The certification of safety-critical systems requires amongst other things understanding the underlying hardware platform, and its use in the context of the system. At the processor level, it means that the designer must understand in detail the behaviour of a core executing a program. Many approaches rely on capturing such knowledge in an abstract model of the core. A crucial question is then does the model correctly represent the processor? and how can the designer prove such correctness? In this paper, we propose a methodology to build a core model, taking solely into account the memory accesses, and to validate the resulting model with associated stressing benchmarks.

A recent trend in embedded industry is to mix Integrated Modular Architectures (IMA) with Time Sensitive Networking (TSN). IMA principles allow resource sharing between numerous software functions in a deterministic way. On the other side TSN is considered a promising communication solution for distributed architectures. However, TSN has not been fully exploited with IMA, while it would meet the increasing communication needs due to the explosion of the number of on-board software functions. In order to better understand the challenges of designing IMA-TSN systems, this paper proposes a joint model which unifies task and message management and allows evaluation of end-to-end latency properties. The model is illustrated by simulation on an avionic case study.

Real-time applications must finish their execution within an imposed deadline to function correctly. DDR memory interference on multicore platforms can make tasks overpass their respective deadline, leading to critical errors. Bandwidth regulators and SDRAM bank partitioning are examples of techniques used to mitigate or avoid this interference type. Another possibility is to optimally place tasks and memory on the platform, i.e., task/memory mapping optimization. The algorithms used for finding optimal mapping solutions work using a cost function that indicates the fitness of the found solution. In this work, we propose a DDR SDRAM cost function that estimates the worst-case execution time for a giving map, and hence, implementable in an optimization algorithm. Our cost function considers the DDR memory device operation, the SoC manufacturer memory controller, the heterogeneity of the platform and the characteristics of the tasks to map. The cost function is evaluated by measuring directly the interference from the heterogeneous MPSoCs Keystone II and Sitara AM5728 by Texas Instruments.

DDR SDRAM memories are resources commonly used on multicore platforms and hence, being a main source of interference. To deal with this issue, we propose a methodology based on task/memory mapping optimization through multi-objective heuristic-based algorithms. By placing the tasks on the platform cores and the memory in the DDR SDRAM banks, we minimize the DDR SDRAM interference while considering other aspects such as the task execution parallelism and deadline margin. To evaluate the fitness of the task/memory map, the optimization algorithms make use of cost function equations. In order to compute the DDR memory interference cost, we use a fast executing self-designed cost function. The execution parallelism is computed using the workload variance cost function. The deadline margin of a task is computed considering the inter and intra core interference. The task/memory mapping outcomes are checked through tests for which the heterogeneous MPSoCs Keystone II and Sitara AM5728 are used. To assure certification, the WCET constraints of the resulting near-optimal Pareto solutions are verified through formally validated bounding frameworks.

Control-command systems must usually satisfy a set of high-level end-to-end timing constraints to ensure their correctness. We propose a formal approach to verify these properties directly at the model level. First, we introduce a small language for specifying arbitrary end-to-end constraints. Then, we show how to verify any constraint of this language for a system represented with a multi-periodic synchronous model, a model that retains the main concepts of data-flow oriented programming languages (such as Matlab/Simulink, synchronous languages or AADL). One advantage of this approach is that it is simpler to verify end-to-end constraints at the model level, early in the development process, rather than at the implementation level.

The Integrated Modular Avionics (IMA) architectures have been defined for sharing communication and computation resources. The aim of this paper is to evaluate latency and freshness properties of functions implemented on IMA platforms. The two contributions are : (1) a modeling approach for IMA platforms based on the tagged signal model and the abstraction of the network, (2) the definition of an evaluation method for these properties based on Integer Linear Programming (ILP). The industrial applicability of the method is showed on an Airbus A380-like platform. We propose a discussion on the significance of the over-approximations induced by the abstraction. This work is supported by the French National Research Agency within the Satrimmap project.

This article studies the scheduling of critical embedded systems, which consist of a set of communicating periodic tasks with constrained deadlines. Currently, tasks are usually sequenced manually, partly because available scheduling policies do not ensure the determinism of task communications. Ensuring this determinism requires scheduling policies supporting task precedence constraints (which we call dependent tasks), which are used to force the order in which communicating tasks execute. We propose fixed priority scheduling policies for different classes of dependent tasks: with simultaneous or arbitrary release times, with simple precedences (between tasks of the same period) or extended precedences (between tasks of different periods). We only consider policies that do not require synchronization mechanisms (like semaphores). This completely prevents deadlocks or scheduling anomalies without requiring further proofs.

Avionics embedded systems are confronted to sensors errors or inaccuracies. It is essential to be able to estimate the impact and the propagation of these errors on the system computed outputs. This paper comes from achieved work in the context of an industrial project in the avionics area. It presents a formal approach allowing to analyse the reaction of a LUSTRE program to inaccurate input values. It uses program analysis techniques like abstract interpretation and interval analysis. The approach has been implemented in Java and applied to parts of a flight control system of the AIRBUS aircrafts.

No abstract available.