Mixed Criticality in Safety-Critical Systems. LS 12, TU Dortmund

Transcription

1 Mixed Criticality in Safety-Critical Systems Prof. Dr. Jian-Jia Chen LS 12, TU Dortmund 18, July, 2016 Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 1 / 25

2 Motivation today s embedded systems use complex networks hundreds of functions thousands of tasks 50+ ECUs (electronic control units) networked control many suppliers heterogeneous networks are an efficient platform for systems integration Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 2 / 25

3 Example: Mercedes-Benz E-Class source: T. Bone, Daimler Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 3 / 25

4 Safety Challenge Embedded systems are increasingly used to implement advanced system features improve safety In such cases, the embedded system inherits the safety and dependability requirements of the system function safety related embedded systems Such functions are no longer simple They are often distributed Example: automotive electronics brake system camera-based object recognition and tracking Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 4 / 25

5 Safety Standards The design of safety-related systems is driven by safety standards Safety standards contain rules and regulations for all design system recommended guidelines for the development process Safety standards cover all stages of the development process specification design implementation test maintenance Objective of safety related design avoid unacceptable risk assure functional safety Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 5 / 25

6 Functional Safety Safety: Freedom from unacceptable risk of physical injury or of damage to the health of people Functional safety: refers to the safety of system functions A safe system can handle faults without causing severe functional failures Risk: frequency of hazardous events severity of hazardous events Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 6 / 25

7 Embedded Systems Functional Failures Embedded system (ES) functional failures are not necessarily catastrophic Effect depends on the importance of the failing function for the overall system function criticality Criticality depends on the overall system functionality fail safe (ES is not critical but important for quality): if the ES function fails there is a safe function backup or a safe system state that avoids severe consequences (mechanical steering, hydraulic brake, emergency stop) fail operational (ES function is critical, but possibly only needs a specific function): the function continues based on system redundancy or turns to an error mode with reduced functionality (graceful degradation) Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 7 / 25

8 Safety and Time Criticality Many safety critical systems have hard deadlines Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 8 / 25

9 Embedded System Functional Failures and Timing ES functions have different criticality depending on the overall system where timing is specified, it becomes part of the function criticality ES timing failures are ES functional failures switching to error modes is time critical switching needs hard deadlines to guarantee overall system function Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 9 / 25

10 IEC Overview Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems basic functional safety standard applicable to industry generic standard for safety-related systems Metric: Safety Integrity Level - SIL defines four degrees of safety: from 1 (lowest) to 4 (highest) specification of maximum failure rates for each level Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 10 / 25

11 Merging Functions with Different Criticality Levels Integration on one platform leads to systems with applications of different safety requirements strict separation too expensive mixed (safety) criticality systems Mutual dependency via platform and sensors/actuators requires safety concept and qualification/certification for all functions Safety is highly relevant aspect in embedded systems integration Sharing resources is hard to avoide in cost efficient systems shared (open) network shared on-chip network, shared memories, etc. Is it possible to integrate several subsystems and avoid interference? This would be important for mixed criticality systems: non-critical parts are less verified and not designed for worst case It would reduce verification/certification/integration cost Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 11 / 25

12 Mixed Criticality Task Scheduling Given a task τ i, with criticality level L i (Let s assume that the higher number is more critical) Defense avionics: 2 (3) criticalities, says safety-critical; mission-critical; non-critical Civilian aviation (DO-178B): 5 criticalities, says catastrophic; hazardous; major; minor; no effect Automotive systems (ISO 26262): 4 criticalities Worst-case execution time function C i (1), C i (2),... A high criticality task may be subject to pessimistic static analysis A medium criticality task may be subject to worst-case measurement, plus a safety margin A low criticality task may be assessed by simple limited measurement (worst seen in a small number of runs) We can assume that C i (j) C i (j + 1) Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 12 / 25

13 Mixed Criticality Task Scheduling (cont.) Let s consider how to verify the schedulability by using the knowledge we learned in the course. Consider a set T of periodic tasks with implicit deadlines Consider two criticality levels: HI: high criticality (C i (2) will be considered) LO: low criticality (C i (1) will be considered) A task τ i is either specified as a HI task (L i = 2) or a LO task (L i = 1) Let HI be the set of HI tasks Let LO be the set of LO tasks When the system is in HI, all the HI tasks should be feasibly scheduled by considering that C i (2) is the WCET. When the system is in LO, all the tasks should be feasibly scheduled by considering that C i (1) is the WCET. Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 13 / 25

14 Criticality Monotonic All HI tasks have priorities higher than all LO tasks Rate monotonic within each class All HI tasks τ i HI use C i (2) All LO tasks τ i LO use C i (1) What s the schedulability condition for such a mixed-criticality scheduling? t T i C i (L i ) + τ j hp(τ i ) t T j C j (L j ) t τ i where hp(τ i ) is the set of tasks with higher priority than τ i. Quiz: Is Criticality Monotonic the best strategy? Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 14 / 25

15 Intermingled Priorities Priorities of HI and LO are intermingled When analysing HI tasks, HI tasks use C i (2), but LO tasks use C i (1) At run-time, tasks τ i in LO must be prevented from executing for more than C i (1) When analysing LO tasks, all tasks use C i (LO). Disadvantage: execution times must be monitored Let s first assume hp(τ i ) is given. What s the schedulability condition for such a mixed-criticality scheduling? t T i C i (L i ) + τ j hp(τ i ) t T j C j (min{l j, L i }) t τ i Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 15 / 25

16 Deciding Priority Levels Use Audsley s algorithm (assume N tasks) Let LO have l tasks and HI have h tasks Order all HI tasks by rate monotonic (1,h) Order all LO tasks by rate monotonic (1,l) Start at lowest priority (N) Is LO(l) (lowest priority task in LO) schedulable at priority level N? yes: l := l 1, and τ l is removed from LO If no, is HI(h) (lowest priority task in HI) schedulable at priority level N? yes h := h 1, and τ h is removed from HI If no, system unschedulable Repeat for N-1 etc. Max 2N 1 tests Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 16 / 25

17 Further Readings for References Alexandre Esper, Geoffrey Nelissen, Vincent Nélis, Eduardo Tovar: How realistic is the mixed-criticality real-time system model? RTNS 2015: Sanjoy K. Baruah, Vincenzo Bonifaci, Gianlorenzo D Angelo, Haohan Li, Alberto Marchetti-Spaccamela, Suzanne van der Ster, Leen Stougie: Preemptive Uniprocessor Scheduling of Mixed-Criticality Sporadic Task Systems. J. ACM 62(2): 14 (2015) Georg von der Brggen, Kuan-Hsun Chen, Wen-Hung Huang and Jian-Jia Chen: Systems with Dynamic Real-Time Guarantees in Uncertain and Faulty Execution Environments, in RTSS 2016 Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 17 / 25

18 Uncertain and Faulty Execution Environments Uncertain / faulty behaviour imposed by physical environment Execution time of task instance enlarged, e.g. recovery process after fault detection Abnormal mode: Ci A > Ci N Assumption: faults happen rarely Using Ci A for scheduling analysis may be a huge over estimation But: only possibility if all tasks are safety critical Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 18 / 25

19 Aborting Tasks Reality: not all tasks are safety critical Deadline Miss (DM)) not that critical In theory and practical systems : abortion not so important tasks T soft in abnormal mode guarantees response time of more important tasks T hard Results of τ i T soft may still be useful, even if they are a bit late aborting may not be such a good idea Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 19 / 25

20 Problems τ i T hard must always meet the deadline We do not know when faults occur only one priority ordering Aborting only works if all tasks in T soft have lower priority then the tasks in T hard τ i T soft should still have good response time in normal mode τ i T soft should still meet there hard deadlines τ i T soft should have bounded tardiness in abnormal mode Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 20 / 25

21 Sufficient Test TDA for all tasks in normal mode (TDA) TDA for all τ i T hard in abnormal mode (TDA) τ i T soft with higher priority then the current task have to be considered Bounded tardiness τ i T soft U A sum 1 Observation: as Ci A > Ci N the schedulability test for τ i T hard only has to be checked in abnormal mode Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 21 / 25

22 RM is Not Optimal Rate Monotonic: Order according to the period τ 1 T soft = (2, 2 + ε, 6, 6) τ 2 T hard = (6, 8, 14, 14) Normal mode: τ 1 T soft = (2, 2 + ε, 6, 6) τ 2 T hard = (6, 8, 14, 14) Abnormal mode: DM Exchanging priority of τ 1 and τ 2 : τ 2 will meet its deadline U A = ε = 0.92 < 1 bounded tardiness for τ 1 Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 22 / 25

23 SLPO is Not Optimal Service Level Priority Ordering: Order according to priority in abnormal mode τ 1 T hard = (6, 6 + ε, 12, 12) τ 2 T soft = (2, 2 + ε, 6, 6) τ 2 T soft = (2, 2 + ε, 6, 6) τ 1 T hard = (6, 6 + ε, 12, 12) Normal mode: DM Switching priority: Abnormal mode: τ 2 T soft = (2, 2 + ε, 6, 6) τ 1 T hard = (6, 6 + ε, 12, 12) Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 23 / 25

24 τ i T hard can be Ordered in DM Order τ 1 T hard τ 2 T soft τ 3 T hard τ 2 T soft τ 1 T hard τ 3 T hard τ 2 T soft τ 3 T hard τ 1 T hard Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 24 / 25

25 Acknowledgment The above slides are based on the slides provided from Prof. Rolf Ernst, Prof. Sanjoy Baruah, and Prof. Alan Burns. Prof. Dr. Jian-Jia Chen (LS 12, TU Dortmund) 25 / 25