Search

Modern safety critical systems require high levels of performance for the implementation of advanced functionalities, which are not possible with the simple conventional architectures currently used in them. Embedded General Purpose Graphics Processing Units (GPGPUs) are among the hardware technologies which can provide the high performance required in these domains. However, their massively parallel nature complicates the verification of their software and increases its cost because it usually involves code coverage through extensive human-driven testing. The Ada-SPARK language has traditionally been used in highly-critical environments for its formal verification capabilities and powerful type system. The use of such tools, especially those being backed up by theorem provers, has significantly lowered the amount of effort needed to validate functionality of safety-critical systems. In this work, we utilize AdaCore's CUDA backend for Ada ---currently in closed beta--- in conjunction with the SPARK language subset to assess the state of static verification for GPU kernels. We show how common programming mistakes in GPU kernels can be prevented, formulate a pattern for buffer overflow detection, and close with a few GPU case studies.

El acelerador SPARROW AI portátil y de bajo costo se propuso y demostró recientemente en VHDL en dos procesadores espaciales, el LEON3 y el NOEL-V. En este trabajo de fin de grado se implementa SPARROW en SystemVerilog y se integra con un procesador RISC-V escrito en SystemVerilog, el SweRV Core EH1. Esta implementación proporciona tres resultados importantes. Demuestra la portabilidad de SPARROW, proporciona una extensión útil a un procesador de grado industrial existente y nos brinda la capacidad de comparar las implementaciones de SPARC y RISC-V. Los resultados obtenidos demuestran que SPARROW puede proporcionar aceleraciones significativas también en el núcleo EH1 de doble emisión. The low-cost and portable SPARROW AI accelerator has been recently proposed and demonstrated in VHDL in two space processors, the LEON3 and NOEL-V. In this Bachelor's thesis, SPARROW is implemented in SystemVerilog and is integrated with a RISC-V processor written in SystemVerilog, the SweRV Core EH1. This implementation provides three important results. It proves the portability of SPARROW, provides a useful extension to an existing industrial grade processor, and give us the ability to compare the SPARC and RISC-V implementations. The obtained results demonstrate that SPARROW can provide significant speedups also in the dual issue EH1 core.

Upcoming safety critical systems require high performance processing, which can be provided by multi-cores and embedded GPUs found in several Systems-on-chip (SoC) targeting these domains. So far, only low-level programming models and APIs, such as CUDA or OpenCL have been evaluated. In this Master thesis, we evaluate the effectiveness of higher level programming models, such as OpenACC and SYCL for critical applications executed in such embedded platforms. In particular, we are interested in two aspects: performance and programmability. In order to conduct our study, we use the GPU4S Bench benchmarking suite for space and a pedestrian detection application representing the automotive sector, which we port into the new programming models and analyze their behavior. We perform our evaluation on a representative embedded platform, the NVIDIA Xavier AGX which is considered a good candidate for future safety critical systems in both domains and compare our results with other programming models.

The real-time control systems industry is moving towards the consolidation of multiple computing systems into fewer and more powerful ones, aiming for a reduction in size, weight, and power. The increasing demand for higher performance in other critical domains like autonomous driving has led the industry to recently include embedded GPUs for the implementation of advanced functionalities. The highly parallel architecture of GPUs could also be leveraged in the control systems industry to develop more advanced, energy-efficient, and scalable control systems. However, the closed-source and non-deterministic nature of GPUs complicates the resource provisioning analysis required for the implementation of critical real-time systems. On the other hand, there is no indication of the integration of GPUs in the traditional development cycle of control systems, which is oriented to the use of a model-based design approach. Recently, some model-based design tools vendors have extended their development frameworks with GPU code generation capabilities targeting hybrid computing platforms, so that the model-based design environment now enables the concurrent analysis of more complex and diverse functions by simulation and automating the deployment to the final target. However, there is no indication whether these tools are well-suited for the design and development of time-sensitive systems. Motivated by these challenges, in this thesis, we contribute to the state of the art of real-time control systems towards the adoption of embedded GPUs by providing tools to facilitate the resource provisioning analysis and the integration in the model-based design development cycle. First, we present a methodology and an automated tool to extract the properties of GPU memory allocators. This tool allows the computation of the real amount of memory used by GPU applications, facilitating a correct resource provisioning analysis. Then, we present a library which allows the characterization of the use of dynamic memory in GPU applications. We use this library to characterize GPU benchmarks and we identify memory allocation patterns that could be modified to improve performance and memory consumption when targeting embedded GPUs. Based on these results, we present a tool to optimize the use of dynamic memory in legacy GPU applications executed on embedded platforms. This tool allows us to minimize the memory consumption and memory management overhead of GPU applications without rewriting them. Afterwards, we analyze the timing of control algorithms executed in embedded GPUs and we identify techniques to achieve an acceptable real-time behavior. Finally, we evaluate model-based design tools in terms of integration with GPU hardware and GPU code generation, and we propose improvements for the model-based generated GPU code. Then, we present a source-to-source transformation tool to automatically apply the proposed improvements. La industria de los sistemas de control en tiempo real avanza hacia la consolidación de múltiples sistemas informáticos en menos y más potentes sistemas, con el objetivo de reducir el tamaño, el peso y el consumo. La creciente demanda de un mayor rendimiento en otros dominios críticos, como la conducción autónoma, ha llevado a la industria a incluir recientemente GPU embebidas para la implementación de funcionalidades avanzadas. La arquitectura altamente paralela de las GPU también podría aprovecharse en la industria de los sistemas de control para desarrollar sistemas de control más avanzados, eficientes energéticamente y escalables. Sin embargo, la naturaleza privativa y no determinista de las GPUs complica el análisis de aprovisionamiento de recursos requerido para la implementación de sistemas críticos en tiempo real. Por otro lado, no hay indicios de la integración de las GPU en el ciclo de desarrollo tradicional de los sistemas de control, que está orientado al uso de un enfoque de diseño basado en modelos. Recientemente, algunos proveedores de herramientas de diseño basado en modelos han ampliado sus entornos de desarrollo con capacidades de generación de código de GPU dirigidas a plataformas informáticas híbridas, de modo que el entorno de diseño basado en modelos ahora permite el análisis simultáneo de funciones más complejas y diversas mediante la simulación y la automatización de la implementación para el objetivo final. Sin embargo, no hay indicación de si estas herramientas son adecuadas para el diseño y desarrollo de sistemas sensibles al tiempo. Motivados por estos desafíos, en esta tesis contribuimos al estado del arte de los sistemas de control en tiempo real hacia la adopción de GPUs integradas al proporcionar herramientas para facilitar el análisis de aprovisionamiento de recursos y la integración en el ciclo de desarrollo de diseño basado en modelos. Primero, presentamos una metodología y una herramienta automatizada para extraer las propiedades de los asignadores de memoria en GPUs. Esta herramienta permite el cómputo de la cantidad real de memoria utilizada por las aplicaciones GPU, facilitando un correcto análisis del aprovisionamiento de recursos. Luego, presentamos una librería que permite la caracterización del uso de memoria dinámica en aplicaciones de GPU. Usamos esta librería para caracterizar una serie de benchmarks GPU e identificamos patrones de asignación de memoria que podrían modificarse para mejorar el rendimiento y el consumo de memoria al utilizar GPUs embebidas. Con base en estos resultados, presentamos también una herramienta para optimizar el uso de la memoria dinámica en aplicaciones de GPU heredadas al ser ejecutadas en plataformas embebidas. Esta herramienta nos permite minimizar el consumo de memoria y la sobrecarga de administración de memoria de las aplicaciones GPU sin necesidad de reescribirlas. Posteriormente, analizamos el tiempo de los algoritmos de control ejecutados en GPUs embebidas e identificamos técnicas para lograr un comportamiento de tiempo real aceptable. Finalmente, evaluamos las herramientas de diseño basadas en modelos en términos de integración con hardware GPU y generación de código GPU, y proponemos mejoras para el código GPU generado por las herramientas basadas en modelos. Luego, presentamos una herramienta de transformación de código fuente para aplicar automáticamente al código generado las mejoras propuestas. Arquitectura de computadors

Modern critical systems need higher performance which cannot be delivered by the simple architectures used so far. Latest embedded architectures feature multi-cores and GPUs, which can be used to satisfy this need. In this thesis we parallelise relevant applications from multiple critical domains represented in the GPU4S benchmark suite, and perform a comparison of the parallel capabilities of candidate platforms for use in critical systems. In particular, we port the open source GPU4S Bench benchmarking suite in the OpenMP programming model, and we benchmark the candidate embedded heterogeneous multi-core platforms of the H2020 UP2DATE project, NVIDIA TX2, NVIDIA Xavier and Xilinx Zynq Ultrascale+, in order to drive the selection of the research platform which will be used in the next phases of the project. Our result indicate that in terms of CPU and GPU performance, the NVIDIA Xavier is the highest performing platform.

In the recent years there has been an increasing interest in artificial intelligence (AI) and machine learning (ML). The advantages of such applications are widespread across many areas and have drawn the attention of different sectors, such as aerospace. However, these applications require much more performance than the one provided by space processors. In space the environment is not ideal for high-performance cutting-edge processors, due to radiation. For this reason, radiation hardened or radiation tolerant processors are required, which use older technologies and redundant logic, reducing the available die resources that can be exploited. In order to accelerate demanding AI applications in space processors, this thesis presents SPARROW, a low-cost SIMD accelerator for AI operations. SPARROW has been designed following a hardware-software co-design approach by analyzing the requirements of common AI applications in order to improve the efficiency of the module. The design of such module does not use any existing vector extension and instead has in its portability one of the key advantages over other implementations. Furthermore, SPARROW reuses the integer register file of the processor avoiding complex managing of the data while reducing significantly the hardware cost of the module, which is specially interesting in the space domain due to the constraints in the processor area. SPARROW operates with 8-bit integer vector components in two different stages, performing parallel computations in the first and reduction operations in the second. This design is integrated within the baseline processor not requiring any additional pipeline stage nor a modification of the processor frequency. SPARROW also includes swizzling and masking capabilities for the input vectors as well as saturation to work with 8 bits without overflow. SPARROW has been integrated with the LEON3 and NOEL-V space-grade processors, both distributed by Cobham Gaisler. Since each of the baseline processors has a different architecture set, software support for SPARROW has been provided for both SPARC v8 and RISC-V ISAs, showing the portability of the design. Software support been developed using two well established compilers, LLVM and GCC allowing for a comparison of the cost of developing support for each of them. The modifications have included the SPARROW instructions in the assembly language of each architecture and with the use of inline assembly and macros allow a programming model similar to SIMD intrinsics. LEON3 and NOEL-V extended with SPARROW have been implemented on a FPGA to evaluate the performance increase provided by our proposal. In order to compare the performance with the scalar version of the processor, different AI related applications have been tested such as matrix multiplication and image filters, which are essential building blocks for convolutional neural networks. With the use of SPARROW a speed-ups of 6x and up to 15x have been achieved.

On-board processing requirements of future space missions are constantly increasing, calling for new hardware than the traditional ones used in space. Embedded GPUs are an attractive candidate offering both high performance capabilities and low power consumption, but there are no complex industrial case studies from the space domain demonstrating these advantages. In this Master Thesis we present the GPU parallelization of an on-board algorithm in multiple GPU programming languages, as well as its performance and energy efficiency on a selection of promising embedded GPU COTS platforms.

Nowadays, Deep learning-based solutions and, in particular, deep neural networks (DNNs) are getting into several core functionalities in critical real-time embedded systems (CRTES), like those in planes, cars, and satellites, from vision-based perception (object detection and object tracking) systems to trajectory planning. As a result, several deep learning instances are running simultaneously at any time on the same computing platform. However, while modern computing platforms offer a variety of computing elements (e.g., CPUs, GPUs, and specific accelerators) in which those DNN instances can be executed depending on their computational requirements and temporal constraints. Currently, most DNNs are mainly programmed to exploit one particular computing element, regular cores of the GPUs. This lack of variety causes a resource imbalance and under-utilization of the various computing element resources when executing several DNN instances, causing an increase in DNN tasks' execution time requirements. In this Thesis, (a) we develop different variants (implementation) of well-known DNN libraries used in the Apollo Autonomous Driving software for each of the computing elements of the latest NVIDIA Xavier system-on-chip. Each variant is configured to balance resource requirements and performance: the regular CPU core implementation that can run on 2, 4, and 6 cores (always leaving 2 cores free for other computations); the GPU with regular and Tensor cores variants that can run on 4 or 8 GPU's Stream Multiprocessors (SM); and 1 or 2 NVIDIA's Deep Learning Accelerators (NVDLA); (b) we show that each particular variant/configuration offers different resource utilization/performance point. (c) we show how those heterogeneous computing elements can be exploited by a static scheduler to sustain the execution of multiple and diverse DNN variants on the same platform.

Critical Real-time Embedded Systems encompasses an increasingly relevant class of embedded systems for which the timely execution of a functionality is as important as its functional correctness. The derivation of trustworthy timing bounds, an inescapable requirement for that class of systems, is challenged by the inherent parallelism in multicore platforms. When shifting from single-core to multicore systems, some hardware resources become shared among available cores. Under such a scenario, contention may arise when two or more cores send requests to the same hardware shared resource at the same time. Contention causes potential delays in the time required to serve each request, which in turn affects the overall execution time requirements of an application and hence its Worst-Case Execution Time (WCET). The computation of trustworthy bounds to the impact of contention in multicore systems is further challenged by the increasing complexity of modern cutting-edge multicore and manycore hardware solutions, which are increasingly adopted in the Critical Real-time Embedded Systems domain to respond to increasing computational and performance requirements. Contention bounds are required to be at the same time accounting for the worst-case scenario, and tight, avoiding unnecessary pessimism and ultimately the development costs and system over-dimensioning. Under the above considerations, this Thesis aims at improving (reducing) the bounds on contention delay when accessing shared resources. In particular, we focus on systems featuring interconnects that allow some form of parallelism such as crossbars and alike. We differentiate from state-of-the-art solutions, which only address bus-like interconnects and only exploit access counts, by exploiting information on the sequence of accesses performed by contenting tasks. Instead, we exploit the sequence of requests to the different target resources produced by each core to produce tighter bounds by discarding contention scenarios that cannot occur in practice. To that end, we adapt existing techniques from the pattern matching domain to derive the worst-case contention effects from the sequences of requests each core sends over the interconnect. Results on a wide set of synthetic and real scenarios and benchmark on an AURIX TC297TX show that our technique outperforms other contention modelling approaches.

The number of mechanical subsystems enhanced or completely replaced by electrical/electronic components is on the rise in critical real-time embedded systems (CRTES) like those in cars, planes, trains, and satellites. In this line, software is increasingly used to control (safety-related) critical aspects of CRTES. More complex software requires unprecedented computing performance requirements, that can only be achieved by deploying aggressive processor designs, multiprocessor system on chips (SoCs or MPSoCs). The other side of the coin is that MPSoCs make software timing analysis -- a mandatory pre-requisite for CRTES -- more complex. Performance Monitoring Units (PMUs) are at the heart of most advanced software timing analysis techniques to control and bound the impact of contention in Commercial Off The-Shelf (COTS) System-on-Chips (SoCs) with shared resources (e.g., GPUs and multicore CPUs). However, PMUs are designed with an assurance level below the role they assume in software timing analysis. In this Thesis, we aim at taking an initial step toward reconciling PMU verification with its key role for timing analysis. In particular, this Thesis covers the analysis of the correctness of hardware event monitor (HEM) in embedded processors for CRTES domains. This Thesis illustrates that some event monitors do not behave as expected in their specification, which can in turn invalidate the software timing analysis process performed building on those HEMs. For three real processors used in different CRTES domains, we report discrepancies on the values obtained from the PMU's HEMs and the number of events expected based on HEM description in the processor's official documentation. Discrepancies, which may be either due to actual errors or inaccurate specifications, make PMU readings unreliable. This is particularly problematic in consideration of the critical role played by event monitors for timing analysis in domains such as automotive and avionics. This Thesis proposes a systematic procedure for event monitor validation. We apply this procedure to validate event monitors in the NVIDIA AGX Xavier, NVIDIA TX2, and the Xilinx Zynq UltraScale+ MPSoC. We show that while some event monitors count as expected, this is not the case for others whose discrepancies with expected values we analyze.

En el camp dels sistemes crítics, que inclou l'automotriu, l'aviònica i els sistemes espacials, es necessita més capacitat de computació per aportar tant valor funcional com seguretat addicional. Per aconseguir-ho, la indústria està considerant noves arquitectures per futurs sistemes crítics. Una de les possibles opcions és l'ús de targetes gràfiques mòbils, que tenen un rendiment excel·lent per tasques computacionals complexes i un baix nivell de consum. Per desgràcia, les eines actuals de desenvolupament per programació de propòsit general de targetes gràfiques com CUDA o OpenCL no compleixen amb les regulacions dels estàndards de seguretat dels sistemes crítics segurs. Per altra banda, hi ha altres solucions per programar per gràfics, com ara OpenGL SC 2 i Brook Auto, que són fàcils de certificar. En aquest projecte, analitzem aquestes solucions per programar per targetes gràfiques i explorem els diferents aspectes del desenvolupament de programari de propòsit general amb elles. Us presentem la nostra experiència adaptant codi de dues aplicacions de dos sectors diferents de sistemes crítics, l'aviònica i els sistemes espacials, a diferents \textit{APIs} (OpenGL 2, OpenGL ES 2, OpenGL SC 2 i Brook Auto) i l'avaluació de les versions que nosaltres hem generat. En funcionalitat i rendiment, no s'ha observat cap diferència, tot i que sí que hem notat un gran salt comparatiu en la complexitat del desenvolupament i la productivitat entre eines orientades només a sistemes gràfics i Brook Auto. In the safety-critical systems domain, which includes automotive, avionics and space systems, more compute power is needed to provide additional functional value and safety. In order to achieve this, new hardware architectures are considered from industry for future critical systems. One of this approaches is the use of mobile GPUs, which have excellent performance capabilities for intensive computational tasks and low-power consumption. However, current programming models for general purpose programming of GPUs like CUDA and OpenCL do not comply with the safety standards of safety critical systems. On the other hand, there are alternative programming solutions based on graphics, namely OpenGL SC 2 and Brook Auto, which are certification-friendly. In this thesis, we perform an analysis of these safety-critical programming models for GPUs and we explore the different aspects of the development of general purpose software in them. We present our experience with porting two applications from two distinct safety-critical domains, aerospace and avionics, in several graphics-based APIs (OpenGL 2, OpenGL ES 2, OpenGL SC 2 and Brook Auto) and the evaluation of our produced versions. In terms of functionality and performance, no difference has been observed, whereas we noticed a big gap in the development complexity and productivity between pure graphics solutions and Brook Auto.

A new approach for detecting security attacks on real-time embedded applications by using performance signatures is introduced in the thesis. Assuming that the behavior of real-time embedded applications is quite stable i.e suffers from little variability, using performance signatures, or in other words key performance metric estimations of the applications, arises as a good option to detect the potential malfunctioning of the system caused by the presence of malware or by the simple existence of bugs escaping the verification process. In our approach we also take into account that slight modifications in the memory layout can lead to high deviations in the performance of the applications for CPUs using standard cache designs implementing modulo placement and LRU replacement. This performance variability may jeopardize the utilization of performance signatures on top of these processors. Therefore, we will also analyze the suitability of performance signatures in the context of time-randomized processors since these processors have been shown to provide higher performance stability.The underlying assumption of this work is that significant performance deviations from well-behaved systems can be used to trigger alerts about the presence of security attacks. In order to be able to study the behavior of the CPU performance in different cases, we will use a SPARC simulator resembling the NGMP (Next Generation Microprocessor) processor, a source-to-source compiler called TASA to mimic the variability due to modification in the cache layout. We also use the EEBMC Autobench benchmarks as representative workloads of the automotive industry. From these benchmarks we have generated randomized variants with TASA to simulate the cache layout variability. We have observed that most of the cases performance signatures suffices to detect the presence of malware since intrinsic cache variability is reduced.