Search

The Time-Triggered Architecture (TTA) presents a blueprint for building safe and real-time constrained distributed systems, based on a set of orthogonal concepts that make extensive use of the availability of a globally consistent notion of time and a priori knowledge of events. Although the TTA tolerates arbitrary failures of any of its nodes by architectural means (active node replication, a membership service, and bus guardians), the design of these means considers only accidental faults. However, distributed safety- and real-time critical systems have been emerging into more open and interconnected systems, operating autonomously for prolonged times and interfacing with other possibly non-real-time systems. Therefore, the existence of vulnerabilities that adversaries may exploit to compromise system safety cannot be ruled out. In this paper, we discuss potential targeted attacks capable of bypassing TTA's fault-tolerance mechanisms and demonstrate how two well-known recovery techniques - proactive and reactive rejuvenation - can be incorporated into TTA to reduce the window of vulnerability for attacks without introducing extensive and costly changes.

Time-triggered real-time systems achieve deterministic behavior using schedules that are constructed offline, based on scheduling constraints. Their deterministic behavior makes time-triggered systems suitable for usage in safety-critical environments, like avionics. However, this determinism also allows attackers to fine-tune attacks that can be carried out after studying the behavior of the system through side channels, targeting safety-critical victim tasks. Replication -- i.e., the execution of task variants across different cores -- is inherently able to tolerate both accidental and malicious faults (i.e. attacks) as long as these faults are independent of one another. Yet, targeted attacks on the timing behavior of tasks which utilize information gained about the system behavior violate the fault independence assumption fault tolerance is based on. This violation may give attackers the opportunity to compromise all replicas simultaneously, in particular if they can mount the attack from already compromised components. In this paper, we analyze vulnerabilities of time-triggered systems, focusing on safety-certified multicore real-time systems. We introduce two runtime mitigation strategies to withstand directed timing inference based attacks: (i) schedule randomization at slot level, and (ii) randomization within a set of offline constructed schedules. We evaluate these mitigation strategies with synthetic experiments and a real case study to show their effectiveness and practicality.

System call relative information such as occurrences, type, parameters, and return values are well established metrics to reveal intrusions in a system software. Many Host Intrusion Detection Systems (HIDS) from research and industry analyze these data for continuous system monitoring at runtime. Despite a significant false alarm rate, this type of defense offers high detection precision for both known and zero-day attacks. Recent research focuses on HIDS deployment for desktop computers. Yet, the integration of such run-time monitoring solution in mixed-criticality embedded systems has not been discussed. Because of the cohabitation of potentially vulnerable non-critical software with critical software, securing mixed-criticality systems is a non trivial but essential issue. Thus, we propose a methodology to evaluate the impact of deploying system call instrumentation in such context. We analyze the impact in a concrete use-case with PikeOS real-time hypervisor.

Much effort has been put into improving the predictability of real-time systems, especially in safety-critical environments, which provides designers with a rich set of methods and tools to attest safety in situations with no or a limited number of accidental faults. However, with increasing connectivity of real-time systems and a wide availability of increasingly sophisticated exploits, security and, in particular, the consequences of predictability on security become concerns of equal importance. Time-triggered scheduling with offline constructed tables provides determinism and simplifies timing inference, however, at the same time, time-triggered scheduling creates vulnerabilities by allowing attackers to target their attacks to specific, deterministically scheduled and possibly safety-critical tasks. In this paper, we analyze the severity of these vulnerabilities by assuming successful compromise of a subset of the tasks running in a real-time system and by investigating the attack potential that attackers gain from them. Moreover, we discuss two ways to mitigate direct attacks: slot-level online randomization of schedules, and offline schedule-diversification. We evaluate these mitigation strategies with a real-world case study to show their practicability for mitigating not only accidentally malicious behavior, but also malicious behavior triggered by attackers on purpose.

Airbus is investigating COTS multicore platforms for safety-critical avionics applications, pursuing helicopter-style autonomous and electric aircraft. These aircraft need to be ultra-lightweight for future mobility in the urban city landscape. As a step towards certification, Airbus identified the need for new methods that preserve the ARINC 653 single core schedule of a Helicopter Terrain Awareness and Warning System (HTAWS) application while scheduling additional safety-critical partitions on the other cores. As some partitions in the HTAWS application are memory-intensive, static memory bandwidth throttling may lead to slow down of such partitions or provide only little remaining bandwidth to the other cores. Thus, there is a need for dynamic memory bandwidth isolation. This poses new challenges for scheduling, as execution times and scheduling become interdependent: scheduling requires execution times as input, which depends on memory latencies and contention from memory accesses of other cores - which are determined by scheduling. Furthermore, execution times depend on memory access patterns. In this paper, we propose a method to solve this problem for slot-based time-triggered systems without requiring application source-code modifications using a number of dynamic memory bandwidth levels. It is NoC and DRAM controller contention-aware and based on the existing interference-sensitive WCET computation and the memory bandwidth throttling mechanism. It constructs schedule tables by assigning partitions and dynamic memory bandwidth to each slot on each core, considering worst case memory access patterns. Then at runtime, two servers - for processing time and memory bandwidth - run on each core, jointly controlling the contention between the cores and the amount of memory accesses per slot. As a proof-of-concept, we use a constraint solver to construct tables. Experiments on the P4080 COTS multicore platform, using a research OS from Airbus and EEMBC benchmarks, d

Consulta en la Biblioteca ETSI Industriales (8996)

In my dissertation, I present ATLAS — the Auto-Training Look-Ahead Scheduler. ATLAS improves service to applications with regard to two non-functional properties: timeliness and overload detection. Timeliness is an important requirement to ensure user interface responsiveness and the smoothness of multimedia operations. Overload can occur when applications ask for more computation time than the machine can offer. Interactive systems have to handle overload situations dynamically at runtime. ATLAS provides timely service to applications, accessible through an easy-to-use interface. Deadlines specify timing requirements, workload metrics describe jobs. ATLAS employs machine learning to predict job execution times. Deadline misses are detected before they occur, so applications can react early.:1 Introduction 2 Anatomy of a Desktop Application 3 Real Simple Real-Time 4 Execution Time Prediction 5 System Scheduler 6 Timely Service 7 The Road Ahead Bibliography Index

Many industrial applications with real-time demands are composed of mixed sets of tasks with a variety of requirements. These can be in the form of standard timing constraints, such as period and deadline, or complex, e.g., to express application specific or non temporal constraints, reliability, performance, etc. Arrival patterns determine whether tasks will be treated as periodic, sporadic, or aperiodic. As many algorithms focus on specific sets of task types and constraints only, system design has to focus on those supported by a particular algorithm, at the expense of the rest. In this paper, we present a method to deal with a combination of mixed sets of tasks and constraints: periodic tasks with complex and simple constraints, soft and firm aperiodic, and in particular sporadic tasks. We propose the use of an offline scheduler to manage complex timing and resource constraints of periodic tasks and transform these into a simple EDF model with start-times and deadlines. On top of the offline schedule, sporadic tasks are guaranteed based on their worst-case activation frequencies. Then at run-time, an extension to EDF ensures feasible execution of tasks with complex constraints in the presence of additional tasks or overloads. It allows changes in the offline generated schedule to insert soft and firm aperiodic tasks by shifting the execution of offline scheduled tasks within their feasibility windows. Furthermore, the online algorithm uses the exact knowledge about sporadic arrivals to reduce the pessimism introduced by worst-case assumption, i.e., the resources unused by sporadic tasks are reclaimed to improve response times and acceptance of firm aperiodic tasks. A simulation study underlines the effectiveness of the proposed approach.

Efficient transport of streams with acceptable playout quality in heterogeneous, dynamic environment (e.g. home networks) requires management of both networks and CPUs. This paper presents a framework for applying real-time resource management methods for decoupled video streaming in networks of heterogeneous devices. It is based on a global abstraction of device states, which reduces system state information and decreases overheads for its determination and dissemination. It provides access to the entire system state in acceptably fresh way, enabling system wide optimized decisions to be taken.

In this paper we have developed a method for an efficient Quality-of-Service provision and adaptation in dynamic, heterogeneous systems, based on our Matrix framework for resource management. It integrates local QoS mechanisms of the involved devices that deal mostly with short-term resource fluctuations, with a global adaptation mechanism that handles structural and long-term load variations on the system level. We have implemented the proposed approach and demonstrated its effectiveness in the context of video streaming.

Efficient transport of streams with acceptable playout quality in in heterogenous, dynamic environment (e.g. home networks) requires management of both networks and CPUs. This paper presents a framework for applying real-time resource management methods for decoupled video streaming of heterogenous devices. It is based on a global abstraction of device states, which reduces system state information and decreases overheads for its determination and dissemination. It provides access to the entire system state in acceptable fresh way, enabling system wide optimized decisions to be taken. This work has started as part of a FABRIC EU IST project. The aim of the FABRIC project was to develop an architecture in which several interoperability standards and technologies in the home networking context can be integrated. In addition, the FABRIC aimed to handle the complete network to satisfy End-to-End Quality of service (QoS) requirements. In this paper we propose an adaptive QoS framework for efficient resource management, called the Matrix approach. The Matrix is a concept to abstract from having detailed technical data at the middleware interface. In stead of having technical data referring to QoS parameters like: bandwidth, latency and delay we only have discrete portions that refer to levels of quality. The underlying middleware must interpret these values and map them on technical relevant QoS parameters.

In this paper we show how off-line scheduling and fixed priority scheduling (FPS) can be combined to get the advantages of both - the capability to cope with complex timing constraints while providing run-time flexibility. We present a method to take advantage of the flexibility provided by FPS while guaranteeing complex constraint satisfaction on periodic tasks. We provide mechanisms to include FPS servers to our previous work, to handle non-periodic events, while still fulfilling the original complex constraints on the periodic tasks. In some cases, e.g., when the complex constraints can not be expressed directly by FPS, we split tasks into instances (artifacts) to obtain a new task set with consistent FPS attributes. Our method is optimal in the sense that it keeps the number of artifacts minimized.

With the upsurge in the demand for high-bandwidth networked real-time applications in cost-sensitive environments, a key issue is to take advantage of developments of commodity components that offer a multiple of the throughput of classical real-time solutions. It was the starting hypothesis of this dissertation that with fine grained traffic shaping as the only means of node cooperation, it should be possible to achieve lower guaranteed delays and higher bandwidth utilization than with traditional approaches, even though Switched Ethernet does not support policing in the switches as other network architectures do. This thesis presents the application of traffic shaping to Switched Ethernet and validates the hypothesis. It shows, both theoretically and practically, how commodity Switched Ethernet technology can be used for low-latency hard real-time communication, and what operating-system support is needed for an efficient implementation.

Scheduling theory generally assumes that real-time systems are mostly composed of activities with hard real-time requirements. Many systems are built today by composing different applications or components in the same system, leading to a mixture of many different kinds of requirements with small parts of the system having hard real-time requirements and other larger parts with requirements for more flexible scheduling and for quality of service. Hard real-time scheduling techniques are extremely pessimistic for the latter part of the application, and consequently it is necessary to use techniques that let the system resources be fully utilized to achieve the highest possible quality. This paper presents a framework for a scheduling architecture that provides the ability to compose several applications or components into the system, and to flexibly schedule the available resources while guaranteeing hard real-time requirements. The framework (called FSF) is independent of the underlying implementation, and can run on different underlying scheduling strategies. It is based on establishing service contracts that represent the complex and flexible requirements of the applications, and which are managed by the underlying system to provide the required level of service.

The work presented here has started as part of a FABRIC EU IST project. The aim of the FABRIC project was to develop an architecture in which several interoperability standards and technologies in the home networking context can be integrated. In addition, the FABRIC aimed to handle the complete network to satisfy End-to-End Quality of service (QoS) requirements. In this paper we propose an adaptive QoS framework for efficient resource management, called the Matrix approach. The Matrix is a concept to abstract from having detailed technical data at the middleware interface. In stead of having technical data referring to QoS parameters like: bandwidth, latency and delay we only have discrete portions that refer to levels of quality. The underlying middleware must interpret these values and map them on technical relevant QoS parameters.

With the growing popularity of variable network technologies, it is highly desirable to enable effective and quick browsing of remote multimedia content. In this paper we present a method for quick access of remote video content as an initial step towards a full digital Video Cassette Recording functionality in multimedia streaming applications such as Video-On-Demand, video broadcasting and remote video editing.We propose a transcoding scheme for H.264/AVC video that fully utilizes the benefits of recently proposed SP- and SI-frames to facilitate user-friendly remote stream browsing and editing. The transcoding parameters can be adaptively changed and optimized to support different characteristics of H.264 video streams.

Functionality for various services of scheduling algorithms is typically provided as extensions to a basic paradigm, intertwined in the kernel architecture. Thus, scheduling services come in packages around single paradigms, fixed to a certain methodology and kernel architecture. Temporal constraints of applications are addressed by a combination of scheduler and system architecture. Consequently, changing system architecture results in a complete rescheduling of all tasks, calling for a new cycle of analysis and testing from scratch, although a schedule meeting all temporal constraints already existed. We propose a component based architecture for schedule reuse. Instead of tying temporal constraints, scheduler, and system architecture together, we provide methods which allow for the reuse of existing schedules on various system architectures. In particular, we show how a schedule developed for table driven, dynamic or static priority paradigm can be reused in the other schemes. We address an architecture to disentangle actual scheduling from dispatching and other kernel routines with a small interface, suited for a variety of scheduling schemes as components., ICSE 2002 Workshop on Software Architectures for Dependable Systems (WADS 2002), 25 May 2002 through 25 May 2002, Orlando, FL

Time triggered methods provide deterministic behaviour suitable for critical real-time systems. The), perform less favourably, however if the arrival times of some activities are not known in advance, in particular if overload situations have to be anticipated. In many systems, the criticality of only a subset of activities justify the cost associated with the time triggered methods. In this paper we consider distributed systems where a subset of critical activities are handled in a time triggered fashion, via an offline schedule. At runtime, the arrival of aperiodic tasks may cause overload that demands to be handled in such a way that i) time triggered activities still meet all their original constraints, ii) execution of high-valued tasks are prioritised over tasks with lower value, iii) tasks can be quickly migrated to balance the overall system load. We give a precise formulation of overload detection and value based task rejection in the presence of offline scheduled tasks, and present a heuristic algorithm to handle overload. To benefit from the distributed setting, the overload handling includes an algorithm that integrates migration of rejected tasks with resource reclaiming and an acceptance test of newly arrived tasks. Simulation results underline the effectiveness of the presented approach.

L'anàlisi i el disseny dels sistemes de control de temps real és una tasca complexa, que requereix la integració de dues disciplines, la dels sistemes de control i la dels sistemes de temps real. Tradicionalment però, els sistemes de control de temps real s'han dissenyat diferenciant, de forma independent, dues fases, primerament el disseny del controlador, i després, la seva implementació en un computador. Això ha desembocat en solucions no òptimes tant en termes de planificabilitat del sistema i com en el rendiment dels sistemes controlats. Normalment, els mètodes i models de la teoria de control de temps discret no consideren durant la fase de disseny dels controladors les limitacions que es puguin derivar de la implementació. En la fase de disseny s'assumeix que els algorismes de control s'executaran en processadors dedicats i que els processadors seran prou ràpids i determinístics per no haver-se de preocupar del comportament temporal que aquests algorismes de control tindran en temps d'execució. Tot i així, quan els recursos - per exemple, processadors - són limitats, apareixen variacions temporals en l'execució dels algorismes de control. En concret, en els sistemes de planificació de tasques de temps real, un algorisme de control s'implementa en una tasca periòdica caracterizada per restriccions temporals estàndards com períodes i terminis. És sabut que, en la planificació de tasques de temps real, les variacions temporals en l'execució d'instàncies de tasques és permesa sempre i quan les restriccions de planificabilitat estiguin garantides. Aquesta variabilitat per tasques de control viola l'estricte comporament temporal que la teoria de control de temps discret pressuposa en l'execució dels algorismes de control. Això té dos efectes negatius: la variabilitat temporal en l'execució de les tasques de control degrada el rendiment del sistema controlat, fins i tot causant inestabilitat. A més, si es minimitza la probabilitat d'aparició d'aquesta variab, The analysis and design of real-time control systems is a complex task, requiring the integration and good understanding of both control and real-time systems theory. Traditionally, such systems are designed by differentiating two separate stages: first, control design and then its computer implementation, leading to sub-optimal solutions in terms of both system schedulability and controlled systems performance. Traditional discrete-time control models and methods consider implementation constraints only to a very small extent. This is due to the fact that in the control design stage, controllers are assumed to execute in dedicated processors and processors are assumed to be fast and deterministic enough not to worry about the timing that the controlling activities may have on the implementation. However, when resources (e.g., processors) are limited, timing variations in the execution of control algorithms occur. Specifically, a control algorithm in traditional real-time scheduling is implemented as a periodic task characterized by standard timing constraints such as period and deadline. In real-time scheduling, timing variations in task instance executions (i.e., jitters) are allowed as far as the schedulability constraints are preserved. Consequently, the resulting jitters for control task instances do not comply with the strict timing demanded by discrete-time control theory. This has two pervasive effects: the presence of jitters for control tasks degrades the controlled system performance, even causing instability. On the other hand, minimizing the likelihood of jitters for control tasks by over-constraining the control task specification reduces the schedulability of the entire task set. It is worth mentioning that control theory offers no advice on how to include, into the design of controllers, the effects that implementation constraints have in the timing of the control activities (e.g., scheduling inherent jitters). Also, real-time theory la, Postprint (published version)

Static scheduling has been shown to be appropriate for a variety of hard real-time systems, mainly due to the verifiable timing behavior of the system and the complex task models supported. Its application is, however, impeded in systems with changing operational modes and critical activities, that arrive infrequently with unknown occurrence times.This thesis presents an approach to overcome these shortcomings.It addresses static scheduling, illustrated by an algorithm serving as case study, and provides concepts to extend the scope of statically scheduled systems to deal with mode changes properly and to provide for efficient handling of dynamic activities. Mode changes are performed by switching from one periodically executing static schedule to another via a special schedule to prepare for the change.As all involved schedules are constructed statically, all actions executing the mode change do so deterministically:Given the current mode, time, and mode change request, the exact executions duringthe mode change and their completion time are known before run-time. Dynamic activities are incorporated into static schedules by making use of the unused resources and leeways in the schedule.We present mechanisms to effectively maintain information about the amount of dynamic activity that can be accommodated without impairing the feasible execution of statically scheduled tasks.Ontop of this service, aperiodic tasks can be handled in a very simple way.We furthermore present an on-line guarantee algorithm. A combined approach integrates both methods.