Handling MixedCriticality in So Cbased RealTime Embedded Systems
Handling Mixed-Criticality in So. Cbased Real-Time Embedded Systems Rodolfo Pellizzoni, Patrick Meredith, Min-Young Nam, Mu Sun, Marco Caccamo, Lui Sha Presented by Rafael Olaechea 1
Platform Based Design for Safety Critical Systems • Platform-Based Design of Embedded Systems – Reuse of a set of libraries and components – Automatic Generation of implementation – Help perform model checking on generated systems 2
Platform Based Design for Safety Critical Systems • Platform-Based Design of Embedded Systems – Reuse of a set of libraries and components – Automatic Generation of implementation – Help perform model checking on generated systems • But Safety Critical Systems have special needs – Isolation of safety critical from non-safety critical processes – Ensures isolation at runtime 3
Architecture Description Language • Specifies logical functionality and requirements – Processes • Computation (Period, Deadline, Execution) • Communication Requests (number of frames, and deadline) 4
Architecture Description Language • Specifies logical functionality and requirements – Processes • Computation (Period, Deadline, Execution) • Communication Requests (number of frames, and deadline) • Specifies Hardware Platform – Processor – Memory – Bus 5
Enforcing Safety of low criticality tasks • Based on AADL specified requirements – Functional Certificate • Runtime Monitoring of Events – Example with Programmer and Pacer interface – Timing Certificate • Ensuring Communication and computation bounds 6
Pacemaker Platform 7
Pacemaker Platform Timing Constraints will be enforced by process scheduler 8
Wrappers Enforcing Communication Safety • Bus Safety – A timeslot is assigned to each process – Hardware wrapper prevents data being sent if frame is not for the process 9
+ , ', "-. . %"' BC 1%"0 - 2' 3 %6 #"<' D 8 EA 3 F' / #01"#2'3 #452%' ! "#$%&&' 8$9%452%"' ! "#$%&&'( #) *$' 3 - 05 - 22<'= "*> %0' ! "#R*4%4'J! ' ? %&*) 0%"'&. %$*@%4' A 51#6 - 7$- 22<'' ) %0%"- 1%4' proc_clk Wrappers Enforcing Communication Safety $2 PQ%0' 3 #0*1#"*0) ' B 0) *0%' N"- 6 %Q&*) 0 - 2' system_clk 3 %6 #"<' / #01"#22%"' J 01%"N- $%' ? - 1 - ' 8$"- 1$9. - 4' 3 #452%' N"- 6 %Q) "- 01' '''M 'M ' ! "#$%&&'K' / #4%' J 01%"N- $%' ? - 1 - ' 8$"- 1$9. - 4' 3 #452%' ! "#$%&&'L ' / #4%' O 8' / #4%' / ! G' D 5 H 2 - I %F' J 0&1"5$7#0' 8$"- 1$9. - 4' N"- 6 %Q) "- 01' / #6 6 50*$- 7#0' 8$9%452%"' N"- 6 %Q&*) 0 - 2' : "- 6 %' ; %0%"- 1#"' / #01"#2'3 #452%' / #01"#2' / !% G' 3 #452 ' 8$9%452%"' 3 #0*1#"*0) ' B 0) *0%' $2 PQ%0' / ! G', "-. . %"' communication / #6 6 50*$- 7#0'J 01%"$#00%$7#0' ! #= %"'3 - 0 - ) %"' (a) Architecture Block Diagram 10
+ , ', "-. . %"' BC 1%"0 - 2' 3 %6 #"<' D 8 EA 3 F' / #01"#2'3 #452%' ! "#$%&&' 8$9%452%"' ! "#$%&&'( #) *$' 3 - 05 - 22<'= "*> %0' ! "#R*4%4'J! ' ? %&*) 0%"'&. %$*@%4' A 51#6 - 7$- 22<'' ) %0%"- 1%4' proc_clk Wrappers Enforcing Communication Safety $2 PQ%0' 3 #0*1#"*0) ' B 0) *0%' N"- 6 %Q&*) 0 - 2' system_clk 3 %6 #"<' / #01"#22%"' J 01%"N- $%' ? - 1 - ' 8$"- 1$9. - 4' 3 #452%' N"- 6 %Q) "- 01' '''M 'M ' ! "#$%&&'K' / #4%' J 01%"N- $%' ? - 1 - ' 8$"- 1$9. - 4' 3 #452%' ! "#$%&&'L ' / #4%' O 8' / #4%' / ! G' D 5 H 2 - I %F' J 0&1"5$7#0' 8$"- 1$9. - 4' N"- 6 %Q) "- 01' / #6 6 50*$- 7#0' 8$9%452%"' N"- 6 %Q&*) 0 - 2' : "- 6 %' ; %0%"- 1#"' / #01"#2'3 #452%' / #01"#2' / !% G' 3 #452 ' 8$9%452%"' 3 #0*1#"*0) ' B 0) *0%' $2 PQ%0' / ! G', "-. . %"' communication / #6 6 50*$- 7#0'J 01%"$#00%$7#0' ! #= %"'3 - 0 - ) %"' (a) Architecture Block Diagram 11
+ , ', "-. . %"' BC 1%"0 - 2' 3 %6 #"<' D 8 EA 3 F' / #01"#2'3 #452%' ! "#$%&&' 8$9%452%"' ! "#$%&&'( #) *$' 3 - 05 - 22<'= "*> %0' ! "#R*4%4'J! ' ? %&*) 0%"'&. %$*@%4' A 51#6 - 7$- 22<'' ) %0%"- 1%4' proc_clk Wrappers Enforcing Communication Safety $2 PQ%0' 3 #0*1#"*0) ' B 0) *0%' N"- 6 %Q&*) 0 - 2' system_clk 3 %6 #"<' / #01"#22%"' J 01%"N- $%' ? - 1 - ' 8$"- 1$9. - 4' 3 #452%' N"- 6 %Q) "- 01' '''M 'M ' ! "#$%&&'K' / #4%' J 01%"N- $%' ? - 1 - ' 8$"- 1$9. - 4' 3 #452%' ! "#$%&&'L ' / #4%' O 8' / #4%' / ! G' D 5 H 2 - I %F' J 0&1"5$7#0' 8$"- 1$9. - 4' N"- 6 %Q) "- 01' / #6 6 50*$- 7#0' 8$9%452%"' N"- 6 %Q&*) 0 - 2' : "- 6 %' ; %0%"- 1#"' / #01"#2'3 #452%' / #01"#2' / !% G' 3 #452 ' 8$9%452%"' 3 #0*1#"*0) ' B 0) *0%' $2 PQ%0' / ! G', "-. . %"' communication / #6 6 50*$- 7#0'J 01%"$#00%$7#0' ! #= %"'3 - 0 - ) %"' (a) Architecture Block Diagram 12
Runtime Monitoring of tasks Task (HW or CPU) Event Specification Corrective Action or Disabling of Action 13
Runtime Monitoring of tasks Task (HW or CPU) Event Specification Corrective Action or Disabling of Action Specification Logic: 14
Runtime Monitoring of tasks Task (HW or CPU) Event Specification Corrective Action or Disabling of Action Specification Logic: Extended Regular Expressions Past Time Linear Temporal Logic 15
Runtime Monitoring of tasks Task (HW or CPU) Event Specification Corrective Action or Disabling of Action Specification Logic: Extended Regular Expressions Past Time Linear Temporal Logic Symbolic names for queues and read/writes 16
Programmer Process updating heartbeat rate Programmer process will update parameters based on RF module input 17
Programmer Process updating heartbeat rate Programmer process will update parameters based on RF module input But Pacer and Rate Adapter are more critical 18
Programmer Process updating heartbeat rate parameters Programmer process will update parameters based on RF module input But Pacer and Rate Adapter are more critical 19
Programmer Process updating heartbeat rate parameters Programmer Rate Adapter Pacer Parameter + Check 20
Programmer Process updating heartbeat rate parameters Programmer Rate Adapter Pacer Parameter + Check Success 21
Programmer Process updating heartbeat rate parameters Programmer Rate Adapter Pacer Parameter + Check Success 22
Programmer Process updating heartbeat rate parameters Programmer Rate Adapter Pacer Parameter + Check Success Commit 23
Programmer Process updating heartbeat rate parameters Programmer Rate Adapter Pacer Parameter + Check Success Commit But Programmer could fail after one commit causing discomfort to patient 24
Solution: Extract the commits logic into the certified monitors • Events are specified in terms of values read/writes to/from symbolic queues 25
Solution: Extract the commits logic into the certified monitors • Monitor sends the commit commands once success are received 26
Solution: Extract the commits logic into the certified monitors • Prevent Programmer from sending commits or checks before receiving an answer 27
Programmer Process updating heartbeat rate parameters Programmer Rate Adapter Pacer Monitor Parameter + Check Success Commit 28
+ , ', "-. . %"' BC 1%"0 - 2' 3 %6 #"<' D 8 EA 3 F' / #01"#2'3 #452%' ! "#$%&&' 8$9%452%"' ! "#$%&&'( #) *$' 3 - 05 - 22<'= "*> %0' ! "#R*4%4'J! ' ? %&*) 0%"'&. %$*@%4' A 51#6 - 7$- 22<'' ) %0%"- 1%4' proc_clk Platform controlling Battery life $2 PQ%0' 3 #0*1#"*0) ' B 0) *0%' N"- 6 %Q&*) 0 - 2' system_clk 3 %6 #"<' / #01"#22%"' J 01%"N- $%' ? - 1 - ' 8$"- 1$9. - 4' 3 #452%' N"- 6 %Q) "- 01' '''M 'M ' ! "#$%&&'K' / #4%' J 01%"N- $%' ? - 1 - ' 8$"- 1$9. - 4' 3 #452%' ! "#$%&&'L ' / #4%' O 8' / #4%' / ! G' D 5 H 2 - I %F' J 0&1"5$7#0' 8$"- 1$9. - 4' N"- 6 %Q) "- 01' / #6 6 50*$- 7#0' 8$9%452%"' N"- 6 %Q&*) 0 - 2' : "- 6 %' ; %0%"- 1#"' / #01"#2'3 #452%' / #01"#2' / !% G' 3 #452 ' 8$9%452%"' 3 #0*1#"*0) ' B 0) *0%' $2 PQ%0' / ! G', "-. . %"' communication / #6 6 50*$- 7#0'J 01%"$#00%$7#0' ! #= %"'3 - 0 - ) %"' (a) Architecture Block Diagram 29
Schedule Generation and Timing Isolation • Communication Requests – Periodic task to be assigned to the communication bus • Computation Requests – Periodic task to its processor • Earliest Deadline Schedule Generated – Statically for hyper-period 30
Schedule Generation and Timing Isolation Rate Data and Signal. Buffer write are part of the communication infrastructure processor 31
Conclusions • Helps combining low and high criticality tasks – Low Priority task safe behavior enforced • Timing • Logically • Model tasks requirements on AADL – Computation – Communication – Generate Safe Schedules 32
- Slides: 32