APRÈN. Portal de la producció docent del professorat de la UPC

Modern Safety Critical Systems such as avionics and automotive systems employ graphics solutions written in safety critical graphics APIs such as OpenGL SC 2.0, accelerated with graphics processing units (GPUs). The purpose of this thesis is to design and evaluate a graphics system in using OpenGL SC 2.0 and evaluate it on an relevant GPU architectures and APIs. In particular, an open source widget library for the design of an avionics flight display has been designed [1]. The resulting software is configurable, reusable and extensible, and has been used in order to model an avionics flight display demonstrator and as a benchmarking application for stressing avionics GPUs. Our evaluation on various embedded GPUs has explored their applicability to the avionics domain, as well as for testing an OpenGL SC 2.0 implementation currently under development.

This Final Degree Project (TFG) explores the realm of Autonomous Driving Systems, where safety is essential, and system failures can lead to severe consequences. Ensuring the predictability of these complex systems poses a substantial challenge. Previous research has identified vulnerabilities in autonomous systems, particularly concerning interference-based attacks within control pipelines. While new timing-related metrics for both functional and non-functional correctness in automotive applications have been introduced, there is a lack of solutions at the code level and comprehensive testing of these systems with implemented timing protections. Our research addresses these gaps by focussing on the identification and mitigation of timing violation patterns in a representative automotive framework deployed on top of Cyber-RT, an industrial-quality distributed middleware. These middleware frameworks enable the design of complex and modular applications that on one hand makes it easier to deploy functionally-rich control systems based on AI, but on the other hand introduce an abstraction layer. The latter complicates the definition of timing metrics and the verification of timing correctness. We focus on the problem of verification of timing properties in safety critical systems on top of distributed middleware by considering solutions that can be applied directly at the middleware level and therefore can adapt to diverse application semantics. In this project, we consider three specific timing issues: temporal displacement, persistent failure in message delivery, and semantically relevant frequency degradation. To address these challenges, we developed and implemented customised protection mechanisms. These include timestamp verification and retry mechanisms to mitigate temporal displacement, predictive models integrated with safeguards to compensate for message delivery failures, and a data purging mechanism to mitigate the effects of frequency degradation. Through rigorous experimentation, our study demonstrated substantial improvements in system stability and performance under adverse conditions. By bridging the gap between theoretical frameworks and practical implementations, this research not only contributes with practical solutions to multiple timing violations, but also generalises these methodologies for broader application in various dynamic control systems.

Modern safety-critical systems demand high performance to support advanced functionalities, exceeding the capabilities of traditional architectures. Embedded General Purpose Graphics Processing Units (GPGPUs) offer the performance required but present challenges due to their massively parallel nature. These challenges increase verification costs and necessitate extensive human-driven testing for code coverage. This project aims to address these issues by replacing the current backend of Brook Auto with a new backend capable of running GPGPU code on Vulkan Safety Critical. The objective is to improve the programmability of Vulkan by enabling developers to program in Brook and execute on Vulkan, thus eliminating the need to learn Vulkan itself. This approach leverages the high-performance capabilities of GPGPUs while reducing the learning curve and verification costs associated with complex parallel architectures. By integrating Brook Auto with Vulkan SC, we anticipate a streamlined development process for safety-critical systems, offering a more accessible and cost-effective solution for high-performance applications. Our work could pave the way for broader adoption of GPGPU technology in safety-critical environments, contributing to the advancement of modern systems.

For decades safety-related functionalities in automotive, avionics and space systems were implemented in low-performance microcontrollers. But the increasing software complexity and computational demanding processes are guiding the safety-critical domain towards using GPUs. This work aims at providing simulator tools for the safety-critical domain approach to the usage of GPUs for high computation demanding task. It will be done by modeling a GPU Full System simulator and validating its architecture against a real GPU model.

In Hard Real-time Systems, the execution of tasks must be completed within a certain timeframe, known as deadline. In consequence, when a hard-real time system is designed, it is strictly necessary to assume that its tasks will always take their Worst Case Execution Time (WCET), to make sure they meet their deadlines. For this reason, Worst Case Execution Times defines the maximum performance of processors in these systems. Since the performance requirements of modern Hard Real-time Systems are rapidly increasing, the use of newer and higher performance processors is needed. However, these processors have a much greater internal complexity compared to the ones previously used in these systems. This complexity can be detrimental given that Worst Case Execution Times, which are critical for these systems, are often estimated using traditional timing analysis methods like Static and Measurement-based deterministic techniques. The need for extremely detailed knowledge of the processor's internals, IP restrictions, and the impossibility of modeling certain features leads to extremely pessimistic assumptions and the disabling of features while using these techniques. On the other hand, Measurement-Based Probabilistic Timing Analysis (MBPTA) allows computing probabilistic WCET estimates easily on top of more complex hardware. This can only be performed when Time Randomisation is introduced in the microarchitectural design, e.g. namely through time-randomised cache designs. Despite their better WCET compared to conventional caches, time-randomised caches provide lower average performance. In this work, we perform the following contributions. First, we add MBPTA support in a commercial RISC-V processor for real-time systems. We show how branch prediction can become MBPTA-compliant, and in conjunction with a cache-locking mechanism can increase the front-end performance of an MBPTA compliant processor. Our evaluation demonstrates benefits both in terms of average case as well as in worst case performance.

Critical Real-Time Embedded Systems (CRTES) are aimed to be executed on Real Time processors under time constraints. To ensure the correct execution under these constraints, a Worst Case Execution Time (WCET) analysis must be performed in every CRTES developing project. Conventional WCET analysis slows down CRTES development as it requires a lot of economic and time resources, and also takes into consideration only the worst case value without taking into account the probability to achieve it. Instead, Measurement Based Probabilistic Timing Analysis (MBPTA) provides a probabilistic Worst Case Execution Time (pWCET) curve. TASA was born as a solution to realize MBPTA, using a flexible and portable code-randomization tool. In this work the TASA tool-chain has been developed and its functionalities are being explained, alongside with a demonstration of its correctness, compiling and executing a real time project and realizing a MBPTA of itself.

The rise in complexity of the algorithms run on space systems, largely attributable to higher resolution instruments which generate a large amount of the data to be processed, as well as to the need for increased autonomy which relies on Neural Network inference systems in future missions, demand the adoption of more powerful on-board hardware, such as multicores. At the same time, the correctness and reliability of critical on-board software is of paramount importance for the success of the missions. However, developing such complex software in low-level languages can have a negative impact on these aspects. For this reason, this thesis evaluates the role that the Rust programming language can have in this change, given its memory safety and built in support for parallelism, which allows to better utilise more powerful hardware, in particular multicore cpus, without compromising programmability and safety of the code. To this end, the GPU4S benchmarking suite, part of the open source OBPMark benchmarking suite of the European Space Agency (ESA), is ported to Rust, with sequential and parallel implementations. The applications are ported both in a hosted as well as in bare metal environment for a RISC-V based platform for the space domain, developed within the METASAT Horizon Europe project. The performance of the ported benchmarks is compared to the existing sequential and parallel implementations in low-level languages to evaluate the trade-offs of the different solutions, and it is evaluated on several multicore platforms which are candidates for future on-board processing systems. A particular focus is put on parallel versions of the benchmarks, where Rust offers solid native support, as well as library support for fast parallelization similar to OpenMP. Finally, in terms of correctness, the Rust implementations are free of recently detected defects in the low-level implementations of the GPU4S benchmarks.

In the past decade, Artificial Intelligence has revolutionized various industries, including automotive, avionics, and health sectors. The installation of Advanced Driver Assistance Systems (ADAS) is now a reality, with the goal of achieving fully self-driving cars (SDCs) in the near future. ADAS and Autonomous Driving (AD) systems require processing vast amounts of data at high frequency using complex algorithms (Deep Learning (DL)) to meet tight time constraints (Real Time (RT)). Traditional computing has become a bottleneck, with CPUs unable to handle the data efficiently. High-performance GPUs have partially fulfilled these timing constraints, leading to continuous innovation in device performance and efficiency. For example, Nvidia introduced the Jetson AGX Xavier SoC in 2017, designed for machine learning applications in the automotive sector. However, AD and ADAS challenges also involve safety constraints, such as functional safety. Redundancy is necessary for identifying and correcting erroneous outcomes. To ensure high safety levels, diverse redundancy is used to avoid common cause faults (CCF). High-performance hardware for AD must be verified and validated (V&V) to ensure safety goals, but these processes can be costly. The automotive industry seeks to avoid non-recurring costs by using commercial off-the-shelf products (COTS). However, COTS devices have drawbacks, including limited redundancy and guarded implementation details. Researchers are developing software-only diverse redundancy solutions on top of COTS devices to overcome these limitations. Two main challenges are ensuring redundant computation for error detection and guaranteeing diverse redundancy to detect errors even when they affect all replicas. Current solutions are limited and mostly focused on NVIDIA GPUs. This thesis presents a software-only solution for diverse redundancy on Intel GPUs, providing strong diversity guarantees for the first time. Built on OpenCL, a hardware-agnostic programming language, the technique relies on intrinsics-special functions optimized by integrators. The intrinsics enable identifying hardware threads on the GPU and smart tailoring of workload geometry and allocation to specific computing elements. As a result, redundant threads use physically diverse execution units, meeting diverse redundancy requirements with affordable performance overheads. Several scenarios are developed to measure the impact of modifications to a standard OpenCL kernel execution. First, allocating only half of the available GPU resources; then, overriding the scheduler to use half of the resources; next, duplicating the work to mimic two kernel execution; and finally, executing both kernels in independent parts of the GPU.

Modern safety critical systems require high levels of performance for the implementation of advanced functionalities, which are not possible with the simple conventional architectures currently used in them. Embedded General Purpose Graphics Processing Units (GPGPUs) are among the hardware technologies which can provide the high performance required in these domains. However, their massively parallel nature complicates the verification of their software and increases its cost because it usually involves code coverage through extensive human-driven testing. The Ada-SPARK language has traditionally been used in highly-critical environments for its formal verification capabilities and powerful type system. The use of such tools, especially those being backed up by theorem provers, has significantly lowered the amount of effort needed to validate functionality of safety-critical systems. In this work, we utilize AdaCore's CUDA backend for Ada ---currently in closed beta--- in conjunction with the SPARK language subset to assess the state of static verification for GPU kernels. We show how common programming mistakes in GPU kernels can be prevented, formulate a pattern for buffer overflow detection, and close with a few GPU case studies.

The low-cost and portable SPARROW AI accelerator has been recently proposed and demonstrated in VHDL in two space processors, the LEON3 and NOEL-V. In this Bachelor's thesis, SPARROW is implemented in SystemVerilog and is integrated with a RISC-V processor written in SystemVerilog, the SweRV Core EH1. This implementation provides three important results. It proves the portability of SPARROW, provides a useful extension to an existing industrial grade processor, and give us the ability to compare the SPARC and RISC-V implementations. The obtained results demonstrate that SPARROW can provide significant speedups also in the dual issue EH1 core.

Upcoming safety critical systems require high performance processing, which can be provided by multi-cores and embedded GPUs found in several Systems-on-chip (SoC) targeting these domains. So far, only low-level programming models and APIs, such as CUDA or OpenCL have been evaluated. In this Master thesis, we evaluate the effectiveness of higher level programming models, such as OpenACC and SYCL for critical applications executed in such embedded platforms. In particular, we are interested in two aspects: performance and programmability. In order to conduct our study, we use the GPU4S Bench benchmarking suite for space and a pedestrian detection application representing the automotive sector, which we port into the new programming models and analyze their behavior. We perform our evaluation on a representative embedded platform, the NVIDIA Xavier AGX which is considered a good candidate for future safety critical systems in both domains and compare our results with other programming models.

In the recent years there has been an increasing interest in artificial intelligence (AI) and machine learning (ML). The advantages of such applications are widespread across many areas and have drawn the attention of different sectors, such as aerospace. However, these applications require much more performance than the one provided by space processors. In space the environment is not ideal for high-performance cutting-edge processors, due to radiation. For this reason, radiation hardened or radiation tolerant processors are required, which use older technologies and redundant logic, reducing the available die resources that can be exploited. In order to accelerate demanding AI applications in space processors, this thesis presents SPARROW, a low-cost SIMD accelerator for AI operations. SPARROW has been designed following a hardware-software co-design approach by analyzing the requirements of common AI applications in order to improve the efficiency of the module. The design of such module does not use any existing vector extension and instead has in its portability one of the key advantages over other implementations. Furthermore, SPARROW reuses the integer register file of the processor avoiding complex managing of the data while reducing significantly the hardware cost of the module, which is specially interesting in the space domain due to the constraints in the processor area. SPARROW operates with 8-bit integer vector components in two different stages, performing parallel computations in the first and reduction operations in the second. This design is integrated within the baseline processor not requiring any additional pipeline stage nor a modification of the processor frequency. SPARROW also includes swizzling and masking capabilities for the input vectors as well as saturation to work with 8 bits without overflow. SPARROW has been integrated with the LEON3 and NOEL-V space-grade processors, both distributed by Cobham Gaisler. Since each of the baseline processors has a different architecture set, software support for SPARROW has been provided for both SPARC v8 and RISC-V ISAs, showing the portability of the design. Software support been developed using two well established compilers, LLVM and GCC allowing for a comparison of the cost of developing support for each of them. The modifications have included the SPARROW instructions in the assembly language of each architecture and with the use of inline assembly and macros allow a programming model similar to SIMD intrinsics. LEON3 and NOEL-V extended with SPARROW have been implemented on a FPGA to evaluate the performance increase provided by our proposal. In order to compare the performance with the scalar version of the processor, different AI related applications have been tested such as matrix multiplication and image filters, which are essential building blocks for convolutional neural networks. With the use of SPARROW a speed-ups of 6x and up to 15x have been achieved.

Modern critical systems need higher performance which cannot be delivered by the simple architectures used so far. Latest embedded architectures feature multi-cores and GPUs, which can be used to satisfy this need. In this thesis we parallelise relevant applications from multiple critical domains represented in the GPU4S benchmark suite, and perform a comparison of the parallel capabilities of candidate platforms for use in critical systems. In particular, we port the open source GPU4S Bench benchmarking suite in the OpenMP programming model, and we benchmark the candidate embedded heterogeneous multi-core platforms of the H2020 UP2DATE project, NVIDIA TX2, NVIDIA Xavier and Xilinx Zynq Ultrascale+, in order to drive the selection of the research platform which will be used in the next phases of the project. Our result indicate that in terms of CPU and GPU performance, the NVIDIA Xavier is the highest performing platform.

On-board processing requirements of future space missions are constantly increasing, calling for new hardware than the traditional ones used in space. Embedded GPUs are an attractive candidate offering both high performance capabilities and low power consumption, but there are no complex industrial case studies from the space domain demonstrating these advantages. In this Master Thesis we present the GPU parallelization of an on-board algorithm in multiple GPU programming languages, as well as its performance and energy efficiency on a selection of promising embedded GPU COTS platforms.

Critical Real-time Embedded Systems encompasses an increasingly relevant class of embedded systems for which the timely execution of a functionality is as important as its functional correctness. The derivation of trustworthy timing bounds, an inescapable requirement for that class of systems, is challenged by the inherent parallelism in multicore platforms. When shifting from single-core to multicore systems, some hardware resources become shared among available cores. Under such a scenario, contention may arise when two or more cores send requests to the same hardware shared resource at the same time. Contention causes potential delays in the time required to serve each request, which in turn affects the overall execution time requirements of an application and hence its Worst-Case Execution Time (WCET). The computation of trustworthy bounds to the impact of contention in multicore systems is further challenged by the increasing complexity of modern cutting-edge multicore and manycore hardware solutions, which are increasingly adopted in the Critical Real-time Embedded Systems domain to respond to increasing computational and performance requirements. Contention bounds are required to be at the same time accounting for the worst-case scenario, and tight, avoiding unnecessary pessimism and ultimately the development costs and system over-dimensioning. Under the above considerations, this Thesis aims at improving (reducing) the bounds on contention delay when accessing shared resources. In particular, we focus on systems featuring interconnects that allow some form of parallelism such as crossbars and alike. We differentiate from state-of-the-art solutions, which only address bus-like interconnects and only exploit access counts, by exploiting information on the sequence of accesses performed by contenting tasks. Instead, we exploit the sequence of requests to the different target resources produced by each core to produce tighter bounds by discarding contention scenarios that cannot occur in practice. To that end, we adapt existing techniques from the pattern matching domain to derive the worst-case contention effects from the sequences of requests each core sends over the interconnect. Results on a wide set of synthetic and real scenarios and benchmark on an AURIX TC297TX show that our technique outperforms other contention modelling approaches.

The number of mechanical subsystems enhanced or completely replaced by electrical/electronic components is on the rise in critical real-time embedded systems (CRTES) like those in cars, planes, trains, and satellites. In this line, software is increasingly used to control (safety-related) critical aspects of CRTES. More complex software requires unprecedented computing performance requirements, that can only be achieved by deploying aggressive processor designs, multiprocessor system on chips (SoCs or MPSoCs). The other side of the coin is that MPSoCs make software timing analysis -- a mandatory pre-requisite for CRTES -- more complex. Performance Monitoring Units (PMUs) are at the heart of most advanced software timing analysis techniques to control and bound the impact of contention in Commercial Off The-Shelf (COTS) System-on-Chips (SoCs) with shared resources (e.g., GPUs and multicore CPUs). However, PMUs are designed with an assurance level below the role they assume in software timing analysis. In this Thesis, we aim at taking an initial step toward reconciling PMU verification with its key role for timing analysis. In particular, this Thesis covers the analysis of the correctness of hardware event monitor (HEM) in embedded processors for CRTES domains. This Thesis illustrates that some event monitors do not behave as expected in their specification, which can in turn invalidate the software timing analysis process performed building on those HEMs. For three real processors used in different CRTES domains, we report discrepancies on the values obtained from the PMU's HEMs and the number of events expected based on HEM description in the processor's official documentation. Discrepancies, which may be either due to actual errors or inaccurate specifications, make PMU readings unreliable. This is particularly problematic in consideration of the critical role played by event monitors for timing analysis in domains such as automotive and avionics. This Thesis proposes a systematic procedure for event monitor validation. We apply this procedure to validate event monitors in the NVIDIA AGX Xavier, NVIDIA TX2, and the Xilinx Zynq UltraScale+ MPSoC. We show that while some event monitors count as expected, this is not the case for others whose discrepancies with expected values we analyze.

Nowadays, Deep learning-based solutions and, in particular, deep neural networks (DNNs) are getting into several core functionalities in critical real-time embedded systems (CRTES), like those in planes, cars, and satellites, from vision-based perception (object detection and object tracking) systems to trajectory planning. As a result, several deep learning instances are running simultaneously at any time on the same computing platform. However, while modern computing platforms offer a variety of computing elements (e.g., CPUs, GPUs, and specific accelerators) in which those DNN instances can be executed depending on their computational requirements and temporal constraints. Currently, most DNNs are mainly programmed to exploit one particular computing element, regular cores of the GPUs. This lack of variety causes a resource imbalance and under-utilization of the various computing element resources when executing several DNN instances, causing an increase in DNN tasks' execution time requirements. In this Thesis, (a) we develop different variants (implementation) of well-known DNN libraries used in the Apollo Autonomous Driving software for each of the computing elements of the latest NVIDIA Xavier system-on-chip. Each variant is configured to balance resource requirements and performance: the regular CPU core implementation that can run on 2, 4, and 6 cores (always leaving 2 cores free for other computations); the GPU with regular and Tensor cores variants that can run on 4 or 8 GPU's Stream Multiprocessors (SM); and 1 or 2 NVIDIA's Deep Learning Accelerators (NVDLA); (b) we show that each particular variant/configuration offers different resource utilization/performance point. (c) we show how those heterogeneous computing elements can be exploited by a static scheduler to sustain the execution of multiple and diverse DNN variants on the same platform.

In the safety-critical systems domain, which includes automotive, avionics and space systems, more compute power is needed to provide additional functional value and safety. In order to achieve this, new hardware architectures are considered from industry for future critical systems. One of this approaches is the use of mobile GPUs, which have excellent performance capabilities for intensive computational tasks and low-power consumption. However, current programming models for general purpose programming of GPUs like CUDA and OpenCL do not comply with the safety standards of safety critical systems. On the other hand, there are alternative programming solutions based on graphics, namely OpenGL SC 2 and Brook Auto, which are certification-friendly. In this thesis, we perform an analysis of these safety-critical programming models for GPUs and we explore the different aspects of the development of general purpose software in them. We present our experience with porting two applications from two distinct safety-critical domains, aerospace and avionics, in several graphics-based APIs (OpenGL 2, OpenGL ES 2, OpenGL SC 2 and Brook Auto) and the evaluation of our produced versions. In terms of functionality and performance, no difference has been observed, whereas we noticed a big gap in the development complexity and productivity between pure graphics solutions and Brook Auto.

A new approach for detecting security attacks on real-time embedded applications by using performance signatures is introduced in the thesis. Assuming that the behavior of real-time embedded applications is quite stable i.e suffers from little variability, using performance signatures, or in other words key performance metric estimations of the applications, arises as a good option to detect the potential malfunctioning of the system caused by the presence of malware or by the simple existence of bugs escaping the verification process. In our approach we also take into account that slight modifications in the memory layout can lead to high deviations in the performance of the applications for CPUs using standard cache designs implementing modulo placement and LRU replacement. This performance variability may jeopardize the utilization of performance signatures on top of these processors. Therefore, we will also analyze the suitability of performance signatures in the context of time-randomized processors since these processors have been shown to provide higher performance stability.The underlying assumption of this work is that significant performance deviations from well-behaved systems can be used to trigger alerts about the presence of security attacks. In order to be able to study the behavior of the CPU performance in different cases, we will use a SPARC simulator resembling the NGMP (Next Generation Microprocessor) processor, a source-to-source compiler called TASA to mimic the variability due to modification in the cache layout. We also use the EEBMC Autobench benchmarks as representative workloads of the automotive industry. From these benchmarks we have generated randomized variants with TASA to simulate the cache layout variability. We have observed that most of the cases performance signatures suffices to detect the presence of malware since intrinsic cache variability is reduced.