Обеспечение надёжного тайминга в safety-critical multicore встраиваемых системах

Современные автомобили и самолёты больше не полагаются исключительно на механические компоненты. Их безопасность и производительность зависят от embedded software, запускаемого на сложных heterogeneous multicore процессорах, управляющих всем — от flight control до power steering — с microsecond-level deadlines.

В multicore окружении execution time задачи влияет не только её собственный код, но и другие задачи, делящие те же hardware resources. Это interference может толкнуть систему за safety margins.

Разработка safety-critical embedded software требует multi-million-euro, multi-year усилий. С самых ранних стадий дизайна safety должна быть вшита в архитектуру и timing behavior каждой задачи должен быть rigorously understood для гарантии соблюдения дедлайнов.

Решение головоломки Multicore Timing Analysis

Пока multicore процессоры обещают higher performance, они также вводят contention за shared resources: buses, memory, caches, accelerators. Задача на одном ядре может замедлить задачи на других, создавая unpredictable timing variations.

Ключевые вопросы: Как量化 влияние такого interference? Как analyze, test и document что safety-critical software всегда завершится в своих дедлайнах на multicore платформе?

Industry leaders — Barcelona Supercomputing Center (BSC), Rapita Systems Ltd (RPT), Raytheon Technologies (RTRC), Marelli Europe (MAR) — годами адресуют эти вызовы. BSC и Rapita теперь доставляют solution set, который скоро будет adopted across aerospace и automotive sectors. Success hinges на specialized tooling, automation, и safety-oriented, requirements-driven methodology.

Эта работа подpins MASTECS project, European Commission-funded, multidisciplinary R&D initiative launched December 2019. MASTECS будет зреть технологии и предоставлять proven approach для certifying avionics и automotive systems, с case studies от RTRC и MAR illustrating real-world impact.

State-of-the-Art Tools

Commercial tools excel для single-core analysis но struggle с complexity multicore certification. Limitations включают:

• Static timing analysis tools [1] hit complexity wall, unable to model sophisticated hardware или extremely complex software.
• Measurement-based solutions — пока prevalent в single-core testing (e.g., Rapita's RVS toolset) — lack hardware-expert methodology to produce trustworthy timing bounds для multicore workloads с adequate traceability.

To date, no commercial tool outside MASTECS development effort offers comprehensive multicore timing analysis aligning with safety standards и emerging certification requirements.

Interference Analysis и Control в действии

Cornerstone нашего подхода — structured test methodology, blending hardware и software expertise для генерации evidence of multicore timing behavior. BSC's multicore micro-benchmark technology (MμBT), commercialized by Rapita as RapiDaemons, позволяет дизайнерам создавать interference scenarios, stressing specific shared resources.

Micro-benchmarks — tiny, low-level code snippets — operate at hardware-software interface to impose quantifiable pressure on target resource. Они reveal effect of interference channels и can be tailored to induce, measure, или validate contention. Key attributes включают:

1. Targeted, quantifiable pressure on a shared resource.
2. Verifiable behavior through event monitors.
3. Alignment с specific timing requirements, such as testing mitigation effectiveness.

Diverse library micro-benchmarks exists to match desired interference levels, maximize resource impact, или act as sensitive "victim" tests.

При анализе interference мы парь MμBT с Task Contention Model (TCM) that provides early estimates of contention delays. Rapita's RapiTest и RapiTime автоматизируют test creation и execution на embedded target.

Design Methodology

Following a seven-step process integrated into V-model software lifecycle (see Figure 2), engineers gain deep insight into interference effects:

1. Hardware configuration & interference channel identification. Hardware experts pinpoint critical settings, interference pathways, и mitigation options, while selecting event monitors для verification.
2. Define timing requirements. Capture user-specific needs, risks, и safety constraints, и evaluate hardware isolation strategies.
3. Test case design. Craft test descriptions that validate hypotheses, specifying micro-benchmarks needed для interference analysis under isolated и stressed conditions.
4. Implement test procedures. Assemble test framework, micro-benchmarks, и measurement probes. Currently manual, this will be automated within MASTECS.
5. Gather evidence. Execute tests on target platform, collecting data that ties directly to verification requirements.
6. Analyze results. Technical experts review outcomes against requirements. For example, Figure 3 shows RapiTime's execution-time breakdown.
7. Validate & document. Final review, report generation, и qualification artifacts ready for certification submissions.

Hardware Expertise и Timing Analysis Process

Hardware insight vital from outset. Early involvement includes:

1. Identifying multicore configurations that shape functional и timing behavior, и determining isolation mechanisms that reduce contention.
2. Spotting interference channels by navigating complex processor manuals и consulting vendors for missing details.
3. Selecting event monitors that capture task activity on interference channels, и validating them с dedicated micro-benchmarks [2].
4. Collaborating с timing analysts to derive requirements и design tests that load specific interference channels.

In later stages, hardware experts assess test results, refine hypotheses, и propose additional tests as needed.

The Bigger Picture

Seven-step design process is part of broader multicore verification methodology (see Figure 2). It delivers full traceability — from evidence и results back to requirements и design — supporting both CAST-32A и ISO 26262. CAST-32A, released by Certification Authorities Software Team (CAST) in 2016, outlines objectives for safe multicore avionics, including interference bounding. EASA и FAA working on unified AMC/AC (AMC 20-193) adaptation expected later this year.

Expertise Cannot Be Automated

Interference dynamics are complex; automated tools can only complement, not replace, seasoned engineers. Multicore experts bring deep knowledge of hardware configurations и interference channels, while software analysts translate requirements into rigorous tests. Human insight essential for validating assumptions, interpreting results, и iterating on designs.

References

1. Reinhard Wilhelm. Mixed Feelings about Mixed Criticality. Workshop on Worst-Case Execution Time Analysis, 2018.
2. Enrico Mezzetti, Leonidas Kosmidis, Jaume Abella, Francisco J. Cazorla. High-Integrity Performance Monitoring Units in Automotive Chips for Reliable Timing V&V. IEEE Micro 38(1): 56-65 (2018).
3. EASA and FAA to issue further guidance on multicore certification this year.