CSR-EHS: Monitor and Control: Towards Dependable COTS-based Real-Time Embedded Systems

本项目的研究任务旨在为基于COTS的下一代嵌入式系统的可靠、可预测集成构建完善的知识库和系统设计框架。在现代计算机体系结构中，外围设备可以自主地发起数据传输并竞争总线事务。大多数实时系统文献主要集中在如何正确划分CPU周期，而对CPU和I/O智能外设的协同调度问题关注较少。不幸的是，每当CPU试图访问当前被另一个主设备锁定的共享总线时，在CPU级别保证的时间隔离可能被全局违反。为了保证下一代嵌入式系统的可靠性和可预测性，本文开展了以下研究工作：1)提出了一种在定制智能桥上实现的硬件服务器的新概念。在正在开发的体系结构中，智能网桥将一组外围设备与系统的其余部分分开，以保护系统本身不受外围设备不良行为的影响。智能网桥是使用基于FPGA的完全片上系统(SoC)来实现的。2)由于商业现成(COTS)设备满足系统假设可能非常困难或不可能被证明，所以来自不可信组件的相关总线事务被监视。其基本原理是乐观地假设所有假设都成立，然后根据其假设的规范监视COTS组件的运行时行为。如果检测到违规行为，则采取适当的恢复措施。监控是分散的：事件被过滤，并通过相应的智能网桥传递给基于FPGA的监控器。此外，通过翻译到中间时间自动机，规范被综合到低级监视器中。

The research tasks of this project aim at building a sound knowledge base and systematic design framework for dependable and predictable integration of next generation COTS-based embedded systems. In modern computer architectures, peripherals autonomously can initiate data transfers and contend for bus transactions. Most of the real-time systems literature is focused mainly on how to properly partition CPU cycles paying less attention to the co-scheduling problem of the CPU and I/O ``smart'' peripherals. Unfortunately, temporal isolation guaranteed at the CPU level can be globally violated whenever the CPU tries to access the shared bus which is currently locked by another master device. To guarantee the dependable and predictable behavior of next generation embedded systems, the following research tasks are pursued: 1) The research introduces the novel idea of a ``hardware server,'' implemented on a customized smart bridge. In the architecture being developed, a smart bridge separates a group of peripherals from the rest of the system shielding the system itself from undesirable behaviors of peripherals. The smart bridge is implemented using a FPGA-based full system-on-chip (SoC).2) Relevant bus transactions from untrusted components are montioredsince it can be very hard or impossible to be shown that commercial off-the-shelf (COTS) devices satisfy system assumptions. The rationale is to optimistically assume that all assumptions hold and then to monitor the runtime behavior of COTS components against their assumed specifications. If violations are detected, then an appropriate recovery measure is taken. Monitoring is decentralized: events are filtered and communicated to FPGA-based monitors by corresponding smart bridges. In addition, specifications are synthesized into low-level monitors via translations to intermediate timed automata.