Enabling fail-operational behavior of safety-critical software is essential to achieve autonomous driving. At the same time, automotive vendors have to regularly deliver over-the-air software updates. Here, the challenge is to enable a flexible and dynamic system behavior while offering, at the same time, a predictable and deterministic behavior of time-critical software. Thus, it is necessary to verify that timing constraints can be met even during failover scenarios. For this purpose, we present a formal analysis to derive the worst-case application failover time. Without such an automated worst-case failover timing analysis, it would not be possible to enable a dynamic behavior of safety-critical software within safe bounds. We support our formal analysis by conducting experiments on a hardware platform using a distributed fail-operational neural network. Our randomly generated worst-case results are as close as 6.0% below our analytically derived exact bound. Overall, our presented worst-case failover timing analysis allows to conduct an automated analysis at run-time to verify that the system operates within the bounds of the over timing constraint such that a dynamic and safe behavior of autonomous systems can be ensured.

Achieving a cost-efficient fail-operational behavior of safety-critical software is crucial for autonomous systems. However, most applications hold a state such that a checkpoint is required to enable a safe recovery. Here, the challenge is to find the maximum possible checkpointing period while minimizing network and computational overhead. For this purpose, we present an approach to analytically derive the maximum checkpointing period by giving an upper bound on the number of missed computational steps due to failure effects. Worst-case results of our case study using a SLAM application are consistent with our analytically derived exact bound. Overall, by using our approach, a maximum achievable checkpointing period can be determined to reduce network overhead in order to achieve a cost-efficient and safe behavior of autonomous systems.

Many-core platforms are rapidly expanding in various embedded areas as they provide the scalable computational power required to meet the ever-growing performance demands of embedded applications and systems. However, the huge design space of possible task mappings, the unpredictable workload dynamism, and the numerous non-functional requirements of applications in terms of timing, reliability, safety, and so forth. impose significant challenges when designing many-core systems. Hybrid Application Mapping (HAM) is an emerging class of design methodologies for many-core systems which address these challenges via an incremental (per-application) mapping scheme: The mapping process is divided into (i) a design-time Design Space Exploration (DSE) step per application to obtain a set of high-quality mapping options and (ii) a run-time system management step in which applications are launched dynamically (on demand) using the precomputed mappings. This paper provides an overview of HAM and the design methodologies developed in line with it. We introduce the basics of HAM and elaborate on the way it addresses the major challenges of application mapping in many-core systems. We provide an overview of the main challenges encountered when employing HAM and survey a collection of state-of-the-art techniques and methodologies proposed to address these challenges. We finally present an overview of open topics and challenges in HAM, provide a summary of emerging trends for addressing them particularly using machine learning, and outline possible future directions. While there exists a large body of HAM methodologies, the techniques studied in this paper are developed, to a large extent, within the scope of invasive computing. Invasive computing introduces resource awareness into applications and employs explicit resource reservation to enable incremental application mapping and dynamic system management.

Future autonomous vehicles will no longer have a driver as a fallback solution in case of critical failure scenarios. However, it is costly to add hardware redundancy to achieve a fail-operational behaviour. Here, graceful degradation can be used by repurposing the allocated resources of non-critical applications for safety-critical applications. The degradation problem can be solved as a part of an application mapping problem. As future automotive software will be highly customizable to meet customers' demands, the mapping problem has to be solved for each individual configuration and the architecture has to be adaptable to frequent software changes. Thus, the mapping problem has to be solved at run-time as part of the software platform. In this paper we present an adaptable demonstrator platform consisting of a distributed simulation environment to evaluate such approaches. The platform can be easily configured to evaluate different hardware architectures. We discuss the advantages and limitations of this platform and present an exemplary demonstrator configuration running an agent-based graceful degradation approach.

Ensuring fail-operational behavior is critical to enable autonomous driving. With the absence of a driver as a fallback in a failure scenario it will not be sufficient to use state-of-the-art fail-safe approaches. Here, instead of costly hardware redundancy, graceful-degradation can be used by repurposing the allocated resources of non-critical applications for safety-critical applications. However, solving the mapping problem with a state-of-the-art design-time analysis leads to semi-static solutions, where the mapping is fixed and the task activation is chosen at run-time. Therefore, such solutions are unsuited for future automotive architectures that will be highly customizable and which will include frequent software updates. In this paper we introduce and analyze the effectiveness of an agent-based approach that finds application mappings at run-time, ensures the fail-operational behaviour of safety-critical applications by using graceful degradation, and reconfigures itself after ECU failures. Our results indicate that the number of tolerated ECU failures until a safety-critical application fails can be significantly improved without adding any redundant hardware resources.

Previously, a new class of distributed application run-time mapping algorithms called self-embedding was presented. They are not designed for hard real-time applications which require an upper bound for end-to-end latency. To achieve predictability or even *-predictability, a static (performance) analysis is inevitable to determine and optimize upper and lower bounds. Therefore, a novel hybrid application mapping methodology (consisting of a design-time analysis and run-time mapping) is introduced. In contrast to related work, a packet-switched NoC communication, as in the invasive NoC, is considered.

One of the most important trends in computer architecture in recent years is the paradigm shift toward multi and many-core chips. This chapter outlines the implications and challenges of future many-core architectures and gives an overview of the book's contributions.

Executing multiple applications on a single MPSoC brings the major challenge of satisfying multiple quality requirements regarding real-time, energy, and so on. Hybrid application mapping denotes the combination of design-time analysis with run-time application mapping. In this article, we present such a methodology, which comprises a design space exploration coupled with a formal performance analysis. This results in several resource reservation configurations, optimized for multiple objectives, with verified real-time guarantees for each individual application. The Pareto-optimal configurations are handed over to run-time management, which searches for a suitable mapping according to this information. To provide any real-time guarantees, the performance analysis needs to be composable and the influence of the applications on each other has to be bounded. We achieve this either by spatial or a novel temporal isolation for tasks and by exploiting composable networks-on-chip (NoCs). With the proposed temporal isolation, tasks of different applications can be mapped to the same resource, while, with spatial isolation, one computing resource can be exclusively used by only one application. The experiments reveal that the success rate in finding feasible application mappings can be increased by the proposed temporal isolation by up to 30% and energy consumption can be reduced compared to spatial isolation.

In this chapter, it is shown that the introduced hybrid application mapping can also be utilized to increase security in heterogeneous many-core systems. In the case of security, it is proposed to use the concept of spatial isolation enabled by invasion to close side channels. This requires a shift from the optimization criteria in the previous chapter. There, the hop distance between tasks is maximized to increase the run-time embeddability as one constraint graph typically allows for many concrete mappings. For spatial isolation, so-called shapes as a second intermediate representation besides the constraint graph are introduced. As these shapes represent tiles and adjacent routers, no communication constraints have to be evaluated during run-time mapping. This eases the run-time mapping and transforms it basically to a constrained 2D packing problem. Consequently, fast heuristics as well as SAT-based solvers which choose fitting shape incarnations from each application concurrently may be applied.

In this chapter, a self-embedding algorithm is presented which solves the mapping problem consisting of task binding to tiles, respectively processors, and message routing to NoC links as formalized in the previous chapter in an autonomous way. In the realm of invasive computing, self-embedding tackles the problem in a resource-aware, decentralized, and adaptive manner. Contrary to related work, the application itself initiates and performs its own mapping autonomously. The main idea of the algorithm is that each task, or i-let in invasive computing, embeds its succeeding task and the respective communication towards it.

Large scale many-core systems are able to execute concurrently changing mixes of different parallel applications. Hybrid application mapping combines the strengths of design-time exploration/analysis of resource constellations for task-to-core mappings with the flexibility of choosing concrete mappings at run time. However, state-of-the-art design space exploration (DSE) techniques so far ignore the problem of symmetries in modern heterogeneous architectures: not only recurring patterns in the architecture but the mapping of tasks to instances of the same processor type may unnecessarily increase the search space by redundant, symmetrical implementations which typically affects the quality of the DSE. As a remedy, we propose a novel meta-heuristic DSE approach that eliminates architectural symmetries by abstracting the problem to a clustering of tasks and their mapping to processor types. However, we demonstrate that simple task clustering and type mappings may again introduce encoding symmetries in our search space. Thus, we present a formulation of the task clustering and type mapping as a 0-1 integer linear program (ILP) which eliminates all architectural as well as encoding symmetries from the search space. We also contribute a formal feasibility check to ensure that only implementations with at least one feasible concrete mapping are considered. To further improve the search process for feasible solutions, we apply satisfiability modulo theories-like learning techniques: from each infeasible implementation, we extract conditions why the implementation is infeasible and enrich our 0-1 ILP by additional constraints continuously during the DSE. Experimental results show that a DSE equipped with the novel symmetry-eliminating search space and the proposed learning techniques clearly outperforms a state-of-the-art approach known from literature in terms of the quality of the gained implementation classes.

Modern many-core systems consist of large number of processing cores and introduce more and more parallelism. The (PGAS) programming model is a popular approach for exploiting this parallelism of architectures while offering flexibility of both shared memory and message passing paradigms. On the architecture design front, (NoCs) have become an integral part of the communication infrastructure due to their good scalability. In order to exploit task level parallelism on modern many-core architectures, the applications spawn more and more tasks to the available computing resources. The applications require less communication and synchronization delays for better performance. However, the distributed nature of NoCs poses a challenge to keep data communication and synchronization latency within the desired bound and hence results in higher task spawning overhead.We proposed an approach based on hardware-assisted task spawning on many-core systems [1]. In the current article, we present an extended version of our work for hardware-managed task spawning, keeping in view the communication requirements of both shared memory and message passing programming models. The proposed hardware support, integrated into the network interface architecture, reduces the synchronization overhead for task spawning. The software is offloaded from task spawning which results in an increase in the overall performance. The simulation results highlight that the proposed task spawning approach improves the overall performance up to 40% in comparison to an existing state-of-the-art approach [2]. To underline the applicability, we implemented an FPGA prototype to investigate real world applications. The investigations show that the proposed concept offers a low overhead in terms of implementation area cost on FPGA and ASIC platforms. (C) 2017 Elsevier B.V. All rights reserved.

The predictability of execution qualities including timeliness, power consumption, and fault-tolerability is of utmost importance for the successful introduction of multi-core architectures in embedded systems requiring guarantees rather than best effort behavior. Examples are real-time and/or safety-critical parallel applications. In particular for future many-core architectures, analysis tools for proving such properties to hold for a given application irrespective of other workload either suffer from computational complexity. Or, sound bounds are of no practical interest due to severe interferences of resources and software at multiple levels. In view of abundant computational and memory resources becoming available, we propose to apply the principles of invasive computing to avoid sharing of resources at run time as much as possible. We subsequently show that statically proven quality guarantees may be enforced on many multi-core architectures by a presented hybrid mapping approach. Rather than fixed resource mappings, this approach provides only constellations of resource allocations to the run-time system that searches for such constellations and assigns the invader a suitable claim of resources, if possible. We have implemented this hybrid approach and the interface to the language InvadeX10, a library-based extension of the X10 programming language. In this extension, so-called requirements on execution qualities such as deadlines (e.g., in the form of latency constraints) may be annotated to individual programs or even program segments. These are then translated into satisfying resource constellations that need to be found at run time prior to admitting a parallel application to start, respectively continue in view of required execution quality requirements. We give a real-world case study from the domain of heterogeneous robot vision to demonstrate the capabilities of this approach to guarantee statically analyzed best and worst-case timing requirements on latency and throughput.

Multi-Processor Systems-on-a-Chip (MPSoCs) provide sufficient computing power for many applications in scientific as well as embedded applications. Unfortunately, when real-time requirements need to be guaranteed, applications suffer from the interference with other applications, uncertainty of dynamic workload and state of the hardware. Composable application/architecture design and timing analysis is therefore a must for guaranteeing real-time applications to satisfy their timing requirements independent from dynamic workload. Here, Invasive Computing is used as the key enabler for compositional timing analysis on MPSoCs, as it provides the required isolation of resources allocated to each application. On the basis of this paradigm, this work proposes a hybrid application mapping methodology that combines design-time analysis of application mappings with run-time management. Design space exploration delivers several resource reservation configurations with verified real-time guarantees for individual applications. These timing properties can then be guaranteed at run-time, as long as dynamic resource allocations comply with the offline analyzed resource configurations.This article describes our methodology and presents programming, optimization, analysis, and hardware techniques for enforcing timing predictability. A case study illustrates the timing-predictable management of real-time computer vision applications in dynamic robot system scenarios.

Network-on-chips (NoCs) have emerged as scalable communication infrastructure for modern and future many-core architectures. The inherent redundant and parallel structures of NoCs can be exploited to increase the reliability of the communication. The idea here is to send messages over disjoint paths to increase the chances of the arrival of data even in the presence of hardware faults. As this communication strategy depends on the actual mapping of the application onto the NoC architecture, we outline in this paper how to incorporate disjoint path routing into application mapping. In particular, we investigate an emerging hybrid application mapping methodology which combines the strength of design-time and run-time approaches. We show how to detect infeasible mappings at design time and how to describe constraints to enable the run-time mapping of redundant routing paths based on the design-time analysis.

Different applications concurrently running on modern MPSoCs can interfere with each other when they use shared resources. This interference can cause side channels, i.e., sources of unintended information flow between applications. To prevent such side channels, we propose a hybrid mapping methodology that attempts to ensure spatial isolation, i.e., a mutually-exclusive allocation of resources to applications in the MPSoC. At design time and as a first step, we compute compact and connected application mappings (called shapes). In a second step, run-time management uses this information to map multiple spatially segregated shapes to the architecture. We present and evaluate a (fast) heuristic and an (exact) SAT-based mapper, demonstrating the viability of the approach.

Networks on chips (NoCs) have become a promising candidate for communication in future many-core architectures. However, manufacturing defects and aging effects are expected to cause permanent errors in future technology nodes, which are targeted by NoC-based architectures. Consequently, fault tolerance concepts are necessary in order to deal with these permanent errors. In this work, we propose a novel approach for fault tolerance in NoC-based architectures. We introduce an additional network layer to take over the duties of defective routers. In contrast to existing approaches, the proposed concept is independent of the routing algorithm and can substitute the bandwidth of defective routers. In addition, we show the potential of the concept for power saving. An ASIC implementation of the proposed design is used for performance and power saving evaluation as well as for overhead analysis.