We introduce Silverline, a novel framework for lightweight virtualization and orchestration of distributed real-time systems. Leveraging WebAssembly (Wasm) for robust sandboxing and multi-language (polyglot) capabilities, Silverline decouples applications from their platforms through distinct manifests, enabling a centralized orchestrator to optimize resource allocation and deploy Wasm modules seamlessly across the edge-cloud continuum. It features a split data and control plane with orchestration sidecars, allowing applications to use native communication protocols and respond autonomously to network changes. We evaluate our framework in two real application contexts: an industrial automation use-case and an automotive body electronics demonstrator. Through micro-benchmarks and end-to-end testing, we demonstrate Silverline's potential for managing real-time workloads in diverse heterogeneous ecosystems.

The control applications of the future will increasingly rely on edge and cloud services to access enhanced computational resources, boosting efficiency and optimizing performance. Such networked systems are however sensitive to variable delays, which are inevitably introduced by the communication between the plant and the remote controller. To increase reliability, we present a delay-aware control design, based on the execution of multiple control modes optimized for different latency conditions, paired with a smart actuator that measures the control chain delay at runtime. The delay information is used by the actuator to select the best suited control input for the current delay, resulting in a higher performance of the control application. Additionally, the measured delay can be used in feedback to adjust the controller configuration for the subsequent iterations.

Modern embedded systems are not only becoming more and more complex but are also often exposed to dynamically changing run-time conditions such as resource availability or processing power requirements. This trend has led to the emergence of adaptive systems which are designed using novel approaches that combine a static off-line Design Space Exploration (DSE) with the consideration of the dynamic run-time behavior of the system under design. In contrast to a static design approach, which provides a single design solution as a compromise between the possible run-time situations, the off-line DSE of these so-called hybrid design approaches yields a set of configuration alternatives, so that at run time, it becomes possible to dynamically choose the option most suited for the current situation. However, most of these approaches still use optimizers which were primarily developed for static design. Consequently, modeling complex dynamic environments or run-time requirements is either not possible or comes at the cost of a significant computation overhead or results of poor quality. As a remedy, this paper introduces Learning Optimizer Constrained by ALtering conditions (LOCAL), a novel optimization framework for the DSE of adaptive embedded systems. Following the structure of Learning Classifier System (LCS) optimizers, the proposed framework optimizes a strategy, i.e., a set of conditionally applicable solutions for the problem at hand, instead of a set of independent solutions. We show how the proposed framework-which can be used for the optimization of any adaptive system-is used for the optimization of dynamically reconfigurable many-core systems and provide experimental evidence that the hereby obtained strategy offers superior embeddability compared to the solutions provided by a s.o.t.a. hybrid approach which uses an evolutionary algorithm.

Composable many-core systems enable the independent development and analysis of applications which will be executed on a shared platform where the mix of concurrently executed applications may change dynamically at run time. For each individual application, an off-line DSE is performed to compute several mapping alternatives on the platform, offering Pareto-optimal trade-offs in terms of real-time guarantees, resource usage, etc. At run time, one mapping is then chosen to launch the application on demand. In this context, to enable an independent analysis of each individual application at design time, so-called inter-application isolation schemes are applied which specify temporal/spatial isolation policies between applications. State-of-the-art composable many-core systems are developed based on a fixed isolation scheme that is exclusively applied to every resource in every mapping of every application and use a timing analysis tailored to that isolation scheme to derive timing guarantees for each mapping. A fixed isolation scheme, however, heavily restricts the explored space of solutions and can, therefore, lead to suboptimality. Lifting this restriction necessitates a timing analysis that is applicable to mappings with an arbitrary mix of isolation schemes on different resources. To address this issue, in this paper, we (a) present an isolation-aware timing analysis that - unlike existing analyses - can handle multiple isolation schemes in combination within one mapping and delivers safe yet tight timing bounds by identifying and excluding interference scenarios that can never happen under the given combination of isolation schemes. Based on the timing analysis, we (b) present a DSE which explores the choices of isolation scheme per resource within each mapping and uses the proposed timing analysis for timing verification. Experimental results demonstrate that, for a variety of real-time applications and many-core platforms, the proposed approach achieves an improvement of up to 67% in the quality of delivered mappings compared to approaches based on a fixed isolation scheme.

Modern embedded many-core systems host, among others, real-time applications which must be dynamically launched at run time. To this end, Hybrid Application Mapping (HAM) methodologies combine design-time analysis with runtime mapping techniques to enable dynamic application mapping with performance guarantees, e.g., w.r.t. real-time constraints. They rely on composability to derive the required performance guarantees in an isolated analysis of individual applications at design time. The ongoing process technology downsizing, however, has given rise to an increased on-chip temperature, so that the thermal integrity of the platform must be monitored and enforced at run time by means of Dynamic Thermal Management (DTM) techniques which use countermeasures e.g. DVFS and power gating. This, however, violates composability, as the thermally unsafe behavior of one application may trigger DTM countermeasures that affect other applications running in the thermally affected region which, in turn, may lead to the violation of their real-time constraints. As a remedy, this paper proposes, for the first time, a thermally composable HAM methodology that enforces thermal safety proactively at the launch time of applications and, thereby, prevents DTM interferences which react to thermal violations. To that end, we present (a) a novel thermal-safety analysis that can be integrated into the design-time analysis of HAM and (b) a set of thermal-safety admission checks that can be used at run time when launching an application. By establishing thermal composability among running applications, the proposed HAM approach enables providing thermally safe real-time guarantees for dynamically mapped applications in many-core systems. Experimental results for a variety of hard real-time applications on multiple heterogeneous many-core architectures demonstrate the efficiency and effectiveness of the proposed methodology.

Design Space Exploration (DSE) techniques for complex embedded systems must cope with a huge variety of applications and target architectures as well as a wide spectrum of objectives and constraints. In particular, existing design automation approaches are either problem-independent, in that they do not exploit any knowledge about the optimization problem at hand, or are tailored to specific a priori assumptions about the problem and/or a specific set of design objectives. While the latter are only applicable within a very limited scope of design problems, the former may struggle to deliver high-quality solutions for problems with large design spaces and/or complex design objectives. As a remedy, we propose Importance-Guided Order Rearrangement (IGOR) as a novel approach for DSE of embedded systems. Instead of relying on an a priori problem knowledge, IGOR uses a machine-learning-inspired technique to dynamically analyze the importance of design decisions, i.e., the impact that these decisions—within the specific problem that is being optimized—have on the quality of explored problem solutions w.r.t. the given design objectives. Throughout the DSE, IGOR uses this information to guide the optimization towards the most promising regions of the design space. Experimental results for a variety of applications from different domains of embedded computing and for different optimization scenarios give evidence that the proposed approach is both scalable and adaptable, as it can be used for the optimization of systems described by several thousands constraints, where it outperforms both problem-specific and problem-independent optimization approaches and achieves ε-dominance improvements of up to 95%.

Dividing the communication network into so-called Virtual Local Area Networks (VLANs), i.e., subnetworks that are isolated at the data link layer (OSI layer 2), is a promising approach to address the increasing security challenges in automotive networks. The automation of the VLAN partitioning is a well-researched problem in the domain of local or metropolitan area networks. However, the approaches used there are hardly applicable for the design of automotive networks as they mainly focus on reducing the amount of broadcast traffic and cannot capture the many design objectives of automotive networks like the message timing or the link load, which are affected by the VLAN partitioning. As a remedy, this article proposes an approach based on a set of Pseudo-Boolean constraints to generate a message routing which is feasible with respect to the VLAN-related routing restrictions in automotive networks. This approach can be used for a design space exploration to optimize not only the VLAN partitioning but also other routing-related objectives. We demonstrate both the efficiency of our message routing approach and the now accessible optimization potential for the complete Electric/Electronic architecture with a mixed-criticality system from the automotive domain. There we thoroughly investigate the impact of the VLAN partitioning on the message timing and the link loads by optimizing these design objectives concurrently. During the exploration of the huge design space, where each resource can be assigned to one of four VLANs, our approach requires less than 40ms for the creation of a valid solution and ensures that all messages satisfy their deadlines and link load bounds.

To cope with the strict reliability requirements of safety-critical ADAS applications, the upcoming TSN standard introduces mechanisms that enable transmission redundancy at any switch or end node. However, it is up to the designer to decide at which points and for which messages to activate transmission redundancy. This significantly increases the design space and requires to trade-off reliability with other routing-related design objectives like network load, transmission timing, or the monetary cost of the hardware. As a remedy, this paper a) presents two different exact approaches to generate feasible redundant message routings and b) proposes an extension of the state-of-the-art approach for the multi-objective routing optimization, enabling the optimizer to directly adjust system features that are relevant for the design objectives. A case study with an application from the automotive domain compares the optimization capabilities of the presented approaches for the routing generation and demonstrates the significant gain in optimization power that is achieved with the proposed optimization extension.

Upcoming high-bandwidth protocols like Ethernet TSN feature mechanisms for redundant and deterministic (scheduled) message delivery to integrate safety- and real-time--critical applications and, thus, realize mixed-criticality systems. In existing design approaches, the message routing and system scheduling are generated in two entirely separated design steps, ignoring and/or not exploiting the distinct interrelations between routing and scheduling decisions. In this paper, we first introduce an exact approach to generate an implementation with a valid routing and a valid schedule in a single step by solving a 0-1 ILP. Second, we show that the 0-1 ILP formulation can be utilized in a design space exploration to optimize the routing and schedule with respect to, e.g., interference imposed on non-scheduled traffic or the number of configured port slots. We demonstrate the optimization potential of the proposed approach using a mixed-criticality system from the automotive domain.

To cope with requirements for low latency, the upcoming Ethernet standard Time-Sensitive Networking (TSN) provides enhancements for scheduled traffic, enabling mixed-criticality networks where critical messages are sent according to a system-wide schedule. While these networks provide a completely predictable behavior of the scheduled traffic by construction, timing analysis of the critical non-scheduled traffic with hard deadlines remains an unsolved issue. State-of-the-art analysis approaches consider the interference that unscheduled messages impose on each other, but there is currently no approach to determine the worst-case interference that can be imposed by scheduled traffic, the so-called schedule interference (SI), without relying on restrictions of the shape of the schedule. Considering all possible interference scenarios during each calculation of the SI is impractical, as it results in an explosion of the computation time. As a remedy, this paper proposes a) an approach to integrate the analysis of the worst-case SI into state-of-the-art timing analysis approaches and b) preprocessing techniques that reduce the computation time of the SI-calculation by several orders of magnitude without introducing any pessimism.

Modern cars integrate a huge number of functionalities with high bandwidth, real-time, and reliability requirements. Ethernet offers the possibility to satisfy these bandwidth requirements and enables the usage of temporal redundancy mechanisms to increase the reliability of the communication network. In this paper, we present a lightweight formal analysis approach for the determination of the transmission reliability of messages in switched Ethernet networks under the influence of transient errors. In particular, this approach takes the interrelation between the individual message reliability and the timing behavior of the communication network into account. We present both a fast approach delivering a pessimistic safe reliability bound and a more sophisticated approach that results in a tighter yet still safe bound. The proposed approaches are compared by performing a design space exploration of an automotive communication network.