The rapid expansion of Internet of Things (IoT), edge, and embedded devices in the past decade has introduced numerous challenges in terms of security and configuration management. Simultaneously, advances in cloud-native development practices have greatly enhanced the development experience and facilitated quicker updates, thereby enhancing application security. However, applying these advances to IoT, edge, and embedded devices remains a complex task, primarily due to the heterogeneous environments and the need to support devices with extended lifespans. WebAssembly and the WebAssembly System Interface (WASI) has emerged as a promising technology to bridge this gap. As WebAssembly becomes more popular on IoT, edge, and embedded devices, there is a growing demand for hardware interface support in WebAssembly programs. This work presents WASI proposals and proof-of-concept implementations to enable hardware interaction with I2C and USB, which are two commonly used protocols in IoT, directly from WebAssembly applications. This is achieved by running the device drivers within WebAssembly as well. A thorough evaluation of the proof of concepts shows that WASI-USB introduces a minimal overhead of at most 8% compared to native operating system USB APIs. However, the results show that runtime initialization overhead can be significant in low-latency applications.

Certification on a component level is highly beneficial in industrial automation because it allows for independent verification and updates without compromising the reliability of the overall system. Containerization technologies naturally address this demand by providing isolation between software modules. In particular, WebAssembly-based (Wasm) containerization is gaining popularity in industrial automation due to its inherent advantages, including cross-platform interoperability and secure execution of untrusted third-party code. However, Wasm’s strict sandboxing poses a significant limitation as it severely limits interaction with hardware devices, making it difficult to interface with sensors and actuators. This is a substantial barrier to adoption in industrial automation, where real-time and low-level hardware interactions are critical. To address this challenge, we present Wasm-IO , a framework designed to facilitate peripheral Input/Output (I/O) operations within WebAssembly (Wasm) containers. Wasm-IO allows the development of isolated device drivers in Wasm, explicitly moving hardware interaction to the container level. Our architectural approach facilitates containers with hardware interaction to be independently certified, updated, and maintained without adversely affecting each other. This article elucidates foundational methodologies and practical implementations supporting synchronous and asynchronous I/O operations and methods for embedding platform-independent peripheral configurations within Wasm binaries. Additionally, we present an extended priority model enabling interrupt handling in Wasm while maintaining temporal isolation. Our evaluation demonstrates that Wasm-IO significantly reduces latency and overhead compared to existing methods and traditional user-level driver implementations, effectively addressing certification and functional requirements critical to industrial automation systems.

Future automotive architectures are expected to transition from a network-centric to a domain-centered architecture featuring central compute units. Powerful domain controllers or smart sensors alleviate the load on these central units and communication systems. These controllers execute tasks with varying criticalities on heterogeneous multicore processors, and are ideally capable of dynamically balancing the computing load between the central unit and sensors. Here, Artificial Intelligence (AI) capabilities playa crucial role, as it is in high demand for such an automotive architecture. However, AI still requires specialized accelerators to improve their computation performance. Task-oriented distributed computing with criticalities up to ASIL-D necessitates the development and utilization of specialized methodologies, such as safety, through the isolation and abstraction of low-level hardware concepts. Meanwhile, online monitoring and diagnostics become vital features to detect errors during operation. The EMDRIVE architecture includes methods, components, and strategies to enhance the performance, safety, and security of such distributed computing platforms. The nationally funded EMDRIVE project connects its twelve partners from academia and industry and is currently in its intermediate stage.

Distributed computing capabilities at the network’s edge enable new use cases, e.g., smart factories, industrial internet of things, or autonomous mobility systems. While new applications evolve, managing the resources and being capable of integrating and adjusting the execution of tasks in a distributed edge infrastructure is of great importance. For this, applications need to be migrated between different nodes. These migrations must happen without interruption, allowing the system to meet service requirements while fully utilizing all available hardware resources. Therefore, applications should also be executable on all different compute nodes in a heterogeneous edge system without interfering with each other. To this end, applications should be granted only necessary permission, especially when un-trusted applications are integrated into the system. We, therefore, propose a migration method for isolated applications across heterogeneous compute nodes in service-oriented edge architectures. A service-oriented architecture is used to decouple applications, allowing for flexible scheduling. The migration method enables the fast migration of sandboxed applications based on WebAssembly by utilizing a two-stage migration approach. The concept can utilize multiple communication protocols for management and service communication. We have implemented a proof of concept based on the Zenoh1communication protocol. While the time required depends on the communication protocol and the memory size, we achieved migration delays of under 51 milliseconds for smaller applications. By providing a method for fast migration for applications across heterogeneous compute nodes, it is possible for distributed edge infrastructures to run applications independently from each other and adjust the execution node based on changes in the system’s environment. By integrating applications into our framework, they are executed isolated and with strict access control, allowing for easier reuse.

Complex edge systems are often structured with service-oriented architectures. Different communications stacks such as MQTT, DDS, or Zenoh are used, hindering reuse of service implementations across systems. One emerging solution for deploying such services is WebAssembly, which enables platform-independent, secure, and low-overhead execution. We propose a concept for integrating Web-Assembly modules into microservice-based architectures using a specialized runtime. This runtime manages the communication between the WebAssembly module and other parts of the system. The runtime for integration of WebAssembly addresses the challenge of reusing service implementations across systems with different communication protocols. At the same time, this provides isolated, safe and secure execution. Both capabilities are central to service-oriented edge systems.