We introduce Silverline, a novel framework for lightweight virtualization and orchestration of distributed real-time systems. Leveraging WebAssembly (Wasm) for robust sandboxing and multi-language (polyglot) capabilities, Silverline decouples applications from their platforms through distinct manifests, enabling a centralized orchestrator to optimize resource allocation and deploy Wasm modules seamlessly across the edge-cloud continuum. It features a split data and control plane with orchestration sidecars, allowing applications to use native communication protocols and respond autonomously to network changes. We evaluate our framework in two real application contexts: an industrial automation use-case and an automotive body electronics demonstrator. Through micro-benchmarks and end-to-end testing, we demonstrate Silverline's potential for managing real-time workloads in diverse heterogeneous ecosystems.

The software development complexity of automotive systems has significantly increased during the last decade due to the latest Advanced Driving Assistance System (ADAS) functionalities. To effectively address this complexity, domain specific modeling languages (DSMLs) like AUTOSAR or an open-source system performance model for AUTOSAR-aligned systems, APP4MC, have become a common trend in the automotive industry. DSMLs allow for easily capturing the functional and non-functional requirements of the system without needing to master low level details of the programming model or the processor architecture. Unfortunately, current DSMLs do not support the parallel programming models, like OpenMP and CUDA, that are used to exploit parallel heterogeneous architectures featuring acceleration devices such as GPUs and FPGAs required. These architectures are however essential to cope with the performance needs of ADAS. This exposes a gap between the DSMLs used by automotive designers to enhance software productivity and leverage verification and validation processes, and the parallel processor architectures used in this domain. This paper presents a complete framework to safely exploit the inherent parallelism exposed by the AMALTHEA system description, supported in APP4MC, by: (1) automatically transforming the high-level design into the OpenMP parallel programming model targeting both host and accelerator parallelism, and (2) using compiler analysis techniques to prove the correctness of the model transformed to OpenMP code. The paper contributes also with (3) an analysis of the parallel execution model allowed by the AMALTHEA DSML and that of OpenMP, and (4) a performance plus productivity evaluation of the proposed framework on real automotive systems executed on an embedded GPU-based processor architecture.

The concept of Digital Twins (DTs) has been discussed intensively for the past couple of years. Today we have instances of digital twins that range from static descriptions of manufacturing data and material properties over live interfaces on operational data of cyber physical systems to the functions and services they provide. Currently, there are no standardized interfaces to aggregate atomic DTs (e.g., the twin of the lowest-level function of a machine) to higher-level DTs providing more complex services in the virtual world. Additionally, there is no existing infrastructure to reliably link the DTs in the virtual world to the integrated CPSs in the physical world, such as a car consisting of many ECUs with even more functions. The concept of the Metaverse is gaining increasing traction and has been explored from different angles, usually centered around a human user, true to its original definition. Beyond social interactions, the Metaverse offers possibilities to integrate layers of interconnected Digital Twins (DTs) representing parts of and interacting with the physical world in real-time, enabling not only analysis and representation of current state, but also feedback loops and control. This paper describes how the Metaverse can become the virtual world where DTs of humans and machines live, and how to reliably connect DTs to the physical world.

The domains of Cyber-Physical Systems (CPSs) and Information Technology (IT) are converging. Driven by the need for increased compute performance, as well as the need for increased connectivity and runtime flexibility, IT hardware, such as microprocessors and Graphics Processing Units (GPUs), as well as software abstraction layers are introduced to CPS. These systems and components are being enhanced for the execution of hard real-time applications. This enables the convergence of embedded and IT: Embedded workloads can be executed reliably on top of IT infrastructure. This is the dawn of Reliable Distributed Systems (RDSs), a technology that combines the performance and cost of IT systems with the reliability of CPSs. The Fabric is a global RDS runtime environment, weaving the interconnections between devices and enabling abstractions for compute, communication, storage, sensing & actuation. This paper outlines the vision of RDS, introduces the aspects required for implementing RDSs and the Fabric, relates existing technologies, and outlines open research challenges.

To offer an infrastructure for autonomous systems offloading parts of their functionality, dynamic distributed systems must be able to satisfy non-functional quality-of-service (QoS) requirements. However, providing hard QoS guarantees without complex global verification that are satisfied even under uncertain conditions is very challenging. In this work, we propose a contract-based QoS assurance for centralized, hierarchical systems, which requires local verification only and has the potential to cope with dynamic changes and uncertainties.

Temporal isolation is one of the key challenges for co-running mixed-criticality applications on Commercial Off-The-Shelf (COTS) multi-core platforms. In particular, the main memory subsystem is one of the most prominent causes of interference and loss of isolation. Existing mechanisms for memory bandwidth regulation are limited to conservative bandwidth reservation, use pessimistic worst-case execution time (WCET) estimations or require dedicated hardware that is not feasible in COTS multi-core platforms.In this paper, we propose a novel mechanism for memory interference control that uses feedback-based control to dynamically regulate memory accesses of individual cores in a multicore platform. Our mechanism directly regulates the source of interference by leveraging information about memory utilization, acquired from existing hardware performance counters provided by modern COTS-based memory controllers. The proposed solution is implemented on Linux as a loadable kernel module. The results of evaluating our approach with real and synthetic benchmarks on a COTS multi-core (NXP S32V234) platform demonstrate that it is able to provide temporal isolation with up to 4x and 2x more overall throughput for non-real-time applications compared to static and dynamic memory bandwidth-based regulation approaches, respectively, while maintaining guarantees for applications running on the real-time core.

Most off-the-shelf embedded control systems lack proper mechanisms to handle computational overload conditions. Therefore, delays may accumulate and produce overruns, potentially harming the stability and performance of the controlled system. In this paper, we explore a controller implementation in which overrun events are tolerated and tackled with a proper countermeasure, which can be easily plugged into existing controller implementations and in particular commercial off-the-shelf control systems. When an overrun occurs, the control period of the next job is reinitialized and its control parameters are adjusted to counteract the additional delay of the previous job. The main strength of this approach resides in a straightforward applicability and in a high flexibility in deployment. It does neither require a stochastic model of the timing evolution of the system, nor rely on prediction of future delays. We provide an exact tool to determine the system stability, which requires only the knowledge of the worst case response time. The final controlled system exhibits a good trade-off between simplicity and performance, both during nominal and overload conditions.

Due to the trends of centralizing the EIE architecture and new computing-intensive applications, high-performance hardware platforms are currently finding their way into automotive systems. However, the Systems-on-Chip (SoCs) currently available on the market have significant weaknesses when it comes to providing predictable performance for time-critical applications. The main reason for this is that these platforms are optimized for average-case performance. This shortcoming represents one major risk in the development of current and future automotive systems. In this paper we describe how highperformance and predictability could (and should) be reconciled in future HW /SW platforms. We believe that this goal can only be reached via a close collaboration among system suppliers, IP providers, semiconductor companies, and OS/hypervisor vendors. Furthermore, academic input will be needed to solve remaining challenges and to further improve initial solutions.

Robotic systems are typically subject to real-time constraints. Still, the ROS ecosystem-the most popular repository of open-source robotics software-exhibits little evidence of the use of real-time theory to bound or control worst-case response times. Hurdles to adoption are the amount of expertise required to correctly use real-time scheduling mechanisms and the inherent unpredictability of typical robotics workloads, which defy static provisioning. To overcome these hurdles, ROS-Llama, an automatic latency manager for ROS2, is proposed. Crucially, use of ROS-Llama requires only little effort and knowledge of realtime concepts. Relevant properties of ROS2 and essential requirements of the robotics domain are identified, and the conceptual and practical challenges in developing such a mostly automatic tool are discussed. Experiments on a mobile robot demonstrate the viability of the approach and show that ROS-Llama reduces the maximum observed latency under load compared to the default Linux scheduler. Finally, open problems in the underlying real-time analysis and major platform limitations in Linux and ROS2 that prevent further improvements are identified.

The QNX operating system has emerged as a promising candidate as a base operating system for upcoming domain or vehicle integration computers in centralized automotive E/E. In this work, we look deeper in the Adaptive Partitioning Scheduler offered by QNX with the aim of assessing its suitability in providing temporal isolation and guaranteed execution behavior to different applications. With APS, QNX has introduced budget-based scheduling into a mainstream commercial OS and hence deserves merit. However we also found certain drawbacks in the APS scheduler and in order to mitigate the problems caused by them, we propose some guidelines for system designers to configure their systems efficiently.

Many industrial players are currently challenged in building distributed CPS and IoT applications with stringent end-to-end QoS requirements. Examples are Vehicle-to-X applications, Advanced Driver-Assistance Systems (ADAS) or functionalities in the Industrial Internet of Things (IIoT). Currently, there is no comprehensive solution allowing to efficiently program, deploy, and operate such distributed applications. This paper will focus on real-time concerns, in building distributed CPS and IoT systems. Thereby, the focus lies, on the one hand, on mechanisms required inside of the IoT (compute) nodes, and, on the other hand, on communication protocols such as TSN and 5G connecting them. In the authors' view, the required building blocks for a first end-to-end technology stack are available. However, their integration into a holistic framework is missing.

Existing software scheduling mechanisms do not suffice for emerging applications in the automotive space, which have the conflicting needs of performance and predictability. As a concrete case, we consider the ETAS lightweight hypervisor (LWHVR), a commercially viable solution in the automotive industry, deployed on multicore microcontrollers. We describe the architecture of the hypervisor and its current scheduling mechanisms based on Time Division Multiplexing. We next show how Reservation-based Scheduling (RBS) can be implemented in the ETAS LWHVR to efficiently use resources while still providing freedom from interference and explore design choices towards an efficient implementation of such a scheduler. With experiments from an industry use case, we also compare the performance of RBS and the existing scheduler in the hypervisor.

This paper deals with the real-time implementation of feedback controllers. In particular, it provides an analysis of the stability property of closed-loop systems that include a controller that can sporadically miss deadlines. In this context, the weakly hard m-K computational model has been widely adopted and researchers used it to design and verify controllers that are robust to deadline misses. Rather than using the m-K model, we focus on another weakly-hard model, the number of consecutive deadline misses, showing a neat mathematical connection between real-time systems and control theory. We formalise this connection using the joint spectral radius and we discuss how to prove stability guarantees on the combination of a controller (that is unaware of deadline misses) and its system-level implementation. We apply the proposed verification procedure to a synthetic example and to an industrial case study.

Autonomous systems are self-governed and self-adaptive systems that must additionally comply with high assurance correctness and safety criteria. Such autonomous systems cannot be tested and verified in the traditional design process. While all systems hardware and software components can be implemented as usual, test and verification only cover the autonomous system functionality, but do not include the goal-driven autonomous behavior in all possible circumstances. This autonomous behavior is a primary design target. Thus, autonomous systems pose a number of emerging challenges and opportunities to the field of electronic design automation (EDA). Examples include specification of (evolving) requirements involving components and their interaction, defining different assurance levels for bounded operational environments, synthesis of mechanisms to guideline diagnosis and rigorously monitor systems integration after deployment.

The high-performance requirements needed to implement the most advanced functionalities of current and future Cyber-Physical Systems (CPSs) are challenging the development processes of CPSs. On one side, CPSs rely on model-driven engineering (MDE) to satisfy the non-functional constraints and to ensure a smooth and safe integration of new features. On the other side, the use of complex parallel and heterogeneous embedded processor architectures becomes mandatory to cope with the performance requirements. In this regard, parallel programming models, such as OpenMP or CUDA, are a fundamental brick to fully exploit the performance capabilities of these architectures. However, parallel programming models are not compatible with current MDE approaches, creating a gap between the MDE used to develop CPSs and the parallel programming models supported by novel and future embedded platforms.The AMPERE project will bridge this gap by implementing a novel software architecture for the development of advanced CPSs. To do so, the proposed software architecture will be capable of capturing the definition of the components and communications described in the MDE framework, together with the non-functional properties, and transform it into key parallel constructs present in current parallel models, which may require extensions. These features will allow for making an efficient use of underlying parallel and heterogeneous architectures, while ensuring compliance with non-functional requirements, including those on real-time performance of the system.

The push towards automated and connected driving functionalities mandates the use of heterogeneous HW platforms in order to provide the required computational resources. For these platforms, the established methods for performance modelling in industry are no longer effective. In this paper, we propose an initial modelling concept for heterogeneous platforms which can then be fed into appropriate tools to derive effective performance predictions. The approach is demonstrated for a prototypical automated driving application on the Nvidia Tegra X2 platform.

The complex dynamic behavior of automotive software systems, in particular engine management, in combination with emerging multi-core execution platforms, significantly increased the problem space for timing analysis methods. As a result, the risk of divergence between academic research and industrial practice is currently increasing. Therefore, we provided a concrete automotive benchmark for the Formal Methods for Timing Verification (FMTV) challenge 2016 (https://waters2016.inria.fr/challenge/), a full blown performance model of a modern engine management system (downloadable at http://ecrts.eit.uni-kl.de/forum/viewtopic.php?f=27&t=62), with the goal to challenge existing timing analysis approaches with respect to their expressiveness and precision. In the demo session we will present the performance model of the engine management system using the Amalthea tool (http://www.amalthea-project.org/). Furthermore, we will show the model in action using professional timing tools such as from Symtavision (https://www.symtavision.com/), Timing Architects (http://www.timing-architects.com/), and Inchron (https://www.inchron.de/). Thereby, the focus will lie on determining tight end-to-end latency bounds for a set of given cause-effect chains. This is challenging since the dynamic behavior of a engine management software is quite complex and contains mechanisms that explore the limits of existing academic approaches: preemptive and cooperative priority based scheduling; periodic, sporadic, and engine synchronous tasks; multi-core platform with distributed cause-effect chains including cross-core communication; label (i.e. data) placement dependent execution times of runnables Overall the demo gives an impression of the current state-of-practice in industrial product development, and serves as baseline for further academic research.

The underlying theories of both control engineering and real-time systems engineering assume idealized system abstractions that mutually neglect central aspects of the other discipline. Control engineering theory, on the one hand, usually assumes jitter free sampling and constant input-output latencies disregarding complex real-world timing effects. Real-time engineering theory, on the other hand, uses abstract performance models that neglect the functional behavior, and derives worst-case situations that have little expressiveness for control functionalities in physically dominated automotive systems. As a consequence, there is a lot of potential for a systematic co-engineering between both disciplines, increasing design efficiency and confidence.

The paper describes first results from the AutoMoDe (automotive model-based development) project. The project's overall goal is to develop an integrated methodology for model-based development of automotive control software, based on problem-specific design notations with an explicit formal foundation. Based on the existing AutoFOCUS framework (Huber, F. et al., 1997), a tool prototype is being developed in order to illustrate and validate the key elements of our approach.

We present a compositional approach to analyze timing behavior of complex platforms with different scheduling strategies. The approach uses event interfacing in order to couple previously incompatible analysis techniques which provide subsystem and component behavior. Based on these interfaces, event propagation using abstract models is used to derive global system timing properties.

Embedded systems typically include reactive and transformative functions, often described in different languages and semantics which are well established in their respective application domains. Additionally, a large part of the system functionality and components is reused from previous designs including legacy code. There is little hope that a single language will replace this heterogeneous set of languages. A design process must be able to bridge the semantic differences for verification and synthesis and should account for limited knowledge of system properties. This paper presents the system property intervals (SPI) model, which employs behavioral intervals and process modes to allow the common representation of different languages and semantics. This model is the basis of a workbench which is targeted at the design of heterogeneously specified embedded systems.

In this paper, an internal design model called FunState (functions driven by state machines) is presented that enables the representation of different types of system components and scheduling mechanisms using a mixture of functional programming and state machines. It is shown how properties relevant for scheduling and verification of specification models such as Boolean dataflow, cyclostatic dataflow, synchronous dataflow, marked graphs, and communicating state machines as well as Petri nets can be represented in the FunState model of computation. Examples of methods suited for FunState are described, such as scheduling and verification. They are based on the representation of the model's state transitions in the form of a periodic graph. The feasibility of the novel approach is shown with an asynchronous transfer mode switch example.

Synchronous Data Flow (SDF) is a well-known model of computation that is widely used in the control engineering and digital signal processing domains. Existing scheduling methods are mainly static approaches that assume full knowledge of the environment, e.g., data arrival times. In a growing number of practical cases like internet multimedia applications there exists only partial knowledge of the environment, e.g. average data rates. Here, only dynamic scheduling can yield optimal results. In this paper we propose a new dynamic scheduling method that minimizes the maximal response time of the system. It is a generalization of a deadline revision method to allow treatment of data-dependent tasks using EDF scheduling. The applicability and benefit of the new approach is shown using a real-world example.

Many embedded systems are implemented with a set of alternative function variants to adapt the system to different applications or environments. This paper proposes a novel approach for the coherent representation and selection of function variants in the different phases of the design process. In this context, the modeling of reconfiguration of system parts is supported in a natural way. Using a real example from the video processing domain, the approach is explained and validated. 1 Introduction Many embedded systems are implemented with a fixed core function and a set of alternative function variants to adapt the system to different applications or environments. Examples are TV sets which can be adapted to different standards or automotive control systems to be used in countries with different emission laws. Function variants are mutually exclusive, i. e. only one variant of a set of alternative functions is selected a time. There may be several of those variant sets in one embedde...

In this paper, an internal design model called FunState (functions driven by state machines) is presented that enables the representation of different types of system components and scheduling mechanisms using a mixture of functional programming and state machines. It is shown how properties relevant for scheduling and verification of specification models like boolean dataflow, cyclostatic dataflow, synchronous dataflow, marked graphs, and communicating state machines as well as Petri nets may be represented in the FunState model. Examples of methods suited for FunState are described, such as scheduling and verification. They are based on the representation of the model's state transitions in form of a periodic graph.

The specijcation of embedded systems veq often contains a mi.x~ureof diferent models of computation.In particular the data $oti~and control $oiv associated to the transformative and reactii'e domains, respectively, are tightly coupled.The paper considers classes of applications that feature communicating processes ~vhoseflmctions depend on a]nite set of computation modes.The change behveen these modes is synchronized by data communication.An approach is presented to model the correlation of process modes and to fidly utilize this information for schedlding.A modeling ~ample sho}vs the optimization potential of the n~v approach.