Mixed Criticality Systems

Transcription

1 Mixed Criticality Systems Report from the Workshop on Mixed Criticality Systems held on 03 rd February 2012 in Brussels, Belgium February 2012 Information Society and Media Directorate-General Unit G3/Computing Systems Research Objective en.html

2 Disclaimer: The views expressed here are those of the workshop participants and do not necessarily represent the official view of the European Commission on the subject. 2

3 Executive Summary Safety-critical and dependable systems are an important part of our daily life. Every day we rely on the expertise of embedded systems engineers that have produced controllers for our aircraft, the braking control in our cars or the control systems used in our railway systems. These safety-critical systems need to be certified and the maximum execution time needs to be bounded and known so that response guarantees can be assured when critical actions are needed. This is becoming increasingly challenging as technology advances in computing drive the adoption of multi-core processing devices and advances in communications and internet technology drive networking of devices to provide networked control systems and larger scale complex systems. CLOSING THE GAP BETWEEN SAFETY-CRITICAL SYSTEMS AND CONSUMER A key challenge for European industry is to innovate through value added services and functionalities to preserve its leading competitive position. For instance, driver, operator or passenger services and interaction are redefining product innovation in industries like automotive and aerospace to compete in a globalised market, e.g. through advanced driver assistance, automatic cruise control, autonomous driving or smart collaborative interfaces. More specifically, the driver or passenger real life experience combined with virtual, augmented services is considered one of the most challenging differentiating factors that would transfer cars, aircraft, trains et al into smart personalised comfortable spaces. Future automotive and aerospace applications require higher performance computing resources. Both the processing and networking technologies are driven by the consumer market which entirely redefines the way embedded and complex systems are designed in the future. The latest generation of devices commonly used in mobile phones, laptops etc. utilise multi-core processing. The advantages of this are clear in terms of reduced size, weight and power consumption (SWaP). The result is that there is clear need to be able to mix safety-critical and non safety-critical functionality within a single system. This report is based on a workshop organised by the European Commission. The report identifies the main research challenges in mixed criticality system design putting forward a number of recommendations defining European research priorities in the medium term (3-5 years) and long term (5-10 years). It is highlighted that developments in multicore technology driven by the consumer electronics markets are driving the adoption of multi-core processors in systems with increasing scale and complexity for a range of applications such as automotive and aerospace because there are clear benefits. 3

4 Embedded computing is shifting to multi/many-core design to boost performance Even greater challenges exist for safety-critical applications when considering the adoption of new computing technologies like multi-core and many-core processors from the consumer market. Guarantees of timing and segregation of critical and non-critical functionality are key to ensuring safe system operation. However, the prize to be obtained in this case is much greater with major reductions in complexity, weight, volume and power while at the same time providing increased flexibility. The future driven by societal challenges like smart energy, emobility and ehealth, promises a new generation of interwoven complex systems combined with emerging mobile services (so-called systems-of-systems), e.g. power grids connected over networks, smart mobility, medical monitoring (using existing wired and wireless communication network infrastructure). Europe has a strong industrial base in automotive and aerospace with a history of innovation and strong SME tool providers. There is a great opportunity for Europe to become leaders in innovation and research in the area of mixed criticality systems, not only in the areas of air and ground transportation, but also in many other areas where robustness, availability and safety are important requirements. The ability to produce robust predictable systems at a competitive price will be key to driving innovation of European companies and keeping leadership in key markets such as automotive, aerospace, manufacturing and building automation, smart cities, construction and railways. 4

5 Table of Contents Contents Executive Summary... 3 Introduction... 6 Starting Point... 7 The European Ecosystem... 9 Research Challenges...17 Challenge 1: Ever Increasing Demand for Computing Performance...18 Challenge 2: Mobile World Meets Embedded World...20 Challenge 3: Holistic Architecture Integration...22 Challenge 4: Data Management in Shared Memory...24 Challenge 5: Decentralised and Distributed Control Systems...25 Recommendations for a Research Program on Mixed Criticality Systems in Europe 27 Research Challenges...27 Research Policy Recommendations...28 Participants and Input

6 Introduction Europe has a history of success in creating innovative, high quality products at competitive prices. New computing paradigms such as multi-core computing are a key driver for the European economy and new scalable system architectures are a key enabler for new functionality and service models. To support these innovations there is a pressing need to bridge the gap between Computing & Systems Engineering. The performance and efficiency of computing systems has gone up exponentially for several decades, with a tremendous impact in new products and new businesses, e.g. in consumer electronics, automotive, aerospace, health diagnostics, mobile communications, office computing, automation, etc. This revolution is, however, rapidly slowing down due to, among other, the diminishing returns of geometrical scaling, or Moore s law; which will lead to an exponential increase of complexity and costs. It has become clear that it is not possible to continuously increase the clock speeds of processors to provide more performance due to power consumption and heat dissipation limits. As a consequence the processing industry has adopted multi-core architectures to provide ever increasing levels of processing capability with 10 s and even hundreds of cores being developed. Multi-core processors are currently driving innovation in the consumer electronics markets taking over from traditional single cores providing Space Weight and Power (SWaP) reductions. Although the use of multi-core technologies allows the power limitations that are challenging Moore s law to be bypassed, the increase in performance is only possible if software can exploit the cores in an efficient manner. The transition to parallel multi-core computing is changing the established market and research landscape in computing platforms and embedded software design. This trend towards multi-core computing is of significant importance to practitioners of embedded system applications, with many challenges to provide systems-level software, such as operating systems, language runtimes and virtual machines. At present the software programming tools are not sufficiently flexible, reliable and scalable to be able to cope with increasing scale and heterogeneity of multicore/multi-processor integration. 6

7 Moreover, the wide spread use of electronics in our daily lives with ubiquitous connectivity, distributed computing and global network infrastructure is having a tremendous impact on systems' complexity and engineering. As mobile and internet based services increasingly penetrate traditional domains like automotive, energy, etc. and get deployed by means of virtual environments offered by cloud providers, it is necessary to introduce new mechanisms and architectures capable to deal with mixed criticalities in the most efficient and transparent way. Challenges for mixed criticality systems are to ensure that both the responsiveness and timeliness requirements and goals of the dependable resource-constraint system together with the application and middleware layers are respected at the underlying computing platform. The opportunity is to build upon the existing European excellence in system design to create new products and services. The trend towards combination with network and internet services offers more and innovative functionality. This is being driven by increasing computing demands and the need to mix timing criticalities, mixed reality (augmented, simulation, imaging) and mixed safety/security requirements. Increased connectivity and user demands are driving the need for massive amounts of data storage. The way in which European citizens interact with these systems in the future will drive advanced user machine cooperation. Multi-/many core computing is seen as both a key enabler for future systems and also a driver offering opportunities to produce new functionalities. In addition to more computing performance being available high added value can be envisaged, e.g. safety, energy efficiency, maintenance, augmented reality interfaces and graphics. The increasingly connected world is also leading to integration of currently separate mobile/public/private functionalities. Here new services are being introduced via Internet-services such as navigation systems for cars and remote support/configuration capabilities providing better and faster customer service. User s increasing expectations for multimedia services driven by the consumer market are placing strong demands for the same services to be available in our aircraft, rail and road transport. Starting Point From the research perspective, there is already a preliminary set of projects to build upon in the area of safety-critical systems and advanced multi-core designs. The FP7 research objectives Computing Systems, Embedded Systems and ARTEMIS are funding a number of projects that address issues related to the next generation of critical applications: CERTAINTY addressing the methodology, techniques and tools for the design, validation and synthesis of complex mixed time and safety-critical applications using a formal component-based design language and validation tools [1] Application - Flight Management System (FMS). 7

8 MultiPARTES addressing an open source virtualization layer, partitioning kernel, hardware virtualization mechanisms and rapid model-driven development [2,3] Application - aerospace, offshore wind turbines, video surveillance, railway and automotive. parmerasa addressing parallelisation techniques for safety-critical applications, timing analysable parallel design patterns, operating system virtualisation and efficient synchronisation mechanisms, guarantee of worst-case execution times (WCET) of parallelised applications, verification and profiling tools and producing a timing analysable multi-core architecture with up to 64 cores [4,5] - Application - avionics, automotive and construction machinery. T-CREST addressing time predictable multi-core architectures [6,7]. Developing tools and building a system that prevents pauses by identifying and addressing the causes for possible pauses. For real-time systems proposing to make the worst-case fast and the whole system easy to analyze Application - aerospace and rail. virtical addressing software/hardware extensions for virtualized heterogeneous multi-core architectures [8]. Developing hardware/software infrastructure and design tools at different layers of the design stack (hardware, operating system, hypervisor and applications) to enable efficient heterogeneous multi-core SoC virtualization in respect to programmability, performance, QoS, reliability, security and power consumption. Application Set top boxes etc. Hycon2 addressing highly complex network systems (heterogeneous systems systems of systems, e.g. network of vehicles, network of energy, analysis and modelling of physical systems [9]. Applications factories, traffic management, smart power grid. The ARTEMIS JU is addressing certification and partitioning aspects of multi-core processing: ACROSS Developing a system on-chip architecture for multi-core partitioning with domain specific and optional building block components for specific implementations [10]. Relies on a "trusted network" and a strict partitioning for mixing applications with different criticality levels on the same device. Producing tools, middleware and hardware components, design and development library and development environment - Applications - automotive, aerospace and industrial control. RECOMP - Reducing certification costs by using trusted multi-core platforms focused on cost-efficient certification and re-certification of safety-critical systems and mixed-criticality systems [11]. The aim is establish methods, tools and platforms for enabling cost-efficient (re-)certification of safety-critical and mixedcriticality systems. Applications - automotive, aerospace, industrial control systems, lifts and transportation systems. Although some projects are already underway a complementary approach is required to avoid fragmentation. There is an opportunity to create a European Ecosystem of 8

9 Excellence in mixed criticality systems by bringing together the expertise in ERA, FP7, ARTEMIS, Eureka and national programmes. Underpinning this there is a need for foundational research to be funded through FP7 and large scale pilot projects to be supported through ARTEMIS. The European Ecosystem Europe is a leader in the design of highly complex systems and safe products. Key competences exist in systems design, system integration and the development of embedded systems. This is supported by a strong industrial base in the area with large companies such as Airbus, Thales and Siemens and smaller companies such as ARM, CAPS and TTTech. Europe has long been a leader in mobile and portable digital computing platform designs with leading companies such as ARM and STmicro driving the use of multi-core designs in many consumer applications. This critical mass of expertise places Europe in an ideal position to lead in the area of innovative novel technologies and services that provide a unique selling position in established domains like aerospace, automotive, automation, etc. None of this would have been possible without strong support at the European level. As an example the ARM processor is used in 95% of the world s mobile handsets. ARM the company was an early beneficiary of OMI (OMI-MAP) and has participated in 30 projects over the past 20 years. During this time the company has grown from 162 employees in 1996 to 1900 in The current trend for energy efficiency has positioned ARM as a key player across the computing market. Another example is CAPS who are a leading global provider in compiler technologies and engineering services for parallel hybrid computing. Participation of the company in the Milepost EU project was crucial for success in building a market leading product. This led to a triplication of staff over 4 years. In the area of safety-critical systems TTTech has become a market leader in time-triggered safety-critical real-time networks. The company has been supported by 9 EU projects over the last 12 years and the company has grown from a small spin-off to 200 employees. The future is being driven by advances in processor technologies providing ever increasing levels of performance. There was a time when the electronics industry could rely on Moore s Law to efficiently provide additional processing power in concert with demand through technological advances that continually allowed for the number of transistors that could be placed onto a piece of silicon to double every two years. Although this trend will likely continue in the near term, the performance gains achieved through these advancements have resulted in diminishing returns as systems manufacturers have looked to obtain further advances and scalability through architectures employing multiple cores and/or processors in their designs. The fundamental advantages of the reduced size weight and power requirements (SWaP) for multi-core devices is driving an increased adoption in many areas. 9

10 Industrial Shift towards Multicore Processing (VDC Research Group, 2011 Embedded Software and Tools Market Intelligence Service, Track 1, Volume 5: Multicore Components & Tools) A recent study [12] indicated that there is likely to be a significant increase in the use of multi-core devices over the next 2 years replacing applications that have traditionally used single core processors. This is set to continue. The ever increasing demands for more functionality and performance are driving this explosion in the use of multi-core devices. In the longer term single core processors may be supplanted by multi-core architectures leaving designers no choice but to migrate to the processors that are available commercially. Mixed Criticality Increasingly there is a move towards integration of critical and non-critical functionality on the same platforms to create mixed criticality systems. The differences can arise from the needs of timeliness where mixed-criticality might describe a mixture of soft, firm and hard real-time applications integrated into one system. Time-critical systems focus on the availability of outputs within predefined intervals, typically indicated by a hard deadline. A leading example of this is set top boxes where content is provided to a user and the timeliness of this provision is highly important from the end users perspective [13]. The other area where mixed criticality arises is when considering the required degree of safety. Mixed-criticality might describe applications that are classified according to different safety levels (IEC 61508, DO-178B, D0-254, ISO 26262). Here the property of function integrity is especially important, i.e. functions must either provide the correct output according to the specification or indicate its failure. No deviation from specification is permitted, not even temporarily. This contrasts with time-criticality which does not automatically imply the necessity of function integrity all the time. 10

11 Safety-Critical and Time Critical Applications (Courtesy Rolf Ernst) Nowadays it is often required to integrate multiple existing systems with assorted levels of criticality. This results in growing complexity of systems which makes the integration of dependability an issue in many domains leading to unacceptable development costs and time to market, especially for SMEs, due to the price of the required tools. The ability to combine previously independent system applications into a single computation platform is a major enabler for mixed criticality. The goal for increased integration is to save cost and improve the overall reliability since fewer wires and connectors are required. In some domains (e.g. aerospace and automotive), the integration of mixedcriticality is becoming essential to optimize weight, volume, and energy consumption. >> Innovation in real-time embedded applications will increasingly demand highperformance computing Mixed criticality applications cut cross many domains with aerospace, automotive, wind turbines, power grid, rail, medical, factory automation and set-top boxes all demanding greater processing capability and the need for guarantees on timeliness and performance. 11

12 Example 1: Automotive Current Segregated Architecture and Increased Integrated Functionality (Courtesy BMW) Modern premium cars typical contain around computers, around 100 electric motors and 2 Km of wiring. These are connected via a mixture of databus standards with gateways between safety-critical and non-safety-critical functionality to provide isolation. Increased functionality enhancing safety and reducing emissions has led to the introduction of adaptive cruise control (requiring interaction between wheels, brakes, engine and radar), Driver Assistance features (typically integrating cameras) and ESP systems (combining control of wheels, brakes, engine and gyroscope inputs). Already mixed criticality exists with the same wheel sensor used for stability control also being used in the navigation system. This increased integration of systems to provide new functionality is set to continue particularly as Europe moves towards electric cars. The increases in complexity and cost for developing new ECUs is driving the industry to reduce the number of ECUs to a few central units connected by high speed networks [14,15]. A key advantage of this is that redundancy for safety can be better handled with fewer similar computers. The overall benefits are reduction in wiring harness cost (and weight), network design complexity and improvements in safety and availability. The reduced energy requirements and weight for a simplified system will result in less power consumption and CO 2 emission contributing to a greener environment. A key need identified by the industry is for reference architectures that can provide one consolidated solution across the industry. This requires strong commitment and leadership to avoid fragmentation. Certification is also a key issue. Today 90% of ECUs are compatible with AUTOSAR. To preserve Europe s interest and access to global markets and maintain a competitive advantage there is a need for international standardisation for certification and the tools to allow incremental certification. 12

13 Example 2 Aerospace Architectural Change to IMA First Adopted on A380 (Courtesy Airbus) A prime objective of Airbus for future avionics, and a subject of active research, is to move towards all-integrated Modular Architecture (IMA) avionics, as a means to provide more processing power per unit of volume, weight, and electrical power [16]. This is necessary in order to sustain the continuous growth in computing power required by aircraft systems, which tend to at least double from aircraft programme to aircraft programme. Other drivers for adoption are the desire to benefit from new technologies and create a more competitive market where computer parts are more interchangeable. Perceived benefits are a reduction of cost by integrating separated systems into a single platform, an increase in reliability by reducing the number of physical components that can fail (e.g. wires and connectors), a dramatic reduction of resources required by placing avionics in a smaller and smaller space (e.g. energy consumption, weight and volume), a reduction in time-to-market by quickly integrating third party applications into a partitioned solution and reduction of certification cost by enabling modular-based independent verification of subsystems. Already some of these topics are being addressed in research programmes such as the FP7-funded SCARLETT and the French CORAC AME projects, as well as several small-scale projects on hardware and software design methodologies and timing analysis. Key needs identified by the industry are for modular systems, composability for certification and timing analysis tools. Again incremental certification is key to reducing effort and cost with a desire to use COTS hardware and software with strict usage domain separation. 13

14 Example 3 Networked Control Systems New Networked Services (Courtesy STM) Societal challenges are driving the integration of large networks of embedded systems via the internet [13]. Applications of this are in building automation, smart metering, medical monitoring, traffic control and large scale infrastructure monitoring and control, e.g. asset monitoring and smart grid. Embedded networked systems are seen as a key enabling technology for this. These systems have to be highly available and utilise a mixture of pre-existing and new infrastructure to provide new functionality. The applications are also likely to use shared components and services for implementing safety-critical applications. This increases the requirements on components but more critically the design process and platform properties will be enforced by the need to meet safety standards requiring independence of functions. Management of criticality is key and it is important that critical parts of a system do not interfere with non critical parts such as maintenance functions, or added value services provided to users such as navigation or weather information. Thus Quality of Service (QoS) both inside and outside of the system becomes important. The ability to provide controlled degradation of service provision is also a requirement with priority being given to safety-critical and high value information exchange. With the use of networking, which may be fixed or wireless, there is also the need to consider self-organising and adaptive systems. The predictability of the network in terms of Quality of Service is highly important. Dependability and security become key issues particularly considering applications such as health care where patient data may be collected remotely by sensors. In addition to the need to provide data in a timely and guaranteed manner this introduces privacy issues. There are also implications on the provenance of data that may well be used in critical diagnostics. The wider scale 14

15 connection of systems to produce systems-of-systems requires the need for contractbased design methodologies and models. Methodologies and Tool Support for a European Eco System From an economical point of view, industrial competitiveness will be improved through multi-core full potential exploitation, with accelerated system development and production, enabling new products to be marketed with a considerably shorter time-tomarket and with a reduction in certification cost. This will lead to increased performance at reduced costs while maintaining safety levels these are the key demands from European avionic, automotive and automation industries. Conversely an inability to adopt multi-core architectures in critical applications will have great negative impact on enterprises in Europe on the world stage. Mixed critical engineering/execution solutions are common across many different industrial sectors. It is expected that these will promote new business eco-systems with new and innovative products and services. Europe has an excellent opportunity to lead in innovating novel technologies for mixed criticality systems with an established and favourable ecosystem of enterprises with the required expertise to exploit new and emerging markets. However, the methodologies and tools to support multi-core architectures and the implementation of mixed criticality systems are still in their infancy. A major research effort is required to reinforce European multidisciplinary scientific excellence and technological leadership in the design and use of multi-core computing architectures, system software and tools. Future Research programmes should encompass distributed (computing) systems beyond multi-many cores. This means that research should cover processor hardware, embedded distributed software and communications/ networking technologies. To build a viable tool platform and to establish a European Eco System for tool vendors, system integrators and application developers across different application domains and market sectors, the following pressing needs were highlighted: Reference architectures are needed to build critical mass, enable cross domain up-take and avoid fragmentation. Here there is a role for standardisation bodies. Methodologies and integrated toolsets are required that reduce certification effort and allow incremental certification and re-certification. Parallelisation techniques that allow application parallelism to be exploited and mapping of tasks to cores are required to help with programmability of homogeneous and heterogeneous multi-core processors. Virtualisation techniques will become key technologies to preserve the integrity of highly integrated architectures where 'real time' and safety tasks co-exist with consumer applications. Virtualisation techniques are required to decouple the 15

16 underlying hardware from the application and allow migration of legacy code onto new platforms. At the hardware level support is required to allow timing predictability which would imply the re-design and fabrication of new integrated circuits (e.g. ASICbased electronic control units). Here there is a choice between semi customized COTS (via hypervisor) or non COTS (fully customized hardware). Traditional silicon vendors will only offer optimised timing-predictable solutions with clear economic perspectives, i.e. if a minimum economy of scale is reached through broad commercialisation potential. Timing analysis methodologies and tools are needed for time-critical and safetycritical systems. Here there is also a need for hardware support for timing predictability (e.g. via a hypervisor) and also the need for end-to-end timing guarantees to be met. As systems become more networked there is a need to provide tools that can ensure segregation of safety-critical and non-safety-critical functionality so that the two do not interfere with each other. QoS guarantees need to be met considering timing, data security and provenance. 16

17 Research Challenges A number of key challenges have been identified with respect to the development of mixed criticality systems. Challenge 1 Ever Increasing Demand for Computing Performance Future innovation in real-time embedded applications is driven by high-performance computing. Although microprocessor performance has improved following Moore s Law power consumption and heat dissipation limitations are driving manufacturers towards architectures employing multi-core or many core devices. Multi-core and multi-threaded processors are becoming the typical design choice. Challenge 2 Mobile World Meets Embedded World New paradigms are needed for embedded systems that take into account safety, security, energy and timing considering these issues in both the vertical and horizontal dimensions. Here there is an opportunity to benefit from network, internet and consumer services. Challenge 3 Holistic Architecture Integration Methodologies and tools are required to allow separation of critical and non-critical domains from the application down to chip level. New concepts are required for HW/SW architectures, operating systems, formal methods and built-in fault tolerance. Challenge 4 Data Management in Shared Memory Data management is a key challenge for the future with the collection and storage of increasing amounts of both critical and non-critical data. It is important to ensure that non-critical applications do not take priority over critical applications and that critical data is not overwritten. Here there is a need to ensure timely data access, avoid conflicting data modification, provide safe sharing of memory and guarantee data security and access rights. Challenge 5 Decentralised and Distributed Control Systems Increasingly there is a trend towards decentralised and distributed control systems. There is a need to provide techniques and algorithms to allow control functionality to be migrated to these new systems architectures that employ mixed criticality infrastructure so that safe operation and availability can be guaranteed. 17

18 Challenge 1: Ever Increasing Demand for Computing Performance Power consumption and heat dissipation limitations are currently driving the electronics industry to employ multi-core or many core devices. Thus the once unassailable truth of Moore s Law is coming to an end not by limitations in the ability to place more and more transistors onto devices and increasing clock speeds but by an energy barrier. All chip vendors are currently moving towards these devices leading to concerns that single core processors may not be available in the future. Typical Multicore Architecture with Shared Cache and I/O Multi-core processors have been developed to support soft time consumer based products and are designed for maximum performance. The design is such that a shared common I/O interface is used to the external world and it is common for devices to exploit shared cache. Most multi-cores only have two memory controllers due to pin constraints and so for safety-critical applications there is a need to guarantee memory bandwidth. Software for multi-cores typically utilises multithreading as it is efficient for loosely coupled and non-real time applications. This is directly opposite to the approach taken in safety-critical software which uses single threads to enable analysis. At present the majority of multi-core processors available are homogeneous but specialist applications (such as the gaming market) are driving the development of heterogeneous multi-cores. This heterogeneity presents event greater challenges. There are currently no established approaches to achieve certification for multi-core processors as time predictability and segregation of function cannot be guaranteed. This provides challenges for other industries such as aerospace and automotive who see multi-core technologies as a way of providing more functionality with fewer processing modules to reduce weight, cabling, energy and complexity. Use of multi-core and many core technologies for safety-critical applications presents both hardware and software challenges. One solution would be to develop multi-core architectures that have features that make them analysable. Here the use of partitionable cache, data path separation, deterministic data communication paths and prioritized internal communications would be advantageous. The underlying problem however is that the safety-critical market is 18

19 very small compared with the consumer mass market that is driving chip development. Development of multi-cores based on a reference architecture dedicated to safetycritical applications and more amenable to certification is likely to be prohibitively expensive unless cross domain applications are possible to obtain critical mass. There is thus an opportunity to bring different domains together, aerospace, automotive, rail etc. to develop certification friendly multi-core devices. An alternative is to develop methodologies and toolsets that allow existing commercial off-the-shelf devices to be utilised in safety-critical applications. Here there is a need to satisfy safety-requirements and provide time predictability. This will require developments in the underlying theoretical analysis of systems and the tools to support this analysis to be cost efficient. Here there is a risk of fragmentation across sectors due a wide spectrum of multi-core architectures being developed. The programmability of devices is also a concern. The ability to add cores to devices at the silicon level is way ahead of the development tools to program devices to maximise efficiency. Although advances in operating system technologies have resulted in improvements in task scheduling which help maximize performance gains of software applications deployed over multi-core processors, these gains are still limited by the amount of the existing software that can be parallelized. Since C is still the dominant embedded software programming language and is serial in nature, challenges abound for software developers lacking practical experience of developing multithreaded software applications. Drastically improved programmability of future parallel multicore/multichip computing systems is thus required. The largest obstacle to the desired performance gains relates to the vast amounts of legacy code that is serial in nature and the foregoing lack of engineering expertise in designing code that can be efficiently parallelized. Parallelization tools and compilers are therefore required. As more cores are added tools are required to aid the designer to efficiently parallelize an application to maximise performance and also minimise energy consumption. These tools need to be designed to exploit the underlying architecture of the multi-core processor being used providing efficient sharing of cache and off-chip bandwidth, scalability, multithread synchronization and simplification of parallel processing. Here virtualisation may be employed to isolate the application from the hardware and hypervisor tools may be used to map tasks to cores. Moving to mixed criticality systems tools are required that can place subsystems with different levels of criticality in different partitions that can be verified and validated. In addition to programming, analysis and debugging tools for parallel applications are required to provide cycle accurate simulation allowing identification of temporal interdependencies such as races and deadlocks which are particularly a concern in parallel and distributed applications. These multi-core development and analysis tools must support multi-tier integration of systems from subtier suppliers to system integrator primes requiring coverage of both the vertical and horizontal levels of a system. 19

20 Challenge 2: Mobile World Meets Embedded World New services and functionalities are being provided through the combination of mobile, multimedia and embedded services. As an example, in the automotive domain these include driver assistance, collision avoidance, navigation and pedestrian recognition. Currently systems are strictly segregated into different domains such as safety-critical (closed), maintenance (private) and infotainment (public) using different communication links to avoid any unsafe interactions. However, increased integration is required to reduce complexity in system design and management. This requires integration of computation and communication with the result of mixing safety and security domains. This is complicated by the fact that the domains that are mixed may well be from different communities. Looking further into the future there will be increased integration of systems to form distributed systems and Systems-of-Systems further compounding the challenges. Mobile World Meets Embedded World (Courtesy BMW) The traditional approach to development of safety-critical systems is to employ strict segregation of functionality and provide time predictability. It is no surprise therefore that existing timing analysis approaches cover sequential program execution. The adoption 20

21 of multi-core architectures presents new challenges due to the inherently parallel nature of the devices themselves and the use of shared cache and I/O. Each core needs to provide deterministic processing with well understood interaction points and data synchronisation between tasks to avoid processors waiting for other threads to complete. Currently existing COTS multi-core devices cannot be analysed and this presents a severe limitation if they are to be used in critical applications. One approach would be to develop special reference architecture designs for safety-critical applications, however, this will be costly. An alternative would be to try to influence COTS manufacturers to include features that are more amenable to timing analysis. It also has to be remembered that the multi-core will be part of a larger system and potentially networked to other multi-core and single core devices over a databus or wireless network. Here the horizontal dimension may also bridge across different communities. This presents key challenges in separation of critical and less critical functionality and in the need to guarantee end-to-end timing across the system to ensure that hard real-time deadlines are met. It is also possible that redundant functionality may be physically divided across the network to provide fault tolerance within the system. This would save cost, weight, volume, and energy consumption and, if done correctly, would increase the overall reliability since fewer cables and connectors are required. Time predictable approaches and timing analysis tools are required to guarantee that hard real-time deadlines will be met at the processor level and at the systems level [17]. Modelling the dynamic features of current processors, memories, and interconnects for Worst Case Execution Time (WCET) analysis often results in computationally infeasible problems. The bounds calculated by the analysis are thus overly conservative with pessimistic values being obtained for WCET. Hardware approaches to ease the timing analysis problem often are at the result of a sacrifice in performance which is not acceptable to the applications engineer. Features that would aid timing analysis such as a fully connected crossbar switches and separate cache may not be technically feasible in multi-core hardware. External additions to aid WCET may also be incompatible with System-on-Chip (SoC) solutions. Verification and profiling tools are needed that can analyse a system at the processor level but also to guarantee end-to-end timing from sensor to actuator. Here there is a fundamental contradiction between the use of bus architectures and determinism. The use of a time triggered communications interconnect is thus preferable [18]. The timing analysis tools must be able to guarantee the worst-case execution times of parallelized applications considering concurrency at the task and chip level and timeliness of onchip and off-chip network communication. Fundamentally new paradigms are needed that consider safety, predictable QoS, energy management and secure data management in concert. A key element will be to develop techniques that are convincing to the certification authorities. 21

22 Challenge 3: Holistic Architecture Integration Challenges of Mixed Criticality on a Multicore (Courtesy RECOMP) The future promises many tasks allocated to many cores. If used with mixed criticality functions, e.g. hard real-time control, signal processing, health monitoring and advanced control techniques on different cores, then a challenge is to provide a means of providing segregation and isolation between functionality to avoid unanticipated interference between safety-critical and non-safety critical tasks. Certification applies to the system. At a system level safety assessment establishes how critical a given computer is according to the system-level architecture of the system to which that computer belongs, and how harmful a failure would be. From that criticality stems requirements for ways in which that computer is allowed to fail, and a maximally acceptable failure rate for that computer alone. Compliance is demonstrated through a combination of testing and quality assurance, quality assurance being the systematic application, and verification of proper application, of best practices that have empirically been shown to achieve the desired objectives. If mixed criticality software is used in a single computer the processes for certification tend to depend on the highest level of criticality applicable to that computer. Economically the cost of developing all software to the highest criticality level is prohibitive. Thus a means to compose systems is required from code of different criticalities. There is a fundamental dichotomy between the design of highly critical systems where an extremely rigorous qualified process is in place dictated by standards and the development of non-critical applications which is driven by performance optimisation and flexibility. Here lower quality design processes are used. Designing a mixed criticality system thus presents a fundamental incompatibility in terms of design process yet the functions are integrated onto one platform. Here there is a clear need for development of a methodology for engineering mixed-criticality systems that avoid 22

23 interactions that affect safety or performance. Designers do not want lower critical functions affecting safety and vice versa they do not want safety-critical functions impacting upon performance. It should also be highlighted that there is a clear need for certification authorities to be engaged as partners in the development of the methodologies and tools as the placement of safety-critical and non safety-critical functionality onto the same computation platform is a major change in mindset. The use of composability within certification offers a route forward. Composability enables the side-effect free composition of a larger system out of independently developed building blocks. Without appropriate preconditions, the integration of mixedcriticality subsystems would lead to a significant and potentially unacceptable increase in certification effort. The challenge is to provide strict temporal and spatial separation (segregation and isolation) between the individual partitions so that applications with different levels of criticality can be placed in different partitions that can be verified and validated in isolation. At the same time the needs for increased flexibility have to be met. Flexibility puts new requirements on the customization and the upgradability of both non-safety and safety-critical critical functionalities within a system. The difficulty with this is the large cost in both effort and money of the re-certification of the modified software. Tool support for the engineering of mixed-criticality systems (2-8 cores, cores) and scalable for future even higher numbers of cores needs to be developed. Methods, tools and platforms for enabling cost-efficient certification and low cost re-certification of safety-critical systems and mixed-criticality systems are required. These tools need to support validation and verification with techniques for composability to allow incremental certification. Major challenges are incorporation of legacy code and 3 rd party applications of lower criticality (such as Windows based software). Software enforcing the separation of mixed criticality subsets is itself somewhat complex and yet must be ultimately trusted. Organizations are reliant on traditional dynamic software testing. Since the number of possible executable paths within software code increases exponentially when applications are created that run simultaneously across multiple cores, many testing tools have not been equipped to provide adequate code coverage nor to detect possible concurrency defects and/or deadlocks emerging during specific execution scenarios. In the longer term virtualization approaches may provide solutions. Although virtualization is an advanced technology widely used for providing an effective and clean way of isolating applications from hardware in the general purpose computing domain, its application on embedded systems is still in its infancy. The hardware/software infrastructure and design tools at different layers of the design stack (hardware, operating system, hypervisor and applications) to enable efficient multi-core SoC virtualization is at a very early stage of development. The efficient and ubiquitous use of virtualization for homogeneous and heterogeneous multi-cores is thus still some way off. Isolation is required at all of the system abstraction levels to decouple hardware and software. Here there is a need for reference designs and platform architectures to reduce certification costs across domains. 23

24 Challenge 4: Data Management in Shared Memory The future promises an increasing challenge in terms of data management with increasing data creation and transmission within systems. Already many companies are struggling with the data deluge problem [19]. Making sense of massive data will require a complete redesign of data management technologies (beyond conventional database management systems) to locate data, and innovation in machine learning to reduce the size and dimensionality of data for services and applications. The adoption of mixed criticality systems that rely on multiple data sources, e.g. driver, car, traffic, obstacle detection, systems maintenance, etc., will drive the needs for data management, collection and storage of an increasing amount of critical and non-critical data from a variety of sources. Dependability and security become key issues particularly considering applications where data may well be sensitive either from a privacy point of view or from a commercial point of view, e.g. medical monitoring or asset monitoring. This raises issues of data security and access rights. Segregation of data is also required and non-critical applications should not be able to overwrite critical data within a mixed criticality system. Strict control of data access and modification is required within a shared memory system to prevent unintentional data modification that may potentially have severe consequences. The usage of such data within medical, health monitoring and economic analysis systems or to perform control is also highly dependent upon the provenance of data. If the application is critical the assurance of quality and provenance of the data becomes essential. Looking beyond this the integration of multiple networked systems to address Systems-of-Systems problems will require even greater care as the consequences of unintentional failure (or malicious attack) may have wide geographical implications. As a consequence data management over networked systems for critical applications requires a high degree of security. This is particularly an issue if the network relies on wireless connections that are open to interception. As well as masquerading entities that may intercept or manipulate critical information, denial of service attacks through flooding the network with data or attacking specific cores within a system are a threat. Mixed criticality systems present a key challenge to security as the networked components in the system may employ different security techniques, e.g. CRC s Hamming Codes, encryption, etc. Although encryption and authentication is a research topic by itself security and safety need to be considered together so that they are integrated into the system design both in the vertical and horizontal directions where end-to-end criticality is essential. A key challenge is how to provide security access to embedded systems from outside entities in order to create new added value functionalities while at the same time preventing un-authorised access when the systems are fundamentally more open to the outside world. 24

25 Challenge 5: Decentralised and Distributed Control Systems Large scale networked control applications in building automation, energy distribution, smart metering, industrial automation, white goods, traffic control, etc. are driving new developments in Cyber Physical Systems. There will be an increasing trend towards interconnection of local control systems and information exchange with networks. At the local level demands for increasing functionality and more sophisticated control algorithms (e.g. model based control, vision based systems) is driving ever increasing processing requirements. Energy management has become a key driver to reduce costs and emissions and energy management across all layers of control is becoming an aspect of systems design. The shift towards multi-core devices presents a major opportunity in providing the additional performance required for advanced features to be incorporated but at the same time presents a challenge to industry as it requires the development of new programming models for parallel architectures. There is also a need for tools to aid the migration of legacy control code onto multi-cores as they take over the processing market. Increasingly Networked World (Courtesy Siemens AG) Decentralisation of control is already a feature of many industrial automation systems and this trend will continue across many sectors. As local control systems become more connected to larger scale supervisory control and monitoring systems implications arise from the use of shared infrastructure and services when the functionality being implemented is safety-related of safety-critical. The evolvable nature of such systems means that new functionality is often reliant on the use of legacy hardware where there 25