CSR-EHS: Monitor and Control: Towards Dependable COTS-based Real-Time Embedded Systems

本项目的研究任务是为下一代基于COTS的嵌入式系统的可靠和可预测的集成建立一个完善的知识库和系统化的设计框架。在现代计算机体系结构中，外围设备可以自主发起数据传输并竞争总线事务。大多数实时系统的文献主要集中在如何正确划分CPU周期，很少关注CPU和I/O“智能”外设的协同调度问题。不幸的是，每当CPU试图访问当前被另一个主设备锁定的共享总线时，在CPU级别保证的时间隔离可能被全局违反。为了保证下一代嵌入式系统的可靠性和可预测性，本研究主要完成了以下几个方面的工作：1）提出了一种“硬件服务器”的新思想，并在一个定制的智能网桥上实现。在正在开发的体系结构中，智能桥接器将一组外围设备与系统的其余部分分离，从而保护系统本身免受外围设备的不良行为的影响。智能桥是使用基于FPGA的完整片上系统（SoC）实现的。2）监控来自不可信组件的相关总线事务，因为很难或不可能证明商用现成（COTS）设备满足系统假设。基本原理是乐观地假设所有的假设都成立，然后根据假设的规范监控COTS组件的运行时行为。 如果发现违规行为，则采取适当的补救措施。监控是分散式的：事件被过滤并通过相应的智能桥传输到基于FPGA的监控器。此外，规范合成到低级别的监视器通过翻译到中间的时间自动机。

The research tasks of this project aim at building a sound knowledge base and systematic design framework for dependable and predictable integration of next generation COTS-based embedded systems. In modern computer architectures, peripherals autonomously can initiate data transfers and contend for bus transactions. Most of the real-time systems literature is focused mainly on how to properly partition CPU cycles paying less attention to the co-scheduling problem of the CPU and I/O ``smart'' peripherals. Unfortunately, temporal isolation guaranteed at the CPU level can be globally violated whenever the CPU tries to access the shared bus which is currently locked by another master device. To guarantee the dependable and predictable behavior of next generation embedded systems, the following research tasks are pursued: 1) The research introduces the novel idea of a ``hardware server,'' implemented on a customized smart bridge. In the architecture being developed, a smart bridge separates a group of peripherals from the rest of the system shielding the system itself from undesirable behaviors of peripherals. The smart bridge is implemented using a FPGA-based full system-on-chip (SoC).2) Relevant bus transactions from untrusted components are montioredsince it can be very hard or impossible to be shown that commercial off-the-shelf (COTS) devices satisfy system assumptions. The rationale is to optimistically assume that all assumptions hold and then to monitor the runtime behavior of COTS components against their assumed specifications. If violations are detected, then an appropriate recovery measure is taken. Monitoring is decentralized: events are filtered and communicated to FPGA-based monitors by corresponding smart bridges. In addition, specifications are synthesized into low-level monitors via translations to intermediate timed automata.