trend in real-time embedded systems is to integrate multiple applications on a single platform. Such systems are known as mixed-criticality (MC) systems when the applications are characterized by different criticality levels. Nowadays, multicore platforms are promoted due to cost and performance benefits. However, certification of multicore MC systems is challenging as concurrently executed applications of different criticalities may block each other when accessing shared platform resources. Most of the existing research on multicore MC scheduling ignores the effects of resource sharing on the response times of applications. Recently, a MC scheduling strategy was proposed, which explicitly accounts for these effects. This paper discusses how to combine this policy with an optimization method for the partitioning of tasks to cores as well as the static mapping of memory blocks, i.e., task data and communication buffers, to the banks of a shared memory architecture. Optimization is performed at design time targeting at minimizing the worst-case response times of tasks and achieving efficient resource utilization. The proposed optimization method is evaluated using an industrial application.

The cluster-based technique is gaining focus for scheduling tasks of mixed-criticality (MC) real-time multicore systems. In this technique, the cores of the MC system are distributed in groups known as clusters. When all cores are distributed in clusters, the tasks are partitioned into clusters, which are scheduled on the cores within each cluster using a global approach. In this study, a cluster-based technique is adopted for scheduling tasks of real-time mixed-criticality systems (MCS). The Decreasing Criticality Decreasing Utilization with the worst-fit (DCDU-WF) technique is used for partitioning of tasks to clusters, whereas a novel mixed-criticality cluster-based boundary fair (MC-Bfair) scheduling approach is used for scheduling tasks on cores within clusters. The MC-Bfair scheduling algorithm reduces the number context switches and migration of tasks, which minimizes the overhead of mixed-criticality tasks. The migration and context switch overhead time is added at the time of each migration and context switch respectively for a task. In low critical mode, the low mode context switch and migration overhead time is added to task execution time, while the high mode overhead time of migration and context switch is added to the execution time of a task in high critical mode. The results obtained from experiments show the better schedulablity performance of proposed cluster-based technique as compared to cluster-based fixed priority (CB-FP), MC-EKG-VD-1, global and partitioned scheduling techniques e.g., for target utilization U=0.6, the proposed technique schedule 66.7% task sets while MC-EKG-VD-1, CB-FP, partitioned and global techniques schedule 50%, 33.3%, 16.7% and 0% task sets respectively.

In Mixed-Criticality (MC) systems, multiple functions with different levels of criticality are integrated into a common platform in order to meet the intended space, cost, and timing requirements in all criticality levels. To guarantee the correct, and on-time execution of higher criticality tasks in emergency modes, various design-time scheduling policies have been recently presented. These techniques are mostly pessimistic, as the occurrence of worst-case scenario at run-time is a rare event. Nevertheless, they lead to an under-utilized system due to frequent drops of Low-Criticality (LC) tasks, and creation of unused slack times due to the quick execution of high-criticality tasks. Accordingly, this paper proposes a novel optimistic scheme, that introduces a learning-based drop-aware task scheduling mechanism, which carefully monitors the alterations in the behaviour of the MC system at run-time, to exploit the generated dynamic slacks for reducing the LC tasks penalty and preventing frequent drops of LC tasks in the future. Based on an extensive set of experiments, our observations have shown that the proposed approach exploits accumulated dynamic slack generated at run-time, by 9.84% more on average compared to existing works, and is able to reduce the deadline miss rate by up to 51.78%, and 33.27% on average, compared to state-of-the-art works.