Dynamic task offloading is essential for real-time robotic applications, enabling them to adapt to fluctuating computational demands and maintain efficiency under changing conditions. This paper introduces a dynamic task offloading framework that incorporates monitoring, decision making, offloading triggering, and performance monitoring to optimize resource usage by offloading real-time tasks to edge and cloud servers. A use case from the manufacturing industry demonstrates the framework’s application, enhancing robotic functions like motion planning. WebAssembly enables the execution of the robotics application across diverse environments, improving both portability and computational efficiency. By addressing key challenges, this work sets the stage for future offloading frameworks to meet the evolving needs of robotic systems.

Time-Sensitive Networking (TSN) has emerged as a key technology for ensuring reliable and deterministic communication in vehicular networks. However, the complexity of evaluating, configuring, and analyzing TSN mechanisms has hindered its widespread adoption. This paper introduces CONAN-TSN, an integrated toolchain designed to address these challenges by providing a comprehensive solution for the configuration, analysis, and evaluation of TSN networks. CONAN-TSN includes tools for traffic generation, traffic mapping, scheduling, and timing analysis, enabling seamless integration and practical implementation of TSN in vehicular systems. The toolchain’s effectiveness is demonstrated through its application to an industrial use case, showcasing its ability to enhance network schedulability and performance. The results highlight CONAN-TSN’s potential to bridge the gap between theoretical benefits and real-world deployment of TSN, offering a valuable resource for researchers and practitioners in the field.

This paper identifies that existing industrial automation standards, such as IEC/IEEE 60802 and IEEE 802.1Q, often have inconsistent definitions of traffic types. In the context of utilizing time-sensitive networking (TSN) standards for future automation systems, clear and consistent traffic characteristics and use cases should be defined to benefit from TSN features. Besides that, to facilitate the integration of TSN into the automation systems, the current standards provide a recommendation for mapping the automation traffic to the TSN traffic classes. In this paper, we propose an alternative mapping methodology for automation traffic to TSN traffic classes after presenting the existing automation traffic and their characteristics. Finally, through a case study, we show the potential of the new mapping methodology compared to the standard mapping strategy.

Software and system architecture modeling is a well-established technique for addressing design-time challenges and enabling validation early in the system and software development process. However, software and system modeling has not been as widely used in automation systems as it has been in the automotive industry. In addition to validating functional properties through modeling, security properties and features can be evaluated in the modeling phase. This paper provides a brief overview of existing modeling approaches for future automation systems, known as modular automation, that support security modeling and analysis. Modular automation refers to a new trend in automation in which various modules are developed in advance and integrated to build an automation system. Moreover, we study the gaps and missing components of the existing modeling approaches via a use case demonstration. Our study shows that the current state of automation and control system modeling has several limitations that require urgent attention.

To meet the increasing demands of high-throughput manufacturing, modern automation systems are increasingly being designed using a modular architecture, commonly referred to as modular automation. However, due to vendor lock-ins and high upfront investment requirements, the industry relies on existing legacy automation systems that were developed in a non-modular fashion. A major challenge lies in enabling the incremental modernization of legacy systems while ensuring their seamless coexistence with modular automation systems. To address this challenge, we propose a conceptual architecture for a containerized gateway that integrates legacy and modular automation systems. We present initial insights into the feasibility of using containers for such integration via a survey conducted with researchers and practitioners in the automation domain. Furthermore, we discuss an implementation plan for the proposed architecture in the automation industrial settings.

In this paper, we present the Rubus tool suite, with a focus on its static (offline) real-time scheduler. The schedules generated by the scheduler are executed by a real-time operating system certified according to the ISO 26262 safety standard. The Rubus tool suite and its scheduler have been utilized in the vehicle industry for model- and component-based software development of resource-constrained embedded systems for over$\mathbf{2 5}$years. Since its introduction in 1998, the scheduler has evolved significantly, transitioning from pure Earliest Deadline First (EDF) heuristics to incorporating priorities, data dependencies, and the ability to distribute the schedule over the entire hyperperiod of the software application, among other heuristics. We provide an in-depth discussion on the mechanisms and algorithms that constitute the Rubus offline scheduler. Moreover, we provide an example of its application in generating an offline schedule for a part of software architecture in an industrial setting.

The increasing complexity of modern embedded systems highlights the limitations of Controller Area Network (CAN) in terms of transmission speed and scalability. The IEEE Time-Sensitive Networking (TSN) task group developed a set of standards to enhance switched Ethernet with high bandwidth, low jitter, and deterministic communication. Despite these advances, CAN will likely co-exist with TSN in, e.g., the automotive industry due to factors such as cost-effectiveness and legacy of CAN. This paper presents an experimental evaluation of a CAN-toTSN gateway implementation, focusing on the impact of different forwarding and scheduling strategies on network performance. We analyze various queuing techniques and scheduling mechanisms in a realistic experimental setup and assess their impact on end-to-end delay and TSN bandwidth utilization. The evaluation results demonstrate that encapsulating only a single CAN frame within a TSN frame effectively minimizes the end-to-end delay of CAN frames, in particular when a high-speed TSN network is used. Furthermore, we perform a comparative evaluation of the Time-Aware Shaper (TAS) and Weighted Round Robin (WRR) mechanisms in the TSN network. Interestingly, WRR leads to lower delays for CAN frames in the TSN network compared to TAS, which we attribute to the lack of synchronization between CAN and TSN.

A hybrid cloud is an efficient solution to deal with the problem of insufficient resources of a private cloud when computing demands increase beyond its resource capacities. Cost-efficient workflow scheduling, considering security requirements and data dependency among tasks, is a prominent issue in the hybrid cloud. To address this problem, we propose a mathematical model that minimizes the monetary cost of executing a workflow and satisfies the security requirements of tasks under a deadline. The proposed model fulfills data dependency among tasks, and data transmission time is formulated with exact mathematical expressions. The derived model is a Mixed-integer linear programming problem. We evaluate the proposed model with real-world workflows over changes in the input variables of the model, such as the deadline and security requirements. This paper also presents a post-optimality analysis that investigates the stability of the assignment problem. The experimental results show that the proposed model minimizes the cost by decreasing inter-cloud communications for dependent tasks. However, the optimal solutions are affected by the limitations that are imposed by the problem constraints.

Integrating Time-Sensitive Networking (TSN) with 5G cellular networks facilitates high-bandwidth, low-latency end-to-end communication in networked embedded systems. An integrated TSN-5G network has the potential to support predictable and deterministic end-to-end communication, as well as to significantly enhance scalability, particularly in industrial automation, by providing flexibility, efficiency, and responsiveness. This paper aims to facilitate the end-to-end (E2E) communication over the integrated TSN-5G networks, by addressing two of the main challenges: (1) design and implementation of an effective TSN-5G gateway that not only ensures an effective forwarding mechanism to translate the traffic among both networks, but also maps the TSN traffic to the corresponding 5G quality-of-service profiles to ensure the timing requirements of high-critical traffic, and (2) establishment of clock synchronization across all network components to support the E2E communication in TSN-5G networks. The paper outlines the design and implementation of a robust TSN-5G gateway that bridges TSN and 5G network architectures, ensuring seamless interoperability between them. We utilize a standalone private 5G network within a controlled lab environment to establish the E2E communication for the TSN-5G network, with a particular emphasizes on analyzing latencies and jitter to provide valuable insights for industrial implementation. Moreover, the gateway facilitates a time synchronization approach, to enable time coordination between network components that supports E2E communication on TSN-5G networks considering the hardware limitation. Our findings indicate that achieving latencies below 20 ms is feasible in an integrated TSN-5G network using the proposed configuration of a private 5G setup with a channel bandwidth of 40 MHz.

Abstract This paper proposes an approach to pattern-based modeling and Uppaal-based verification for ROS 2 applications. The proposed verification focuses on callback execution latencies and buffer overflow. We propose formal model templates to model the execution of ROS 2 system components, created using a pattern-based approach. The model templates simplify the formal modeling of an ROS 2 application. Using Uppaal, we model in Uppaal timed automata, allowing the description of computation chains of ROS 2-based applications. Our focus is on execution behavior, including two versions of the mainline single-threaded executor of ROS 2. System traces generated using the formal models are validated in multiple experiments. Furthermore, we compare two approaches to modeling the execution of nodes that are typically the core units of computation of ROS 2. The first approach is a holistic approach to model ROS 2 applications, including communication and execution in computation chains. The second is an approach for individual nodes only, at a higher abstraction level. Additionally, we show the application of the verification by model checking in two ROS 2 system scenarios where we compare generated model traces to actual system executions. Overall, through formal modeling and verification, we showcase the potential for uncovering errors in the execution of distributed robotic systems.

The Time-Sensitive Networking (TSN) Task Group of the IEEE has proposed standards to provide Ethernet with real-time guarantees, network management and fault tolerance mechanisms. In this way, the Task Group expects Ethernet to become the standard network technology for novel industrial applications with real-time and reliability requirements. TSN proposes to use space redundancy to increase the reliability of the network, but redundancy alone might not be enough to reach the reliability guarantees required by certain applications, such as offshore industrial systems. For this reason, we propose a fault diagnosis mechanism called FAUDI that represents the first step towards automatic online reconfiguration of TSN networks to adapt to faults affecting the network. We present the design of FAUDI and we model it using the UPPAAL model checker, which allows to carry out an exhaustive evaluation of FAUDI's design. We use the model to validate the design and to verify that FAUDI exhibits properties that are of paramount importance in reliable real-time systems.

In an Industrial Control System (ICS), link failures causing partitioning between the redundant controller pair can prevent synchronization. This disruption could potentially trigger incorrect redundancy role-switching procedures. Distinguishing link and node failures from each controller's perspective can effectively mitigate these dependability threats. We introduce an algorithm capable of detecting and differentiating link failures from node failures within a bounded time. The proposed algorithm leverages periodic messages generated by industrial protocols operational in network devices. Our preliminary evaluation indicates the feasibility of the proposed algorithm in terms of meeting the real-time requirements of the ICSs.

Industrial automation and control systems are responsible for running our most important infrastructures, providing electricity and clean water, producing medicine and food, along with many other services and products we take for granted. The safe and secure operation of these systems is therefore of great importance. Reliability is a fundamental requirement, with spatial controller redundancy being one important fault-tolerance mechanism. In current control system solutions, controller redundancy is implemented using state and heartbeat transfer communicated over dedicated physical links, based on an assumption of implicit trust. However, with the emerging network-centric control strategies there is a desire to transition into dynamic redundancy scenarios, where such dedicated links are unfeasible. In this paper, an approach for a threat-model based security analysis is presented from the perspective of the automation industry. The approach is applied to the communication links used for supporting control system redundancy within a network-centric architecture.

As the industry trend is moving toward Ethernet-based Industrial Control Systems (ICSs) in line with the industry 4.0 paradigm, the network traffic must be monitored and managed to keep the systems reliably available. A flat converged network architecture where all the controllers, Input/Output (I/O), and supervisory systems are connected introduces mixed traffic classes competing for network resources and access to the shared medium. These traffic classes are typically managed with different Quality of Service (QoS) techniques. The challenge lies in managing end-to-end QoS in a heterogeneous environment and configuring switches according to the vendor, model, and operating software. Meanwhile, emerging greenfield technology are not deployable with switches used in today's ICS. We propose a distributed QoS supervisory agent, capable of detecting and correcting faulty QoS configurations in a contemporary heterogeneous Layer 2 switch environment. The initial results are achieved through two experimental testbeds in a use case where our agent successfully corrected the QoS configurations.

Abstract The edge-cloud computing continuum effectively uses fog and cloud servers to meet the quality of service (QoS) requirements of tasks when edge devices cannot meet those requirements. This paper focuses on the workflow offloading problem in edge-cloud computing and formulates this problem as a nonlinear mathematical programming model. The objective function is to minimize the monetary cost of executing a workflow while satisfying constraints related to data dependency among tasks and QoS requirements, including security and deadlines. Additionally, it presents a genetic algorithm for the workflow offloading problem to find near-optimal solutions with the cost minimization objective. The performance of the proposed mathematical model and genetic algorithm is evaluated on several real-world workflows. Experimental results demonstrate that the proposed genetic algorithm can find admissible solutions comparable to the mathematical model and outperforms particle swarm optimization, bee life algorithm, and a hybrid heuristic-genetic algorithm in terms of workflow execution costs.

Novel production paradigms aim at increasing the efficiency and flexibility of production systems. Nonetheless, traditional industrial infrastructures lack the mechanisms needed to support these new paradigms. One of the main limiting factors is the architecture, which follows the automation pyramid in which subsystems are divided in layers depending on their functionalities. This allowed to meet the timing and dependability requirements of the production subsystems, however at the cost of limiting the exchange of information required to provide increased flexibility to the system. For this reason, in this paper we propose a new industrial architecture with a single network infrastructure to connect all the devices that conform to the industrial systems. On top of that, we design an Automatic Network Configurator to support the automatic configuration of the system. To assess the feasibility of our design and evaluate its performance, we implement the first instance of the architecture capable of supporting changes in the traffic requirements during run-time, i.e., without stopping or disrupting the system's operation. Furthermore, we use the implemented instance to measure the time required for reconfigurations.

This paper performs a comparative evaluation of various generations of Controller Area Network (CAN), including the classical CAN, CAN Flexible Data-Rate (FD), and CAN Extra Long (XL). We utilize response-time analysis for the evaluation. In this regard, we identify that the state of the art lacks the response-time analysis for CAN XL. Hence, we discuss the worst-case transmission times calculations for CAN XL frames and incorporate them to the existing analysis for CAN to support response-time analysis of CAN XL frames. Using the extended analysis, we perform a comparative evaluation of the three generations of CAN by analyzing an automotive industrial use case. In crux, we show that using CAN FD is more advantageous than the classical CAN and CAN XL when using frames with payloads of up to 8 bytes, despite the fact that CAN XL supports higher bit rates. For frames with 12-64 bytes payloads, CAN FD performs better than CAN XL when running at the same bit rate, but CAN XL performs better when running at a higher bit rate. Additionally, we discovered that CAN XL performs better than the classical CAN and CAN FD when the frame payload is over 64 bytes, even if it runs at the same or higher bit rates than CAN FD.

Robot operating system 2 (ROS 2) is increasingly popular both in research and commercial robotic systems. ROS 2 is designed to allow real-time execution and data communication, enabling rapid prototyping and deployment of robotic systems. In order to predict and calculate execution times in ROS 2, one needs to analyze its internal scheduler, called executor. The executor has been updated in various distributions of ROS 2, which is shown to impact significantly the periodic execution invoked by the underlying operating system’s timers, potentially causing unexpected latencies. To expose the mentioned impact due to executor differences, in this paper, we present an experimental evaluation of the execution behavior of ROS 2’s schedulable entities, namely callbacks, among the existing versions of the executor. We visualize the differences of callback execution order via simulation, and we create design-level scenarios that impact the execution of periodically scheduled callbacks, negatively. Moreover, we show how such negative impact can be mitigated by using multi-threaded executors. Finally, we illustrate the observed behavior on a real-world centralized multi-agent robot system. Our work aims to raise awareness within the ROS 2 developer community, regarding possible problems of timer blocking, and propose a mitigation solution of the latter.

The edge computing paradigm extends the architectural space of real-time systems by bringing the capabilities of the cloud to the edge. Unlike cloud-native systems designed for mean response times, real-time industrial embedded systems are designed to control a single physical system, such as a manipulator arm or a mobile robot, that requires temporal predictability. We consider the problem of dispatching and scheduling of jobs with deadlines that can be offloaded to the edge and propose DAL, a deadline-aware load balancing and scheduling framework that leverages the availability of on-demand computing resources along with an on-arrival dispatching scheme to manage temporal requirements of such offloaded applications. The evaluation indicates that DAL can achieve reasonably good performance even when execution times, arrival times, and deadlines vary.

Wireless Time-Sensitive Networks (TSN) are needed to fulfill the requirements of real-time applications in areas where wired connections are not feasible. Wireless TSN combines the real-time capabilities of TSN with the flexibility of wireless connectivity opening a path for new use cases while providing determinism to time-critical scenarios such as autonomous vehicles. Industrial automation is integrating TSN with various wireless technologies such as WiFi, 4G, and 5G. This paper presents an ongoing work which aim is to experimentally analyze the performance of TSN when integrated with 4G, 5G, and WiFi in real-world scenarios. This will help both the researchers and industries to have a clear view of the network performance regarding the end-to-end latency requirements when designing their applications and use cases.

We consider the problem of on-arrival dispatching and scheduling jobs with stochastic execution times, inter-arrival times, and deadlines in multi-server fog and edge computing platforms. In terms of mean response times, it has been shown that size-based scheduling policies, when combined with dispatching policies such as join-shortest-queue, provide better performance over policies such as first-in-first-out. Since job sizes may not always be known apriori, prediction-based policies have been shown to perform reasonably well. However, little is known about the performance of prediction-based policies for jobs with firm deadlines. In this paper, we address this issue by considering the number of jobs that complete within their deadlines as a performance metric and investigate, using simulations, the performance of a prediction-based shortest-job-first scheduling policy for the considered metric and compare it against scheduling policies that prioritize based on deadlines (EDF) and arrival times (FIFO). The evaluation indicates that in under-loaded conditions, the prediction-based policy is outperformed by both FIFO and EDF policies. However, in overloaded scenarios, the prediction-based policy offers slightly better performance.

Controller Area Network (CAN) and Ethernet network are expected to co-exist in automotive industry as Ethernet provides a high-bandwidth communication, while CAN is a legacy cost-effective solution. Due to the shortcomings of conventional switched Etherent, such as determinism, IEEE Time Sensitive Networking (TSN) task group developed a set of standards to enhance the switched Ethernet technology providing low-jitter and deterministic communication. Considering these two network domains, we investigate various design approaches for a gateway that connects a CAN domain to a TSN domain. We present three gateway forwarding techniques and we develop end-to-end delay analysis methods for them. Via the analysis methods and applying them to synthetic use cases we show that the intuitive existing approach of encapsulating multiple CAN frames into a single Ethernet frame is not necessarily an efficient solution. In fact, we demonstrate several cases where it is preferable to encapsulate only one CAN frame into a TSN frame, in particular when we use a high speed TSN network. The results have a significant impact on developing such gateways as the implementation of the one-to-one frame encapsulation is considerably simpler than other complex gateway-forwarding techniques.

In this paper, we present an end-to-end timing model to capture timing information from software architectures of distributed embedded systems that use network communication based on the Time-Sensitive Networking (TSN) standards. Such a model is required as an input to perform end-to-end timing analysis of these systems. Furthermore, we present a methodology that aims at automated extraction of instances of the end-to-end timing model from component-based software architectures of the systems and the TSN network configurations. As a proof of concept, we implement the proposed end-to-end timing model and the extraction methodology in the Rubus Component Model (RCM) and its tool chain Rubus-ICE that are used in the vehicle industry. We demonstrate the usability of the proposed model and methodology by modeling a vehicular industrial use case and performing its timing analysis.

The edge computing paradigm brings the capabilities of the cloud such as on-demand resource availability to the edge for applications with low-latency and real-time requirements. While cloud-native load balancing and scheduling algorithms strive to improve performance metrics like mean response times, real-time systems, that govern physical systems, must satisfy deadline requirements. This paper explores the potential of an edge computing architecture that utilizes the on-demand availability of computational resources to satisfy firm real-time requirements for applications with stochastic execution and inter-arrival times. As it might be difficult to know precise execution times of individual jobs prior to completion, we consider an admission policy that relies on single-bit execution time predictions for dispatching. We evaluate its performance in terms of the number of jobs that complete by their deadlines via simulations. The results indicate that the prediction-based admission policy can achieve reasonable performance for the considered settings.

In this paper, we identify that the existing end-to-end data propagation delay analysis for distributed embedded systems can calculate pessimistic (over-estimated) analysis results when the nodes are synchronized. This is particularly the case of the Scheduled Traffic (ST) class in Time-sensitive Networking (TSN), which is scheduled offline according to the IEEE 802.1Qbv standard and the nodes are synchronized according to the IEEE 802.1AS standard. We present a comprehensive system model for distributed embedded systems that incorporates all of the above mentioned aspect as well as all traffic classes in TSN. We extend the analysis to support both synchronization and non-synchronization among the ECUs as well as offline schedules on the networks. The extended analysis can now be used to analyze all traffic classes in TSN when the nodes are synchronized without introducing any pessimism in the analysis results. We evaluate the proposed model and the extended analysis on a vehicular industrial use case.

Many industrial real-time applications in various domains, e.g., automotive, industrial automation, industrial IoT, and industry 4.0, require ultra-low end-to-end network latency, often in the order of 10 milliseconds or less. The IEEE 802.1 time-sensitive networking (TSN) is a set of standards that supports the required low-latency wired communication with ultra-low jitter. The flexibility of such a wired connection can be increased if it is integrated with a mobile wireless network. The fifth generation of cellular networks (5G) is capable of supporting the required levels of network latency with the Ultra-Reliable Low Latency Communication (URLLC) service. To fully utilize the potential of these two technologies (TSN and 5G) in industrial applications, seamless integration of the TSN wired-based network with the 5G wireless-based network is needed. In this article, we provide a comprehensive and well-structured snapshot of the existing research on TSN-5G integration. In this regard, we present the planning, execution, and analysis results of the systematic review. We also identify the trends, technical characteristics, and potential gaps in the state of the art, thus highlighting future research directions in the integration of TSN and 5G communication technologies. We notice that 73% of the primary studies address the time synchronization in the integration of TSN and 5G technologies, introducing approaches with an accuracy starting from the levels of hundred nanoseconds to one microsecond. Majority of primary studies aim at optimizing communication latency in their approach, which is a key quality attribute in automotive and industrial automation applications today.

In this paper, we present a hierarchical model for time predictable task scheduling in edge-cloud computing architecture for industrial cyber-physical systems. Regarding the scheduling problem, we also investigate the common problem-solving approaches and discuss our preliminary plan to realize the proposed architecture. Furthermore, an Integer linear programming (ILP) model is proposed for task scheduling problem in the cloud layer. The model considers timing and security requirements of applications and the objective is to minimize the financial cost of their execution.

Novel industrial applications are leading to important changes in industrial systems. One of the most important changes is the need for systems that are capable to adapt to changes in the environment or the system itself. Because of their nature many of these applications are distributed, and their network infrastructure is key to guarantee the correct operation of the overall system. Furthermore, in order for a distributed system to be able to adapt, its network must be flexible enough to support changes in the traffic during runtime. The Time-Sensitive Networking (TSN) Task Group has proposed a series of standards that aim at providing deterministic real-time communications over Ethernet. TSN also provides centralised online configuration and control architectures which enable the online configuration of the network. A key part in TSN’s centralised architectures is the Centralised Network Configuration element (CNC). In this work we present a first implementation of a CNC capable of scheduling time-triggered traffic and deploying such configuration in the network using the Network Configuration (NETCONF) protocol. We also assess the correctness of our implementation using an industrial use case provided by Volvo Construction Equipment.

The integration of Time-Sensitive Networks (TSN) with 5G cellular networks requires a defined architecture for network configuration and management. Although 3GPP specifications provide necessary means for the TSN-5G integration, the operation of such converged TSN-5G network remains an open challenge for the research community. To address this challenge, this paper presents the ongoing work in developing a centralized architectural model to configure the TSN-5G network, and forward traffic from TSN to 5G and vice-versa. The proposed architectural model uses knowledge of the traffic characteristics to carry out a more accurate mapping of quality of service attributes between TSN and 5G.

Extraction of end-to-end timing information from software architectures of vehicular systems to support their timing analysis is a daunting challenge. To address this challenge, this paper presents a systematic method to extract this information from vehicular software architectures that can be distributed over several electronic control units connected by Time-Sensitive Networking (TSN) networks. As a proof of concept, the proposed extraction method is applied to an industrial component model, namely the Rubus Component Model (RCM), and its toolchain. Furthermore, the usability of the proposed method is demonstrated in an industrial use case from the vehicular domain.

Service-oriented architectures are emerging as a promising solution to deal with the increasing complexity of automotive software systems. In this paper, we conduct a systematic mapping study to investigate the use of service-oriented architecture for the development of automotive software systems. This study aims at providing publication trends, available architectural solutions, core benefits and open challenges in the automotive service-oriented architectures. From an initial set of 341 peer-reviewed publications, we select 28 primary studies, which are classified and analysed using a systematic and comprehensive protocol. Using the extracted data, we provide both quantitative and qualitative analyses using vertical and orthogonal analysis. The results indicate that there has been a significant increase in the number of publications recently, and that the studies focused on defining functionalities and data flows among them. Functional suitability is found to be the most recognised benefit while security, safety and reliability are the most addressed challenges when utilising service-oriented architectures in the automotive domain.

In a distributed system, applications can perform both reads and updates without costly synchronous network round-trips by using Conflict-free Replicated Data Types (CRDTs). Most CRDTs are based on some variant of atomic broadcast, as that enables them to support causal dependencies between updates of multiple objects. However, the overhead of this atomic broadcast is unnecessary in systems handling only independent CRDT objects. We identified a set of use cases for tracking resource usage where there is a need for a replication mechanism with less complexity and network usage as compared to using atomic broadcast. In this paper, we present the design of such a replication protocol that efficiently leverages the commutativity of CRDTs. The proposed protocol CReDiT (CRDT enhanced with intelligence) uses up to four communication steps per update, but these steps can be batched as needed. It uses network resources only when updates need to be communicated. Furthermore, it is less sensit ive to server failures than current state-of-the-art solutions as other nodes can use new values already after the first communication step, instead of after two or more.

Multi-agent robot systems, specifically mobile robots in dynamic environments interacting with humans, e.g., assisting in production environments, have seen an increased interest over the past years. To better understand the ROS2 communication in a network with a high load of nodes, this paper investigates the communication handling of multiple robots to a single tracking node for centralized multi-agent robot systems using ROS2. Thereore, a quantitative analysis of two publisher-subscriber communication architectures and a comparative study between DDS vendors (CycloneDDS, FastDDS and GurumDDS) using ROS2 Galactic is performed. The architectures of consideration are a many-to-one approach, where multiple robots communicate to a central node over one topic, and the one-to-one communication approach, where multiple robots communicate over particular topics to a central node. Throughout this work, the increase in the number of robots at different publishing rates is simulated on a single computer for the different DDS vendors. A further simulation is done using a distributed setup with CycloneDDS. The simulations show that with an increase in the number of nodes, the average data age and the data miss ratio in the one-to-one approach were significantly lower than in the many-to-one approach. CycloneDDS was shown as the most robust regarding crashes and response time under system launch, while FastDDS showed better results regarding the data ageing.

Integrating wired Ethernet networks, such as Time-Sensitive Networks (TSN), to 5G cellular network requires a flow management technique to efficiently map TSN traffic to 5G Quality-of-Service (QoS) flows. The 3GPP Release 16 provides a set of predefined QoS characteristics, such as priority level, packet delay budget, and maximum data burst volume, which can be used for the 5G QoS flows. Within this context, mapping TSN traffic flows to 5G QoS flows in an integrated TSN-5G network is of paramount importance as the mapping can significantly impact on the end-to-end QoS in the integrated network. In this paper, we present a novel and efficient mapping algorithm to map different TSN traffic flows to 5G QoS flows. To the best of our knowledge, this is the first QoS-aware mapping algorithm based on the application constraints used to exchange flows between TSN and 5G network domains. We evaluate the proposed mapping algorithm on synthetic scenarios with random sets of constraints on deadline, jitter, bandwidth, and packet loss rate. The evaluation results show that the proposed mapping algorithm can fulfill over 90% of the applications’ constraints.

Time Sensitive Networking (TSN) is a set of IEEE standards based on switched Ethernet that aim at meeting high-bandwidth and low-latency requirements in wired communication. TSN implementations typically do not support integration of wireless networks, which limits their applicability to many industrial applications that need both wired and wire-less communication. The development of 5G and its promised Ultra-Reliable and Low-Latency Communication (URLLC) in-tegrated with TSN would offer a promising solution to meet the bandwidth, latency and reliability requirements in these industrial applications. In order to support such an integration, we propose a technique to translate the traffic between TSN and 5G communication technologies. As a proof of concept, we implement the translation technique in a well-known TSN simulator, namely NeSTiNg, that is based on the OMNeT ++ tool. Furthermore, we evaluate the proposed technique using an automotive industrial use case.

Scheduling of real-time applications modelled according to the periodic and the sporadic task model under hierarchical and compositional real-time systems has been widely studied to provide temporal isolation among independent applications running on shared resources. However, for some real-time applications which are amenable to variation in their timing behaviour, usage of these tasks models can result in pessimistic solutions. The elastic task model addresses this pessimism by allowing the timing requirements of an application’s tasks to be specified as a range of values instead of a single value. Although the scheduling of elastic applications on dedicated resources has received considerable attention, there is limited work on scheduling of such applications in hierarchical and compositional settings. In this paper, we evaluate different earliest deadline first scheduling algorithms to schedule elastic applications in a minimum parallelism supply form reservation on a multiprocessor system. Our evaluation indicates that the proposed approach provides performance comparable to the current state-of-art algorithms for scheduling elastic applications on dedicated processors in terms of schedulability.

This paper addresses the scheduling of industrial time-critical applications on multi-core embedded systems. A novel scheduling technique under partitioned scheduling is proposed that minimizes inter-core data-propagation delays between tasks that are activated with different periods. The proposed technique is based on the read-execute-write model for the execution of tasks to guarantee temporal isolation when accessing the shared resources. A Constraint Programming formulation is presented to find the schedule for each core. Evaluations are preformed to assess the scalability as well as the resulting schedulability ratio, which is still 18% for two cores that are both utilized 90%. Furthermore, an automotive industrial case study is performed to demonstrate the applicability of the proposed technique to industrial systems. The case study also presents a comparative evaluation of the schedules generated by (i) the proposed technique and (ii) the Rubus-ICE industrial tool suite with respect to jitter, inter-core data-propagation delays and their impact on data age of task chains that span multiple cores.

This paper presents a schedulability analysis for the Best-Effort (BE) traffic class within Time Sensitive Networking (TSN) networks. The presented analysis considers several features in the TSN standards, including the Credit-Based Shaper (CBS), the Time-Aware Shaper (TAS) and the frame preemption. Although the BE class in TSN is primarily used for the traffic with no strict timing requirements, some industrial applications prefer to utilize this class for the non-hard real-time traffic instead of classes that use the CBS. The reason mainly lies in the fact that the complexity of TSN configuration becomes significantly high when the time-triggered traffic via the TAS and other classes via the CBS are used altogether. We demonstrate the applicability of the presented analysis on a vehicular application use case. We show that a network designer can get information on the schedulability of the BE traffic, based on which the network configuration can be further refined with respect to the application requirements.

Many real-time applications have functional behaviour that requires variability in timing properties at runtime. The elastic task model provides a convenient mechanism to specify and encapsulate such variability and enables the modification of an application's periods during run-time to keep the application schedulable. Additionally, reservation-based scheduling techniques were proposed for the same purpose of taming unpredictability of timing variations, but with a different solution, i.e., by providing the spatial and temporal isolation for executing independent applications on the same hardware. In this paper, we combine the two approaches by proposing a two-level adaptive scheduling framework which is based on the elastic task model and the compositional framework based on the periodic resource model. The proposed framework minimises the number of requests for bandwidth adaption at the reservation (system) level and primarily enables schedulability by accounting for the application's elasticity by adjusting the periods. The motivation for this design choice is to rather localise the effect of the modifications within the application, without necessarily affecting all the applications at the system level compared to the changes made at the application level. The evaluation results show that the local application changes may often be enough to solve the problem of variability, significantly reducing the number of bandwidth adjustments, and therefore reducing the potential negative impact on all the applications of a system.

Autonomous vehicular systems require computer vision and intelligent on-board decision making functionalities that include a mix of sequential and parallel workloads. The execution times of the workloads and power consumption in these functionalities can be lowered by utilizing the accelerators (e.g., GPU) instead of running the workloads entirely on the host processing units (CPU). However, allocating all the parallelizable workload to accelerators can create a computation bottleneck in the accelerators that, in turn, can have an adverse effect on schedulability of the systems. This paper presents a novel framework that can allocate the accelerate-intensive workloads to the accelerators as well as to the non-accelerated host processing units. Within the context of this framework, the paper introduces five offloading techniques to mitigate the accelerator-intensive workloads by utilizing excess capacity of non-accelerated processing units under dynamic scheduling in CPU-GPU heterogeneous processors. The proposed techniques are evaluated using simulation experiments. The evaluation results indicate that one of the proposed techniques can achieve up to 16% improvement in schedulability of the task sets compared to the traditional non-offloading technique.

The functionality advancements and novel customer features that are currently found in modern automotive systems require high-bandwidth and low-latency in-vehicle communications, which become even more compelling for autonomous vehicles. In a recent effort to meet these requirements, the IEEE Time-Sensitive Networking (TSN) task group has developed a set of standards that introduce novel features in Switched Ethernet. TSN standards offer, for example, a common notion of time through accurate and reliable clock synchronization, delay bounds for real-time traffic, time-driven transmissions, improved reliability, and much more. In order to fully utilize the potential of these novel protocols in the automotive domain, TSN should be seamlessly integrated into the state-of-the-art and state-of-practice model-based development processes for automotive embedded systems. Some of the core phases in these processes include software architecture modeling, timing predictability verification, simulation, and hardware realization and deployment. Moreover, throughout the development of automotive embedded systems, the safety and security requirements specified on these systems need to be duly taken into account. In this context, this work provides an overview of TSN in automotive applications and discusses the recent technological developments relevant to the adoption of TSN in automotive embedded systems. The work also points at the open challenges and future research directions.

This paper identifies a limitation in the frame preemption model in the TSN standard (IEEE 802.1Q-2018), due to which high priority frames can experience significantly long blocking delays, thereby exacerbating their worst-case response times. This limitation can have a considerable impact on the design, analysis and performance of TSN-based systems. To address this limitation, the paper presents a novel and more efficient frame preemption model in the TSN standard that allows over 90% reduction in the maximum blocking delay leading to lower worst-case response times of high priority frames compared to the frame preemption model used in the existing works. The paper also shows that the improvement becomes even more significant in multi-switch TSN networks. In order to evaluate the effects of preemption, the paper performs simulations by enabling and disabling preemptions as well as enabling and disabling the Hold/Release mechanism supported by TSN. Furthermore, the paper performs a comparative evaluation of the two models of frame preemption in TSN using simulations. The evaluation shows that the maximum response times of high priority frames can be significantly reduced with very small impact on the response times of lower priority frames. The paper also shows the improvement in the maximum response times of higher priority frames using an automotive industrial use case that employs a multi-hop TSN network for on-board communication.

This paper proposes a systematic three-stage methodology for migrating complex real-time industrial software systems from single-core to multi-core computing platforms. Single-core platforms have limited computational capabilities that prevent integration of computationally demanding applications such as image processing within the existing system. Modern multi-core processors offer a promising solution to address these limitations by providing increased computational power and allowing parallel execution of different applications within the system. However, the transition from traditional single-core to contemporary multi-core computing platforms is non-trivial and requires a systematic and well-defined migration process. This paper reviews some of the existing migration methods and provides a systematic multi-phase migration process with emphasis on software architecture recovery and transformation to explicitly address the timing and dependability attributes expected of industrial software systems. The methodology was evaluated using a survey-based approach and the results indicate that the presented methodology is feasible, useable and useful for real-time industrial software systems.

This paper provides a systematic three-stage methodology for migrating complex real-time industrial software systems from single-core to multi-core computing platforms. Single-core platforms have limited computational capabilities that prevent integration of computationally demanding applications such as image processing within the existing system. Modern multi-core processors provide increased computing capacity and allow the parallel execution of different applications within the system. However, this transition is non-trivial and requires a systematic and well-defined migration process. This paper reviews some of the existing migration methods and provides a systematic multi-phase migration process with emphasis on software architecture recovery and transformation to explicitly address the timing and dependability attributes expected of industrial software systems.

Abstract Software in modern vehicles consists of multi-criticality functions, where a function can be safety-critical with stringent real-time requirements, less critical from the vehicle operation perspective, but still with real-time requirements, or not critical at all. Next-generation autonomous vehicles will require higher computational power to run multi-criticality functions and such a power can only be provided by parallel computing platforms such as multi-core architectures. However, current model-based software development solutions and related modelling languages have not been designed to effectively deal with challenges specific of multi-core, such as core-interdependency and controlled allocation of software to hardware. In this paper, we report on the evolution of the Rubus Component Model for the modelling, analysis, and development of vehicular software systems with multi-criticality for deployment on multi-core platforms. Our goal is to provide a lightweight and technology-preserving transition from model-based software development for single-core to multi-core. This is achieved by evolving the Rubus Component Model to capture explicit concepts for multi-core and parallel hardware and for expressing variable criticality of software functions. The paper illustrates these contributions through an industrial application in the vehicular domain.

This paper presents the first holistic modeling approach for Time-Sensitive Networking (TSN) communication that integrates into a model-and component-based software development framework for distributed embedded systems. Based on these new models, we also present an end-to-end timing model for TSN-interconnected distributed embedded systems. Our approach is expressive enough to model the timing information of TSN and the timing behaviour of software that communicates over TSN, hence allowing end-to-end timing analysis. A proof of concept for the proposed approach is provided by implementing it for a component model and tool suite used in the vehicle industry. Moreover, a use case from the vehicle industry is modeled and analyzed with the proposed approach to demonstrate its usability.

In time-constrained vehicular systems, optimisation of the system architectures with respect to the system resources has a significant impact on the development cost, performance, and reliability of the systems. This paper adapts the state-of-the-art methods to derive optimised system architectures in the vehicular industrial settings, while taking real-time constraints, resource requirements, communication dependencies, and design choices into account. In this regard, the paper describes and evaluates an industrial use case wherein the proposed method is applied to derive an optimised allocation of the system architecture. The paper also presents evidence and validations that suggest the viability of the method and its applicability in the vehicle industry.

This paper investigates the effects of various parameters of high priority traffic classes on the Best Effort (BE) traffic in the networks based on the IEEE Time Sensitive Networking (TSN) standards. In this regard, the paper discusses ongoing work and presents preliminary results using a TSN simulator. The results indicate that several parameters of the high priority traffic such as periods, offsets and preemption modes can have a significant impact on the quality of service (e.g., guaranteed message delivery and message delays) of the BE traffic.

The collective use of several models and tools at various abstraction levels and phases during the development of vehicular distributed embedded systems poses many challenges. Within this context, this paper targets the challenges that are concerned with the unambiguous refinement of timing requirements, constraints and other timing information among various abstraction levels. Such information is required by the end-to-end timing analysis engines to provide pre-run-time verification about the predictability of these systems. The paper proposes an approach to represent and refine such information among various abstraction levels. As a proof of concept, the approach provides a representation of the timing information at the higher levels using the models that are developed with EAST-ADL and Timing Augmented Description Language. The approach then refines the timing information for the lower abstraction levels. The approach exploits the Rubus Component Model at the lower level to represent the timing information that cannot be clearly specified at the higher levels, such as trigger paths in distributed chains. A vehicular-application case study is conducted to show the applicability of the proposed approach.

Modern cars consist of a number of complex embedded and networked systems with steadily increasing requirements in terms of processing and communication resources. Novel automotive applications, such as automated driving, rise new needs and novel design challenges that cover a broad range of hardware/software engineering aspects. In this context, this paper provides an overview of the current technological challenges in on-board and networked automotive systems. This paper encompasses both the state-of-the-art design strategies and the upcoming hardware/software solutions for the next generation of automotive systems, with a special focus on embedded and networked technologies. In particular, this paper surveys current solutions and future trends on models and languages for automotive software development, on-board computational platforms, in-car network architectures and communication protocols, and novel design strategies for cybersecurity and functional safety.

The papers in this special section focus on embedded and networked systems for intelligent vehicles and robots. Embedded and networked systems for intelligent vehicles and robots are expected to have a significant economic, societal, and technological impact on industrial and automotive applications. Among the aspects that will benefit from these technologies the first one is safety, thanks to the reduction of accidents caused by human errors. Another positive effect is expected on sustainability, thanks to the increase in transport systems efficiency. Comfort and inclusiveness will be also improved, ensuring users’ freedom for other activities and “mobility for all.” Logistics and factory automation are among the main areas that will take advantages from intelligent vehicles and robots, that are expected to play a key role in Industry 4.0 scenarios, the so-called fourth industrial revolution, where intelligent vehicles and industrial robots will move and operate autonomously and cooperatively. Such a revolution has many key enabling technologies, such as, networked sensors, actuators, and embedded computing and control platforms, that will be distributed on-board the vehicle/robot. The contribution of artificial intelligence and deep learning computing platforms is also emerging to achieve full intelligent autonomous mobility of vehicles and robots.

Software-to-hardware allocation plays an important role in the development of resource-constrained automotive embedded systems that are required to meet timing, reliability and power requirements. This paper proposes an Integer Linear Programming optimization approach for the allocation of fault-tolerant embedded software applications that are developed using the AUTOSAR standard. The allocation takes into account the timing and reliability requirements of the multirate software applications and the heterogeneity of their execution platforms. The optimization objective is to minimize the total power consumption of the applications that are distributed over multiple computing units. The proposed approach is evaluated using a range of different software applications from the automotive domain, which are generated using the real-world automotive benchmark. The evaluation results indicate that our proposed allocation approach is effective while meeting the timing, reliability, and power requirements of the considered automotive software applications.

Access to shared memory is one of the main challenges for many-core processors. One group of scheduling strategies for such platforms focuses on the division of tasks' access to shared memory and code execution. This allows to orchestrate the access to shared local and off-chip memory in a way such that access contention between different compute cores is avoided by design. In this work, an execution framework is introduced that leverages local memory by statically allocating a subset of tasks to cores. This reduces the access times to shared memory, as off-chip memory access is avoided, and in turn improves the schedulability of such systems. A Constraint Programming (CP) formulation is presented to select the statically allocated tasks and to generate the complete system schedule. Evaluations show that the proposed approach yields an up to 19% higher schedulability ratio than related work, and a case study demonstrates its applicability to industrial problems.

Model-based development and component-based software engineering have emerged as a promising approach to deal with enormous software complexity in automotive systems. This approach supports the development of software architectures by interconnecting (and reusing) software components (SWCs) at various abstraction levels. Automotive software architectures are often modeled with chains of SWCs, also called cause-effect chains that are constrained by timing requirements. Based on the variations in activation patterns of SWCs, a single model of a cause-effect chain at a higher abstraction level can conform to several valid refined models of the chain at a lower abstraction level, which is closer to the system implementation. As a consequence, the total number of valid implementation-level models generated by the existing techniques increases exponentially, thereby significantly increasing the runtime of the timing analysis engines and liming the scalability of the existing techniques. This paper computes an upper bound on the activation pattern combinations that may result from a system of cause-effect chains in a given high-level model of the software architecture. An efficient algorithm is presented that traverses only a reduced number of possible combinations of the cause-effect chains, resulting in the timing analysis of a significantly lower number of implementation-level models of the software architecture. A proof of concept is provided by conducting a case study that shows significant reduction in the runtime of timing analysis engines, i.e., the timing behavior of the considered system is verified by performing the timing analysis of only 27% of all possible combinations of the cause-effect chains.

This paper proposes an approach to model switched Ethernet communication within a model- and component-based software development framework for vehicular distributed embedded systems. The paper also presents a method to extract the network timing model from the systems that use switched Ethernet networks. In order to provide a proof of concept, an existing industrial component model and its tool suite, namely RCM and Rubus-ICE respectively, are extended by implementing the modeling technique, the timing model extraction method and response-time analysis of the Ethernet AVB protocol. The extensions to RCM are backward compatible with the modeling and end-to-end timing analysis of traditional in-vehicle networks and legacy (previously developed) vehicular distributed embedded systems. Furthermore, the paper discusses the implementation and test strategy used in this work. Finally, the usability of the modeling approach and implemented timing analysis is demonstrated by modeling and time analyzing a vehicular application case study with the extended component model and tool suite.

A majority of multi-rate real-time systems are constrained by a multitude of timing requirements, in addition to the traditional deadlines on well-studied response times. This means, the timing predictability of these systems not only depends on the schedulability of certain task sets but also on the timely propagation of data through the chains of tasks from sensors to actuators. In the automotive industry, four different timing constraints corresponding to various data propagation delays are commonly specified on the systems. This paper identifies and addresses the source of pessimism as well as optimism in the calculations for one such delay, namely the reaction delay, in the state-of-the-art analysis that is already implemented in several industrial tools. Furthermore, a generic framework is proposed to compute all the four end-to-end data propagation delays, complying with the established delay semantics, in a scheduler and hardware-agnostic manner. This allows analysis of the system models already at early development phases, where limited system information is present. The paper further introduces mechanisms to generate job-level dependencies, a partial ordering of jobs, which need to be satisfied by any execution platform in order to meet the data propagation timing requirements. The job-level dependencies are first added to all task chains of the system and then reduced to its minimum required set such that the job order is not affected. Moreover, a necessary schedulability test is provided, allowing for varying the number of CPUs. The experimental evaluations demonstrate the tightness in the reaction delay with the proposed framework as compared to the existing state-of-the-art and practice solutions.

Automotive embedded systems are subjected to stringent timing requirements that need to be verified. One of the most complex timing requirement in these systems is the data age constraint. This constraint is specified on cause-effect chains and restricts the maximum time for the propagation of data through the chain. Tasks in a cause-effect chain can have different activation patterns and different periods, that introduce over- and under-sampling effects, which additionally aggravate the end-to-end timing analysis of the chain. Furthermore, the level of timing information available at various development stages (from modeling of the software architecture to the software implementation) varies a lot, the complete timing information is available only at the implementation stage. This uncertainty and limited timing information can restrict the end-to-end timing analysis of these chains. In this paper, we present methods to compute end-to-end delays based on different levels of system information. The characteristics of different communication semantics are further taken into account, thereby enabling timing analysis throughout the development process of such heterogeneous software systems. The presented methods are evaluated with extensive experiments. As a proof of concept, an industrial case study demonstrates the applicability of the proposed methods following a state-of-the-practice development process.

Contemporary distributed embedded systems in many domains have become highly complex due to ever-increasing demand on advanced computer controlled functionality. The resource reservation techniques can be effective in lowering the software complexity, ensuring predictability and allowing flexibility during the development and execution of these systems. This paper proposes a novel end-to-end resource reservation model for distributed embedded systems. In order to support the development of predictable systems using the proposed model, the paper provides a method to design resource reservations and an end-to-end timing analysis. The reservation design can be subjected to different optimization criteria with respect to runtime footprint, overhead or performance. The paper also presents and evaluates a case study to show the usability of the proposed model, reservation design method and end-to-end timing analysis.

Models and model transformations, the two core constituents of Model-Driven Engineering, aid in software development by automating, thus taming, error-proneness of tedious engineering activities. In many cases, the result of these automated activities is an overwhelming amount of information. This is the case of one-to-many model transformations that, e.g. in model-based design-space exploration, can potentially generate a massive amount of candidate models (i.e., solution space) from one single source model. In our scenario, from one design model we generate a set of possible implementation models on which timing analysis is run. The aim is to find the best model from a timing perspective. However, multiple implementation models can have equally good analysis results. Therefore, the engineer is expected to investigate the solution space for making a final decision, using criteria which fall outside the analysis' criteria themselves. Since candidate models can be many and very similar to each other, manually finding differences and commonalities is an impractical and error-prone task. In order to provide the engineer with an expressive representation of models' commonalities and differences, we propose the use of modelling with uncertainty. We achieve this by elevating the solution space to a first-class status, adopting a compact notation capable of representing the solution space by means of a single model with uncertainty. Commonalities and differences are thus represented by means of uncertainty points for the engineer to easily grasp them and consistently make her decision without manually inspecting each model individually.

Dependency analysis techniques are widely used to understand software implementations, and reduce their verification efforts. Recently, architectural languages have started to be integrated in the development of complex embedded systems. Such languages provide early development artifacts, which can be used to specify the structure and functionality of a system, and can be also analyzed in order to provide early information regarding the system's correctness. By performing dependency analysis on architectural languages, crucial dependencies can surface earlier in the life cycle. Once computed, these dependencies can be used to prune the architectural models in an attempt to reduce the early design-stage verification efforts. In this paper, we propose a dependency analysis-based technique that can be applied to prune models in EAST-ADL, an architectural description language tailored to automotive systems development. To achieve correct pruning, we investigate the types of dependencies that can appear in an architectural model, and how these dependencies create dependency chains within the model. Next, we investigate how such dependency chains can be exploited in formal verification in order to reduce the verified state-spaces during model-checking. Assuming a given requirement, our pruning method entails that only the relevant dependency chains are examined during EAST-ADL model-checking against that particular requirement. We validate our analysis results by comparing them to those obtained by applying an analytical approach for end-to-end timing analysis in EAST-ADL models. The methodology is illustrated on a Brake-by-Wire industrial system.

There is a plethora of models, techniques and tools that support model-and component-based software development of vehicular distributed embedded systems. However, a large majority of them have a limited or no support to model and specify end-to-end resource reservations on the software architectures of these systems. Resource reservations allow flexibility during the development and execution of such complex systems without jeopardizing their predictable behavior. As a result, several applications in the system that share the same hardware platform can be developed independently. In this paper we identify several requirements that any existing component model should fulfill in order to support the modeling of end-to-end resource reservations on the software architectures of such systems. As a proof of concept, we extend the Rubus Component Model (RCM) by fulfilling these requirements. RCM is used for the development of control functionality in vehicular embedded systems by several international companies. We also provide a technique to extract execution models from the software architectures of these systems with resource reservations. In order to show the usability of our technique, we model a vehicular distributed embedded system with the extended component model and extract the execution model from the software architecture augmented with end-to-end resource reservations.

The resource reservation techniques provide effective means to lower the software complexity, ensure predictability and allow flexibility during the development and execution of complex distributed embedded systems. In this paper we propose a new end-to-end resource reservation model for distributed embedded systems. The model is comprehensive in such a way that it supports end-to-end resource reservations on distributed transactions with various activation patterns that are commonly used in industrial control systems. The model allows resource reservations on processors and real-time network protocols. We also present timing analysis for the distributed embedded systems that are developed using the proposed model. The timing analysis computes the end-to-end response times as well as delays such as data age and reaction delays. The presented analysis also supports real-time networks that can autonomously initiate transmissions. Such networks are not supported by the existing analyses. We also include a case study to show the usability of the model and end-to-end timing analysis with resource reservations.

Today's automotive embedded systems comprise a multitude of functionalities, many with complex timing requirements. Besides task specific timing requirements, such applications often have timing requirements for the propagation of data through a chain of tasks. An important metric for control applications is the data age, which is addressed in this paper. The analysis of such systems is non-trivial because tasks involved in the data propagation may execute at different periods, which leads to over and undersampling within one chain. This paper presents a novel method to compute worst-and best-case end-to-end latencies for such systems. A second contribution synthesizes job-level dependencies for such task sets in a way that data paths which exceed the age constraint are eliminated. An extensive evaluation is performed on synthetic task sets and the applicability to industrial applications is demonstrated in a case study.

The IEC 61131-3 standard, a widely used standard in the automation industry, defines various programming languages for programmable logic controllers. Today, the open source tools that comply with this standard do not support deployment of the applications on multi-core platforms. In this paper, we introduce a novel multi-step approach that aims to support automatic deployment of the automation control applications, developed using the IEC 61131-3 standard, to multi-core platforms. In the first step, the generated sequential code is partitioned. In the second step, the partitioned code is allocated to tasks while the tasks are mapped to various cores, without violating the dependencies, synchronization and communication constraints in the application. In order to provide a proof of concept, we develop a prototype by extending an existing tool that complies with the standard. We also perform a case study and a preliminary evaluation of the prototype.

Software development of component-based distributed embedded systems in the vehicle domain can be described at various abstraction levels. One important activity during the development of these systems is to verify their timing requirements by using pre-runtime analysis techniques, e.g., end-to-end timing analysis. There are several models and tools in the vehicle domain that support the timing analysis of these systems. In this paper, we discuss and compare our recent works with the existing techniques that support the end-to-end timing analysis of these systems at each abstraction level.

In this paper we discuss the challenges that are faced when the state-of-the-art research results are transferred to a model-based tool chain for the industrial use. These challenges are often overlooked when the research results are implemented in an academic environment. In particular, we discuss various challenges regarding the implementation and integration of the response-time analysis for heterogeneous networks, comprising of CAN and Ethernet AVB, as a plug-in for the Rubus Analysis Framework. Rubus tool suite is used for the model- and component-based development of software for vehicular real-time systems by several international companies. We also discuss preliminary solutions to deal with the challenges.

A majority of existing techniques and tools, used in the vehicular industry, support the extraction of end-to-end timing models. Such models are used to perform timing analysis of distributed embedded systems at an abstraction level that is close to their implementation. This paper takes a first initiative to provide such a support at a higher level of abstraction. At such a level, the system can be modeled with inter-connected black-box models of nodes whose internal software architectures may not be available. However, most of the design decisions about network communication are available. This represents a typical scenario in the vehicular industry where most of the artifacts are reused from either legacy systems, other projects or previous releases of the vehicle. In this paper we present an approach for the extraction of end-to-end timing models at the highest level of abstraction used in the vehicular domain. Using these models, end-to-end path delay analysis of the systems can be performed at a higher abstraction level and at an early phase during the development. As a proof of concept we implement this technique in an industrial tool suite, Rubus-ICE, that is used for the development of these systems by several international companies. Using the extended tool, we conduct a vehicular-application case study.

The end-to-end path delay analysis is used to predict timing behavior of multi-rate automotive embedded systems. Some of the assumptions used by the existing analysis may not be strictly followed by some legacy tools due to optimizations applied during the development of these systems. As a result, the existing analysis may not be applicable in some cases. In this paper we identify one such case. That is, the case in which all the tasks in a multi-rate task chain have equal priorities despite the fact that they have different periods. Furthermore, the chain contains at least one single-rate sub-chain. We also propose a preliminary solution that makes the existing analysis applicable to this case. However, the proposed solution is pessimistic. Currently, we are working on minimizing the pessimism.

The existing worst-case response-time analysis for Controller Area Network (CAN) does not support mixed messages that are scheduled with offsets in the systems where the CAN controllers implement abortable transmit buffers. Mixed messages are partly periodic and partly sporadic. These messages are implemented by several higher-level protocols based on CAN that are used in the automotive industry. Moreover, most of the CAN controllers implement abortable transmit buffers. We extend the existing analysis with offsets for mixed messages in CAN. The extended analysis is applicable to any higher-level protocol for CAN that uses periodic, sporadic, and mixed transmission of messages where periodic and mixed messages can be scheduled with offsets in the systems that implement abortable transmit buffers in the CAN controllers. The extended analysis also supports gateway nodes in CAN by considering arbitrary jitter and deadlines for the messages. We also perform comparative evaluation of the existing and extended analyses.

The existing offset-based response-time analysis for mixed messages in Controller Area Network (CAN) assumes the jitter and deadline of a message to be smaller or equal to the transmission period. However, practical systems may contain messages whose release jitter and deadlines can be greater than their periods, e.g., in the gateway nodes. We extend the existing response-time analysis for mixed messages in CAN that are scheduled with offsets and have arbitrary jitter and deadlines. Mixed messages are implemented by several higher-level protocols for CAN that are used in the automotive industry. The extended analysis is applicable to any higher-level protocol for CAN that uses periodic, sporadic and mixed transmission modes.

The existing response-time analysis for Controller Area Network (CAN) does not support mixed messages that are scheduled with offsets. Mixed messages are implemented by several high-level protocols for CAN that are used in the automotive industry. We extend the existing offset-based analysis which is applicable to any high-level protocol for CAN that uses periodic, sporadic and mixed transmission of messages. Moreover, we implement the extended analysis as a standalone simulator that will be integrated as a plug-in with the existing industrial tool suite (Rubus-ICE). The experiments, that we performed, indicate that it is possible to achieve up to 4.48% improvement in schedulability when mixed messages are scheduled with offsets.

The existing response-time analysis for messages in Controller Area Network (CAN) with controllers implementing non-abortable transmit buffers does not support mixed messages that are implemented by several high-level protocols used in the automotive industry. We present the work in progress on the extension of the existing analysis for mixed messages. The extended analysis will be applicable to any high-level protocol for CAN that uses periodic, sporadic and mixed transmission modes and implements non-abortable transmit buffers in CAN controllers.

The schedulability analysis of Controller Area Network (CAN) developed by the research community is able to compute the response times of CAN messages that are queued for transmission periodically or sporadically. However, there are a few high-level protocols for CAN such as CANopen and Hägglunds Controller Area Network (HCAN) that support the transmission of mixed messages as well. A mixed message can be queued for transmission both periodically and sporadically. Thus, it does not exhibit a periodic activation pattern. The existing analysis of CAN does not support the analysis of mixed messages. We extend the existing analysis to compute the response times of mixed messages. The extended analysis is generally applicable to any high level protocol for CAN that uses any combination of periodic, event and mixed (periodic/event) transmission of messages.

Existing response-time analysis for Controller Area Network (CAN) messages in networks where some nodes implement FIFO queues while others implement priority queues, assumes that at every node, CAN messages are queued for transmission periodically or sporadically. However, there are a few high level protocols for CAN such as CANopen and Hägglunds Controller Area Network (HCAN) that support the transmission of mixed messages as well. A mixed message can be queued for transmission both periodically and sporadically. The existing analysis of CAN with FIFO queues does not support the analysis of mixed messages. We extend the existing response-time analysis of mixed-type CAN messages. The extended analysis can compute the response-times of mixed (periodic/ sporadic) messages in the CAN network where some nodes use FIFO queues while others use priority queues.

Efficient on-chip communication is very important for exploiting enormous computing power available on a multi-core chip. Network on Chip (NoC) has emerged as a competitive candidate for implementing on-chip communication. Routing algorithms significantly affect the performance of a NoC. Most of the existing NoC architectural proposals advocate distributed routing algorithms for building NoC platforms. Although source routing offers many advantages, researchers avoided it due to its apparent disadvantage of larger header size requirement that results in lower bandwidth utilization. In this paper we make a strong case for the use of source routing for NoCs, especially for platforms with small sizes and regular topologies. We present a methodology to compute application specific efficient paths for communication among cores with a high degree of load balancing. The methodology first selects the most appropriate deadlock free routing algorithm, from a set of routing algorithms, based on the application's traffic patterns. Then the selected (possibly adaptive) routing algorithm is used to compute efficient static paths with the goal of link load balancing. We demonstrate through simulation based evaluation that source routing has a potential of achieving higher performance, for example up to 28% lower latency even at medium load, as compared to distributed routing. A simple scheme is proposed for encoding of router ports to reduce the header overhead. A generic simulator was developed for evaluation and performance comparison between source routing and distributed routing. We also designed a router to support source routing for mesh topology NoC platforms.