Cyber–physical system (CPS) design is characterized by modeling a computer (or cyber) system together with the physical system that the computer controls. This approach differs from both classical control systems design and also embedded systems design. In the former case, given properties of the physical system or the “plant” to be controlled, a control law or strategy is derived, that when applied to the plant enforces the desired behavior on it. Such control laws are described mathematically, and their implementations in software already result in a CPS, viz., the plant together with the software implementation of the controller. But traditionally, the design of the control law did not take into account all the peculiarities of software implementation—such as delays involved in computing the control input based on the state of the plant, or numerical limitations of the processor running the software, or how faithfully the software implements the mathematical description of the controller. When these issues are not accounted for when designing the controller, there might be a deviation in the behavior of the system when analyzing the mathematical description of the controller, versus what would be observed with the software implementation.

In the next decade, a growing number of scientific and industrial applications will require power-efficient systems providing unprecedented computation, memory, and communication resources. A promising paradigm foresees the use of heterogeneous many-tile architectures. The resulting computing systems are complex: they must be protected against several sources of faults and critical events, and application programmers must be provided with programming paradigms, software environments and debugging tools adequate to manage such complexity. The EURETILE (European Reference Tiled Architecture Experiment) consortium conceived, designed, and implemented: 1- an innovative many-tile, many-process dynamic fault-tolerant programming paradigm and software environment, grounded onto a lightweight operating system generated by an automated software synthesis mechanism that takes into account the architecture and application specificities; 2- a many-tile heterogeneous hardware system, equipped with a high-bandwidth, low-latency, point-to-point 3D-toroidal interconnect. The inter-tile interconnect processor is equipped with an experimental mechanism for systemic fault-awareness; 3- a full-system simulation environment, supported by innovative parallel technologies and equipped with debugging facilities. We also designed and coded a set of application benchmarks representative of requirements of future HPC and Embedded Systems, including: 4- a set of dynamic multimedia applications and 5- a large scale simulator of neural activity and synaptic plasticity. The application benchmarks, compiled through the EURETILE software tool-chain, have been efficiently executed on both the many-tile hardware platform and on the software simulator, up to a complexity of a few hundreds of software processes and hardware cores.

A calibration based method to construct fast and accurate thermal models of the state-of-the-art multicore systems is presented. Such models are usually required during Design Space Exploration (DSE) exercises to evaluate various task-to-core mapping, associated scheduling and processor speed-scaling options for their overall impact on the system temperature. Current approaches require modeling the thermal characteristics of the target processor using numerical simulators, which assume accurate information about several critical parameters (e.g., the processor floorplan). Such parameters are not readily available, forcing the system designers to use time and cost intensive, and possibly error-prone techniques such as using heat maps for reverse-engineering such parameters. Additionally, advanced power and temperature management algorithms commonly found in the state-of-the-art processors must also be accurately modeled. This paper proposes a calibration based method for constructing the complete system thermal model of a target processor without requiring any hard-to-get information such as the detailed processor floorplan or system power traces. Taking an example of a sufficiently complex Intel Xeon 8-core processor, we show that our approach yields an accurate thermal model, which is also lightweight both in terms of memory and compute requirements to be practically feasible for DSE over current processors.

Side channels remain a challenge to information flow control and security in modern computing platforms. Resource partitioning techniques that minimise the number of shared resources among processes are often used to address this challenge. In this work, we focus on multi core platforms and we demonstrate that even seemingly strong isolation techniques based on dedicated cores can be circumvented through the use of thermal channels. Specifically, we show that the processor core temperature can be used both as a side channel as well as a covert communication channel even when the system implements strong spatial and temporal partitioning. Our experiments on an Intel Xeon server platform demonstrate covert thermal channels that achieve up to 12.5 bps and weak thermal side channels that can detect processes executed on neighbouring cores. This work therefore shows a limitation in the isolation that can be achieved on existing multi-core systems.

Thus far, most of the research into many- core computation has focussed on improving the average performance of an application, such as the average throughput. However, applications such as medical ultrasound not only require high throughput, but also require predictable performance characteristics, and are generally implemented on platforms explicitly designed for real-time computing. This paper proposes design strategies which enable high performance multiprocessing applications to achieve predictable communication latencies, computation times and reaction latencies over on-chip many-core platforms, such as the Intel SCC. The strategies presented in this paper can be incorporated into existing many core application design frameworks, wherein the responsibility of achieving predictable timing performance can be relegated to the framework itself. Experiments using two representative applications validate our strategies and show that it is indeed possible to use on-chip many core platforms for real time multiprocessing.

The EURETILE project required the selection and coding of a set of dedicated benchmarks. The project is about the software and hardware architecture of future many-tile distributed fault-tolerant systems. We focus on dynamic workloads characterised by heavy numerical processing requirements. The ambition is to identify common techniques that could be applied to both the Embedded Systems and HPC domains. This document is the first public deliverable of Work Package 7: Challenging Tiled Applications.

We explore how many-core platforms can be used to enhance the security of future systems and to support important security properties such as runtime isolation using a small Trusted Computing Base (TCB). We focus on the Intel Single-chip Cloud Computer (SCC) to show that such properties can be implemented in current systems. We design a system called SEMA which offers strong security properties while maintaining high performance and flexibility enabled by a small centralized security kernel. We further implement and evaluate the feasibility of our design. Currently, our prototype security kernel is able to execute applications in isolation and accommodate dynamic resource requests from them. We show that, with minor modifications, many-core architectures can offer some unique security properties, not supported by existing singleand multi-core architectures, such as application context awareness. Context awareness, a new security property that we define and explore in this work, allows each application to discover, without any interaction with the security kernel, which other parts of the system are allowed to interact with it and access its resources. We also discuss how an application can use context awareness to defend itself from an unlikely, yet potentially compromised security kernel.

We present a new framework that efficiently detects and tolerates timing faults in real time systems. Timing faults are observed when the inputs and/or outputs of a given system fail to meet their desired timing properties, such as I/O rates. Most current approaches either rely on heartbeat monitoring which is too restrictive; or on statistical or inexact methods which are not suitable for embedded real time systems. Current approaches based on the abstract real time model of the given application are resource intensive, and may not be suitable for embedded systems. Our framework utilizes active replication, and is based on already existing timing models for real time applications to develop fault detection and tolerance strategies. The approach does not require any timekeeping at runtime, and is efficient in terms of computational resources used. Experiments using three realistic applications on the Intel Baremetal SCC demonstrate the efficiency of our framework, both in memory and computational resources used.

EURETILE investigates foundational innovations in the design of massively parallel tiled computing systems by introducing a novel parallel programming paradigm and a multi-tile hardware architecture. Each tile includes multiple general-purpose processors, specialized accelerators, and a fault-tolerant distributed network processor, which connects the tile to the inter-tile communication network. This paper focuses on the EURETILE software design flow, which provides a novel programming environment to map multiple dynamic applications onto a many-tile architecture. The elaborated high-level programming model specifies each application as a network of autonomous processes, enabling the automatic generation and optimization of the architecture-specific implementation. Behavioral and architectural dynamism is handled by a hierarchically organized runtime-manager running on top of a lightweight operating system. To evaluate, debug, and profile the generated binaries, a scalable many-tile simulator has been developed. High system dependability is achieved by combining hardware-based fault awareness strategies with software-based fault reactivity strategies. We demonstrate the capability of the design flow to exploit the parallelism of many-tile architectures with various embedded and high performance computing benchmarks targeting the virtual EURETILE platform with up to 192 tiles.

Intel's Single-chip Cloud Computer (SCC) is a prototype architecture for on-chip many-core systems. By incorporating 48 cores into a single die, it provides unique opportunities to gain insights into many-core software development. Earlier results have shown that programming efficient and reliable software for many-core processors is difficult due to a lack of appropriate programming tools. In this paper, we present a programming framework to execute multiple applications specified as Kahn process networks on the SCC. These applications might be started or stopped at runtime based on requests of the user. The proposed application programming interface (API) abstracts low-level implementation details from the application designer enabling high-level performance analysis and automated mapping optimization. To efficiently execute workload specified by the proposed API, a lightweight runtime-system and an automated program synthesis backend are presented. Extensive experiments are carried out to characterize the performance of the proposed framework.

Technology scaling is a common trend in current embedded systems. It has promoted the use of multi-core, multi-processor, and distributed platforms. Such systems usually require run-time migration of distributed applications between the different nodes of the platform in order to balance the workload or to tolerate faults. Before an application can be migrated, it needs to be brought to a stable state such that restarting the application after migration does not violate its functional correctness. An application in a stable state does not change its context any further, and therefore, stabilization is a prerequisite for any application migration. Process networks are a common model of computation for specifying distributed applications. However, most results on the migration of process networks do not provide an algorithm to put a general process network into a stable state , suitable for migration. This paper proposes a technique which efficiently and correctly brings a process network executing on a distributed system to a known stable state . The correctness of the technique is independent of the temporal characteristics of the system and the topology of the process network. The required modifications of a process network are lightweight and preserve its original functionality. A model characterizing the timing properties of the technique is provided. The feasibility and efficiency of the proposed approach and the respective model are validated with experimental results on Intel's SCC platform.

With the evolution of today's semiconductor technology, chip temperature increases rapidly mainly due to the growth in power density. Therefore, for modern embedded real-time systems it is crucial to estimate maximal temperatures early in the design in order to avoid burnout and to guarantee that the system can meet its real-time constraints. This paper provides answers to a fundamental question: What is the worst-case peak temperature of a real-time embedded system under all feasible scenarios of task arrivals? A novel thermal-aware analytic framework is proposed that combines a general event/resource model based on network and real-time calculus with system thermal equations. This analysis framework has the capability to handle a broad range of uncertainties in terms of task execution times, task invocation periods, jitter in task arrivals, and resource availability. The considered model takes both dynamic and leakage power as well as thermal dependent conductivity into consideration. Thorough simulation experiments validate the theoretical results.

The next generation of embedded software has high performance requirements and is increasingly dynamic. Multiple applications are typically sharing the system, running in parallel in different combinations, starting and stopping their individual execution at different moments in time. The different combinations of applications are forming system execution scenarios. In this paper, we present the distributed application layer, a scenario-based design flow for mapping a set of applications onto heterogeneous on-chip many-core systems. Applications are specified as Kahn process networks and the execution scenarios are combined into a finite state machine. Transitions between scenarios are triggered by behavioral events generated by either running applications or the run-time system. A set of optimal mappings are precalculated during design-time analysis. Later, at run-time, hierarchically organized controllers monitor behavioral events, and apply the precalculated mappings when starting new applications. To handle architectural failures, spare cores are allocated at design-time. At run-time, the controllers have the ability to move all processes assigned to a faulty physical core to a spare core. Finally, we apply the proposed design flow to design and optimize a picture-in-picture software.

Temperature plays an increasingly important role in the overall performance and reliability of a computing system. Multi- and many-core systems provide an opportunity to manage the overall temperature profile by cleverly designing the application-to-core mapping and the associated scheduling policies. An uncontrolled temperature profile may lead to an unplanned performance loss, since the system activates protective mechanisms such as voltage and/or frequency scaling to cool itself. Similarly, deep thermal cycles with high frequency lead to severe deterioration in the overall reliability of the system. Design space exploration tools are often used to optimize binding and scheduling choices based on a given set of constraints and objectives, thus motivating the need for fast and accurate temperature estimation techniques. We argue that the currently available techniques are not an ideal fit to design space exploration tools, and suggest a system level technique which is based on application fingerprinting. It does not need any information about the processor floorplan, the physical and thermal structure, or about power consumption. Instead, its temperature estimation is based on a set of application-specific calibration runs and associated temperature measurements using available built-in sensors. We show that a given application possesses a unique thermal signature on the system it executes on, which provides a computationally fast method to calculate accurate temperature traces. Extensive experimental studies show that our technique can estimate temperature on all cores of a system to within $5^{o}C$, and is three orders of magnitude faster than state of the art numerical simulators like \emph{Hotspot.}

Various schemes utilizing path delay information have been proposed to determine the authenticity of a given integrated circuit. However, the performance of these techniques under parameter variations must be evaluated, as delay variations may mask the delay impact of design alterations, such as hardware Trojan horses. This paper examines how path delay characterization performs under extensive delay variations, and results reveal that it remains a powerful tool for detecting design alterations by leveraging statistical techniques.

The complexity of automotive software and the needs for shorter development time and software portability require the development of new approaches and standards for software architectures. The AUTOSAR project is one of the most comprehensive and promising solutions for defining a methodology supporting a function-driven development process. Furthermore, it manifests itself as a standard for expressing compatible software interfaces at the Application Layer. This paper discusses the implementation of AUTOSAR requirements for the component structure, as well as interfaces to the Application Layer in a model-based development environment. The paper outlines the major AUTOSAR requirements for software components, provides examples of their implementation in a Simulink/Stateflow model, and describes the modelbased implementation of an operating system for running AUTOSAR software executables ("runnables"). In addition, it describes the use of xml files for the architectural and interface descriptions of software. The architectural development and simulation of the model, along with auto-generation of AUTOSAR-compliant software, are demonstrated based on the Exterior Light Module of an automotive body controller.