Building safety-critical real-time systems out of inexpensive, non-real-time, COTS components is challenging. Although COTS components generally offer high performance, they can occasionally incur significant timing delays. To prevent this, we propose controlling the operating point of each shared resource (like the cache, memory, and interconnection buses) to maintain it below its saturation limit. This is necessary because the low-level arbiters of these shared resources are not typically designed to provide real-time guarantees. In this work, we introduce a novel system execution model, the Predictable Execution Model (PREM), which, in contrast to the standard COTS execution model, coschedules at a high level all active components in the system, such as CPU cores and I/O peripherals. In order to permit predictable, system-wide execution, we argue that real-time embedded applications should be compiled according to a new set of rules dictated by PREM. To experimentally validate our theory, we developed a COTS-based PREM testbed and modified the LLVM Compiler Infrastructure to produce PREM-compatible executables.

/pdf/a-predictable-execution-model-for-cots-based-embedded-4b6dmsvp16.pdf

A Predictable Execution Model for COTS-Based Embedded Systems

Embedded hard real-time systems need reliable guarantees for the satisfaction of their timing constraints. Experience with the use of static timing-analysis methods and the tools based on them in the automotive and the aeronautics industries is positive. However, both the precision of the results and the efficiency of the analysis methods are highly dependent on the predictability of the execution platform. In fact, the architecture determines whether a static timing analysis is practically feasible at all and whether the most precise obtainable results are precise enough. Results contained in this paper also show that measurement-based methods still used in industry are not useful for quite commonly used complex processors. This dependence on the architectural development is of growing concern to the developers of timing-analysis tools and their customers, the developers in industry. The problem reaches a new level of severity with the advent of multicore architectures in the embedded domain. This paper describes the architectural influence on static timing analysis and gives recommendations as to profitable and unacceptable architectural features.

/pdf/memory-hierarchies-pipelines-and-buses-for-future-1na3dj06bk.pdf

Memory Hierarchies, Pipelines, and Buses for Future Architectures in Time-Critical Embedded Systems

Multi-core chips have been increasingly adopted by microprocessor industry. For real-time systems to safely harness the potential of multi-core computing, designers must be able to accurately obtain the worst-case execution time (WCET) of applications running on multi-core platforms, which is very challenging due to the possible runtime inter-core interferences in using shared resources such as the shared L2 caches. As the first step toward time-predictable multi-core computing, this paper presents a novel approach to bounding the worst-case performance for threads running on multi-core processors with shared L2 instruction caches. The idea of our approach is to compute the worst-case instruction access interferences between different threads based on the program control flow information of each thread, which can be statically analyzed. Our experiments indicate that the proposed approach can reasonably estimate the worst- case shared L2 instruction cache misses by considering inter-thread instruction conflicts. Also, the WCET of applications running on multi-core processors estimated by our approach is much better than the estimation by simply assuming all L2 instruction accesses are misses.

/pdf/wcet-analysis-for-multi-core-processors-with-shared-l2-42uf8zzm5n.pdf

WCET Analysis for Multi-Core Processors with Shared L2 Instruction Caches

The requirement of high performance computing at low power can be met by the parallel execution of an application on a possibly large number of programmable cores. However, the lack of accurate timing properties may prevent parallel execution from being applicable to time-critical applications. We illustrate how this problem has been addressed by suitably designing the architecture, implementation, and programming model, of the Kalray MPPA®-256 single-chip many-core processor. The MPPA® -256 (Multi-Purpose Processing Array) processor integrates 256 processing engine (PE) cores and 32 resource management (RM) cores on a single 28nm CMOS chip. These VLIW cores are distributed across 16 compute clusters and 4 I/O subsystems, each with a locally shared memory. On-chip communication and synchronization are supported by an explicitly addressed dual network-on-chip (NoC), with one node per compute cluster and 4 nodes per I/O subsystem. Off-chip interfaces include DDR, PCI and Ethernet, and a direct access to the NoC for low-latency processing of data streams. The key architectural features that support time-critical applications are timing compositional cores, independent memory banks inside the compute clusters, and the data NoC whose guaranteed services are determined by network calculus. The programming model provides communicators that effectively support distributed computing primitives such as remote writes, barrier synchronizations, active messages, and communication by sampling. POSIX time functions expose synchronous clocks inside compute clusters and mesosynchronous clocks across the MPPA®-256 processor.

Time-critical computing on a single-chip massively parallel processor

The performance and power efficiency of multi-core processors are attractive features for safety-critical applications, as in avionics But increased integration and average-case performance optimisations pose challenges when deploying them for such domains In this paper we propose a novel approach to compute an is WCET considering variable access delays due to the concurrent use of shared resources in multi-core processors, particularly focusing on shared interconnects and main memory Thereby we tackle the problem of temporal partitioning as required by safety-critical applications In particular, we introduce additional phases to state-of-the-art timing analysis techniques to analyse an application's resource usage and compute an interference delay We further complement the offline analysis with a runtime monitoring concept to enforce resource usage guarantees The concepts are evaluated on Free scale's P4080 multi-core processor in combination with SYSGO's commercial real-time operating system Pike OS and Abs Int's timing analysis framework aiT We abstract real applications' behaviour using a representative task set of the EEMBC Auto bench benchmark suite Our results show a reduction of up to 53% of the multi-core WCET, while implementing full transparency to the temporal and functional behaviour of applications, enabling the seamless integration of legacy applications

/pdf/multi-core-interference-sensitive-wcet-analysis-leveraging-1uejjxd6wm.pdf

Multi-core Interference-Sensitive WCET Analysis Leveraging Runtime Resource Capacity Enforcement

Hard real-time systems must obey strict timing constraints. Therefore, one needs to derive guarantees on the worst-case execution times of a system's tasks. In this context, predictable behavior of system components is crucial for the derivation of tight and thus useful bounds. This paper presents results about the predictability of common cache replacement policies. To this end, we introduce three metrics, evict, fill, and mls that capture aspects of cache-state predictability. A thorough analysis of the LRU, FIFO, MRU, and PLRU policies yields the respective values under these metrics. To the best of our knowledge, this work presents the first quantitative, analytical results for the predictability of replacement policies. Our results support empirical evidence in static cache analysis.

/pdf/timing-predictability-of-cache-replacement-policies-3sqglqtkwd.pdf

Timing predictability of cache replacement policies

Domino effects have been shown to hinder a tight prediction of worst case execution times (WCET) on real-time hardware. First investigated by Lundqvist and StenstrAƒÂ¶m, domino effects caused by pipeline stalls were shows to exist in the PowerPC by Schneider. This paper extends the list of causes of domino effects by showing that the pseudo LRU (PLRU) cache replacement policy can cause unbounded effects on the WCET. PLRU is used in the PowerPC PPC755, which is widely used in embedded systems, and some x86 models.

/pdf/plru-cache-domino-effects-8ukl15tvnm.pdf

PLRU Cache Domino Effects

This paper introduces a set of design principles that aim to make processor
architectures amenable to static timing analysis. Based on these principles,
we give a design of a hard real-time processor with predictable timing, which is
simultaneously capable of reaching respectable performance levels.
The design principles we identify are recoverability from information loss in
the analysis, minimal variation of the instruction timing, non-interference between
processor components, deterministic processor behavior, and comprehensive
documentation. The principles are based on our experience and that of other
researchers in building timing analysis tools for existing processors.

/pdf/requirements-for-and-design-of-a-processor-with-predictable-1xyfy18883.pdf

Requirements for and Design of a Processor with Predictable Timing

We report on the formal verification of the floating point unit used in the VAMP processor. The FPU is fully IEEE compliant, and supports denormals and exceptions in hardware. The supported operations are addition, subtraction, multiplication, division, comparison, and conversions. The hardware is verified on the gate level against a formal description of the IEEE standard by means of the theorem prover PVS.

/pdf/formal-verification-of-the-vamp-floating-point-unit-3vfbhsxgoq.pdf

Formal Verification of the VAMP Floating Point Unit

We describe the results and status of a project aiming to provide a provably correct library of basic circuits. We use the theorem proving system PVS in order to prove circuits such as incrementers, adders, arithmetic units, multipliers, leading zero counters, shifters, and decoders. All specifications and proofs are available on the web.

/pdf/formal-verification-of-a-basic-circuits-library-27thrnk68g.pdf

Christoph Berg

Papers

Timing predictability of cache replacement policies

PLRU Cache Domino Effects

Requirements for and Design of a Processor with Predictable Timing

Formal Verification of the VAMP Floating Point Unit

Formal Verification of a Basic Circuits Library