AUTOSAR-based automotive software decomposes applications into sequences of runnables that execute at different rates and exhibit causal relationships to realize specific functionalities. For example, in a typical sensor-to-actuator interaction, a sensor runnable acquires input data (cause), subsequent runnables process this data, and a final runnable produces an output that can trigger an actuator (effect). In practice, an automotive application comprises multiple of these runnable sequences (i.e., cause–effect chains), which form a directed acyclic graph of runnables.The end-to-end data latencies of cause–effect chains are subject to stringent timing requirements, such as reaction time. To achieve efficient resource utilization and improve end-to-end data latency, runnables are grouped into tasks using runnable-to-task mapping methods. We propose a method to automatically and jointly determine runnable-to-task mapping, execution order of runnables within tasks, and task offsets, while maintaining schedulability. In addition, we propose a packet-oriented method based on symbolic execution, which enables precise and explainable analysis of end-to-end data latency, including reaction time, data age, and time disparity. Unlike existing approaches that analyze individual cause–effect chains in isolation, the proposed analysis method considers the entire directed acyclic graph and naturally supports latency analysis of merged multirate cause–effect chains.Together, the proposed design and analysis techniques support correct-by-design early-stage modeling and analysis of automotive applications. Through experimental evaluation on industrial case studies and automotive benchmarks, we demonstrate that our approach, compared to state-of-the-art methods, achieves tighter data-latency timing estimates and provides explainable analysis.

Embedded and edge devices increasingly require lifetime adaptability: once deployed, they must accommodate evolving workloads, standards and protocols, and dependability and security requirements under strict energy and cost constraints. This paper presents a runtime-reconfigurable FPGA-based RISC-V microcontroller architecture that combines dynamic partial reconfiguration with standardized custom-instruction integration via SCAIE-V. Accelerators are implemented as reconfigurable modules hosted in reconfigurable partitions and invoked via a custom instruction. We showcase the approach with two soft cores - the non-pipelined PicoRV32 and the pipelined Orca - showing that the design is mainly independent of the underlying microarchitecture. Beyond standardized accelerator integration, we contribute a system-level execution mechanism that preserves ISA-level semantics under runtime reconfiguration. When an accelerator is absent, dedicated hardware transparently triggers a controlled context switch to an equivalent software fallback function, then restores the architectural state so that execution proceeds as if the custom instruction had executed in hardware, including program-flow changes. To maintain correctness for stateful accelerators during reconfiguration, we introduce a memory handover manager that enables seamless migration across the hardware/software boundary. An automatic reconfiguration module loads accelerators on demand while the software fallback remains available. We evaluate the concept on an AMD Artix-7 FPGA using a control-flow-intensive reduced-overhead loop and an ASCON-based lightweight cryptographic accelerator. For ASCON, hardware execution reduces runtime from 126,017 to 3515 clock cycles on PicoRV32 and from 66,191 to 1800 clock cycles on Orca, while the software fallback adds only 20.23% and 18.04% overhead over regular software, respectively. In contrast, the ROL case study exposes the fixed cost of full semantic transparency, reaching 1289.93% and 1089.45% fallback overhead. These results show that the approach is most beneficial for accelerators with sufficient per-invocation work and reuse to amortize fallback and reconfiguration costs, while maintaining correctness and software-level compatibility under dynamic accelerator availability.

Open-source chip design gained increasing attention in recent years. It can play a crucial role in educating the next generation of chip designers by making the designs, EDA tools, and PDKs available to a broad community. In light of this, we present Greyhound, an open-source, reconfigurable, and extensible RISC-V SoC and eFPGA with a focus on educational purposes. Compared to other designs, Greyhound is fully open-source, including the source code, the tools used, and the physical design implementation. With it, students can learn how to program a RISC-V CPU, implement custom instruction extensions and peripherals, or dive into the chip design of Greyhound itself. The SoC achieves a maximum clock frequency of 55 MHz (typ.) and is based on the CV32E40X RISC-V core. It contains 8 KiB of SRAM, a QSPI XIP flash controller, a QSPI PSRAM controller, and UART. The eFPGA is based on the FABulous framework and features 32xI/O, 784xLUT4+FF, 98xMUX, 7xSRAM (4KiB), 7xMAC, and 14xregister file. In addition to being used for custom instructions or accelerators, it can be used stand-alone. The final chip is 3.6mmx5mm in size and DRC and LVS clean. Greyhound was taped out in April 2025 through an IHP Open MPW shuttle.

Embedded computing platforms increasingly require adaptable architectures to meet varying application demands. This paper explores how the instruction set of RISC-V-based microcontrollers can be extended at runtime using reconfigurable hardware accelerators and the SCAIE-V framework. Building on a flexible infrastructure based on dynamic partial reconfiguration and a scalable, standardized instruction interface within the pipeline, we demonstrate the integration of application-specific accelerators without sacrificing general-purpose capabilities. The experimental proof of concept based on the ASCON lightweight cryptographic algorithm validates the approach across two soft microcontrollers. With this, we showcase the usage of a software fallback mechanism to support seamless hardware/software transitions and enable memory handover between the software and hardware execution domains. The results show clear advantages in execution time and flexibility over static hardware designs while supporting long-term maintainability and sustainability through hardware reuse.

Learning analytics can provide valuable insight to improve the learning experience for students. We are successfully using the ATTEST test system in our Real-Time Operating Systems course for two semesters. Besides the direct advantage of providing low-latency feedback to students, analysis of usage data provides the foundation for adaptation decisions to improve the course in future semesters. This paper answers 11 concrete questions, including the preferred working day and time. It analyzes the number of test cases passed as the deadline approaches and correlates the starting time to the achieved results. Finally, a technical analysis shows that the test system response time is sufficiently short despite the constraint of testing on the actual target MSP430 microcontroller. Thus, students can receive multiple feedback iterations within an average working session length without interrupting their workflow.

Embedded automotive software development increasingly uses formal methods to guarantee correctness and dependability. Generally, we can use models of high-level (hardware-independent) specifications to generate high-level code. However, we need to model low-level (hardware-dependent) specifications individually for each hardware architecture, which significantly increases modeling complexity and verification effort and limits the re-usability of these low-level models to generate hardware-specific code. The problem is even more significant when dealing with complex low-level functionalities (e.g., context switch, system initialization) of an AUTOSAR Operating System (OS). In this paper, we propose a refinement-based formal modeling approach to address this problem. First, we use UML-B and Event-B formal methods to implement a hardware-generic model of the low-level specification, which abstracts hardware-specific details. Next, we refine the generic model by including the hardware-specific details in the final refinements. We verify the hardware-generic and -specific models using theorem proving and Linear Temporal Logic (LTL) model checking. This way, our approach facilitates portability and re-usability while ensuring the correctness of low-level functionalities. As proof of concept and evaluation, we model and verify the context switch of an AUTOSAR OS and refine the hardware-generic model of the use case for AURIX TriCore and RISC-V architectures.

This paper introduces the open-source pnrXplore framework to archive, visualize, and explore physical design implementation data. It specifically targets the requirements in CAD and EDA research, which sets it apart from generic frameworks for data inspection. pnrXplore consists of a Python package to bundle the preprocessed data from implementation runs into a single archive file and a versatile Web-based viewer built upon streamlit. Thus, it runs natively or in a Docker container and includes a feature-rich and extensible set of components. Besides a dynamic dashboard and an embedded Python playground, we demonstrate the extensibility by integrating nextpnr viewer to render the routed implementation result.

Modern embedded automotive software uses AUTOSAR for software development. This software is organized into a set of runnables that represent basic functionality. For optimal resource utilization, runnables are grouped into tasks. In AUTOSAR, a schedule table is used for the deterministic time triggering of task activations or events. In the state of the art, the schedule table is generated at design time. The memory demand of the schedule table is highly sensitive to the application parameters, i.e., the periods and offsets of the runnables and task types. Variations in these parameter values can very significantly increase the memory demand of the schedule table, even for small applications consisting of, e.g., only four runnables. In this paper, we propose an alternative approach for the online generation of the schedule table with an upper bound on the memory demand that is insensitive to variations in the values of the periods and offsets of runnables, and task types. Using multiple case studies, we show that our approach, despite a slight runtime overhead, significantly reduces memory demand.

Microarchitecture documentation, such as datasheets and user manuals, is indispensable for embedded software development. However, the extensive volume and complexity of these documents render information retrieval a time- and effort-intensive task. To address this challenge, we propose a framework for constructing a queryable knowledge base on microarchitecture documentation, leveraging Retrieval-Augmented Generation (RAG) and Large Language Models (LLMs). As a proof of concept, we implement a knowledge base on AURIX TriCore TC27x documentation and evaluate this knowledge base by querying it with a curated set of questions. The generated responses are evaluated by measuring their semantic similarity to reference answers. In our evaluation, we assess the performance of six LLMs with different model architectures and sizes. The results show that the smaller models (with 8 billion and 3 billion parameters) achieve similarity scores comparable to those of the larger model (with 72 billion parameters). These initial findings demonstrate the robustness of our framework for creating queryable knowledge bases and the potential of smaller LLMs for efficient information retrieval in this context

Electrostatic placers are a type of non-linear placers that gained popularity due to their high quality of results. Obtaining an accurate placement solution is crucial in Field-Programmable Gate Arrays (FPGAs), where routing resources are limited and post-placement improvements, such as buffer insertions, are not possible. This paper investigates the electrostatic placer in the open-source place&route framework nextpnr. Driven by the vast interest in machine learning, new gradient direction algorithms emerged. We revisit the choice of gradient direction algorithm and compare Nesterov's method used in ePlace and elfPlace against RMSProp, Adam, Adan, and an adaptive restarting scheme. Further, we add optional initial bi-partitioning and tune the hyper-parameters for two schemes to update the Lagrange multipliers. Initial experiments show that adaptively restarting Nesterov's method can be beneficial and emphasize Adam as a promising candidate besides Nesterov's method due to its high-quality results and fast convergence.

Porting software to new target architectures is a common challenge, particularly when dealing with low-level functionality in drivers or OS kernels that interact directly with hardware. Traditionally, adapting code for different hardware platforms has been a manual and error-prone process. However, with the growing demand for dependability and the increasing hardware diversity in systems like the IoT, new software development approaches are essential. This includes rigorous methods for verifying and automatically porting Real-Time Operating Systems (RTOS) to various devices. Our framework addresses this challenge through formal methods and code generation for embedded RTOS. We demonstrate a hardware-specific part of a kernel model in Event-B, ensuring correctness according to the specification. Since hardware details are only added in late modeling stages, we can reuse most of the model and proofs for multiple targets. In a proof of concept, we refine the generic model for two different architectures, also ensuring safety and liveness properties. We then showcase automatic low-level code generation from the model. Finally, a hardware-independent factorial function model illustrates more potential of our approach.

Modern embedded automotive software depends on the AUTOSAR architecture for design and development. AUTOSAR application consists of functions, called runnables, that are mapped to sequencer tasks. In the state-of-the-art approach, each sequencer task uses a counter to decide which runnables to execute in each activation. However, this approach might (i) contain empty task instances (ETI) of the sequencer task, i.e., instances that execute no runnables; and (ii) introduce offset drifts, i.e., delay the execution of subsequent runnables if the corresponding sequencer task misses activations and, consequently, does not increment its counter. The empty instances lead to unnecessary CPU usage, while unexpected offset drifts lead to different runtime behaviors, potentially invalidating the design-time analysis. In this paper, we propose a timestamp-based approach that eliminates empty instances and restricts the impact of missing activations to a single instance instead of delaying the execution of all subsequent instances. We evaluate our approach using a real-world automotive use case and show (i) a reduction in CPU usage compared to the counter-based approach and (ii) a consistent data latency and response time even missing some task activations.

RISC-V processor cores with a 32-bit internal data path reach a boundary on their minimal size, requiring novel concepts to decrease silicon area and the cost of Internet of Things (IoT) devices. We propose a minimal-area open-source RV32I RISC-V core targeting the IoT and low-workload applications. Unlike cores with a similarly small area, FazyRV is inherently scalable to a data path width of 1, 2, 4, or 8 bits. FazyRV has manifold variants to achieve the smallest footprint at given performance requirements. This paper provides insight into FazyRV, its verification, and the resource utilization for five Field-Programmable Gate Array (FPGA) architectures. We also compare its performance with similar cores using the Embench benchmark suite. Based on the findings, we analyze and discuss optimization potentials in depth. Although FazyRV is implemented at the register transfer level, we achieve comparable results to hand-optimized cores at the gate level. In an exemplary IoT application, the whole system on chip is implemented in 77 Slices, or 645 Logic Cells for a Xilinx/AMD 7-Series or an iCE40 FPGA, respectively.

Modern embedded software development uses model-based methods to support long-term maintenance, portability, and correctness. A growing trend is to use formal methods to create software models and verify their correctness against requirement specifications. However, modeling and verifying low-level Real-Time Operating Systems (RTOS) or Basic Software (BSW) code sequences remains a major challenge, as it requires correctness against the internal hardware behavior and timing. To ensure this correctness, we need formal models of the complex hardware architecture, and due to the increased model complexity, the verification can lead to a state space explosion.In this paper, we mitigate these challenges by using an existing static Worst-Case Execution Time (WCET) analysis tool, OTAWA, for microarchitecture analysis. We use the intermediate results of the WCET analysis as input to our process, which verifies the correctness of the low-level implementations against the runtime effects of the hardware (e.g., synchronization dependencies, memory race conditions) and analyzes the timing and performance of the low-level code with respect to the data hazards in the pipeline. After successful verification, the results can be used in a formal method environment to model and verify the low-level code for correctness against the timing and requirement specifications. We demonstrate the proposed framework by analyzing and verifying the low-level context switch sequence of a classic AUTOSAR-based RTOS and the kernel startup sequence of FreeRTOS for correctness against hardware effects in the AURIX TriCore architecture. In addition, we show an empirical evaluation of our framework to examine the scalability, performance, and state space.

We present in this paper, a fair and starvation-free spin-lock protocol for partitioned fixed priority (P-FP) preemptive multi-core real-time operating systems (mRTOS). We discuss some strongly related works in this regard and highlight the drawbacks with respect to the AUTOSAR standards. We then proceed to define a system model and develop a mathematical framework to calculate an upper bound on the blocking time a task incurs under our protocol. We also discuss how our protocol was implemented in a state-of-the-art AUTOSAR-compliant mRTOS. Finally, through experimental evaluation, we show that our protocol performs better than the existing spinlock protocol of the mRTOS.

Traditional embedded Real-Time Operating Systems (RTOS) or Basic Software (BSW) implementations typically require manual porting to new hardware platforms. However, this approach can be time-consuming and error-prone, especially given the frequent introduction of new or upgraded hardware architectures. In addition, traditional testing methods may not fully capture the complexity and nuances of the system, making it difficult to ensure correctness and dependability. To address these challenges, we propose a comprehensive methodology that integrates formal methods, a WCET tool, and a code generation technique. We use formal methods to create models and verify their correctness against functional and non-functional specifications or properties such as safety, liveness, and timing. We use the WCET tool as a microarchitecture analyzer to analyze the low-level binary code. The intermediate results of the tool are used to verify the correctness of the software implementation against the runtime effects of the hardware, such as data/memory race conditions. Finally, the code is generated from the formal models. Our proposed framework simplifies the maintenance of RTOS or BSW implementations while ensuring their correctness and partially automating portability to new hardware architectures.

This paper presents an open-source approach to automatically stitch FPGA fabrics generated by FABulous. We use the Python API provided by OpenLane 2 to programmatically place pins and macros. The tiles of the fabric are arranged and stitched together depending on their size and the geometry of the FPGA. Thus, much faster design iterations can be achieved for various homogeneous FPGA fabrics. We compare fabric stitching with a simple, non-hierarchical approach, so-called sea of gates, in terms of time required for the physical implementation, maximum RAM usage and area demand. Our findings show that the sea of gates approach yields the best results in terms of area, but also requires significant runtime for large fabrics. For an FPGA with the size of 10x10 Configurable Logic Blocks, fabric stitching takes 12 times less runtime and consumes only 21% of the maximum RAM compared to the sea of gates approach for the same target density of 50%, as the tiles only need to be hardened once and are then stitched together. Fabric stitching with higher-density tiles (70%) reduces the area overhead to -4.17%, meaning less area demand than the sea of gates approach for just a small runtime increase. The physical implementation is performed using the open-source SKY130 PDK.