On the Determinism of Multi-core Processors

2013

UTILIZING MULTICORE ARCHITECTURES TO ENHANCE SOFTWARE VERIFICATION IN REAL-TIME EMBEDDED SYSTEMS Padraig Justin Fogarty The hypothesis of this research is that new techniques are required to facilitate software verification on the highly-integrated, but resource constrained, real-time embedded systems; which are widely used in safety-critical applications. Software verification is an essential but expensive undertaking which often consumes as much or more resources than design activities; this is particularly the case in embedded systems that require functional safety. This research explores the existing techniques for software verification on these systems and the verification challenges posed by modern highly-integrated devices. The author then proposes a novel target-level verification approach which addresses some of these challenges. Advances in semiconductor manufacturing processes have fuelled the relentless shrinking of IC design geometries. This has dramatically reduced the...

Computer, 2016

lthough multicore technology has many benefits for real-time systems-among them, decreased weight and power, fewer cooling requirements, and increased CPU bandwidth per processor-multicore chips pose problems that stem from the cores interfering with one another when accessing shared resources. Interference is compounded in real-time systems, which are based on the assumption that worst-case execution time (WCET) is constant; that is, a software task's measured WCET must be the same whether that task executes alone or with other tasks. This assumption holds for single-core chips, but not for multicore chips unless they have isolation mechanisms between cores. Measurements we performed on a commercial multicore platform (Freescale P4080) revealed that a task's WCET can increase by as much as 600 percent when a task on one core runs with logically independent tasks in other cores. Because of the potential for large and random delay spikes, the US Federal Aviation Administration (FAA), European Aviation Safety Agency (EASA), and Transport Canada specify that only single-core chips can be used unless intercore interference is specifically defined and handled. 1 Indeed, DO-178C: Software Considerations in Airborne Systems and Equipment Certification, the primary document by which certification authorities such as the FAA, the EASA, and Transport Canada approve all commercial software-based aerospace systems, was developed for the certification of software in single-core computers. 2 With a single-core chip, architects can assume a constant WCET and can thus schedule tasks and partition resources without unanticipated delays. Hence, the ideal solution is to certifiably bound intercore interference in a multicore chip such that each core can be used as a single-core computer. As part of studying the feasibility of such a solution, we developed the Single-Core Equivalent (SCE) technology package, which addresses interference problems that arise when cores concurrently access DRAM, the memory bus, shared cache resources, I/O resources, and the on-chip network. With SCE, each core can be used as if it were a single-core chip, allowing the timing analysis and certification of software in a core independently of software in other cores. This has implications for avionics Architects of multicore chips for avionics must define and bound intercore interference, which requires assuming a constant worstcase execution time for tasks executing on the chip. With the Single Core Equivalent technology package, engineers can treat each core as if it were a single-core chip.

The demand for predictable timing behavior is characteristic for real-time applications. Experience has shown that this property cannot be achieved by software alone but rather requires support from the processor. This situation is analyzed and mapped to a design rationale for SPEAR (Scalable Processor for Embedded Applications in Real-time Environments), a processor that has been designed to meet the specific temporal demands of real-time systems. At the hardware level, SPEAR guarantees interrupt response with minimum temporal jitter and minimum delay. Furthermore, the processor provides an instruction set that only has constant-time instructions. At the software level, SPEAR supports the implementation of temporally predictable code according to the single-path programming paradigm. Altogether, these features support writing of code with minimal jitter and provide the basis for exact temporal predictability. Experimental results show that SPEAR indeed exhibits the anticipated high...

Proceedings of the 8th IEEE International Symposium on Industrial Embedded Systems, SIES 2013, 2013

COTS-based multicores are now the preferredchoice for hosting embedded applications owing to their immensecomputational capabilities, small form factor and low powerconsumption. Many of these embedded applications have real-timerequirements and real-time system designers must be ableassess them for their predictability and provide guarantees (atdesign time) that they deliver the correct functional behaviorwithin predefined time bounds. However, the underlyingarchitecture of commercially available multicores is extremelycomplex and non-amenable to straightforward timing analysis.In this paper, we highlight the architectural features leading totemporal unpredictability, which mainly involve shared hardwareresources, such as buses, caches, and memories. We explore someof the existing work in timing analysis with respect to thesefeatures, identify their limitations, and present some unaddressedissues that must be dealt with to ensure safe deployment of real-timesystems.

Lecture Notes in Computer Science, 2012

In order to be able to use multicore COTS hardware in critical systems, we put forward a time-oriented execution model and provide a general framework for programming and analysing a multicore compliant with the execution model.

Lecture Notes in Computer Science, 2005

Previous work on microprocessor formal verification has almost exclusively addressed the proof of safety-that if a processor does something during a step, it will do it correctly-as also observed in [2], while ignoring the proof of liveness-that a processor will complete a new instruction after a finite number of steps. Several authors used theorem proving to check liveness [15][16][17][19][23][28][32][34], but invested extensive manual work. This paper is the first to prove liveness for pipelined processors with multicycle functional units in an automatic way. Functional units in recent state-of-the-art processors usually have latencies of up to 20-30 cycles, and rarely up to 200 cycles, but it is expected that the memory latencies in next generation high-performance designs will reach 1,000 cycles [13]. Thus, the need to develop automatic techniques to prove the liveness of pipelined processors where the functional units can have latencies of up to thousands of cycles. In the current paper, the implementation and specification are described in the highlevel hardware description language HDL [46], based on the logic of Equality with Uninterpreted Functions and Memories (EUFM) [7]. In EUFM, word-level values are abstracted with terms (see Sect. 4) whose only relevant property is that of equality with other terms. Restrictions on the style for describing high-level processors [35][36] reduced the number of terms that appear in both positive and negated equality comparisons-and are so called g-terms (for general terms)-and increased the number of

2006

To develop on-board software in embedded space applications, it is often a requirement to use a real-time operating system, since these systems must assure that the timing constraints associated to each task are guaranteed. Furthermore, it's desirable that the execution time of the real-time application in any scenario is as deterministic as possible (i.e., it takes always the same time to perform the task). Typical real-time operating systems focus on increasing performance by focusing on scheduler design, device driver writing, heavy machine-level code optimisations, etc. However, the main goal must be to behave in as a deterministic way as possible. The work related to this paper is centred in real-time, embedded operating systems research on the ERC32 architecture, an E.S.A. (European Space Agency) standard architecture for space applications. This architecture is SPARC V7 instruction set compliant and has a lot of features built-in for space applications, but some aspects o...

2011

La consulta d'aquesta tesi queda condicionada a l'acceptació de les següents condicions d'ús: La difusió d'aquesta tesi per mitjà del servei TDX (www.tesisenxarxa.net) ha estat autoritzada pels titulars dels drets de propietat intel•lectual únicament per a usos privats emmarcats en activitats d'investigació i docència. No s'autoritza la seva reproducció amb finalitats de lucre ni la seva difusió i posada a disposició des d'un lloc aliè al servei TDX. No s'autoritza la presentació del seu contingut en una finestra o marc aliè a TDX (framing). Aquesta reserva de drets afecta tant al resum de presentació de la tesi com als seus continguts. En la utilització o cita de parts de la tesi és obligat indicar el nom de la persona autora. ADVERTENCIA. La consulta de esta tesis queda condicionada a la aceptación de las siguientes condiciones de uso: La difusión de esta tesis por medio del servicio TDR (www.tesisenred.net) ha sido autorizada por los titulares de los derechos de propiedad intelectual únicamente para usos privados enmarcados en actividades de investigación y docencia. No se autoriza su reproducción This thesis also investigates a solution to verify the timing correctness of HRTs without requiring any modification in the core design: we design a hardware unit which is interfaced with the processor and integrated into a functional-safety aware methodology. This unit monitors the execution time of a block of instructions and it detects if it exceeds the WCET. Concretely, we show how to handle timing faults on a real industrial automotive platform. X 8 Conclusions 8.1 Thesis Conclusions .

2017 IEEE Real-Time Systems Symposium (RTSS), 2017

In this paper we outline Design Space Exploration methodology aimed at homogeneous multi-core architectures, where the safety-criticality is the crux of a system design. Multi-core architectures provide better computational abilities, but at the same time complicate the computation of timing bounds. Determining suitable architectures that achieve timing requirements is an important aspect for a system designer. The proposed work conceptualizes ways to automate and explore different design facets of a multi-core processor. The intention is to ensure that the particular application meets its deadlines, while optimizing other objectives such as minimizing hardware costs, energy consumption and floor area. The automated exploration builds upon Mulitcore Response Time Analysis for timing verification and multicube for heuristic search methods. The aim is to generate an architecture design in the end that can be used directly to build a custom application specific processor.