Linux kernels are being widely deployed in embedded applications, such as increasingly automated vehicles and robots, due to their robust ecosystem. Security modules have been developed to enhance the integrity of Linux kernels, a critical system component. However, these modules consume substantial computational resources, making them unsuitable for embedded domains. We introduce LightRIM, a lightweight method to measure the Linux kernel’s integrity during runtime, ideal for resource-limited embedded applications. We focus on major attack types and extract objects for monitoring. Our approach includes a two-stage hashing process and an event-triggered measurement algorithm tied to the security value. To mitigate Time-of-Check-to-Time-of-Use (TOCTOU) attacks, we introduce a heuristic algorithm that maximizes the attack detection rate within CPU usage constraint and randomizes the measurement intervals. Experimental results indicate that LightRIM incurs less than 0.7% performance overhead while providing extensive attack coverage.

Directed Acyclic Graphs (DAGs) are widely deployed as task models in autonomous systems, including vehicles and drones, to capture functional dependency. DAG scheduling has been extensively investigated by various communities to shorten makespan, under the common assumption that the model itself is given a priori. This work studies a rarely touched problem - construction of DAG models - and considers time-triggered blended task chains predominant in autonomous systems. We report representation semantics and a topology optimization method. Experiments show that the average end-to-end response time reduction is 4.8 times of the conventional Floyd algorithm. Our time complexity is $\mathcal{O}\left(n^{2}\right)$, making it suitable for handling dynamic tasks as well.

Embedded Android Devices have proliferated in many security-critical embedded scenarios, requiring sufficient testing to root out vulnerabilities. Due to Android’s architecture, which uses a Hardware ion Layer (HAL) for vendor-specific driver implementations, traditional kernel testing techniques cannot detect such bugs within the actual driver logic, which are commonly proprietary and vendorspecific. In this paper, we propose DroidFuzz, an embedded Android system fuzzer that targets such vendor-specific driver implementations to find such bugs. Through leveraging pre-testing HAL driver probing, kernel-user relational payload generation, and cross-boundary execution state feedback, we effectively test the proprietary drivers in both the kernel and the HAL layer. We implemented DroidFuzz and evaluated its effectiveness on 7 embedded Android devices, and found 12 security-critical previously unknown bugs, all of which have been confirmed by the respective vendors.

Quasi-cyclic moderate density parity-check McEliece (QMM) cryptosystem is designed to mitigate the security threat posed by quantum computers, and is considered to be a promising candidate for post-quantum cryptography (PQC). However, the growing requirement of data encryption pose severe challenges for QMM implementation in terms of latency and hardware overhead. In this work, we firstly propose ACIM-QMM, an analog computing-in-memory (CIM) accelerator design for QMM cryptosystem. The use of analog circuits and CIM enables the design to efficiently generate key and encrypt ciphertext while breaking the performance bottleneck constrained by digital computing paradigm in PQC. In the experiment, ACIM-QMM can work in low relative error, and it can achieve $31.4 \times \sim 288.1 \times$ speedup compared with SOTA hardware of QMM cryptosystem. Furthermore, the results indicate that ACIM-QMM can achieve a maximum of $3.12 \times$ area efficiency and $20.32 \times$ energy efficiency compared to other PQC hardware for 256-bit security.

Chiplets promise customized design for different sets of applications with heterogeneity, where there are various kinds of resources to manage. Examples are GPUs, NPUs, and CPUs for computation of AI and general tasks, memory, communication, as well as logical resources such as I/Os. There can be strong contention in access of resources across chiplets by applications, which sometimes have discrepant requirements. Resolving such contention is critical to fully exploit the resources on heterogeneous chiplets and satisfy the needs of dynamic application workloads. This talk will discuss a set of methods that manage these resources during the design phase as well as at runtime, which should interact with the architecture exploration and contribute to the entire chiplets systems design altogether.

The Linux kernel network stack is a critical component of modern operating systems, widely deployed across platforms and often exposed to untrusted inputs. Its complex and stateful nature makes it a frequent target of security vulnerabilities, particularly those triggered by subtle protocol interactions. While existing fuzzers like syzkaller have demonstrated strong capabilities in discovering kernel bugs, they face challenges in exercising deep protocol logic due to the lack of coordinated inputs and protocol awareness. In this paper, we present Tron, a tool designed for fuzzing the Linux kernel network stack. By synthesizing syscall–packet input sequences based on protocol structure and incorporating runtime feedback, Tron enables the exploration of protocol-dependent state transitions and deep execution paths. Our approach addresses the fundamental challenges in dual-input fuzzing by integrating protocol knowledge with execution feedback. We evaluate Tron on four recent Linux kernel versions and compare it against syzkaller and kernelGPT. The results show that Tron improves branch coverage by 22.9% and 12.1% over syzkaller and kernelGPT, respectively, and discovers 25 previously unknown bugs, 7 of which have been fixed. These results demonstrate the effectiveness of protocol–system call input synthesis in enhancing network stack fuzzing and uncovering hard-to-reach bugs in kernel protocol implementations.

WCET (Worst-Case Execution Time) estimation on multicore architecture is particularly challenging mainly due to the complex accesses over cache shared by multiple cores. Existing analysis identifies possible contentions between parallel tasks by leveraging the partial order of the tasks or their program regions. Unfortunately, they overestimate the number of cache misses caused by a remote block access without considering the actual cache state and the number of accesses. This paper reports a new analysis for inter-core cache contention. Based on the order of program regions in a task, we first identify memory references that could be affected if a remote access occurs in a region. Afterwards, a fine-grained contention analysis is constructed that computes the number of cache misses based on the access quantity of local and remote blocks. We demonstrate that the overall inter-core cache interference of a task can be obtained via dynamic programming. Experiments show that compared to existing methods, the proposed analysis reduces inter-core cache interference and WCET estimations by$\mathbf{5 2. 3 1 \%}$and$\mathbf{8. 9 4 \%}$on average, without significantly increasing computation overhead.

Controller area network (CAN) is widely adopted in automobiles and susceptible to cyber attacks with the development of intelligent connected vehicles. While neural networks have demonstrated high accuracy in detection of such attacks, they consume a large amount of resources, hence unsuitable to be directly used for the automotive domain. In this work, we propose a lightweight intrusion detection system (LIDS) for CAN. It first filters out denial-of-service (DoS) and Fuzzy attacks through list screening, following which, a multilayer perceptron (MLP) model is deployed to predict Impersonation attacks. Leveraging this combination, the detection accuracy is kept and the resources required are significantly reduced. LIDS is able to run on small hardware with 520-kB memory and CPU of 240 MHz. Its power consumption is one order of magnitude lower than the existing works, thus an excellent candidate for protection of CAN in automobiles.

Directed Acyclic Graph (DAG) models are extensively utilized across fields such as automotive, wireless communication, and deep learning, to capture the inherent functional dependencies. Topology of DAG has a significant impact on the performance of scheduling and resource management algorithms applied to it. Hence, it is imperative to generate all DAG topologies within the parameter ranges pertinent to an application domain, for impartial evaluation of such algorithms. Unfortunately, the existing DAG generators that are capable of offering full topology coverage have limited scalability and controllable parameters. This work reports open-source FT-DAG, an efficient and formally verified full-topology DAG generator that is able to control all major parameters, including the longest length, shortest length, width, jump layer, jump level, in-degree, out-degree, shape value as well as the number of nodes and edges. Experiments show that when the number of nodes is larger than 20, FT-DAG provides at least two orders of magnitude speedup compared to the state of the art and more orders to other generators. FT-DAG scales to 100 nodes in a typical industrial case study within hours.

5G mobile communication techniques are widely applied in ubiquitous communication scenarios (e.g., smart navigation and smart transportation), which require time synchronization among mobile devices. However, the built-in time synchronization software of Android phones presents large time offsets with hundreds of milliseconds (ms), and the mainstream time synchronization techniques have specific limitations: 1) the Network Time Protocol (NTP) has too large offset to meet the real-time information interaction among mobile devices; 2) the Linux Precision Time Protocol (LinuxPTP) exists hardware dependence and cannot be implemented on Android and 5G networks; and 3) the Global Navigation Satellite System (GNSS) requires installing a hardware receiver on each mobile device. In this study, we develop a Mobile Precision Time Protocol (MobiPTP), which is hardware-independent and compatible with various network types, including Wide-Area Network (WAN), Local-Area Network (LAN), wired and wireless networks. The main challenges include signal strength instability and uplink-downlink asymmetry. We propose a dynamic time synchronization algorithm and an asymmetry compensation strategy to overcome these challenges. Regardless of high-speed mobile or crowded conditions in 5G networks, MobiPTP demonstrates an average offset of 9 ms, outperforming the NTP-based open-source software Chrony (about 30 ms). MobiPTP has been successfully deployed in multiple real-world ubiquitous communication scenarios and always demonstrates much lower offsets than Chrony.

Simulink plays an important role in the industry for modeling and synthesis of embedded systems. Ensuring system stability requires using numerous test cases to validate the functionality and safety of the models. However, as requirements increase, the complexity of the models poses new challenges to traditional testing methods. Traditional methods such as constraint solving and random search run into significant obstacles when navigating the complex branching logic and states within models.

In autonomous driving (AD) systems, complex data dependencies exist between tasks with different activation rates, making it very hard to analyze the system’s timing behaviors. This paper formulates an AD system as a multi-rate directed acyclic graph (DAG) and introduces a novel reaction time bound for critical chains within this multi-rate DAG. Furthermore, we introduce a priority assignment strategy tailored to optimize priority allocation, effectively minimizing the reaction time of critical task chains. This strategy comes with theoretical guarantees, ensuring that the achieved latency bound is only slightly higher than the ideal one. Our empirical work demonstrates that the newly proposed reaction time bound outperforms current standards, achieving an average improvement of $5.46 \%$. Furthermore, our strategy for priority assignment significantly enhances the success rate of achieving timing correctness in the AD system, exceeding the baseline method by a notable $19.24 \%$.

Fully-partitioned fixed-priority scheduling (FP-FPS) multiprocessor systems are widely found in real-time applications, where spin-based protocols are often deployed to manage the mutually exclusive access of shared resources. Unfortunately, existing approaches either enforce rigid spin priority rules for resource accessing or carry significant pessimism in the schedulability analysis, imposing substantial blocking time regardless of task execution urgency or resource over-provisioning. This paper proposes FRAP, a spin-based flexible resource accessing protocol for FP-FPS systems. A task under FRAP can spin at any priority within a range for accessing a resource, allowing flexible and finegrained resource control with predictable worst-case behaviour. Under flexible spinning, we demonstrate that the existing analysis techniques can lead to incorrect timing bounds and present a novel MCMF (minimum cost maximum flow)-based blocking analysis, providing predictability guarantee for FRAP. A spin priority assignment is reported that fully exploits flexible spinning to reduce the blocking time of tasks with high urgency, enhancing the performance of FRAP. Experimental results show that FRAP outperforms the existing spin-based protocols in schedulability by $\mathbf{1 5. 2 0 \%} \mathbf{- 3 2. 7 3 \%}$ on average, up to $\mathbf{6 5. 8 5 \%}$.

With the high-performance requirement of safety-critical real-time tasks, the platforms of many-core processors with high parallelism are widely utilized, where network-on-chip (NoC) is generally employed for inter-core communication due to its scalability and high efficiency. Unfortunately, large uncertainties are suffered on NoCs from both the overly parallel architecture and the distributed scheduling strategy (e.g., wormhole flow control), which complicates the response time upper bounds estimation (i.e., either unsafe or pessimistic). For DAG-based real-time parallel tasks, to solve this problem, we propose DAG-Order, an order-based dynamic DAG scheduling approach, which strictly guarantees NoC real-time services. First, rather than build the new analysis to fit the widely used best-effort wormhole NoC, DAG-Order is built upon a kind of advanced low-latency NoC with SLT ( S ingle-cycle L ong-range T raversal) to avoid the unpredictable parallel transmission on the shared source-destination link of wormhole NoCs. Second, DAG-Order is a non-preemptive dynamic scheduling strategy, which jointly considers communication as well as computation workloads, and fits SLT NoC. With such an order-based dynamic scheduling strategy, the provably bound safety is ensured by enforcing certain order constraints among DAG edges/vertices that eliminate the execution-timing anomaly at runtime. Third, the order constraints are further relaxed for higher average-case runtime performance without compromising bound safety. Finally, an effective heuristic algorithm seeking a proper schedule order is developed to tighten the bounds. Experiments on synthetic and realistic benchmarks demonstrate that DAG-Order performs better than the state-of-the-art related scheduling methods.

Internet of Things (IoT) messaging protocols play an important role in facilitating communications between users and IoT devices. Mainstream IoT platforms employ brokers, server-side implementations of IoT messaging protocols, to enable and mediate this user-device communication. Due to the complex nature of managing communications among devices with diverse roles and functionalities, comprehensive testing of the protocol brokers necessitates collaborative parallel fuzzing. However, being unaware of the relationship between test packets generated by different parties, existing parallel fuzzing methods fail to explore the brokers’ diverse processing logic effectively. This article introduces MPFuzz, a parallel fuzzing tool designed to secure IoT messaging protocols through collaborative packet generation. The approach leverages the critical role of certain fields within IoT messaging protocols that specify the logic for message forwarding and processing by protocol brokers. MPFuzzemploys an information synchronization mechanism to synchronize these key fields across different fuzzing instances and introduces a semantic-aware refinement module that optimizes generated test packets by utilizing the shared information and field semantics. This strategy facilitates a collaborative refinement of test packets across otherwise isolated fuzzing instances, thereby boosting the efficiency of parallel fuzzing. We evaluated MPFuzzon six widely used IoT messaging protocol implementations. Compared to two state-of-the-art protocol fuzzers with parallel capabilities, Peach and AFLNet, as well as two representative parallel fuzzers, SPFuzz and AFLTeam, MPFuzzachieves (6.1%,$174.5\times $), (20.2%,$607.2\times $), (1.9%,$4.1\times $), and (17.4%,$570.2\times $) higher branch coverage and fuzzing speed under the same computing resource. Furthermore, MPFuzzexposed seven previously unknown vulnerabilities in these extensively tested projects, all of which have been assigned with CVE identifiers.

With the development of the automotive industry toward intelligence and automation, there is a trend of controller area network (CAN) migrating to CAN with flexible data-rate (CAN-FD), where frame packing (i.e., packing signals of various periods, deadlines, and payloads into frames following the standard CAN-FD format) is critical to address the high bandwidth demand with limited resources. Existing works have applied integer linear programming (ILP), which easily gets intractable as the number of signals to be packed increases, or proposed heuristics, which are not able to obtain the optimal solution. In addition, the security model employed does not meet the AUTOSAR SecOC specification. This article reports a novel frame-packing approach for CAN-FD with an AUTOSAR-compliant security model. We establish the theory that extending the existing frame to pack signals with the same period leads to shorter worst-case transmission time (WCTT) and thus lower bus utilization compared to creating a new frame. Following this principle, the design space is tremendously pruned, where the optimal solution is guaranteed to remain. With pruning, we are able to increase the optimally solvable size of the problem from 150 signals to 300 signals, which is sufficient for practical usage. When there are 300 signals, only 10−142 of the original design space needs to be explored. To further improve efficiency, we apply pruning to heuristics. When the signal size is 500, for simulated annealing (SA), the computation time can be reduced by 54.1% and the bus utilization can be saved by 10.5% with pruning being deployed. In addition, we propose the max–min ant system as an alternative, which achieves better bus utilization than SA in shorter computation. Our reported method is generally applicable to other CAN-based distributed networks demanding higher bandwidth as well, such as in industry automation.

Embedded operating systems (Embedded OSs) power much of our critical infrastructure but are, in general, much less tested for bugs than general-purpose operating systems. Fuzzing Embedded OSs encounter significant roadblocks due to much less documented specifications, an inherent ineffectiveness in generating high-quality payloads. In this article, we propose ECG, an Embedded OS fuzzer empowered by large language models (LLMs) to sufficiently mitigate the aforementioned issues. ECG approaches fuzzing Embedded OS by automatically generating input specifications based on readily available source code and documentation, instrumenting and intercepting execution behavior for directional guidance information, and generating inputs with payloads according to the pregenerated input specifications and directional hints provided from previous runs. These methods are empowered by using an interactive refinement method to extract the most from LLMs while using established parsing checkers to validate the outputs. Our evaluation results demonstrate that ECG uncovered 32 new vulnerabilities across three popular open-source Embedded OS (RT-Linux, RaspiOS, and OpenWrt) and detected ten bugs in a commercial Embedded OS running on an actual device. Moreover, compared to Syzkaller, Moonshine, KernelGPT, Rtkaller, and DRLF, ECG has achieved additional kernel code coverage improvements of 23.20%, 19.46%, 10.96%, 15.47%, and 11.05%, respectively, with an overall average improvement of 16.02%. These results underscore ECG’s enhanced capability in uncovering vulnerabilities, thus contributing to the overall robustness and security of the Embedded OS.

Simulink has gained widespread recognition as a valuable tool for system design. As systems grow increasingly complex, particularly in terms of their internal states, this complexity poses new challenges for existing model testing methodologies. Traditional techniques such as constraint solving and random search encounter difficulties when attempting to explore the intricate logic embedded within these models. In this paper, we introduceHSTCG, a state-aware test case generation method for Simulink models with heuristic strategy.HSTCGsolves only one iteration of the model each time to get the test input that can cover a target branch, then executes the model once to obtain and update the new model state based on the solved input dynamically. Then, it solves the remaining branches based on the new model state iteratively until all the coverage requirements are satisfied. To improve the efficiency of test case generation, we also designed a heuristic strategy containing heuristic branch searching, repeated state filter and unreached branch filter to minimize the times of constraint solving. We implementedHSTCGand evaluated it on several benchmark Simulink models. Compared to the built-in Simulink Design Verifier and state-of-the-art academic work SimCoTest,HSTCGachieves an average improvement of 55% and 103% on Decision Coverage, 53% and 62% on Condition Coverage and 192% and 201% on Modified Condition Decision Coverage, respectively. We also validated the significant improvement of the heuristic strategy, which can improve the efficiency of test case generation by 62.2% on average.

Through the attention mechanism, Transformer-based large-scale deep neural networks (LSDNNs) have demonstrated remarkable achievements in artificial intelligence applications such as natural language processing and computer vision. The matrix-matrix multiplication operation (MMMO) in Transformer makes data movement dominate the inference overhead over computation. A solution for efficient data movement during Transformer inference is to embed arithmetic logic units (ALUs) into the memory array, hence an accelerator-in-memory architecture (AIMA). Existing work along this direction has not considered the heterogeneity of parallelism and resource requirements among Transformer layers. This increases the inference latency and lowers the resource utilization, which is critical for the embedded systems domain. To this end, we propose HAIMA, a hybrid AIMA and the parallel dataflow for Transformer, which exploit the cooperation between SRAM and DRAM to accelerate different MMMOs. Compared to the state-of-the-art Newton and TransPIM, our proposed hardware-software co-design achieves 1.4x-1.5x speedup, and solves the problem of resource under-utilization when DRAM-based AIMA performs the light-weight MMMOs.

As an Ethernet-based communication protocol with timing determinism, TSN (time-sensitive networking) has become a well-recognized promising in-vehicle network solution for increasingly automated automobiles. To satisfy the reliability requirement of safety-critical applications, existing works towards fault-tolerant TSN trade too much bandwidth for redundancy, limiting their scope of applicability. Targeting mixed-critical traffic, which is widely found in practice, we define a shared fault-tolerant segment that is compatible with the TSN standard. It serves the critical flows when faults occur, to improve their reliability and serves the non-critical flows when otherwise, to improve their quality of service (QoS). On top of this, we propose a space-time redundancy scheduling algorithm, aiming to make the most efficient use of bandwidth, i.e., to fulfill both the reliability as well as hard real-time requirements, and maximize the QoS with the least bandwidth. In essence, we formulate a bi-objective design space exploration problem with hundreds of thousands of decision variables and solve it with customized heuristics. Experimental results show that compared to the state-of-the-art methods, our reported work increases the number of critical flows that can be accommodated on a resource-constrained network by 3 to 4 times, and achieve the highest QoS with an average reduction of 60.3% in bandwidth. As the first work along sharing of bandwidth between mixed-critical traffic in fault-tolerant TSN, this idea can be further pursued towards higher efficiency and may be applied in general autonomous systems.

Simulink has been widely used in system design, which supports the efficient modeling and synthesis of embedded controllers, with automatic test case generation to simulate and validate the correctness of the constructed Simulink model. However, the increasing complexity of the model, especially the internal states, brings extra challenges to existing model testing techniques such as constraint solving and random search, which results in difficulties when trying to reach the deeper logic of the model effectively.In this paper, we propose STCG, a state-aware test case generation method for Simulink models. STCG solves only one iteration of the model each time to get the test input that can cover a target branch, then executes the model once to obtain and update the novel model state based on the solved input dynamically. Then, it solves the remaining branches based on the new model state iteratively until all the coverage requirements are satisfied. We implemented STCG and evaluated it on several benchmark Simulink models. Compared to the built-in Simulink Design Verifier and state-of-the-art academic work SimCoTest, STCG achieves an average improvement of 58% and 132% on Decision Coverage, 52% and 70% on Condition Coverage and 239% and 237% on Modified Condition Decision Coverage, respectively.

Many embedded applications demand both resource efficiency and timing guarantee. However, resource sharing naturally complicates the analysis that extracts the worst-case scenario out of contention. Global Fixed-Priority (GFP) preemptive multiprocessor scheduling is one of the mainstream strategies to resolve contention on computational resources. It allows jobs of the same task to be executed on different processors, hence potentially enabling better parallelism and more efficient resource utilization. Unfortunately, its worst-case response time (WCRT) analysis is challenging. Existing approaches divide a high-priority task into three workloads, namely, carry-in workload, body workload, and carry-out workload, trying to optimize them individually. In this work, we propose a holistic WCRT analysis for GFP preemptive multiprocessor scheduling, where a task is no longer divided. Specifically, (i) we establish the tight interference scenario for the task being analyzed to find the most interfering high-priority jobs in any time interval; (ii) we obtain the starting released instant of each high-priority task’s first job to determine the maximum interference from high-priority tasks’ first jobs to the task being analyzed; (iii) we build the worst-case tight interference scenario for the task being analyzed by combining the tight interference scenario and the starting released instants; (iv) we prove that the WCRT of the task being analyzed can be decided by the worst-case tight interference scenario. Evaluation on schedulability shows that our proposed analysis achieves 4.2%-8.6% higher acceptance ratio in randomly generated data sets than the state-of-the-art workload division approaches.

Many complex real-time systems, such as increasingly automated vehicles and 5G wireless base stations, contain a large amount of shared resources that must be accessed in a mutually exclusive fashion. This leads to significant contention especially when resources are shared across processors. To reduce the contention, various resource-aware task allocation methods have been developed to localize the shared resources. Unfortunately, these existing methods either are tailored for specific scheduling and analysis approaches, or introduce runtime overhead that undermines their applicability. In this paper, we present a task allocation method for a mainstream type of real-time systems in practice: FP-FPS (fully-partitioned fixed-priority scheduling) multiprocessor systems with spin locks managing shared resources. Instead of relying on timing bounds as guidance, we utilize a model to approximate the degree of resource contention between tasks. The model is decoupled from priority assignment algorithms, resource sharing protocols and schedulability tests. Hence, our task allocation method can be applied without detailed knowledge of the underlying system, which is particularly useful during the initial design phase of the system. More detailed information about the system in the later phases of design will push up the approximation accuracy and further enhance the performance. Experimental results show that the proposed method outperforms the state-of-the-art by 13.6% on average (up to 24.2%) in system schedulability with a much less (57x on average) computation cost and negligible runtime overhead.

In many real-time application domains, there are execution dependencies, such tasks may be formulated as multiple Directed Acyclic Graphs (DAGs) and scheduled with intra-task (i.e., intra-DAG) priority assignment. The worst-case completion time of a DAG must be bounded and schedulability analysis must be conducted during the design phase to estimate the required hardware resources. Typical examples include automotive systems and Ultra-Reliable Low Latency Communications (URLLC), which is the “to-business” protocol in 5G technologies, deployed in industrial automation for instance. To bound the execution time of multiple DAGs, there are two key factors to analyze: the intra-task interference for a single DAG and the inter-task interference between DAGs. While extensive efforts have been invested, the existing methods either still contain a large degree of pessimism or are even erroneous due to errors in the derived analysis. In this paper, we first provide an indepth analysis of the limitation and defects of the existing methods. Inspired by these observations, we construct novel response time analysis for multiple DAG tasks with arbitrary intra-task priority assignment. Our analysis precisely accounts for both the intra- and inter-task interference by fully exploring the node parallelism in each DAG as well as between DAGs. Extensive experimental results show that the proposed analysis obtains tighter bounds and improves the system scheduability by at least 300 % compared to state-of-the-art approaches. This improvement is even larger when the scheduling pressure is relatively high, up to 100 % versus 0 % in many cases. This work notably advances the use of response time analysis in industry. Practitioners have to resort to either potentially unsafe measurement results or significant resource over-provisioning when precise analysis is unavailable.

The increasing computational demand promotes the application of parallel tasks with complex execution dependencies in industrial applications. The Directed Acyclic Graph (DAG) task model is widely applied with dedicated scheduling algorithms to understand and manage the execution of such systems. In order to validate the effectiveness of different DAG scheduling algorithms, DAG generators are often applied to produce synthesized DAGs for performance evaluation. However, existing DAG generators either fail to provide sufficient topology coverage or suffer from severe scalability issues, leading to biased and incomplete evaluation results. This paper proposes a novel DAG generator that provides full topology coverage under the given DAG structural parameters while eliminating isomorphic DAGs as well as redundant edges in each DAG. In addition, a verification method is constructed that enables topology coverage, isomorphic DAG identification, and constraint satisfaction of the generated DAGs. The experimental results show that compared to existing generators, the proposed DAG generator achieves full topology coverage and significantly reduces the number of DAGs being produced. The DAG generator proposed in this work provides a complete solution for synthesised DAG generation, enabling fair and comprehensive evaluation of DAG systems.

Virtual machines (VMs) have been increasingly deployed in real-time systems to enhance heterogeneous resource sharing. Despite being isolated for security and prevention of failure propagation, VMs need to communicate with each other to complete certain tasks jointly. A real-time inter-VM communication framework has been proposed based on VirtIO, which is in essence a mechanism of message passing with high latency and low scalability on data amount. In contrary, IVSHMEM implements inter-VM communication with shared memory, which is generally fast and large in throughput. Unfortunately, IVSHMEM does not resolve resource contention between flows and hence cannot be applied in real-time scenarios. In this work, we propose a real-time inter-VM communication framework RTISM built upon shared memory and IVSHMEM. RTISM provides priority-based scheduling and supports mixed-criticality flows. Worst-Case Response Time (WCRT) analysis is reported to bound the end-to-end communication delay and a Limited Priority Assignment (LPA) algorithm is developed to enhance schedulability. Experimental evaluation shows that (i) RTISM has about 4 times higher throughput than the VirtIO-based inter-VM communication framework; (ii) LPA improves schedulability by over 25% compared to the state-of-the-art; (iii) WCRT produces a tight bound.

With the advancement of intelligence and networked automotive, the domain-centralized architecture, which employs time sensitive networking (TSN) as the inter-domain backbone network and control area network with flexible data rate (CAN-FD) as the intra-domain network, has garnered significant attention. However, cross-domain end-to-end communication involves multiple components, and significant disparities between TSN and CAN-FD render response time analysis within domain-centralized architecture for mixed-critical traffic exceptionally complex. In this paper, we develop a cross-domain with TSN and CAN-FD end-to-end response time evaluation tool, which analyzes the response time of mixed-critical traffic under different design options segment by segment. We specifically analyze the waiting times of different messages in the domain control unit when faced with the design options of one-to-one and multi-to-one conversion of CAN-FD and TSN frames. The proposed evaluation tool can be easily extended to different design options to support more application scenarios. Theoretical computational analysis and real hardware measurements show the effectiveness of our tool.

Autonomous vehicles at L2 and above are increasingly relying on stereo vision systems, where haze removal is critical to detect obstacles hidden in fog. Existing image dehazing techniques have low processing speed and high resource consumption, restricting their application scope in practice. In this work, we propose a hardware-software co-design solution for haze removal. It fully decouples calculation of the two main parameters, i.e., atmospheric light and transmittance, in the dehazing process. By eliminating the data dependency, parallelism in hardware acceleration is enhanced. Furthermore, in replacement of the conventional global homogeneous atmospheric light computation, we report a chunk-based heterogeneous method to reduce cache overhead. Our approach is implemented on FPGA, compared against five state-of-the-art (SOTA) works for image haze removal. Evaluation using test sets of real-world foggy driving scenarios shows that our object detection accuracy is over 88%, 9.5%-47.4% better than the SOTA works with neural networks (NN) on GPU, and 25.9%-52.2 % better than the SOTA works on FPGA. The processing speed varies with image resolution and our improvement is generally even more at higher resolution, which is 29.7% faster than the fastest SOTA. We have the lowest overall resource consumption, where the bottleneck BRAM usage is reduced by over 70%. The FPGA solution has circuit-level timing determinism at nanosecond, hence suitable for hard real-time applications.

Retention, with its powerful energy-saving effect and negligible switching delay, offers the advantages of Power Gating (PG) and Clock Gating (CG), and has gradually been adopted into the processor power management systems by both AMD and Intel. However, there has been no research on how to integrate retention to achieve energy-efficient task scheduling. Furthermore, although most commercial chips support per-cluster configurations to achieve energy saving, existing energy-efficient works often underutilize all cores in the cluster, resulting in numerous static power from unused cores. In this paper, we propose a task partitioning algorithm to optimize energy consumption among clusters. We further study energy-efficient scheduling of directed acyclic graph (DAG) tasks with arbitrary deadlines on multicore platforms, which is the first work to integrate the per-cluster retention to reduce power consumption by fully utilizing the used clusters. The experimental results verify that our approach can increase the retention time by 21.24% and reduce the static energy consumption in the idle state by 45.81% compared to retention-based work-conserving scheduling.

Simulink is widely used for the model-driven design of embedded systems. It is able to generate optimized embedded control software code through expression folding, variable reuse, etc. However, for some commonly used computing-sensitive models, such as the models for signal processing applications, the efficiency of the generated code is still limited. In this article, we propose PHCG, an optimized code generator for the Simulink model with single-instruction–multiple-data (SIMD) instruction synthesis. It will select the optimal implementations for intensive computing actors based on adaptively precalculation of the input scales, and synthesize the appropriate SIMD instructions for batch computing actors based on the iterative dataflow graph mapping. In addition, actors of the same type that can be executed in parallel can be combined into batch computing actors as much as possible by merging isomorphic subgraphs. We implemented and evaluated its performance on benchmark Simulink models. Compared to the built-in Simulink Coder and the most recent DFSynth, the code generated by PHCG achieves an improvement of 38.9%–92.9% and 41.2%–76.8% in terms of execution time across different architectures and compilers, respectively.

The network architecture with the controller area network (CAN) as the domain bus in most domains and time-sensitive networking (TSN) as the backbone network is called the CAN-TSN interconnection network architecture, which has been or will be employed in industrial embedded networks (e.g., automobiles, spacecraft, and factory automation). In this architecture, the CAN-TSN gateway acts as a transmission hub handling a large number of communications between the CAN domains and TSN. However, most commercial CAN-TSN gateways are highly integrated with low flexibility, such that they are hard to accommodate different time planning mechanisms from TSN. In addition, these CAN-TSN gateways suffer from high congestion when TSN frames are sent from the TSN side to a CAN domain (i.e., TSN-to-CAN transmission) because of at least 100 times in the transmission rate between CAN and TSN. In this study, we propose a high-flexibility CAN-TSN gateway, where the CAN side can be easily adapted to different bus protocols, and the TSN side can be easily adapted to different configurations. In the gateway, we develop a low-congestion TSN-to-CAN scheduler, which executes a maximum awaiting time (MAT)-based scheduling strategy to alleviate the congestion. Experiments on the prototype platform show the advantages of the proposed CAN-TSN gateway and the developed MAT-based scheduling strategy.

Simulink is widely used for the model-driven design of embedded systems. It is able to generate optimized embedded control software code through expression folding, variable reuse, etc. However, for some commonly used computing-sensitive models, such as the models for signal processing applications, the efficiency of the generated code is still limited.

Worst-Case Execution Time (WCET) analysis for real-time tasks must precisely predict cache hit/miss of memory accesses. While bringing great performance benefits, multi-core processors significantly complicate the cache analysis problem due to the shared cache contentions among different cores. Existing methods pessimistically consider that memory references of parallel executing tasks will contend with each other as long as they are mapped to the same cache line. However, in reality, numerous shared cache contentions are mutually exclusive, due to the partial orders among the programs executed in parallel. The presence of shared cache contentions greatly exacerbates the computational complexity of the WCET computation, as finding the longest path needs exploring an exponentially large partial ordering space. In this paper, we propose a quantitative method with O(n2) time complexity to precisely estimate the worst-case extra execution time (WCEET) caused by shared cache contentions. The proposed method can be easily integrated into the abstract-interpretation based WCET estimation framework. Experiments with MRTC benchmarks show that our method can averagely tighten the WCET estimation by 13% without sacrificing the analysis efficiency.

Driven by applications such as autonomous vehicles, spacecrafts, robotics, and industrial automation, real-time systems are required to implement ever more complex functionalities with high performance, while maintaining conventional timing predictability, reliability, and cost efficiency. Necessarily, large-scale resource sharing on multiprocessor architectures has to be deployed. Unfortunately, existing protocols that manage shared resources and bound blocking delay have not considered reliability, i.e. how to handle faults. Contention over shared resources may be seriously aggravated by re-executions that are essential to satisfy a system’s reliability requirements. Hence, there exists a significant barrier to applying resource sharing in the mission-critical sector. This paper fills that gap between reliability and resource sharing. Focusing on mixed-criticality systems (MCS), which widely exist in practice and make the problem more challenging, we propose a fault-tolerance solution which includes the first fault-tolerance multiprocessor resource sharing protocol (namely MSRP-FT) and a system execution model that supports the application of MSRP-FT in MCS. Our aim is to minimize blocking time while satisfying reliability requirements. A schedulability analysis is reported which can guarantee that timing constraints are respected. Compared to the state-of-the-art method, developed for fault-tolerant MCS without resource sharing, we improve the system schedulability by an average of $ 1.28\times$ in stable modes and $ 1.1\times$ during the mode switch.

A network switch implements multiple services and each service is formed by a number of match-action operations through several pipeline stages. These services running in the switch equipment are to process various packets based on standard internet protocols to decide the route of each packet. Data packets come in serial to a port, where each packet is processed by a service according to the contents of the packet headers and then send out via another port. Design of the switch, i.e., mapping services to physical resources in the pipeline stages, aims to achieve low switching latency with small chip area while respecting data-flow dependencies and hardware constraints. The current practice relies on expertise of engineers empirically, which is laborious and generates mediocre results. In this paper, we propose a switching pipeline design optimizatton technique, called SPOT. Our main contributions are as follows: (i) We first formulate the bi-objective (latency and chip area) constrained design optimization problem; (ii) SPOT quickly spots a feasible solution from a largely unfeasible design space using a dependency-aware greedy algorithm; (iii) Based on the above feasible seed, SPOT explores the design space with hundreds of decision dimensions towards Pareto optimal solutions using non-dominated sorting genetic algorithm II (NSGA-II) and multi-objective tabu search (MOTS), both adapted to be deployed in this problem setting. We apply SPOT on three sets of real-world network services. In comparison to the design sheets prepared by expert engineers, experiments show that SPOT offers 20.63% shorter service latency and 4.55% smaller chip area on average. As a by-product, the power consumption is lowered by 23.72% on average, which is correlated to the chip area. For hard real-time scenarios, the longest service latency a data packet may experience is the major concern. SPOT reduces the worst-case service latency by 12.65% on average. SPOT is the first automated optimization solution for switching pipeline design in network chips, being utilized in millions of network products of various kinds and saving manual efforts from days to minutes.

In 1969, Graham developed a well-known response time bound for a DAG task using the total workload and the longest path of the DAG, which has been widely applied to solve many scheduling and analysis problems of DAG-based task systems. This paper presents a new response time bound for a DAG task using the total workload and the lengths of multiple long paths of the DAG, instead of the longest path in Graham's bound. Our new bound theoretically dominates and empirically outperforms Graham's bound. We further extend the proposed approach to multi-DAG task systems. Our schedulability test theoretically dominates federated scheduling and outperforms the state-of-the-art by a considerable margin.

Physical unclonable function (PUF) is a promising lightweight hardware security primitive for resource-limited Internet-of-Things (IoT) devices. Strong PUFs are suitable for lightweight device authentication because it can generate quantities of challenge-response pairs. Unfortunately, while the machine learning (ML) techniques have benefited various areas, such as Internet, industrial automation, robotics and gaming, they pose a severe threat to PUFs by easily modelling their behavior. This article first shows that even a recently reported dual-mode PUF can be cloned by ML (prediction accuracy of up to 95%). To solve this issue, we propose a configurable tristate (CT) PUF which can flexibly perform as an arbiter PUF, a ring oscillator (RO) PUF, or a bistable ring (BR) PUF with a bitwise XOR-based mechanism to obfuscate the relationship between the challenge and the response, hence resisting the ML attacks. An authentication protocol for the use in IoT security is presented. The CT PUF is implemented on Xilinx ZedBoard FPGAs with placement and routing details described. The experimental results show that the modelling accuracy of logistic regression (LR), support vector machine (SVM), covariance matrix adaptation evolutionary strategies (CMA-ES), and artificial neural network (ANN) is close to 60% (50% as the ideal number in theory) while meeting the PUF requirements for uniformity, reliability, and uniqueness. The hardware overhead and power consumption are slight. The entire project has been open sourced.

Timing errors of microelectronic circuits occur when the circuit timing specification is violated, i.e., the dynamic delay of circuits exceeds the circuit clock period. With the continuous scaling of CMOS technology, microelectronic circuits are increasingly susceptible to microelectronic variations such as variations in operating conditions. Such variations can cause delay uncertainty in microelectronic circuits, leading totiming errors. Circuit designers typically combat these errors using conservative guardbands in the circuit and architectural design, which can, however, cause significant loss of operational efficiency. In this article, we proposeDEVoT, a supervised learning model that can predict the dynamic delay of functional units (FUs) under different operating conditions, clock speeds, and input workload. The main contribution ofDEVoTis to jointly consider the impact of voltage, temperature, and input workload in path sensitization, hence predicting the dynamic delay. We measure the dynamic delay using switching activity generated through gate-level simulation of post place-and-route design in the TSMC 45-nm process. We characterize the delay of FUs under different operating conditions and input workload. We then extract useful features in the input workload that influences dynamic path sensitization. Using these features, we apply supervised learning methods to buildDEVoT. Across 100 different operating conditions, four widely used FUs, and three datasets,DEVoTachieves, on average, less than 2% relative deviation from the ground truth and is$100\times $faster than the gate-level simulation. We present two case studies usingDEVoT. First, we useDEVoTto predict timing errors of FUs, andDEVoTachieves an average prediction accuracy at 98.04%. We further useDEVoTto estimate application output quality under different operating conditions, andDEVoTachieves an average estimation accuracy at 97% for two image processing applications. Second, we present a fuzzing-based method to identify “critical” patterns that can cause longer delay for a given circuit. Built on top ofDEVoT, the generated input patterns can improve the sensitized delay by up to 8.3% compared to random patterns.DEVoTalso outperforms automatic test pattern generation (ATPG) in sensitizing circuit delay. We will opensourceDEVoT, which can assist circuit designers to perform early design space exploration and can also help software developers in approximate computing community to assess their program resilience to hardware approximation without performing circuit simulation.

Model-driven methodology has been widely adopted in embedded software design, and Dataflow is a widely used computation model, with strong modeling and simulation ability supported in tools such as Ptolemy. However, its code synthesis support is quite limited, which restricts its applications in real industrial practice. In this article, we focus on the automatic code synthesis of Dataflow, and implementDFSynth, a code generator that could support most of the widely used modeling features, such as the expression type and Boolean switch, more efficiently. First, we disassemble the Dataflow model into actors embedded in if-else or switch-case statements based on the schedule analysis, which bridges the semantic gap between the code and the original Dataflow model. Then, we design well-designed templates for each actor, and synthesize well-structured executable C and Java codes with sequential code assembly. Compared to the existing C and Java code generators of Dataflow model in Ptolemy-II, and the C code generator in Simulink, the lines of code synthesized byDFSynthare decreased by an average of 99.7%, 81.4%, and 61.9%, and the execution time of the synthesized code byDFSynthis also decreased by an average of 76.2%, 56.8%, and 22.7%, respectively.

Model-driven methods are widely used in embedded control software development. Current design tools, such as Ptolemy-II and Simulink, have strong modeling capability but their simulation and code generation functionalities are challenged by the increasing complexity of control requirements. For simulation, emulating the triggering of the actor leads to additional time overhead and speed degradation. For code generation, generating redundant content degrades the code quality. Besides, current tools do not have a unified interface, which makes it difficult to cooperation. In this article, we propose a unified model-driven design framework MDD to facilitate embedded control software development. MDD can support the unification of models built by different modeling tools for high-efficiency simulation and high-quality code generation. The MDD framework supports the expansion of more modeling tools, and also supports the expansion of more uses, such as unified testing and verification. First, it offers a model intermediate representation (MIR) and several corresponding parsers, which facilitate a unified representation and cooperation for different design tools. Then, based on data flow schedule analysis of the original MIR, intermediate code representation will be generated for optimized code synthesis. Finally, a variety of code translators will synthesize the intermediate code representation into the code of actual use, such as code for simulation and code for deployment. For evaluation, we enhance two widely used design tools in industry, Ptolemy-II and Simulink, and apply them on the implementation of several benchmark models and a real-world self-driving control software of our industrial collaborator. Using MDD can help reduce their simulation time by 98.9% and 92.6%, the generated code by 99.7% and 69.9% in the number of lines, and 94.3% and 34.3% in code execution time, respectively.

Physical unclonable functions (PUFs) have been adopted in many resource-constrained Internet of Things (IoT) applications to provide effective and lightweight solutions for device authentication. However, an attacker can collect challenge–response pairs (CRPs) of a strong PUF, to build a machine learning (ML) model and mimic its behavior, i.e., predicting the responses of unseen challenges with high accuracy. Although several PUFs have been proposed to resist such modeling attacks, they incur high hardware overhead. Developing a PUF primitive with low hardware cost and high resistance to ML attacks is thus a crucial task. In this article, we propose the first response–feedback-based lightweight anti-ML-attack PUF (FLAM-PUF). It is only composed of one arbiter PUF (APUF) and one Galois linear-feedback shift register (LFSR), with some basic logic gates, reducing more than 62% hardware cost compared with the state-of-the-art robust strong PUFs. Specifically, FLAM-PUF leverages a cost-effective feedback loop structure to dynamically control and update the LFSR configuration. FLAM-PUF has two main characteristics: 1) it feeds back a 1-bit response in every cycle to intentionally poison the data of the CRP set for training. To resist ML-based modeling attacks, the 1-bit response can randomly update one coefficient of the feedback polynomial to implant more complex correlations into the model built by attackers and 2) it takes advantage of an$n-$bit response feedback-controlled reconfigurable Galois LFSR to enlarge the original challenge space of the APUF. Extensive experimental results show that the proposed FLAM-PUF achieves near-optimal uniformity, uniqueness, and reliability. Our scheme works well under standard attack models with public crucial initial information. In particular, the prediction accuracy of modeling attacks against FLAM-PUF is nearly 50% under the four widely used ML algorithms, i.e., support vector machines (SVMs), logistic regression (LR), covariance matrix adaptation evolution strategy (CMA-ES), and deep neural networks (DNNs), indicating excellent resistance against these ML attacks.

Simulink is a widely used model-driven design environment for supporting the simulation and code generation of embedded applications. To improve the quality of the code generated from Simulink models, state-of-the-art code generators employ various high-level optimizations, like eliminating local variables. However, they overlook the compatibility between code and the low-level processor architecture, especially the instruction pipeline. Consequently, instruction pipeline stalls occur frequently, leading to additional delays in instruction execution, as well as limited efficiency for deployed the embedded software. In this article, we propose Mercury, an instruction pipeline aware code generator for Simulink models which utilizes data dependencies between actors to decrease the instruction pipeline stalls of the generated code. First, Mercury collects data dependencies through model dataflow traversal and records the property of each actor. Then, Mercury approximately estimates the execution latency of required instructions fetched from corresponding actors and uses a topology-based method to obtain candidate actors for code synthesis. Finally, Mercury adopts the least penalty priority to iteratively select the most suitable actor for code synthesis and releases data dependencies with its subsequent actors. We implemented and evaluated Mercury on benchmark Simulink models (Su et al., 2021) as well as a real industrial model. Compared to the official tool Simulink Embedded Coder and the state-of-the-art academic tool DFSynth, Mercury outperformed them by 9.7%–33.4% and 9.2%–59.4% in terms of the execution time of the generated code across different architectures, respectively. The statistics also demonstrate that the generated code of Mercury increases utilization of pipeline slots by 11.0%–37.1% and 10.6%–50.0%, respectively.

Controller design and their software implementations are usually done in isolated design spaces using respective COTS design tools. However, this separation of concerns can lead to long debugging and integration phases. This is because assumptions made about the implementation platform during the design phase—e.g., related to timing—might not hold in practice, thereby leading to unacceptable control performance. In order to address this, several control/architecture co-design techniques have been proposed in the literature. However, their adoption in practice has been hampered by the lack of design flows using commercial tools. To the best of our knowledge, this is the first article that implements such a co-design method using commercially available design tools in an automotive setting, with the aim of minimally disrupting existing design flows practiced in the industry. The goal of such co-design is to jointly determine controller and platform parameters in order to avoid any design-implementation gap , thereby minimizing implementation time testing and debugging. Our setting involves distributed implementations of control algorithms on automotive electronic control units ( ECUs ) communicating via a FlexRay bus. The co-design and the associated toolchain Co-Flex jointly determines controller and FlexRay parameters (that impact signal delays) in order to optimize specified design metrics. Co-Flex seamlessly integrates the modeling and analysis of control systems in MATLAB/Simulink with platform modeling and configuration in SIMTOOLS/SIMTARGET that is used for configuring FlexRay bus parameters. It automates the generation of multiple Pareto-optimal design options with respect to the quality of control and the resource usage, that an engineer can choose from. In this article, we outline a step-by-step software development process based on Co-Flex tools for distributed control applications. While our exposition is automotive specific, this design flow can easily be extended to other domains.

Blockchain has been widely deployed in various fields, such as finance, education, and public services. Blockchain has decentralized mechanisms with persistency and auditability and runs as an immutable distributed ledger, where transactions are jointly performed through cryptocurrency-based consensus algorithms by worldwide distributed nodes. There have been many survey papers reviewing the blockchain technologies from different perspectives, e.g., digital currencies, consensus algorithms, and smart contracts. However, none of them have focused on the blockchain data management systems. To fill in this gap, we have conducted a comprehensive survey on the data management systems, based on three typical types of blockchain, i.e., standard blockchain, hybrid blockchain, and DAG ( Directed Acyclic Graph )-based blockchain. We categorize their data management mechanisms into three layers: blockchain architecture, blockchain data structure, and blockchain storage engine, where block architecture indicates how to record transactions on a distributed ledger, blockchain data structure refers to the internal structure of each block, and blockchain storage engine specifies the storage form of data on the blockchain system. For each layer, the works advancing the state-of-the-art are discussed together with technical challenges. Furthermore, we lay out several possible future research directions for the blockchain data management systems.

With ever more complicated functionalities being integrated in modern autonomous systems, traditional design methods may not remain sufficient to deliver trusted and high-performance systems with stringent temporal, safety and cost efficiency requirements. In this paper, we discuss the limitations of the traditional design methods with the above requirements enforced, in which hardware and software design are often considered separately. To tackle these limitations, this paper presents a novel design solution that synthesizes both software-level and hardware-level design. First, we highlight and analyze the interconnections between software-level methods (e.g. priority assignment and task allocation) and hardware design (e.g. cache and memory management), in terms of the resulting system performance, e.g. latency. Second, by applying the identified interconnections, we propose an optimization framework to produce high-quality synthesized solutions of both software and hardware design based on a set of candidate design methods. In addition, we describe potential research directions derived from the work and major challenges that can be investigated jointly by engineers and researchers from embedded systems, system safety and programming languages communities.

DM-SMR adopts Persistent Cache (PC) to accommodate non-sequential write operations. However, the PC cleaning process induces severe long-tail latency. In this paper, we propose to mitigate the tail latency of PC cleaning by using Reinforcement Learning (RL). Specifically, a real-time lightweight Q-learning model is built to analyze the idle window of I/O workloads, based on which PC cleaning is judiciously scheduled, thereby maximally utilizing the I/O idle window and effectively hiding the tail latency from regular requests. We implement our technique inside a Linux device driver with an emulated SMR drive. Experimental results show that our technique can reduce the tail latency by 57.65% at 99.9th percentile and the average response time by 46.11% compared to a typical SMR design.

CAN-FD (CAN with flexible data rate) has been developed to support automated driving as a high-bandwidth version of the conventional CAN (controller area network) bus protocol. Due to the complexity of the emerging automotive functionalities, there exist dependencies between the tasks and thus also between the CAN-FD messages. The current industrial practice is that the same application has exactly the same message transmission flow (i.e., the same ordered sequence of messages to be transmitted) across all vehicles. This renders large-scale attacks possible and potentially leads to millions of vehicles to be recalled, as one vehicle being compromised exposes all the others. To address this issue, an application could have different (obfuscated) message flows on individual vehicles. The challenge is to find a large number of available flows (i.e., flows that respect dependencies and meet application deadlines) within short time. For this purpose, we propose a novel priority assignment approach, which assigns the ordered positions in a flow (named priorities) to the messages. It dynamically generates new valid flows (i.e., flows with only dependencies respected and deadlines not considered) by message swapping, instead of exploring all valid flows as in the existing approaches. We apply pruning through affix-matching to further enhance the efficiency. That is, the prefix, infix, and suffix are all matched when determining whether a certain flow should be discarded without evaluating its availability, aiming for lower false positive rate (FSR) and false negative rate (FNR) than adfix-matching (only prefix and suffix are matched) in the state-of-the-art approach. Experimental results show that the proposed approach dominates the state-of-the-art approach, in the number of available flows found (up to 79x) and time consumption (up to 200x), most notably when the proportion of available flows is small. This work is an important step for obfuscated priority assignment to be deployed on practical CAN-FD messages.

Deep Neural Networks (DNNs) are widely investigated due to their striking performance in various applications of artificial intelligence. However, with DNNs becoming larger and deeper, the computing resource of a single hardware accelerator is insufficient to meet the training requirements of popular DNNs. Hence, it is required to train them using multiple accelerators in a distributed setting. For a better utilization of the accelerators and a faster training, it is necessary to partition the whole process into segments that can run in parallel. However, in this context, intra-layer parallelization techniques (i.e., data and model parallelization) often face communication and memory bottlenecks, while the performance and resource utilization of inter-layer parallelization techniques (i.e., using pipelining) depend on the partitioning possibilities of the model. We present EffTra, a synchronous hybrid parallelization strategy, that uses a combination of intra-layer and inter-layer parallelism to realize a distributed training of DNNs. EffTra employs the idea of dynamic programming to try to search for the optimal partitioning of a DNN model and assigns devices to the obtained partitions. Our evaluation shows that EffTra accelerates training by up to 2.0x and 1.78x compared to state-of-the-art inter-layer (i.e., GPipe) and intra-layer (i.e., data parallelism) parallelization techniques respectively.

With the trend towards automated driving, Controller Area Network (CAN) is migrating to CAN with Flexible Data-Rate (CAN-FD), where frame packing (i.e., packing signals of various periods, deadlines, and payloads into frames following the standard CAN- FD format) is critical to address the high bandwidth demand with limited resources. Existing works have applied Integer Linear Programming (ILP), which easily gets intractable as the number of signals to be packed increases, or proposed heuristics, which are not able to obtain the optimal solution. In addition, the security model employed does not meet the AUTOSAR SecOC specification. This paper reports a novel frame packing approach for CAN-FD with an AUTOSAR-compliant security model. We establish the theory that extending the existing frame to pack signals with the same period leads to shorter WCTT (worst-case transmission time) and thus lower bus utilization compared to creating a new frame. Following this principle, the design space is tremendously pruned. As shown in the comprehensive experiments, only 10−9 of the original size or even a smaller portion needs to be explored, while the optimality is kept. The computational time is correspondingly reduced, generating solutions within 15 minutes to large-scale problems that are otherwise intractable with ILP.

There is a demand of high bandwidth in the emerging real-time applications, such as autonomous vehicles, robotics, and industrial automation, where time-sensitive networking (TSN) is a promising solution. According to IEEE 802.1, a port in a TSN switch has eight prioritized FIFO (first-in first-out) queues, whose gates are opened or closed following a gate control list (GCL). Most of the existing works use one TT (time-triggered) queue for the hard real-time traffic, i.e., traffic flows with hard deadlines, which easily achieves timing determinism through GCL. Unfortunately, as a rigid mechanism, GCL is not able to handle timing jitter. In this work, we propose a hybrid strategy towards robust TSN. GCL is applied to only one queue named TT T1 for a small number of hard real-time flows with negligible jitter. The remaining flows with hard deadlines are allocated to a prioritized queue named TT T2 without GCL. Similarly, GCL is removed from all other queues handling AVB (audio-video-bridging) flows with soft deadlines and BE (best-effort) flows with no deadlines. Two analyses are proposed to obtain delay bounds for the TT T2 flows and periodic AVB flows, respectively, with interference from TT T1. Although safety is not compromised if the periodic AVB flows miss their deadlines, it is often desirable in practice to satisfy them for quality of service. In order to strike a balance, contention between the AVB queues is resolved with credit values on top of priorities. Experiments support that the delay bounds for the TT T2 and AVB flows are safe. In addition, changing the credit function can lead to different delay bounds of AVB flows, which is valuable for real-world configurations of TSN.

Development of dependable multi-/many-core systems requires assurance that the system is operable in a range of conditions, subjected to both functional and non-functional requirements. To achieve this, tools need to be implemented that can enable exploration of design options and be able to detect deficiencies earlier to avoid costly system re-design. In this work we discuss the challenges of design of multi-core realtime systems with timing assurance and discuss what are the requirements for modelling, testing and analysis tools. Digital Twin-based predictive modelling and fast design space evaluation are studied that work toward addressing these challenges.

With the rapid development of distributed applications, smart contracts have attracted more and more developers' attentions. However, developers or domain experts have different levels of familiarity with specific programming languages, like Solidity, and those vulnerabilities hidden in the code would be exploited and result in huge property losses. Existing auxiliary tools lack security considerations. Most of them only provide word completion based on fuzzy search and detection services for limited types of vulnerabilities, which results in the manpower waste during coding and potential vulnerability threats after deployment.

Driven by industry demand, there is an increasing need to develop real-time multiprocessor systems which contain shared resources. The Multiprocessor Stack Resource Policy (MSRP) and Multiprocessor resource sharing Protocol (MrsP) are two major protocols that manage access to shared resources. Both of them can be applied to Fixed-Priority Preemptive Scheduling (FPPS), which is enforced by most commercial real-time systems regulations, and which requires task priorities to be assigned before deployment. Along with MSRP and MrsP, there exist two forms of schedulability tests that bound the worst-case blocking time due to resource accesses: the traditional ones being more widely adopted and the more recently developed holistic ones which deliver tighter analysis. On uniprocessor systems, there are several well-established optimal priority assignment algorithms. Unfortunately, on multiprocessor systems with shared resources, the issue of priority assignment has not been adequately understood. In this article, we investigate three mainstream priority assignment algorithms-Deadline Monotonic Priority Ordering (DMPO), Audsley's Optimal Priority Assignment (OPA), and Robust Priority Assignment (RPA), in the context of partitioned multiprocessor systems with shared resources. Our contributions are multifold: First, we prove that DMPO is optimal with the traditional schedulability tests. Second, two counter examples are given as evidence that DMPO is not optimal with the tighter holistic schedulability tests. Third, we then analyze the pessimism arising from the adoption of OPA and RPA with the holistic tests. Lastly, we propose a Slack-based Priority Ordering (SPO) algorithm that minimises such pessimism, and has polynomial time complexity. Comprehensive experiments show that SPO outperforms (i.e., results in a larger number of schedulable systems) DMPO, OPA, and RPA in general with the holistic schedulability tests, by up to 15 percent. With the theoretical contributions, this paper is a useful guide to priority assignment in real-time partitioned multiprocessor systems with shared resources.

Heterogeneous computing systems are being increasingly deployed on time-critical applications, where tasks need to meet execution deadlines and the energy consumption is to be minimized. Dynamic voltage and frequency scaling (DVFS) has been widely applied for energy saving on computing devices. Unfortunately, DVFS may introduce transient errors and shorten the processor lifetime. There is also time and energy overhead when computing and making the switching. In this article, we investigate scheduling approaches—that are independent of, or weakly dependent on DVFS—for parallel real-time applications with hard deadlines running on heterogeneous computing systems. The aim is to minimise the energy consumption while keeping all deadlines satisfied. First, in the domain without DVFS, we propose a DVFS-nondependent scheduling algorithm (DNDS), which prioritises tasks of high energy consumption during reassignment with slack time. Second, we propose a DVFS-weakly dependent scheduling (DWDS) algorithm, which finds an appropriate frequency for each processor in an iterative manner. DVFS is only allowed when switching applications. Third, based on DWDS, we further propose an algorithm Fast_DWDS, which quickly converges by deploying a binary search method. Our proposed scheduling approaches are evaluated with a large number of directed acyclic graph-based applications of high, low, and random parallelism. The results show that they significantly reduce the energy cost compared to their existing counterparts, i.e., without and with DVFS, respectively, while all deadlines remain satisfied.

A real-time operating system (RTOS) is an operating system designed to meet certain real-time requirements. It is widely used in embedded applications, and its correctness is safety-critical. However, the validation of RTOS is challenging due to its complex real-time features and large code base. In this paper, we propose Rtkaller , a state-aware kernel fuzzer for the vulnerability detection in RTOS. First, Rtkaller implements an automatic task initialization to transform the syscall sequences into initial tasks with more real-time information. Then, a coverage-guided task mutation is designed to generate those tasks that explore more in-depth real-time related code for parallel execution. Moreover, Rtkaller realizes a task modification to correct those tasks that may hang during fuzzing. We evaluated it on recent versions of rt-Linux, which is one of the most widely used RTOS. Compared to the state-of-the-art kernel fuzzers Syzkaller and Moonshine, Rtkaller achieves the same code coverage at the speed of 1.7X and 1.6X, gains an increase of 26.1% and 22.0% branch coverage within 24 hours respectively. More importantly, Rtkaller has confirmed 28 previously unknown vulnerabilities that are missed by other fuzzers.

Emerging cyber-physical systems (CPSs), such as in the domains of automotive, robotics, and industrial automation, often run complex functions with different criticality levels on a heterogeneous and distributed architecture. The ever stronger interactions between the cyber components and the physical environment lead to dynamic and irregular release of these functions. This article investigates dynamic scheduling of such mixed-criticality functions, where each function is modeled by a directed acyclic graph with no assumption on its period or minimum interarrival time. Unlike the existing methods that passively address the mixed criticality with a remedy when deadline misses are observed-this results in a high deadline miss ratio (DMR), and it is particularly undesirable for the high-criticality functions-we propose a novel dynamic scheduling approach using active strategies (ASDYS in short), where the mixed criticality is actively treated throughout the scheduling process. Automotive CPSs are used as an example for illustration. Experimental results show that our approach is significantly better than the existing methods in both the DMR of high-criticality functions and the overall system DMR.

Optimisation of timing performance and power consumption on heterogeneous multi-core architectures is gaining increasing attention. Systems and devices may have varying demands on timing and power, which motivates more flexible optimisation. Along this line, we consider a heterogeneous computing architecture with multiple cores, where each core runs a mixed stream of general and dedicated tasks with a certain scheduling strategy. Employing the queuing model, we first propose a load balancing algorithm, which minimises the average response time of the general tasks whilst guaranteeing the timing requirements of the dedicated tasks. Built upon the above, we propose a bi-directional optimisation algorithm that is able to improve the timing performance under the constraint of power consumption, and reduces the power consumption for the given timing requirement. Extensive numerical experiments illustrate the significance of the proposed algorithms. Implementation on a real platform validates the consistency between the theoretical analysis and the practical results.

General-purpose I/O widely exists on multi- and many-core systems. For real-time applications, I/O operations are often required to be timing-predictable, i.e., bounded in the worst case, and timing-accurate, i.e., occur at (or near) an exact desired time instant. Unfortunately, both timing requirements of I/O operations are hard to achieve from the system level, especially for many-core architectures, due to various latency and contention factors presented in the path of instigating an I/O request. This paper considers a dedicated I/O co-processing unit, and proposes two scheduling methods, with the necessary hardware support implemented. It is the first work that guarantees timing predictability and maximises timing accuracy of I/O tasks in the multi-and many-core systems.

With the continuous scaling of CMOS technology, microelectronic circuits are increasingly susceptible to micro-electronic variations such as variations in operating conditions. Such variations can cause delay uncertainty in microelectronic circuits, leading to timing errors. Circuit designers typically combat these errors using conservative guardbands in the circuit and architectural design, which can, however, cause significant loss of operational efficiency. In this paper, we propose TEVoT, a supervised learning model that can predict the timing errors of functional units (FUs) under different operating conditions, clock speeds, and input workload. We perform dynamic timing analysis to characterize the delay variations of FUs under different conditions, based on which we collect training data. We then extract useful features from training data and apply supervised learning methods to establish TEVoT. Across 100 different operating conditions, 4 widely-used FUs, 3 clocking speeds, and 3 datasets, TEVoT achieves an average prediction accuracy at 98.25% and is 100X faster than gate-level simulation. We further use TEVoT to estimate application output quality under different operating conditions by exposing circuit-level timing errors to application level. TEVoT achieves an average estimation accuracy at 97% for two image processing applications across 100 operating conditions.

Industrial Control System (ICS) protocols play an essential role in building communications among system components. Recently, many severe vulnerabilities, such as Stuxnet and DragonFly, exposed in ICS protocols have affected a wide distribution of devices. Therefore, it is of vital importance to ensure their correctness. However, the vulnerability detection efficiency of traditional techniques such as fuzzing is challenged by the complexity and diversity of the protocols.In this paper, we propose to equip the traditional protocol fuzzing with coverage-guided packet crack and generation. We collect the coverage information during the testing procedure, save those valuable packets that trigger new path coverage and crack them into pieces, based on which, we can construct higher-quality new packets for further testing. For evaluation, we build Peach*on top of Peach, which is one of the most widely used protocol fuzzers, and conduct experiments on several ICS protocols such as Modbus and DNP3. Results show that, compared with the original Peach, Peach*achieves the same code coverage and bug detection numbers at the speed of 1.2X-25X. It also gains final increase with 8.35%-36.84% more paths within 24 hours and has exposed 9 previously unknown vulnerabilities.

Modeling and design of automotive systems from a cyber-physical system (CPS) perspective have lately attracted extensive attention. As the trend towards automated driving and connectivity accelerates, strong interactions between vehicles and the infrastructure are expected. This requires modeling and control of the traffic network in a similarly formal manner. Modeling of such networks involves a tradeoff between expressivity of the appropriate features and tractability of the control problem. Back-pressure control of traffic signals is gaining ground due to its decentralized implementation, low computational complexity, and no requirements on prior traffic information. It guarantees maximum stability under idealistic assumptions. However, when deployed in real traffic intersections, the existing back-pressure control algorithms may result in poor junction utilization due to (i) fixed-length control phases; (ii) stability as the only objective; and (iii) obliviousness to finite road capacities and empty roads. In this paper, we propose a CPS-oriented model of traffic intersections and control of traffic signals, aiming to address the utilization issue of the back-pressure algorithms. We consider a more realistic model with transition phases and dedicated turning lanes, the latter influencing computation of the pressure and subsequently the utilization. The main technical contribution is an adaptive controller that enables varying-length control phases and considers both stability and utilization, while taking both cases of full roads and empty roads into account. We implement a mechanism to prevent frequent changes of control phases and thus limit the number of transition phases, which have negative impact on the junction utilization. Microscopic simulation results with SUMO on a 3×3 traffic network under various traffic patterns show that the proposed algorithm is at least about 13% better in performance than the existing fixed-length backpressure control algorithms reported in previous works. This is a significant improvement in the context of traffic signal control.

Time-sensitive networking (TSN) is a set of standardised communication protocols developed under the IEEE 802.1 working group. TSN aims to support deterministic communication based on network schedules that are distributively configured. It is widely considered as the future in-vehicle network solution for highly automated driving, where the requirement on timing guarantee is alongside the demand of high communication bandwidth. In this work, we study a setting of periodic control and non-control packets, with implicit and arbitrary deadlines, respectively. As the FIFO (first-in, first-out) queues in the 802.1Qbv switch incur long delay in the worst case, which prevents the control tasks from achieving short sampling periods and thus impedes control performance optimisation, we propose the first fixed-priority scheduling (FPS) approach for TSN by leveraging its gate control features. In this context, we develop a finer-grained frame-level response time analysis, which provides a tighter bound than the conventional packet-level analysis. Building upon FPS and the above analysis, we formulate a co-design optimisation problem to decide the sampling periods and poles of real-time controllers with settling time as the objective to minimise, whilst satisfying the schedulability constraint.

Multi-core architectures are increasingly being used in real-time embedded systems. In general, such systems have more processors than the shared memory modules, potentially causing severe interference over memory accesses. This resource contention could lead to substantial variation on memory access latencies, and thus wide fluctuation in the overall system performance, which is highly undesirable especially for the time-critical applications. In this paper, we address resource contention and timing predictability for multi-core architectures with distributed memory interconnects. We focus on the locally arbitrated interconnect constructed by pipelined multiplexing stages with local arbitration, while the globally arbitrated interconnect employing global scheduling to the same architecture potentially suffers synchronisation issue and requires strict coordination. Our contributions are mainly threefold: (i) We analyse the resource contention across the memory access data path, and report the accurate calculational method to bound the worst-case behaviour. (ii) We compare the average-case behaviour of the locally arbitrated and the globally arbitrated architectures with experiments, demonstrating varying memory latencies caused by the resource sharing issue. (iii) We propose an architectural modification to smooth resource sharing. Evaluations on simulators and FPGA implementations with synthetic memory workload show that the latency variation is significantly reduced, contributing towards timing predictability of multi-core systems.

With ever more complex functionalities being implemented in emerging real-time applications, multiprocessor systems are demanded for high performance, and directed acyclic graphs (DAGs) are used to model functional dependencies. In this work, we study a single periodic non-preemptive DAG running on a homogeneous multiprocessor platform, which is a common setup in many domains, such as automotive, robotics, and industrial automation. Aiming to reduce the makespan of the DAG and provide a tight yet safe bound, our contributions involve the exploitation of node-level parallelism and inter-node dependency, which are the two key factors of a DAG topology. First, we introduce a concurrent provider and consumer (CPC) model that precisely captures the above two factors, and can be recursively applied when parsing a DAG. Building upon CPC, we propose a novel scheduling method focused on reducing the makespan that orders the nodes in the following sequence: (i) the critical path, (ii) early predecessor paths of the critical path, and (iii) longer paths. Secondly, new response time analysis is presented, which provides a generic bound for any execution order of the non-critical nodes and a specific (tighter) bound for a fixed such order. Comprehensive evaluation demonstrates that our scheduling approach and analysis outperforms the state-of-the-art methods.

There is a demand in the automotive industry to connect two CAN-based subsystems. The commercial CAN-CAN gateway supports basic message forwarding with no real-time behavior. To address this issue, a new gateway architecture is described, on which we present a novel worst-case latency analysis. Specifically, we bound the arrival of the messages at the gateway, which is then used by the Pointer Reachability Exploration (PRE) to derive the interfering message jobs. Our analysis computes a safe gateway latency tighter than the conventional one applied in CAN. Furthermore, we propose a Targeted Priority Assignment (TPA) algorithm that targets at the priorities assigned at the CAN bus and runs a reordering at the gateway to enhance the schedulability. TPA performs better than DMPO (Deadline Monotonic Priority Ordering), while OPA (Audsley's Optimal Priority Assignment) cannot be applied in this context. Evaluation over real-life and scalable CAN message sets is conducted. The reported analysis and priority assignment algorithm are developed for dynamic use to improve the acceptance ratio and can also be deployed statically to provide timing guarantees. This work can be easily extended to support multiple CAN subsystems.

Embedded systems are increasingly interconnected in the emerging application scenarios. Many of these applications are safety critical, making it a high priority to ensure that the systems are free from malicious attacks. This work aims to detect vulnerabilities, that could be exploited by adversaries to compromise functional correctness, in the embedded firmware, which is challenging especially due to the absence of source code. In particular, we propose EM-Fuzz, a firmware vulnerability detection technique that tightly integrates fuzzing with real-time memory checking. Based on the memory instrumentation, the firmware fuzzing can not only be guided by the traditional branch coverage to generate high-quality seeds to explore hard-to-reach regions but also by the recorded memory sensitive operations to continuously exercise sensitive regions which are prone to being attacked. More importantly, the instrumentation integrates real-time memory checkers to expose memory vulnerabilities, which is not well-supported by existing fuzzers without source code. The experiments on several real-world embedded firmware such as OpenSSL demonstrate that EM-Fuzz significantly improves the performance of state-of-the-art fuzzing tools, such as AFL and AFLFast, with the coverage improvements of 93.98% and 46.89%, respectively. Furthermore, EM-Fuzz exposes a total of 23 vulnerabilities, with an average of about 7-h per vulnerability. AFL and AFLFast together find 10 vulnerabilities, costing about 13 h and 10-h per vulnerability on average, respectively. Out of these 23 vulnerabilities, 16 are previously unknown and have been reported to the upstream product vendors, 7 of which have been assigned with unique CVE identifiers in the U.S. National Vulnerability Database.

Multiprocessor systems are increasingly deployed in real-time applications, where reliability, energy consumption, and makespan are often the main scheduling objectives. In this work, we investigate the dynamic scheduling of tasks modeled by directed acyclic graphs (DAGs), which is an NP-hard problem with all existing methods being heuristics. Our contributions have two steps: 1) assuming that the allocation of DAG nodes to processors is given, we propose optimal energy allocation (OEA) and search-based OEA (SOEA)-the first optimal methods that minimize the energy consumption while satisfying the reliability requirement-for homogeneous and heterogeneous systems, respectively and 2) we present a novel scheduling algorithm out-degree scheduling (ODS) that allocates the DAG nodes according to their out-degrees, and considering energy consumption, reliability, as well as dynamic finish time. ODS dominates the widely applied heterogeneous earliest finish time (HEFT) in makespan. Combining SOEA with ODS makes a complete solution to the problem of dynamic DAG scheduling on multiprocessor systems, and achieves generally better results compared to the existing approaches. Specifically, in most cases, we are better on all the three objectives, i.e., reliability, energy, as well as makespan, and in other cases, we are better on some of the objectives.

As Moore's Law comes to an end and transistor scaling increasingly falls short in improving energy efficiency, alternative computing paradigms are direly needed. This need is further highlighted by the overwhelming increase in computing demand posed by emerging applications, such as multimedia and data analysis. Fortunately, such driving workloads also present new opportunities since, thanks to their inherent error tolerance, they do not require completely accurate computations. Thus, by trading off accuracy for better performance or improved efficiency, approximate computing promises tremendous growth for future computing. Various approximation methods demonstrate the effectiveness of voltage scaling in functional units (FUs) for exploring this energy-error tradeoff. Yet, while an accurate error model is critical for assessing the error behavior of voltage-scaled FUs and its effects on application quality, existing error models of voltage-scaled FUs overlook the effects of input data and error rate disparity among different bits. To tackle this challenge, we propose LEVAX, an input-aware learning-based error model of voltage-scaled FUs that can predict the timing error rate (TER) for each output bit. This model is trained using random forest methods, with input features and output labels extracted from gate-level simulations. To validate its effectiveness and demonstrate its prediction accuracy, we use LEVAX on various FUs. Across all bit positions, voltage levels, and FUs, LEVAX achieves, on average, a relative error of 1.20%. LEVAX also achieves an average per-voltage root mean square error (RMSE) of 1.03% and per-bit RMSE of 1.17%. Exposing this error rate even up to the application level, LEVAX can estimate the quality of four image processing applications under-voltage scaling with an average accuracy of 97.9%. To the best of our knowledge, LEVAX is the first voltage scaling error model of FUs that can incorporate the effects of input data.

Multicore architectures are widely adopted in the emerging real-time applications, such as autonomous vehicles and robotics, where latency is required to be both bounded in the worst case (i.e., time predictability) and low. With the number of processors growing, the conventional memory interconnects, i.e., shared bus, crossbar, and network-on-chip (NoC), suffer high latency due to the increasing logic size of their centralized arbiter, which is deployed for time predictability. In this article, we introduce a novel distributed multimemory interconnect, Meshed Bluetree, and explain its operation. Constructed by coupling a router network with multiple Bluetree-based memory architectures in parallel, Meshed Bluetree allows simultaneous access to multiple memory modules. We present the analysis for the predictable timing behavior of memory access to bound the worst case. The evaluation of FPGA with synthetic memory workloads and real-world benchmarks demonstrates the effectiveness of our work, i.e., as the number of memory modules increases, the latency is reduced with the same scale. This work reports the first time-predictable distributed multimemory interconnect, significantly contributing to multicore real-time systems.

Many applications in emerging scenarios, such as autonomous vehicles, intelligent robots, and industrial automation, are safety-critical with strict timing requirements. However, the development of real-time systems is error prone and highly dependent on sophisticated domain expertise, making it a costly process. This article utilises the principles of model-driven engineering (MDE) and proposes two methodologies to automate the development of real-time Java applications. The first one automatically converts standard time-sharing Java applications to real-time Java applications, using a series of transformations. It is in line with the observed industrial trend, such as for the big data technology, of redeveloping existing software without the real-time notion to realise the real-time features. The second one allows users to automatically generate real-time Java application templates with a lightweight modelling language, which can be used to define the real-time properties—essentially a synthesis process. This article opens up a new research direction on development automation of real-time programming languages and inspires many research questions that can be jointly investigated by the embedded systems, programming languages as well as MDE communities.

In modern autonomous systems, there is typically a large number of connected components realizing complex functionalities. For example, in autonomous vehicles (AVs), there are tens of millions of lines of code implemented on hundreds of sensors, controllers, and actuators. AVs have been deployed, mostly in trials and restricted environments, showing that substantial progress has been made in functionality development. However, they are still faced with two major challenges: (i) performance guarantee of safety-critical functions under all possible scenarios; (ii) functionality implementation with limited resources. These two challenges are conflicting because safety guarantees necessitate a worst-case analysis that is often very pessimistic for complex hardware/software systems, and thus require more resources. To address this, we study an abstraction of a heterogeneous cyber-physical system architecture consisting of a mix of high- and low-quality resources, such as time- and event-triggered resources, or wired and wireless resources. We show that by properly managing such a mix of resources and formulating a formal verification (model checking) problem, it is possible to tightly dimension the high-quality resource to the minimum (50% in certain cases) while providing control performance guarantees.

In this paper, we for the first time utilize the micro-ring resonators (MRs) in optical networks-on-chip (ONoCs) to implement thermal sensing without requiring additional hardware or chip area. The challenges in accuracy and reliability that arise from fabrication-induced process variations (PVs) and device-level wavelength tuning mechanism are resolved. We quantitatively model the intrinsic thermal sensitivity of MRs with finegrained consideration of wavelength tuning mechanism. Based on it, a novel PV-tolerant thermal sensor design is proposed. By exploiting the hidden ‘redundancy’ in wavelength division multiplexing (WDM) technique, our sensor achieves accurate and efficient temperature measurement with the capability of PV tolerance. Evaluation results based on professional photonic component and circuit simulations show an average of 86.49% improvement in measurement accuracy compared to the state-of-the-art on-chip thermal sensing approach using MRs. Our thermal sensor achieves stable performance in the ONoCs employing dense WDM with an inaccuracy of only 0.8650 K.

Automotive embedded systems are safety-critical, while being highly cost-sensitive at the same time. The former requires resource dimensioning that accounts for the worst case, even if such a case occurs infrequently, while this is in conflict with the latter requirement. In order to manage both of these aspects at the same time, one research direction being explored is to dynamically assign a mixture of resources based on needs and priorities of different tasks. Along this direction, in this paper we show that by properly modeling the physical dynamics of the systems that an automotive control software interacts with, it is possible to better save resources while still guaranteeing safety properties. Towards this, we focus on a distributed controller implementation that uses an automotive FlexRay bus. Our approach combines techniques from timing/schedulability analysis and control theory and shows the significance of synergistically combining the cyber component and physical processes in the cyber-physical systems (CPS) design paradigm.

Real-time systems are receiving increasing attention with the emerging application scenarios that are safety-critical, complex in functionality, high on timing-related performance requirements, and cost-sensitive, such as autonomous vehicles. Development of real-time systems is error-prone and highly dependent on the sophisticated domain expertise, making it a costly process. There is a trend of the existing software without the real-time notion being re-developed to realise real-time features, e.g., in the big data technology. This paper utilises the principles of model-driven engineering (MDE) and proposes the first methodology that automatically converts standard time-sharing Java applications to real-time Java applications. It opens up a new research direction on development automation of real-time programming languages and inspires many research questions that can be jointly investigated by the embedded systems, programming languages as well as MDE communities.

The emerging scenarios of cyber-physical systems (CPS), such as autonomous vehicles, require implementing complex functionality with limited resources, as well as high performances. This paper considers a common setup in which multiple control and non-control tasks share one processor, and proposes a dual-mode strategy. The control task switches between two sampling periods when rejecting (coping with) a disturbance. We create an optimisation framework looking for the switching sampling periods and time instants that maximise the control performance (indexed by settling time) and resource efficiency (indexed by the number of tasks that are schedulable on the processor). The latter objective is enabled with schedulability analysis tailored for the dual-mode model. Experimental results show that (i) given a set of tasks, the proposed strategy improves the control performances whilst retaining schedulability; and (ii) given requirements on the control performances, the proposed strategy is able to schedule more tasks.

Embedded control applications are widely implemented on small, low-cost and resource-constrained microcontrollers, e.g., in the automotive domain. Conventionally, control algorithms are designed using model-based approaches, without considering the details of the implementation platform. This leads to inefficient utilization of the resources. With the emergence of the cyber-physical system (CPS)-oriented thinking, there has lately been a strong interest in co-design of control algorithms and their implementation platforms. Some recent efforts have shown that a schedule on multiple applications with more on-chip cache reuse is able to improve the control performance. However, it has not been studied how the control performance can be maximized for a given schedule and how an optimal schedule can be computed. In this work, we propose a two-stage framework to compute the schedule maximizing the overall control performance of all the applications. First, a holistic controller design taking all the sampling periods and sensing-to-actuation delays in a schedule into account is presented, aiming to maximize the overall control performance. Second, a hybrid search algorithm for discrete decision space is reported to efficiently compute an optimal schedule. Experimental results on a case study with multiple automotive applications show that a significant improvement of 10-20% in control performance can be achieved by the proposed cache-aware scheduling approach.

Software-based control of physical systems is common in domains such as automotive, avionics, and industrial automation. Safety of such systems is determined by control-theoretic properties such as stability, settling time, and peak overshoot. These properties strongly depend on the software code generated from high-level controller models, and the implementation of such code on an embedded platform. To ensure safety, the semantics of the system model considered for controller design must be faithfully preserved in the platform implementation. However, traditionally, controller design and implementation platform design are carried out in isolation, followed by their integration, which often relies on simulations to estimate the behavior of the controllers. Thus, safety properties that were proven at the model level using control-theoretic tools can no longer be established in an actual implementation. This makes the design of embedded control systems costly, error prone, and hinders certification. In this paper, we review recent efforts in control-platform cosynthesis techniques toward addressing this problem. Here, the control and the embedded systems communities have come together to adopt a cyber-physical system (CPS)-oriented design paradigm. This cosynthesis paradigm integrates the design of control algorithms and platform parameters within a holistic optimization framework and accounts for relevant details from both sides. We survey the evolution of design approaches for such cosynthesis and show how-the originally disjoint-controller and the platform design methods are gradually converging.

Automotive functionalities typically consist of a large set of periodic/cyclic tasks scheduled under a real-time operating system (OS). Many of the tasks are feedback control applications with stringent performance requirements. OSEK/VDX is a common class of automotive OS that offers preemptive periodic schedules supporting a pre-configured set of periods. The feedback controllers implemented onto such OSEK/VDX-compliant systems need to use one of the pre-configured (sampling) periods. A shorter period is often desired for a higher control performance, and this implies a higher processor load. For a given performance requirement, the longest sampling period that meets this requirement is the optimal one. Given a limited set of pre-configured periods, such optimal sampling periods are often not available, and the practice is to choose a shorter available period—leading to a higher processor load. To address this, we propose a controller that cyclically switches among the available periods, thereby leading to an average sampling period closer to the optimal one. This way, we reduce the processor load and are able to pack more control applications on the same processor. The main challenge in this article is the design of such controllers that takes into account such cyclic switching of sampling periods (i.e., use non-uniform sampling). The controller needs to meet specified performance requirements (settling time) and system constraints (e.g., input saturation). Such a non-convex constrained controller optimization problem as raised in the OS-aware automotive systems design has not been addressed in the traditional optimal control literature. A novel approach based on adaptively parameterized particle swarm optimization (PSO) is proposed to solve it. Using the OS-aware controller design with non-uniform sampling, we show that a higher number of applications can be packed on a processor, which is of particular interest in the cost-sensitive automotive industry.

Modern automotive systems consist of hundreds of functionalities implemented in software. Moreover, these functionalities are constantly evolving with increasing demand for automation, industry competition and changing sensor and actuator capabilities. Correspondingly, it is important to adapt the engineering and software development processes for such systems to consider fast management of this evolution at minimum cost. Towards this, in this paper, we outline three different problems in the context of evolving automotive software and discuss potential solutions for each of them. First, we outline a framework that can accommodate variability in specifications while developing software for automotive product lines. Secondly, a technique is illustrated to addresses after-sales addition of new features in existing systems by studying corresponding acceptable performance degradation of existing functionalities. Finally, we discuss how an inconsistency management framework and regression verification can ensure consistent evolution of engineering processes for automotive mechatronic systems.

The rapid growth in the size and complexity of modern Cyber-Physical Systems (CPS) imposes increasing demand for the embedded resources, especially the communication resources. As a result, resource-efficient CPS design has become an important issue. Towards the design of networked embedded control systems, a major branch of CPS, reliable and deterministic communication is able to achieve satisfactory control performance. However, the amount of this type of resource that can be provided by the embedded platform is often limited. On the other hand, it is difficult to guarantee the control performance with non-deterministic communication resources, due to their unpredictable behavior. In this paper, we propose a novel control scheme to efficiently utilize elastic communication resources. In general, the non-deterministic communication resources are flexibly deployed on top of the deterministic communication resources to achieve stability and good control performance. In the rare worst-case, when non-deterministic communication is completely unavailable, the deterministic communication resources are used to guarantee stability and the control performance satisfying the design requirement. The experimental results show that the performance of the control application is ensured to satisfy the design requirement in the worst case and that better control performance is achieved when non-deterministic resources are available.

Control applications are often implemented on highly cost-sensitive and resource-constrained embedded platforms, such as microcontrollers with a small on-chip memory. Typically, control algorithms are designed using model-based approaches, where the details of the implementation platform are completely ignored. As a result, optimizations that integrate platform-level characteristics into the control algorithms design are largely missing. With the emergence of cyber-physical systems (CPS)-oriented thinking, there has lately been a strong interest in co-design of control algorithms and their implementation platforms, leading to work on networked control systems and computation-aware control algorithms design. However, there has so far been no work on integrating the characteristics of a memory architecture into the design of control algorithms. In this paper we, for the first time, show that accounting for the impact of on-chip memory (or cache) reuse on the performance of control applications motivates new techniques for control algorithms design. This leads to significant improvement in quality of control for given resource availability, or more efficient implementations of embedded control applications. We believe that this paper opens up a variety of possibilities for memory-related optimizations of embedded control systems, that will be pursued by researchers working on computer-aided design for CPS.

One emerging research direction to address the design of Cyber-Physical Systems (CPS) is the co-design of the architecture and the controllers. The co-design techniques integrate the design of control and architecture in an early phase and the parameters on both sides can be synthesized according to certain design objectives. This explores the characteristics on both sides to achieve more efficient design of such systems. In this paper, we give an overview of the automated synthesis of CPS from joint controller/architecture specifications by explaining the background and motivation for such methods and illustrating this design paradigm with a concrete example of a FlexRay-based embedded control system. Furthermore, we provide the future outlook in this direction by explaining possible extensions and the related challenges.

Automotive platforms today run hundreds of millions of lines of software code implementing a large number of different control applications spanning across safety-critical functionality to driver assistance and comfort-related functions. While such control software today is largely designed following model-based approaches, the underlying models do not take into account the details of the implementation platforms, on which the software would eventually run. Following the state-of-the-art in control theory, the focus in such design is restricted to ensuring the stability of the designed controllers and meeting control performance objectives, such as settling time or peak overshoot. However, automotive platforms are highly cost-sensitive and the issue of designing “resource-efficient” controllers has largely been ignored so far and is addressed using very ad hoc techniques. In this paper, we will illustrate how, following traditional embedded systems design oriented thinking, computation, communication and memory issues can be incorporated in the controller design stage, thereby resulting in control software not only satisfying the usual control performance metrics but also making efficient utilization of the resources on distributed automotive architectures.

Recently, research on control and architecture co- design has been drawing increasingly more attention. This is because these techniques integrate the design of the controllers and the architecture and explore the characteristics on both sides to achieve more efficient design of embedded control systems. However, there still exist several challenges like the large design space and inadequate trade-off opportunities for different objectives like control performance and resource utilization. In this paper, we propose a co-optimization approach for FlexRay-based distributed control systems, that synthesizes both the controllers and the task and communication schedules. This approach exploits some FlexRay protocol specific characteristics to reduce the complexity of the whole optimization problem. This is done by employing a customized control design and a nested two-layered optimization technique. Therefore, compared to existing methods, the proposed approach is more scalable. It also allows multi-objective optimization taking into account both the overall control performance and the bus resource utilization. This approach generates a Pareto front representing the trade-offs between these two, which allows the engineers to make suitable design choices.

In this paper, for the first time, we propose a battery- and aging-aware optimization framework for embedded control systems design in electric vehicles (EVs). Performance and reliability of an EV are influenced by feedback control loops implemented into in-vehicle electrical/electronic (E/E) architecture. In this context, we consider the following design aspects of an EV: (i) battery usage, (ii) processor aging of the in-vehicle embedded platform. In this work, we propose a design optimization framework for embedded controllers with gradient-based and stochastic methods taking into account quality of control (QoC), battery usage and processor aging. First, we obtain a Pareto front between QoC and battery usage utilizing the optimization framework. Well-distributed non-dominated solutions are achieved by solving a constrained bi-objective optimization problem. In general, QoC of a control loop highly depends on the sampling period. When the processor ages, on-chip monitors could be used to measure the delay of the critical path, based on which, the processor operating frequency is reduced to ensure correct functioning. As a result, the sampling period gets longer opening up the possibility of QoC deterioration, which is highly undesirable for safety-critical applications in EVs. Utilizing the proposed framework, we take into account the effect of processor aging by re-optimizing the controller design with the prolonged sampling period resulting from processor aging. We illustrate the approach considering electric motor control in EVs. Our experimental results show that the effect of processor aging on QoC deterioration can be mitigated by controller re-optimization with a slight compromise on battery usage.

This paper gives an overview of the system architecture and software design challenges for Electric Vehicles (EVs). First, we introduce the EV-specific components and their control, considering the battery, electric motor, and electric powertrain. Moreover, technologies that will help to advance safety and energy efficiency of EVs such as drive-by-wire and information systems are discussed. Regarding the system architecture, we present challenges in the domain of communication and computation platforms. A paradigm shift towards time-triggered in-vehicle communication systems becomes inevitable for the sake of determinism, making the introduction of new bus systems and protocols necessary. At the same time, novel computational devices promise high processing power at low cost which will make a reduction in the number of Electronic Control Units (ECUs) possible. As a result, the software design has to be performed in a holistic manner, considering the controlled component while transparently abstracting the underlying hardware architecture. For this purpose, we show how middleware and verification techniques can help to reduce the design and test complexity. At the same time, with the growing connectivity of EVs, security has to become a major design objective, considering possible threats and a security-aware design as discussed in this paper.

Electric vehicles are emerging as a solution to environmental changes and transportation challenges in growing mega-cities. Compared to combustion engine vehicles, electric vehicles bring along new challenges in the CPS design. This paper gives an overview of several of these challenges and presents initial and potential solutions for the design of the electric powertrain and E/E architectures for electric vehicles. The powertrain consists of multiple complex CPS such as the battery, the electric motor, and a distributed energy management system. These components require a complex monitoring and control in order to guarantee safety and maintain a high efficiency. For this purpose, novel E/E architectures become necessary that facilitate a predictable distributed computation and communication, requiring a paradigm shift towards fully time-triggered systems. These E/E architectures will also enable novel CPS such as innovative driver assistance systems, x-by-wire control to further increase the safety and energy-efficiency of electric vehicles, and a pervasive interaction of the vehicle and the grid. Instead of focusing on the specific applications, this paper describes the prerequisite architectural changes that are necessary to implement these novel functions.