Bit-serial RISC-V cores cover a distinctive corner in the design space, making them particularly interesting for highly area-constrained, ultra-low-cost applications in the IoT and extreme edge computing, such as smart sensors or single-use healthcare devices. Given their stringent focus on area demand, each feature must be carefully considered. One is the use of RISC-V compressed instructions by the RVC extension to reduce the memory footprint and, consequently, costs. While compressed instructions reduce the required ROM size by 22.4% on average in the Embench suite, the RVC extension is costly in terms of hardware resources. This work proposes three RVC implementations for the bit-serial FazyRV core and provides an in-depth analysis of their implications. We utilize open-source tools wherever applicable and base our evaluations on the iCE40, ECP5, GateMate, and 7-Series FPGA architectures, as well as estimates for an IHP-SG13G2 ASIC implementation. Our findings highlight the hardware cost of supporting compressed instructions in bit-serial cores, which increases the implementation size by 14.5% to 58% in a 1-bit FazyRV variant. Ultimately, none of the proposed RVC implementations is optimal for all targets. Thus, we provide guidance on decisions to be made in conjunction with the target architecture, the intended system performance, and the firmware.

Embedded computing platforms increasingly require adaptable architectures to meet varying application demands. This paper explores how the instruction set of RISC-V-based microcontrollers can be extended at runtime using reconfigurable hardware accelerators and the SCAIE-V framework. Building on a flexible infrastructure based on dynamic partial reconfiguration and a scalable, standardized instruction interface within the pipeline, we demonstrate the integration of application-specific accelerators without sacrificing general-purpose capabilities. The experimental proof of concept based on the ASCON lightweight cryptographic algorithm validates the approach across two soft microcontrollers. With this, we showcase the usage of a software fallback mechanism to support seamless hardware/software transitions and enable memory handover between the software and hardware execution domains. The results show clear advantages in execution time and flexibility over static hardware designs while supporting long-term maintainability and sustainability through hardware reuse.

RISC-V processor cores with a 32-bit internal data path reach a boundary on their minimal size, requiring novel concepts to decrease silicon area and the cost of Internet of Things (IoT) devices. We propose a minimal-area open-source RV32I RISC-V core targeting the IoT and low-workload applications. Unlike cores with a similarly small area, FazyRV is inherently scalable to a data path width of 1, 2, 4, or 8 bits. FazyRV has manifold variants to achieve the smallest footprint at given performance requirements. This paper provides insight into FazyRV, its verification, and the resource utilization for five Field-Programmable Gate Array (FPGA) architectures. We also compare its performance with similar cores using the Embench benchmark suite. Based on the findings, we analyze and discuss optimization potentials in depth. Although FazyRV is implemented at the register transfer level, we achieve comparable results to hand-optimized cores at the gate level. In an exemplary IoT application, the whole system on chip is implemented in 77 Slices, or 645 Logic Cells for a Xilinx/AMD 7-Series or an iCE40 FPGA, respectively.

Modern embedded software development uses model-based methods to support long-term maintenance, portability, and correctness. A growing trend is to use formal methods to create software models and verify their correctness against requirement specifications. However, modeling and verifying low-level Real-Time Operating Systems (RTOS) or Basic Software (BSW) code sequences remains a major challenge, as it requires correctness against the internal hardware behavior and timing. To ensure this correctness, we need formal models of the complex hardware architecture, and due to the increased model complexity, the verification can lead to a state space explosion. In this paper, we mitigate these challenges by using an existing static Worst-Case Execution Time (WCET) analysis tool, OTAWA, for microarchitecture analysis. We use the intermediate results of the WCET analysis as input to our process, which verifies the correctness of the low-level implementations against the runtime effects of the hardware (e.g., synchronization dependencies, memory race conditions) and analyzes the timing and performance of the low-level code with respect to the data hazards in the pipeline. After successful verification, the results can be used in a formal method environment to model and verify the low-level code for correctness against the timing and requirement specifications. We demonstrate the proposed framework by analyzing and verifying the low-level context switch sequence of a classic AUTOSAR-based RTOS and the kernel startup sequence of FreeRTOS for correctness against hardware effects in the AURIX TriCore architecture. In addition, we show an empirical evaluation of our framework to examine the scalability, performance, and state space.

Abstract Porting software to new target architectures is a common challenge, particularly when dealing with low-level functionality in drivers or OS kernels that interact directly with hardware. Traditionally, adapting code for different hardware platforms has been a manual and error-prone process. However, with the growing demand for dependability and the increasing hardware diversity in systems like the IoT, new software development approaches are essential. This includes rigorous methods for verifying and automatically porting Real-Time Operating Systems (RTOS) to various devices. Our framework addresses this challenge through formal methods and code generation for embedded RTOS. We demonstrate a hardware-specific part of a kernel model in Event-B, ensuring correctness according to the specification. Since hardware details are only added in late modeling stages, we can reuse most of the model and proofs for multiple targets. In a proof of concept, we refine the generic model for two different architectures, also ensuring safety and liveness properties. We then showcase automatic low-level code generation from the model. Finally, a hardware-independent factorial function model illustrates more potential of our approach.

Rising digital design complexity and demands for a shorter time to market increasingly challenge functional correctness. Formal verification can prevent flaws due to ambiguities and hard-to-find corner case issues. However, it is primarily attributed to verification engineers and formal experts. We consider that (a) Formal Property Verification (FPV) for sanity checking can contribute to finding flaws early, and (b) more guidance can promote a higher adoption rate by designers. Thus, we propose a concise, tool-agnostic, and flow-chart-based methodology to demystify FPV from a designer's perspective. We showcase the flow in two case studies using designs with different formal suitability, walk through the parts & phases to make the steps more tangible, and point out the limitations.

Abstract The use of formal methods to prove the correctness of compositional embedded systems is increasingly important. However, the required models and algorithms can induce an enormous complexity. Our approach divides the formal system model into layers and these in turn into modules with defined interfaces, so that reduced formal models can be created for the verification of concrete functional and non-functional requirements. In this work, we use Uppaal to (1) model an RTOS kernel in a modular way and formally specify its internal requirements, (2) model abstract tasks that trigger all kernel functionalities in all combinations or scenarios, and (3) verify the resulting system with regard to task synchronization, resource management, and timing. The result is a fully verified model of the operating system layer that can henceforth serve as a dependable foundation for verifying compositional applications w.r.t. various aspects, such as timing or liveness.

We propose XtenStore, a system that extends the existing SGX-based secure in-memory key-value store with an external hardware accelerator in order to ensure comparable security guarantees with lower performance degradation. The accelerator is implemented on a commodity FPGA card that is readily connected with the x86 CPU via PCIe interconnect to form a hybrid x86-FPGA system. In comparison to the prior SGX-based work, XtenStore improves the throughput by 4–33x, and exhibits considerably shorter tail latency (>23x, 99th-percentile).

Embedded devices are fundamental to a huge variety of application areas, with a wide range of complexity and criticality. Therefore, they must satisfy a variety of (non-)functional requirements, and reliable strategies are necessary to guarantee that these requirements are met. As an additional complication, modern software systems are composed from various modules that interact and interfere at runtime. Operating Systems (OSes) are then used to manage the concurrency, but introduce additional complexity and runtime effects. Where testing is no longer sufficient to assess the software correctness, formal methods are becoming increasingly popular. Respecting the typical layering in embedded software, we propose a generic formal modeling scheme for OS-based application tasks and the formal verification of their liveness and real-time requirements. We use UPPAAL to model the software composition as the conjunction of application tasks and the OS, and for taking the interaction and interference of tasks through the OS into account. Despite of focusing on only two requirements in this paper, the modeling strategy is generic and extensible, meaning that additional requirements can be modeled and verified in a similar manner. An evaluation shows the general benefit of the approach as well as the impact of various factors on the verification complexity and scalability.

As the number of embedded systems continues to grow, so does the amount of disposed electronic devices. This is mainly due to partially or fully outdated hardware, caused by new legal regulations in jurisdiction or cutting-edge features within a new generation of devices or hardware components. As most devices are designed without having long-term maintainability in mind and can be easily replaced without much monetary effort, it is often easier to dispose of them. This throw-away mentality, however, increases the carbon footprint enormously. Within this work, we propose a platform that can be used to design future embedded systems in a more sustainable way by preparing them for long-term hardware adaptations. To do so, we aim to make logic updatable and re-usable while the device stays operational. This is achieved by carefully co-designing an operating system and a microcontroller platform with reconfigurable logic. In this paper, we use a RISC-V-based microcontroller running on a field-programmable gate array. The said microcontroller is designed to feature a modular pipeline and replaceable on-chip peripherals alongside a partial reconfiguration controller that can hot-swap parts of the microcontroller while it is running. It is supported by an operating system that handles the reconfiguration as well as functionality emulation, in case it is not (yet) available in hardware. Both the hardware and the software are aware of each other and can manipulate shared data structures for the management of the reconfiguration concept. The experimental evaluation that was carried out on a Artix-7 device shows the proper operation alongside performance measurements and resource utilization of the on-the-fly reconfiguration of a proof-of-concept system without affecting the execution of the remainder of the system.

Embedded systems are built from various hardware components and execute software on one or more microcontroller units (MCU). These MCUs usually contain a fixed integrated circuit, thus disallowing modifications to their logic at runtime. While this keeps the instruction set architecture (ISA) fixed as well, it leaves the software as the only flexible part in the system. But what if the MCU logic could be easily changed at runtime in order to fix bugs or if the ISA could be extended on-the-fly in order to introduce application-specific instructions and features on demand?This work demonstrates a concept for introducing more hardware flexibility through application-specific MCU modifications. Therefore, the MCU is implemented as a soft core on a field-programmable gate array (FPGA) and we reconfigure its logic with support of the operating system (OS) running on it. The reconfiguration happens on-the-fly, so no interruption of the application code or even a system restart is required. Therefore, (i) the MCU pipeline is specially designed for extensibility by new instructions, and (ii) the FPGA is selected to support partial self-reconfiguration of its logic cells at runtime. As long as an instruction is not yet part of the ISA, the OS supports its emulation to provide a consistent interface for applications. Apart, no special compiler support is required, but the application must provide either the emulation code or a hardware description for adding the required logic. For a proof of concept, we use a RISC-V based MCU on a Xilinx Artix-7 FPGA and for evaluating the general benefit of our approach we use an algorithm that is costly when executed with the original ISA but fast with application-specific instructions added at runtime. The experimental evaluation also shows that the on-the-fly hardware update does not disrupt or compromise the software execution flow.

Current approaches for portability of real-time operating systems (RTOSs) for embedded systems are largely based on manual coding, which is arduous and error prone. With increasing dependability requirements for cyber physical systems, specially within the Internet of Things (IoT), along with the expected great diversity of hardware platforms, software platforms will only remain competitive in the long run if they guarantee correct operation and easy deployment to every hardware platform. In this scenario, a new approach to the development and portability of RTOSs that guarantees correct implementations for all current and future devices and hardware architectures becomes indispensable.We present a framework for automatic RTOS portability that integrates model-based design and formal methods into dependable embedded software development. We focus specially on modeling the interaction between software and hardware in order to generate low-level code. This enables automatic portability for hardware-related parts of the OS (i.e., context switching, memory management, security aspects, etc,) as well as for on-chip peripheral drivers (i.e., timers, I/O, etc.).With our framework we will be able to prove the consistency of the refinements as well as that the RTOS model fulfills various functional and non-functional requirements. Automatic code generation guarantees that the model is correctly translated to machine language, avoiding implementation mistakes common to manual coding. Changes on the software, for bug fixes or testing of new concepts, for example, do not require knowledge of the target architectures, since they are done on the model and are immediately reflected in all implementations upon code generation, assuring consistency across platforms.

The number of low-end embedded devices in today's Internet of Things and Cyber-Physical Systems is increasing along with their security concerns. Memory isolation mechanisms are often absent, programming flaws lead to malfunctioning applications, which in turn can crush the whole system. A common design approach in these devices is to have applications, operating system components, and device driver libraries reside in a single non-isolated address space, which represents one vast attack surface. Furthermore, with increasing network connectivity and frequent dynamic updates, new or modified applications and services are uploaded, opening space for even more attacks. Isolating the execution of applications in these systems is still a challenge. In this work we provide a holistic hardware/software co-designed approach for memoryisolation, which prevents corruption of the state of the operating system and applications from a buggy software, including device drivers, interrupt service routines, and misused system calls. We implemented low-cost architectural extensions in a RISC-V-based microcontroller which work together with kernel-based protection concepts. Our evaluation shows that applications as well as the kernel can enjoy the benefits of the proposed memory isolation with minimal impact on performance and an insignificant increase in the area of the MCU.

The amount and diversity of connected computing platforms in the Internet of Things (IoT) is expected to increase exponentially throughout the next years, together with their dependability requirements. This imposes many challenges to software and hardware developers and calls for safe and secure real-time operating systems (RTOSs) that are portable to different or changing hardware. Middleware ports, including RTOS ports, must keep functional and non-functional behavior constant towards the application. Current middleware portability approaches for embedded systems, however, are arduous and error prone. We present a novel approach towards portability of embedded RTOSs based on the formal, hardware-independent and detailed specification of RTOS kernels. With additional models of relevant MCU properties and instruction set architectures (ISA), we are able to generate low level RTOS code for different target architectures. This paper focuses on the hardware-independent model of the context switch within a multi-tasking RTOS. With the general approach, we expect to (1) reduce the effort for maintaining and porting RTOS code, as well as the (2) likeliness for errors, (3) make it easier to test new kernel concepts during OS development, (4) improve security by modeling different levels of access permissions for memory or peripherals depending on the execution mode, and (5) improve safety by formally proving the correctness and consistency of the models.

Temporal predictability is a crucial requirement for hard real-time applications. Thus, deterministic software execution flows are commonly aspired to achieve that requirement. However, as an apparently unavoidable contradiction to this approach in today's embedded systems, both IRQs and concurrently running tasks are also required to react to dynamic environments and to allow the modular composition of complex software. These concepts operate non-deterministic and thus interleave unpredictably the program flow leading to timing violations. Even worse, determinism is initially introduced at application level, but affected by task scheduling at OS level, and violated by IRQs at hardware level introducing the so-called Operating System Priority Inversion (os-pi) problem: A high priority control task can easily be preempted by an IRQ that is eventually relevant for just a lower prioritized task. Thus, we propose a new hardware extension to avoid os-pi by unifying the concepts and mapping all IRQs to regular OS events. Since the extension keeps track of task priorities and event dependencies, an interrupt will only be executed if the priority of the task waiting for the triggered event is higher than the priority of the currently running task.

Due to increasing complexity of software in embedded systems, performance aspects become much more important this days. This should happen early in the development process. Often execution times and events are not easily countable or measurable due to a lack of functionality in these systems. Execution time monitoring is also relevant in terms of reacting to internal and external events dynamically. Especially for systems using multiple tasks with internal or external resource dependencies, this is a major discipline. Another problem is that measurements during the development process are often done by interfering the system as a whole. This method leads to biases in the measurement results, because the finalized system gets deployed without these interfering functionalities and can therefore work more efficiently than the development system. The scope of the present work is to develop a module in a hardware description language (HDL) which is able to measure execution times and events task-aware and unaware without interfering the system. The measurements of this module must be handed to the programmer through an easy accessible interface. The main focuses of the project are the scalability, platform independency concerning processor and operating system (OS), as well as easy extendibility. Also, reusability of counters during runtime is included in this work.

Real-time multi-tasking systems may require an individual stack for each task to fulfill all hard real-time requirements. However, these stacks may consume a huge memory space, even if not all stacks are simultaneously fully utilized. Thus, sharing currently unused stack space may improve memory utilization as possible with Memory Management Units (MMUs). However, an MMU introduces temporal jitter to memory accesses, influencing the real-time behavior. In this work, we propose a new concept to share dynamically the complete available stack space across tasks. Thereby, every stack operation executes in a deterministic time, by giving the Microcontroller Unit (MCU) Operating System (OS)-awareness.

Today's embedded system designs demand for an ever increasing integration density of various services on common platforms. Especially within highly dynamic environments where severe real-time demands must be met, sharing exclusive resources among these concurrently running subsystems is a hard compositional problem. Classic approaches suffer from the fact that tasks or cores are not aware about their mutual influences and existing resource conflicts, and thus cannot collaborate efficiently in critical situations. We eliminate this flaw, and present the novel DynamicHinting method for sharing exclusive resources on-demand among prioritized tasks on both common and different cores: Hints will be issued by the resource manager(s) to indicate e.g. priority inversions, and to provide blocking tasks with the time, knowledge, and CPU power to resolve the conflicts in time.

Several ultrasound based localization systems consist of environmental anchor nodes, and mobile nodes, which estimate their own position by using a static infrastructure. For the location process, every anchor has to know its position. In most approaches, the location of all anchors has to be determined a priori manually. This procedure is time consuming and fault-prone. In this paper, we present Distribute & Erase and Explorer, two self-calibration methods for ultrasound based localization systems. The first uses a set of three pre-calibrated anchors to explore the whole localization system whereas the second refines the anchors' positions progressively. Both of our approaches require no additional hardware besides ultrasound receivers or transmitters, and radio transceivers, which have to be already available for the WSN based localization system.

Increasing complexity of today's WSAN applications imposes demanding challenges on the underlying system design. This especially affects real-time operation, resource sharing and memory usage. Using preemptive task systems is one way to retain acceptable reactivity within highly dynamic environments. Yet, since memory is commonly rare and can often not be assigned statically, this rapidly leads to severe memory management problems among tasks with interfering and even varying requirements. Finding an allocator which suitably adapts to changing conditions while covering both issues is generally hard. We present the novel CoMem approach for maintaining high reactivity and efficient memory usage within such systems. With respect to task priorities and the typically limited performance and resources of sensor nodes, our technique facilitates compositional software design by providing tasks with runtime information for yet collaborative and reflective memory sharing. Thereby, we require no special hardware-support like MMUs but operate entirely software-based. An evaluation will show that our approach can still allow allocation delays to be close to the best case and inversely proportional to the requester's priority.

Increasing complexity of today's WSAN applications can rapidly result in reduced real-time capabilities of the underlying sensor nodes. Using preemptive operating systems is one way to retain acceptable reactivity within highly dynamic environments but commonly leads to severe resource management problems. We present the dynamic hinting approach for maintaining good system reactivity by efficient combination of preemptive task scheduling and cooperative resource allocation. With respect to task priorities, our technique significantly improves classical methods for handling priority inversions under both short- and long-term resource allocations. Furthermore, we facilitate compositional software design by providing independently developed tasks with runtime information for yet collaborative resource sharing. In some cases this even allows to improve blocking delays as otherwise imposed by bounded priority inversion.

Localization of objects within space is a common problem in WSN research. Besides the location estimation itself, wireless communication is a central aspect within such systems. We present the novel HashSlot method for assured and collision-free transmission of radio packets from multiple sources to a common destination within a constant and predictable time. Due to self-organization, our approach needs no prior active coordination between sensor nodes and offers various techniques like selectable quality of service levels to dynamically limit the number of returned information during runtime. Thereby, precision and speed of the localization process can be adjusted, fault tolerance can be achieved and energy consumption will be reduced. This paper describes theory and application of the HashSlot method within a real WSN based localization system.

The real-world implementation of a just theoretically elaborated idea is sometimes cumbersome, often a couple of obstacles have to be overcome. That's likewise in the area of wireless sensor networks (WSN), but complicated by some further restrictions, e.g. little memory or low power consumption. One well-known and often required application within WSN is the geographical localization of several sensor nodes. That's why this paper deals with some problems arising during the development of a WSN using the time difference of arrival (TDoA) of ultrasound and radio signals for positioning. Its focus is on handling of microcontroller difficulties like little memory, low computational power or low energy consumption as well as hardware driven failures like inaccurate measurements or node failures.