Germany

We present MINOTAuR, a timing predictable open source RISC-V core based on the Ariane core. We first modify Ariane in order to make it timing predictable following the approach used to design the SIC processor. We prove that the instruction parallelism in the Ariane core does not prevent from enforcing timing predictability. We further relax restrictions by enabling a limited amount of speculative execution and we are still able to formally prove that the core is timing predictable. Experimental results show that the performance is reduced by only 10% on average compared to the original Ariane core.

IEEE RTSS 2021

Speculative Execution and Timing Predictability in an Open Source RISC-V Core

benchmark testing

codes

costs

philosophical considerations

degradation

silicon carbide

processor architecture

timing predictability

parallel processing

 **RTSS 2021** has successfully concluded. Hope you have enjoyed it, and look forward to seeing you next year in person.
    Announcement for the Awards:
 * Best Paper Award goes to: Monte Carlo Response-Time Analysis, Sergey Bozhko, Georg von der Brüggen, and Björn Brandenburg
 * Best Student Paper Award goes to: Automatic Energy-Hotspot Detection and Elimination in Real-Time Deeply Embedded Systems, Mohsen Shekarisaz, Lothar Thiele, and Mehdi Kargahi.
 * Best Solution Award for Industry Session goes to: Toward Real-Time Guaranteed Scheduling for Autonomous Driving Systems. Jinghao Sun, Tianyi Wang, Kailu Duan, Bin Lu, Jiankang Ren, Zhishan Guo, and Guozhen Tan.



The IEEE Real-Time Systems Symposium (RTSS) is the premier conference in the field of real-time systems, and is a venue for researchers and practitioners to showcase innovations covering all aspects of real-time systems, including theory, design, analysis, implementation, evaluation, and experience. 

technical paper

Today’s deeply embedded systems, with real-time interactions to the environment, are largely battery-operated, and peripheral modules like LTE, WiFi, and GPS are among the most energy-hungry components of them. These components are often under the direct control of an embedded software. Some pieces of the software program are called energy hotspots if they can be transformed towards better system energy consumption while leaving it logically- and temporally-correct. This paper focuses on three such energy hotspots from the peripheral module perspective. The root causes of the hotspots in the software program are misplaced driver calls: Early acquiring or late releasing of the module causes it to waste energy in the active state, having unnecessary distance between the use operations causes extra tail energy overhead, and unaccounted releasing and re-acquiring of the module causes more energy consumption in comparison to leaving the module unreleased. We provide static analysis methods for the detection and elimination of such energy hotspots automatically with regard to some relations between temporal requirements of the real-time embedded software, the time and energy specifications of the module, and the extreme (worst-case/best-case) execution times of specific pieces of the software program. Our simulation results show about 4.7 to 20 percent of energy reductions after elimination of the energy hotspots of the test programs using our proposed method.

Automatic Energy-Hotspot Detection and Elimination in Real-Time Deeply Embedded Systems,

In mixed-criticality systems (MCSs), less-critical tasks are often terminated to ensure the correct execution of high critical tasks. This strategy could however lead to safety hazards, and largely reduce system functionality due to the absence of the discarded tasks. To overcome this problem, we introduce a high resilience and approximated computing framework for MCS, i.e., HIART-MCS. HIART-MCS introduces a novel processor which supports approximation at the hardware level. Associated with this, we also introduce a new intermediate system mode which allows less-critical tasks to be executed with reduced precision instead of being directly dropped out. Corresponding to the HIART-MCS, we further present a new theoretical model and schedulability analysis providing a timing guarantee for the system, followed by optimisations of the mode switch strategy. As demonstrated in both the theoretical and practical evaluations, HIART-MCS effectively improves the survivability of less-critical tasks with limited sacrifice of the critical tasks and negligible extra overhead. It is notable that HIART-MCS is the first practical framework for imprecise MCSs.

HIART-MCS: High Resilience and Approximated Computing Architecture for Imprecise Mixed-Criticality Systems

The secure functioning of automotive systems is vital to the safety of their passengers and other roadway users. One of the critical functions for safety is the controller area network (CAN), which interconnects the safety-critical electronic control units (ECUs) in the majority of ground vehicles. Unfortunately CAN is known to be vulnerable to several attacks. One such attack is the bus-off attack, which can be used to cause a victim ECU to disconnect itself from the CAN bus and, subsequently, for an attacker to masquerade as that ECU. A limitation of the bus-off attack is that it requires the attacker to achieve tight synchronization between the transmission of the victim and the attacker's injected message. In this paper, we introduce a schedule-based attack framework for the CAN bus-off attack that uses the real-time schedule of the CAN bus to predict more attack opportunities than previously known. We describe a ranking method for an attacker to select and optimize its attack injections with respect to criteria such as attack success rate, bus perturbation, or attack latency. The results show that vulnerabilities of the CAN bus can be enhanced by schedule-based attacks.

Vulnerability of Controller Area Network to Schedule-Based Attacks

With the rising demand for emerging DNN ap- plications in safety-critical systems, much attention has been given to the reliability and trustworthiness of DNN inference output against malicious attacks. Although prior work has been conducted to improve the privacy of DNN inference by executing the entire DNN model inside Intel SGX enclaves, ex- isting approaches pose severe performance challenges to achieve dependable and timely execution simultaneously. In this paper, we propose AegisDNN, a DNN inference framework to address this problem. AegisDNN leverages secure SGX enclaves for protecting only the critical part of real-time DNN tasks which are vulnerable to potential fault injection attacks. To choose the right set of layers for protection while ensuring the timeliness of task execution, AegisDNN includes a dynamic-programming based algorithm that finds a layer protection configuration for each task to meet the real-time and dependability requirements based on the layer-wise DNN time and SDC (Silent Data Cor- ruption) profiling mechanism. AegisDNN also utilizes a machine- learning based SDC prediction method to significantly reduce the time for estimating SDC rates for all possible layer protection configurations. We implemented AegisDNN on Caffe, PyTorch, and Tensorflow with Eigen BLAS ported into SGX enclaves to comprehensively demonstrate the effectiveness of AegisDNN against state-of-the-art DNN fault-injection attacks. Experiment results indicate that AegisDNN could satisfy both dependability and real-time requirements simultaneously, when none of the other compared approaches could do so.

AegisDNN: Dependable and Timely Execution of DNN Tasks with SGX

Reinforcement Learning (RL) is a sampling based approach to optimization, where learning agents rely on scalar reward signals to discover optimal solutions. The specification of learning objectives as scalar rewards is tedious and error prone, and more so for real-time systems with complex time- critical requirements. This paper advocates the use of Duration Calculus (DC)—a highly expressive real-time logic with duration and length modalities—in expressing the learning objectives in model-free RL for stochastic real-time systems. On the other hand, to model stochastic real-time environments, we consider probabilistic timed automata (PTA)—Markov decision processes extended with clock variables—that provide an expressive yet computationally decidable formalism to capture real-time con- straints over nondeterministic and probabilistic behaviors. The key hurdle in developing a convergent RL algorithm for DC specifications is the undecidability of the synthesis problem for PTA against general DC specifications. Inspired by the di- chotomy between event-triggered and time-triggered approaches to the design of real-time systems, we present two variants of DC logic—that we dub event-triggered duration calculus (EDC) and time-triggered duration calculus (TDC)—and identify their subclasses with appealing theoretical properties. We study the decidability (and exact complexity) of the satisfiability of these calculi as well as the controller synthesis against PTA models. Based on these results, we propose a reward scheme for RL agents in such a way that guarantees that any RL algorithm maximizing rewards is guaranteed to maximize the probability of satisfaction for the given DC specification. The effectiveness of the proposed approach is demonstrated via grid-world benchmarks and a proof-of-concept case study for synthesizing control for simple cardiac pacemaker directly from a set of DC specifications.

Event-Triggered and Time-Triggered Duration Calculus for Model-Free Reinforcement Learning

The TeamPlay Coordination Language for Mission-critical Cyber-physical Systems


Scheduling Adaptive Dataflow Applications in Safety-critical Cyber-physical Systems

Designing Adaptive Avionics Embedded Systems

Several cyber-physical systems use real-time restart-based embedded systems with the Simplex architecture to provide safety guarantees against system faults. Some approaches have been developed to protect such systems from security violations too, but none of these approaches can prevent an adversary from modifying the operating system or application code to execute an attack that persists even after a reboot. In this work, we present a secure boot mechanism to restore real-time restart-based embedded systems into a secure computing environment after every restart. We analyze the delay introduced by the proposed security feature and present preliminary results to demonstrate the viability of our approach using an open-source bootloader and real-time operating system.

Enabling Secure Boot for Real-Time Restart-Based Cyber-Physical Systems

In this paper, we focus on improving the resilience of distributed real-time applications for Cyber Physical Systems. To guarantee the safety related resilience, fault-tolerant techniques, e.g., task re-execution and active replica, are leveraged to tolerate faults in task executions. To provide security related resilience, cryptography is deployed to resist confidentiality attack on messages delivered over the communication media. We analyze the impact of task's fault tolerance on secure message communication, and then formulate the design problem as a multi-objective optimization problem, i.e., to minimize the failure probability and security vulnerability of the application while subject to given fault-tolerant constraints, execution constraints and deadline constraints. We propose an improved multi-objective optimization algorithm, called Decomposition-based Security and Fault tolerance Co-Optimization (DeSFCO) algorithm, to search for the optimal Pareto solutions of security and reliability harden assignments for messages and tasks. Two preliminary experiments evaluate efficiency of our approach.

Premium content

Speculative Execution and Timing Predictability in an Open Source RISC-V Core

Downloads

Next from IEEE RTSS 2021

Automatic Energy-Hotspot Detection and Elimination in Real-Time Deeply Embedded Systems,

Similar lecture

TORTIS: Retry-Free Software Transactional Memory for Real-Time Systems