WO2017024371A1

WO2017024371A1 - Method and device for analysing and timing the critical application of a multicore processor

Info

Publication number: WO2017024371A1
Application number: PCT/BR2016/050189
Authority: WO
Inventors: Fabian Luis VARGAS; Bruno Naspolini GREEN
Original assignee: Uniao Brasileira De Educacao E Assistencia
Priority date: 2015-08-11
Filing date: 2016-08-11
Publication date: 2017-02-16
Also published as: BR102015019186A2

Abstract

The present invention describes a method for precisely determining the maximum execution time of a critical task of an embedded system based on a multicore processor. For that purpose, the use of a specific hardware is proposed, with the function of analysing and timing the execution of the task. More specifically, the purpose of the system is to ensure that the maximum response time of the critical function of the program executed by the processor does not exceed a preset limit, and should this critical task not be completed before the limit, the system disables the other processor cores, keeping in operation only the core that is executing the critical task. The specific hardware, which is implemented with a watchdog system, is configured with information relevant to the execution of the critical program in isolation (that is to say, in a processor with a single core), with reduced computational complexity and extreme feasibility, monitoring the execution time of the task without needing to know what is the maximum value of the execution time of this program in an environment with multiple microprocessor cores. The present invention pertains to the fields of eletronics and computer science.

Description

Patent Invention Descriptive Report

METHOD AND DEVICE FOR ANALYSIS AND TEMPORAL CONTROL OF CRITICAL APPLICATION OF A MULTICORE PROCESSOR

Field of the Invention

[0001] The present invention describes a process of accurately determining the maximum critical task execution time of an embedded system based on a multicore processor. Therefore, it is proposed to use a specific hardware whose function is to analyze and control the execution time of that task. This invention lies in the fields of Electronics and Computing.

Background of the Invention

For embedded systems to be used in critical applications such as an aircraft's on-board computer or the ABS or Air-Bag brake controller in a car, these systems must be certified by international bodies. The purpose of this certification is to ensure that the maximum response time of a program (software) executed by the embedded system processor is not greater than the time defined by these bodies, ensuring safety and precision in performing a critical task.

For example, when a pilot manages the joystick of his aircraft, the program responsible for handling the joystick must respond to a specific command within a few milliseconds, otherwise the program is considered unsafe / inaccurate. and the on-board computer is not certified by international organizations.

[0004] This requirement for international certification requires an accurate technique for estimating the response time of a given critical function program. Some of the techniques widely used by companies / universities to estimate maximum execution time (WCET) Worst-Case Execution Time) of the critical task of a given program are known as "Static Timing Analysis" and "Dynamic Timing Analysis".

"Static Time Analysis" techniques are fundamentally based on the simulation of abstract processor architecture models. These models substantially describe the evaluated critical task instruction set, the number of clock periods (CPI) to execute each of these instructions, the processor pipeline organization, the various processor cache levels, and other architectural details. . These models are described in high level programming language such as C or C ++. In addition to these processor models, we use the Graph Theory and Integer Linear Programming (ILP) to compute the WCET of the program in question. These techniques have the great advantage of never underestimating WCET and are often accurate software tools in calculating this parameter.

"Dynamic Time Analysis" techniques are based on measurements made directly on the hardware platform. In this scenario, you must have a hardware platform already in place and operating in the embedded system. The system starts with all possible input data as if it were operating under normal conditions. At the same time, the maximum execution time of the critical program is measured, ie the WCET of this program is measured. The great advantage of these techniques over static analysis techniques is the fact that the time required to estimate WCET is reduced due to two reasons: computational simplicity, since processor models and complex control flow graphs critical tasks are no longer needed for WCET determination; and the hardware execution of the program in question is much faster than the simulation processes of this program in abstract processor models or complex control flow graph analysis. The world's most renowned universities and research centers typically study, propose and work with static time analysis techniques, while companies, because they are more practical and less formal than universities, prefer to use dynamic time analysis techniques. . Still, it is known that the described techniques present a number of shortcomings and problems that must be taken into account during the WCET evaluation of a program whose application is critical.

In static time analysis techniques, the problem addresses the fact that a multicore processor, containing multiple cores, in which multiple tasks run concurrently on each core makes the execution time of each task extremely variable, which makes WCET calculation impossible. This is because, in addition to the critical task running on a given core, the other tasks performed by other processor cores perform asynchronous and random access to the system's global and peripheral memories, which makes it possible to use runtime prediction algorithms. in any program an extremely complex task.

In the case of dynamic time analysis techniques, we have two main difficulties: first, it is impossible to know in advance which of all possible system input data produces the largest WCET, as they are not exhaustively generated all this data, which implies a great uncertainty in the WCET calculation; and secondly, as described by the "Static Time Analysis" techniques, a multicore, multi-core processor running multiple tasks per core simultaneously makes the execution time of each task extremely variable, making WCET impossible to determine.

In the search for the state of the art in scientific and patent literature, the following documents dealing with the subject were found:

US2009 / 0307700 relates to a US filed patent for a system, in a processor structure, adapted for performing critical tasks in multi-core architectures, and comprising means for determining the time remaining in relation to the runtime deadline. The system monitors whether the critical task requires the use of any resources (for example, the system's global memory access bus) that at that moment some ordinary (less critical) task is using. If so, the proposed technique calculates the critical task wait time for this resource and if this time is equal to or greater than a "slack time"{"slack time = WCET - deadline", where WCET was determined with the task critical running in isolation on the processor) the non-critical task is stopped, the resource allocated for the critical task is released, and the ordinary task is paused, keeping only the critical task running until it finishes. Once the critical task is completed, the remaining ordinary tasks are restarted. Thus, the processor runs in "shared" mode until the critical task wait time for a given resource allocated to one or more non-critical tasks is less than slack time, but note that the author does not take into account the fact that the critical task can take different and shorter times than WCET to perform (which happens most of the time). In this case, the time period in which the processor runs in "shared" mode could be longer if the author took into account real-time monitoring of the critical task. This condition would cause the slack time to be dynamically adjusted in real time, which would result in a longer period of time for the processor to remain in "shared" mode and thus increasing the processor performance as much as possible without the risk of loss of power. system reliability due to possible deadline violation by the critical task. Subsequently, this patent was made public through work published in [0012], where further details were described.

[0012] The publication "Hardware Support for WCET Analysis of Hard Real-Time Multicore Systems" by authors Marco Paolieri, Eduardo Quihones, Francisco J. Cazorla, Guillem Bernat and Mateo Valero, reveal more details about the same multicore processor-sharing architecture for real-time applications, described earlier in US2009 / 0307700. Note that one of the co-authors of this publication is also the author of the patent (Francisco J. Cazorla). The architecture presented in the article allows the analysis of the time of a given critical task determining its maximum execution times. Thus, at the moment the execution of a critical task begins, a configuration called WCET Computation Mode causes that task to be performed in isolation, interrupting the remaining ordinary tasks. Content described in the publication, however, reports that the system stops an ordinary task as soon as a critical task is started. This fact (as in the example described previously in US2009 / 0307700) reveals that a single switchover is performed between the processor cores described in the article, compulsorily pausing the ordinary task (and others, if any) until the task is completed critical, which causes a loss in system performance.

[0013] The publication "Virtual Simple Architecture (VISA): Exceeding the Complexity Limit in Safe Real-Time Systems" by authors Aravindh Anantaraman, Kiran Seth, Patty Kaustubh, Eric Rotenberg, Frank Mueller, reveals a system for detecting WCET A hardware-based watchdog circuit-critical task that monitors and maps the checkpoints of a critical task performed concurrently with other ordinary tasks on a complex processor pipeline. If it is detected by the watchdog that any critical task checkpoints have been violated while running the processor in the processor pipeline, the technique assumes that all architectural features that made the pipeline unpredictable are disabled, leaving the critical task to run in the pipeline with " static prediction of "conditional offsets" and "execution-in-order of statements", for example, and mainly disable pipeline execution of other ordinary tasks. Thus, the content described in Publication reports that the system halts an ordinary task if it detects that any critical task checkpoints are violated during its execution in the pipeline. This fact reveals that a single switch is performed between the processor cores described in the article, compulsorily pausing the ordinary task (and the others, if any) until the end of the critical task, which causes a loss in system performance.

Thus, from what is clear from the researched literature, no documents were found anticipating or suggesting the teachings of the present invention, so that the solution proposed here has novelty and inventive activity in relation to the state of the art.

In other words, the current analysis and time control techniques, as well as the background content of the present invention, cannot accurately determine the maximum execution time (WCET) of a program executed by a multicore processor. . In addition, they have a low throughput because they do not switch between processor cores; and temporarily pause ordinary tasks as soon as critical task execution begins, rather than pausing an ordinary task only when the critical task execution time exceeds a predetermined threshold.

Summary of the Invention

Thus, the present invention aims to solve the constant problems in the state of the art by means of a system capable of determining exactly the maximum execution time (WCET) of a given critical task, which is performed by a program executed. by a multicore processor. The purpose of the system is to ensure that the maximum response time of the program critical function executed by the processor does not exceed a predefined limit, and if this critical task is not completed to the limit, the system disables the remaining processor cores, keeping in operation only the core that is performing the critical task. This fact becomes extremely important in technologies that use embedded systems, since a system that takes a long time to respond to a certain command can cause severe damage.

In this scenario, specific hardware is implemented, implemented by a watchdog system, and configured with information pertinent to the execution of the critical program in isolation (ie on a single core processor), which is of complexity. computationally limited and extremely feasible. The watchdog is configured with the value of the maximum time allocated for the execution of the critical task, according to the requirements of international organizations and according to the application niche. Thus, the hardware has the function of monitoring the execution time of said task without needing to know what is the value of WCET for this program in a multi-core microprocessor environment.

It is also noteworthy that, in the case of the present invention, there is no need to develop models, perform abstract processor simulations (as in the case of "Static Time Analysis" techniques), or thoroughly exercise the embedded system hardware platform. with an endless number of input data (as with "Dynamic Time Analysis" techniques). In addition to these advantages of the proposed invention, it should be stressed that the watchdog design presents less complexity than WCET calculation via theoretical analysis or by measurements directly on the hardware platform, as performed by existing techniques.

These and other facts make the present invention a solution capable of ensuring that the maximum time allocated for running a given program will not be exceeded in a multi-core microprocessor environment, each performing one or more tasks.

These and other objects of the invention will be immediately appreciated by those skilled in the art and companies having an interest in the segment, and will be described in sufficient detail for their reproduction in the following description. Brief Description of the Figures

The following figures are presented in order to further define and clarify the contents of this patent application:

[0022] Figure 1 illustrates the execution timeline of a critical task, indicating its control milestones.

Figure 2 illustrates an example of applying the technique proposed by the present invention in the form of a block diagram of the interior of the hardware.

[0024] Figure 3 illustrates a didactic diagram of the watchdog operation (W).

Detailed Description of the Invention

The following descriptions are given by way of example and not limiting the scope of the invention and will more clearly understand the subject matter of the present patent application.

In a first object, the present invention provides a method of accurately determining the maximum execution time (T) of a given critical task (TC), being a satisfactory programmed computer program or function in multicore processors. ; processors with two or more operating cores. The goal of the system is to ensure that the maximum program response time executed by a processor does not exceed a predefined timeout and, unlike existing techniques in this technical field, only if the critical core task (TC) does not is terminated before the timeout, the system disables the remaining processor cores, keeping only the core performing the critical task (TC) running. In technologies that use onboard computers in embedded systems, this knowledge becomes extremely important as a system that takes a long time to respond to a given command can cause severe damage.

[0027] In one embodiment, the device of which the present invention relates is a hardware implemented watchdog system (W), which is coupled to the processor bus with its memory. THE watchdog (W) is configured to determine and ensure that the maximum execution time (T), WCET {Worst-Case Execution Time), of a critical task (TC) does not exceed its deadline; remembering that deadline is the maximum deadline for the critical task (TC) established by international organizations. In other words, the WCET value must be less than the task execution deadline. Thus, a safety margin between the WCET limit and the deadline of said critical task (TC) is defined. These operating characteristics are exemplified by Figure 1 by means of a timeline.

The watchdog (W) consists of a checkpoint monitor block (MC) and a checkpoint time controller block (CTC). Through a General Purpose Input-Output (GPIO) signal, this block identifies the current critical task checkpoint, called CPID {Checkpoint ID). The second block determines, from the CPID time instant, its Critical Checkpoint Time (CCT), that is, the time required to configure the watchdog (W) at the current checkpoint, given by the expression: CCT (CPID) = Deadline - WCET (CPID). The checkpoint time controller block (CTC) also identifies when a task is started {CTaskStart) and when it is terminated {CTaskEnd) by sending flags to the watchdog block (WT), which has a timer (Temp) and is responsible for notifying the processor with the proper function to be performed. An example of how the technique proposed by the present invention can be implemented using such watchdog components (W) is didactically illustrated by the block diagram of Figure 2.

When a task is started, the watchdog timer (WT) starts monitoring the critical task (TC) runtime (T) through the timer (Temp). If the execution time (T) is greater than the time defined for safety margin (MS), given by deadline - WCET (CPID), of the current checkpoint, ie if the execution time (T) is greater than CCT (CPID), the system sends a Warning (Wng) command to the system bus. processor so that the remaining cores are disabled so that only the core with the critical task (TC) remains running. If the critical task (TC) execution time (T) exceeds the deadline reached (DR), the system displays an error and sends a reset signal to the processor to restart the system, placing it in a known state in which all registers will be "reset". If the Warning (Wng) command is not sent or the deadline is not exceeded, the logic described is repeated until the critical task (TC) is completed. Figure 3 illustrates a didactic diagram of this logical hardware operation.

The watchdog (W) mode of operation described herein is well represented by the concept of processor core switching, which increases system throughput. State-of-the-art documents and publications are unable to perform the process in multi-processor environments, and unlike the present invention, they temporarily pause the execution of other tasks as soon as the critical task (TC) is performed. ) starts.

Preferred Realization Example

[0031] In one preferred embodiment, in employing the device and / or method of the present invention in an aircraft control system, an aircraft pilot must handle the vehicle's joystick too precisely, either for military purposes. or commercial, ensuring that your goal is achieved accurately and without difficulty or risk. The on-board computer program, which controls the joystick, must respond to a specific command within a few milliseconds, in accordance with the requirements of international aviation bodies. Otherwise, the program is considered unsafe / inaccurate and the on-board computer is not certified / permitted by these international organizations for operation. Those skilled in the art will enhance the knowledge presented herein and may reproduce the invention in the embodiments disclosed and in other embodiments within the scope of the appended claims.

Claims

1 . Method of analysis and temporal control of the critical application of a multicore processor characterized by monitoring the execution time (T) of a critical task (TC) in one core and interrupting all other tasks performed in the other cores only when the critical task (T) execution (T) reaches a predetermined time limit (WCET).

Method according to claim 2, characterized in that the Watchdog Timer (WT) sends:

The. Warning signal (Wng) to disable other processor cores when the timer count (Temp) is equal to or greater than the difference between the deadline and the default time limit (WCET); or b. Normally set time range (DR) signal to restart Watchdog operation (W) when the timer count (Temp) is equal to or greater than the standard deadline.

Method according to claim 1, characterized in that it comprises the steps of:

The. check if a critical task (CT) has been started;

B. repeat the verification of step "a" until a critical task (TC) is started;

ç. start timer count (Temp) after detection of the start of a critical task (TC);

d. check if the critical task (CT) has been completed;

and. return to step "a" after the critical task (TC) ends; f. If the critical task (TC) has not been completed, compare the timer count (Temp) to date with the timeout value set by {deadline};

g. if the timer count (Temp) is equal to or greater than the deadline, restart the system; H. If the timer count (Temp) is less than the default time limit, compare the timer count (Temp) with the difference between the standard deadline and the predetermined time limit (WCET). ; i. if the timer count (Temp) is less than the difference between the deadline and the default time limit (WCET), return to step "d";

j. if the timer count (Temp) is equal to or greater than the difference between the deadline and the default time limit (WCET), disable processor cores that do not perform the critical task (TC) and return to step "d".

4. Device for analysis and temporal control of the critical application of a multicore processor characterized by the fact that it comprises:

The. Watchdog (W);

B. Checkpoint Monitor (MC);

ç. Checkpoint Time Controller (CTC); and

d. Watchdog Timer (WT) with Timer (Temp),

the device being coupled to the processor bus.

Device according to claim 4, characterized in that the Watchdog (W) comprises the Checkpoint Monitor (MC), the Checkpoint Time Controller (CTC) and the Watchdog Timer (WT) with Timer (Temp).

Device according to any one of claims 4 to 5, characterized in that the Checkpoint Monitor (MC) receives a signal from input, receive and send a clock signal (Clk), receive and send a Reset signal, and send a signal (CPID) identifying the current checkpoint.

Device according to Claim 6, characterized in that the Checkpoint Monitor (MC) receives a Reset signal only at the time of device initialization.

Device according to any one of claims 4 to 7, characterized in that the Checkpoint Time Controller (CTC) receives a signal (CPID), receives and sends a clock signal (Clk), receives and sends a reset signal, send the CTaskStart and CTaskEnd signals that mark the start and end of the critical task (TC), and send a watchdog configuration time (W) CCT signal from the current checkpoint.

Device according to Claim 8, characterized in that the Checkpoint Time Controller (CTC) receives a Reset signal only at the time of device initialization.

Device according to any one of claims 4 to 9, characterized in that the Watchdog Timer (WT) with Timer (Temp) receives said CCT, CTaskStart, CTaskEnd, Clock signal (Clk), and Reset signal, and send Warning signal (Wng) or standard time range signal (DR).

1 1. Device according to claim 6, characterized in that the Watchdog Timer (WT) receives a Reset signal at the time of device initialization.