Battery-less embedded systems powered by energy harvesting eliminate the need for battery maintenance and enable their deployment in remote environments. However, their intermittent execution, disrupted by unpredictable power failures, complicates data processing. Solutions for intermittency management gravitate around one key technique: checkpointing volatile data before power failures, and retrieving data at system reboot. Moreover, since data transmission is a major source of energy consumption, performing computations directly ondevice is essential. Initially used for simple tasks such as goods identifications, battery-less systems are now being applied to more energy-intensive tasks such as image recognition leveraging machine learning algorithms such as Convolutional Neural Networks (CNNs). In this paper, we introduce Circadia, a checkpointing strategy dedicated to CNN inference in battery-less systems. By leveraging the structured dataflow and control flow of CNNs, Circadia strategically places checkpoints within the CNN code to ensure task termination, data consistency, and low energy consumption. By design, Circadia has a linear complexity relative to model size, a significant improvement over the closest state-of-the-art checkpointing method, which has cubic complexity. This enables Circadia to handle much larger CNNs. Experimental results, on both generated and state-of-the-art embedded CNNs, show that its checkpoint placement time is several orders of magnitude lower than existing approaches, while its energy consumption at runtime remains nearly identical.

We evaluate HARVEST (Hardware Accelerated Runtime Verification for Embedded SofTware), a runtime error detection mechanism for embedded software running on standard SoPC architectures,i.e., one (or more) processor(s) and an FPGA on a single chip. The program under monitoring runs on the processor(s), while a trace analysis module running on the FPGA detects errors in its execution. The hardware implementation of trace analysis minimizes the performanceimpact and achieves a very low error reporting latency (a few processor cycles). In this article, we evaluate the suitability of using HARVEST to detect errors resulting from transient physical faults. We explain how HARVEST is used to monitor a complex software component (Trampoline RTOS) on a commercially available hardware platform (Microchip SmartFusion2). We measure the overhead of the resulting instrumentation on system resources. We then evaluate its performance in detecting silent data corruptions, based on a systematic simulation of bit flips at the instruction set architecture level. We report a detection rate of up to 90.2% for a fairly low system resource overhead, suggesting an interesting trade-off for designers of highly constrained critical systems.

Battery-free devices enable sensing in hard-to-access locations, opening up new opportunities in various fields such as healthcare, space, or civil engineering. Such devices harvest ambient energy and store it in a capacitor. Due to the unpredictable nature of the harvested energy, a power failure can occur at any time, resulting in a loss of all non-persistent information (e.g., processor registers, data stored in volatile memory). Checkpointing volatile data in non-volatile memory allows the system to recover after a power failure, but raises two issues: (i) spatial and temporal placement of checkpoints; (ii) memory allocation of variables between volatile and non-volatile memory, with the overall objective of using energy as efficiently as possible. While many techniques rely on the developer to address these issues, we present Schematic,a compiler technique that automates checkpoint placement and memory allocation to minimize the overall energy consumption. Schematicensures that programs will eventually terminate (forward progress property). Moreover, checkpoint placement and memory allocation adapt to the size of the energy buffer and the capacity of volatile memory. Schematictakes advantage of volatile memory (VM) to reduce the energy consumed, by automatically placing the most used variables in VM. We tested Schematicfor different experimental settings (size of volatile memory and capacitor) and results show an average energy reduction of 51 % compared to related techniques.

By relying on ambient energy, battery-less devices significantly increase the autonomy of IoT devices, enabling maintenance-free operation in remote locations. However, due to the scarcity of ambient energy, these devices rely on capacitors to buffer energy, and alternate between power-off phases where the device is harvesting energy and computation bursts. In most existing techniques, the device resumes execution only when the capacitor is full. However, we argue that doing so is sub-optimal. Instead, we advocate that waking-up the device sooner may yield better performance since the microcontroller consumes less power when operating at lower voltage. To this extent, we introduce EarlyBird, a technique that automatically computes a fine-tuned wake-up voltage for each resume point. EarlyBird leverages static analysis to determine how much energy is needed before resuming from a given program location, and provides a runtime library to enforce the early wake-up strategy. We evaluated how EarlyBird improves existing checkpointing techniques and results show an increase in the number of benchmarks executed per minute of up to 5.65×.

The SecureV (also known as SecV) project offers an innovative, open-source hardware, secure, and high-performance processor core based on the RISC-V ISA. The originality of the approach lies in the integration of a complete solution to increase security based on dynamic code transformation, covering 4 of the 5 NIST11National Institute of Standards and Technology functions of cybersecurity via monitoring (identify, detect), obfuscation (protect), and dynamic adaptation (react).

In an embedded system, the specialization of the code of the real-time operating system (RTOS) according to the requirements of the application allows one to remove unused services and other sources of dead code from the binary program. The typical specialization process is based on a mix of precompiler macros and build scripts, both of which are known for being sources of errors. In this article, we present a new model-based approach to the design of application-specific RTOS. Starting with finite state models describing the RTOS and the application requirements, the set of blocks in the RTOS code actually used by the application is automatically computed. This set is used to build an application-specific RTOS model. This model is fed into a code generator to produce the source code of an application-specific RTOS. It is also used to carry on model-based validations and verifications, including the formal verification that the specialization process did not introduce unwanted behaviors or suppress expected ones. To demonstrate the feasibility of this approach, it is applied to specialize Trampoline, an open-source implementation of the AUTOSAR OS standard, to an industrial case study from the automotive domain.

This article introduces STM-HRT, a nonblocking wait-free software transactional memory (STM) for hard real-time (HRT) multicore embedded systems. Resource access control in HRT systems is usually implemented with lock-based synchronization. However, these mechanisms may lead to deadlocks or starvations and do not scale well with the number of cores. Most existing nonblocking STM are not suitable for HRT systems, because it is not possible to find an upper bound of the execution time for each task. In this article, we show how STM-HRT can be a robust solution for resource sharing in HRT multicore systems. We provide a detailed description of STM-HRT architecture. We propose a set of arguments to establish the functional correctness of its concurrency control protocol. Finally, as part of a real-time analysis, we derive upper bounds on the computations required to access shared data under STM-HRT.

In this paper, we present different modeling and execution frameworks that allow us to efficiently analyze, design and verify complex systems, mainly to cope with the specific concerns of the Real-time and embedded systems (RTE) domain. First we depict a UML /MARTE based methodology for executable RTE systems modeling with a framework and its underlying model transformations required to execute UML models conforming to the MARTE standard. The advantages of adopting a more generic action language with formal features are highlighted, in order to raise the level of abstraction with formal features. Then, we investigate how MARTE, with its Time Model facilities, can be made to represent faithfully AADL periodic/aperiodic tasks communicating through event or data ports, in an approach to end-to-end flow latency analysis. An analytical framework allows us to optimize port-based communication by generating a run time executive that utilizes shared data areas where appropriate, while ensuring the timing semantic assumed by the control application. An analysis of the AADL mode change protocol is also provided, exposing a translation process that takes as an input an AADL model and produces as an output a time Petri net. We show how an AADL model transformation provides a formal model for model checking activities and we suggest that model transformation provides useful support to improve the integration of formal verification in an industrial engineering process. As a case study we use an implementation of a UDP /IP protocol stack.

The in-vehicle embedded system market is evolving toward a large improvement of the industrialization of the embedded software. One of the technical consequences of this evolution is the mandatory integration of protection mechanisms in the embedded operating system kernels to support the design of multi-suppliers multi-critical component-based embedded software. In this paper, we evaluate such a mechanism: the timing protection mechanism proposed in the AUTOSAR OS standard. This evaluation shows that the present version of the mechanism is not fully adapted to multi-critical systems because it does not handle soft/non real-time applications.

This paper describes a contribution to the verification of AADL models. It focuses on the part of the language dealing with operating modes. An analysis of the AADL mode change protocol is provided. Then, a translation process is exposed, that takes as an input an AADL model and produces as an output a Time Petri Net. Lastly, it is explained how the resulting Time Petri Net model can be used to (formally) verify some real-time properties of the AADL model.

This paper introduces an OSEK/VDX operating system implementation. OSEK/VDX is an industry standard for real-time operating system used in the field of automotive embedded software. This implementation is proposed in the context of the open source software, which interest needs not to be demonstrated any more. The paper explains the main implementation choices as well as the technique proposed for the generation of a real-time application. This implementation is nowadays available for three targets: Infineon C167, Darwin/PowerPC and Linux/x86.

In this paper we describe a process for the design and the validation of the "architectural design" step of a realtime application. This process relies on a model of the system that is analysed to perform a validation of the timing constraints of the system prior to its effective design.