Mixed Criticality Embedded Systems on Many-Core Platforms

实时和嵌入式系统设计中一个日益重要的趋势是将具有不同关键程度的应用程序集成到一个公共硬件平台上。与此同时，这些平台正在从单核迁移到多核，并在未来迁移到多核架构。关键程度是对系统组件所需的故障保证级别的指定。混合临界系统(MCS)是指具有两个或两个以上不同级别的系统。许多应用领域，如汽车和航空电子设备，以及欧盟倡议(例如Horizon 2020)都已确定混合关键程度是未来系统的关键问题。这些倡议背后的基本研究问题是：如何以一种有纪律的方式协调(安全)保证的“分区”和高效资源使用的“共享”这两个相互冲突的要求。这个问题引起了建模和验证方面的理论问题，以及与必要的硬件和软件运行时控制的设计和实现有关的系统问题。这个项目解决了理论和相关的系统问题。具有预定通信介质的多核平台是指定的平台，在该平台上将托管多个应用程序(可能由通常所说的系统系统组成)。隔离具有不同关键级别的组件至关重要，但处理器互连必须是共享的，并且能够传输具有不同关键级别的消息。此外，具有不同关键级别的应用程序必须能够以明显安全的方式交换数据。MCS的一个定义属性是不同的保证手段(对于每个关键级别)导致组件的关键参数的不同值，例如最坏情况执行时间和最坏情况传输时间。一般来说，临界级别越高，对这些值所做的假设就越保守。因此，上下文(系统关键程度级别)将确定必须用来验证(通过调度分析)每个核心和每个互连将按照每个应用的时间约束所要求的方式执行的参数。虽然完全隔离和严格的时间触发的全局调度是一种可能的架构结构，但是如果在整个系统的关键程度和对每个组件的运行时行为的假设之间进行权衡，则可以显著提高资源利用率，从而降低功耗。例如，我们要求：在双临界系统中，如果所有组件都受到(依赖于)低临界假设的约束，则所有应用程序都将满足其时间约束，但如果任何组件表现出高临界行为(即，低临界假设不再可靠)，则所有高临界应用程序也必须满足其最后期限。先前的工作(约克和其他一些国际研究中心)已经探索了单处理器系统的这种权衡。这个项目将集中在多核平台上：(I)开发适当的调度方案(在核和互连上)，(Ii)推导出MCS的验证程序，(Iii)探索所开发方案的理论界限(以显示与完全分区系统相比，资源使用和功耗改善到何种程度)，(Iv)开发必要的运行时控制(以管理关键级别之间的通信媒体共享)，以及(V)通过模拟、一个现场可编程门阵列试验台和一个与工业相关的案例研究来验证所开发的理论。

An increasingly important trend in the design of real-time and embedded systems is the integration of applications with different levels of criticality onto a common hardware platform. At the same time, these platforms are migrating from single cores to multi-cores and, in the future, many-core architectures. Criticality is a designation of the level of assurance against failure needed for a system component. A mixed criticality system (MCS) is one that has two or more distinct levels. A number of application domains, such as automotive and avionics, and EU initiatives (for example Horizon2020) have identified Mixed Criticality as a key issue in future systems.The fundamental research question underlying these initiatives is: how, in a disciplined way, to reconcile the conflicting requirements of 'partitioning' for (safety) assurance and 'sharing' for efficient resource usage. This question gives rise to theoretical problems in modelling and verification, and systems problems relating to the design and implementation of the necessary hardware and software run-time controls. This project addresses both the theoretical and related systems questions.A many-core platform with a scheduled communications medium is the designated platform on which multiple applications (perhaps composed of what are often called 'system of systems') are to be hosted. The isolation of components with different criticality levels is crucial, but the processor interconnects must be shared and be able to transmit messages with different criticality levels. Moreover, applications with different criticality levels must be able to exchange data in a demonstrably safe way.A defining property of MCS is that the different means of assurance (for each criticality level) give rise to different values for the component's key parameters such as worst-case execution times and worst-case transmission times. In general, the higher the criticality level, the more conservative are the assumptions made about these values. Hence the context (system criticality level) will determine the parameters that must be used to verify (via scheduling analysis) that each core and each inter-connect will perform as required by the temporal constraints of each application. The development of criticality-aware analysis is needed for these systems.Although total isolation with rigid time-triggered global scheduling is a possible architectural structure, significantly greater resource utilisation and hence reduced power consumption is possible if trade-offs are made between the overall system criticality level and assumptions about each component's run-time behaviour. For example, we require that: in a dual-criticality systems all applications will meet their timing constraints if all components are constrained by (rely on) their low criticality assumptions, but all high-criticality applications must also meet their deadlines if any component exhibits high-criticality behaviour (i.e. the low criticality assumptions can no longer be relied upon).Previous work (in York and in a number of other international research centres) has explored this trade-off for single processor systems. This project will focus on many-core platforms to: (i) develop the appropriate scheduling schemes (on the cores and interconnects), (ii) derive verification procedures for MCSs, (iii) explore the theoretical bounds of the developed schemes (to show to what extent resource usage and power consumption are improved over a full partitioned system), (iv) develop the necessary run-time controls (to manage the sharing of communication media between the criticality levels), and (v) demonstrate the developed theory via simulations, a FPGA test-bed and an industrially relevant case study.