arXiv subjects

Gerhard Fohler

Publications and source records attributed to Gerhard Fohler.

12 recordsLinked to original sources

arXiv2026

Exploring and Exploiting Synchrony Limitations of Time-Triggered Network-Agnostic Guardians

Time-triggered communication protocols rely on trusted components known as guardians to enforce adherence to predetermined network schedules. Network-agnostic guardians offer an efficient and scalable distributed solution with reduced implementation cost and complexity compared to network-aware alternatives. However, this efficiency is based on the guardian's dependence on the controlled node for clock synchronization, which introduces a vulnerability: a malicious node can exploit this dependency to launch timing attacks against its guardian and eventually interfere with messages from other nodes on the network. In this paper, we establish a theoretical lower bound on the attainable clock synchronization precision between a node and its network-agnostic guardian. Building on this result, we introduce a timing attack that leverages the unavoidably imperfect clock synchrony to cause controlled and undetected de-synchronization of the guardian. The attack enables a malicious node to cause collisions with targeted critical network messages. We evaluate the effectiveness of the attack using a FlexRay field bus network model implemented in the OMNeT++ simulation framework. Our results show that the attack is able to remain undetected with 100% success and disrupts the transmission of the critical messages of the target node by causing collisions with them with 100% success.

cs.CR↗

arXiv2025

Defending Event-Triggered Systems against Out-of-Envelope Environments

The design of real-time systems is based on assumptions about environmental conditions in which they will operate. We call this their safe operational envelope. Violation of these assumptions, i.e., out-of-envelope environments, can jeopardize timeliness and safety of real-time systems, e.g., by overwhelming them with interrupt storms. A long-lasting debate has been going on over which design paradigm, the time- or event-triggered, is more robust against such behavior. In this work, we investigate the claim that time-triggered systems are immune against out-of-envelope behavior and how event-triggered systems can be constructed to defend against being overwhelmed by interrupt showers. We introduce importance (independently of priority and criticality) as a means to express which tasks should still be scheduled in case environmental design assumptions cease to hold, draw parallels to mixed-criticality scheduling, and demonstrate how event-triggered systems can defend against out-of-envelope behavior.

cs.OS↗

arXiv2025

Decreasing Utilization of Systems with Multi-Rate Cause-Effect Chains While Reducing End-to-End Latencies

The Logical Execution Time (LET) model has deterministic properties which dramatically reduce the complexity of analyzing temporal requirements of multi-rate cause-effect chains. The configuration (length and position) of task's communication intervals directly define which task instances propagate data through the chain and affect end-to-end latencies. Since not all task instances propagate data through the chain, the execution of these instances wastes processing resources. By manipulating the configuration of communication intervals, it is possible to control which task instances are relevant for data propagation and end-to-end latencies. However, since tasks can belong to more than one cause-effect chain, the problem of configuring communication intervals becomes non-trivial given the large number of possible configurations. In this paper, we present a method to decrease the waste of processing resources while reducing end-to-end latencies. We use a search algorithm to analyze different communication interval configurations and find the combination that best decrease system utilization while reducing end-to-end latencies. By controlling data propagation by means of precedence constraints, our method modifies communication intervals and controls which task instances affect end-to-end latencies. Despite the sporadic release time of some task instances during the analysis, our method transforms those instances into periodic tasks. We evaluate our work using synthetic task sets and the automotive benchmark proposed by BOSCH for the WATERS industrial challenge.

eess.SY↗

arXiv2024

Safety-Critical Edge Robotics Architecture with Bounded End-to-End Latency

Edge computing processes data near its source, reducing latency and enhancing security compared to traditional cloud computing while providing its benefits. This paper explores edge computing for migrating an existing safety-critical robotics use case from an onboard dedicated hardware solution. We propose an edge robotics architecture based on Linux, Docker containers, Kubernetes, and a local wireless area network based on the TTWiFi protocol. Inspired by previous work on real-time cloud, we complement the architecture with a resource management and orchestration layer to help Linux manage, and Kubernetes orchestrate the system-wide shared resources (e.g., caches, memory bandwidth, and network). Our architecture aims to ensure the fault-tolerant and predictable execution of robotic applications (e.g., path planning) on the edge while upper-bounding the end-to-end latency and ensuring the best possible quality of service without jeopardizing safety and security.

cs.RO↗

arXiv2024

Multicore DRAM Bank-& Row-Conflict Bomb for Timing Attacks in Mixed-Criticality Systems

With the increasing use of multicore platforms to realize mixed-criticality systems, understanding the underlying shared resources, such as the memory hierarchy shared among cores, and achieving isolation between co-executing tasks running on the same platform with different criticality levels becomes relevant. In addition to safety considerations, a malicious entity can exploit shared resources to create timing attacks on critical applications. In this paper, we focus on understanding the shared DRAM dual in-line memory module and created a timing attack, that we named the "bank & row conflict bomb", to target a victim task in a multicore platform. We also created a "navigate" algorithm to understand how victim requests are managed by the Memory Controller and provide valuable inputs for designing the bank & row conflict bomb. We performed experimental tests on a 2nd Gen Intel Xeon Processor with an 8GB DDR4-2666 DRAM module to show that such an attack can produce a significant increase in the execution time of the victim task by about 150%, motivating the need for proper countermeasures to help ensure the safety and security of critical applications.

cs.CR↗

arXiv2023

Joint Time-and Event-Triggered Scheduling in the Linux Kernel

There is increasing interest in using Linux in the real-time domain due to the emergence of cloud and edge computing, the need to decrease costs, and the growing number of complex functional and non-functional requirements of real-time applications. Linux presents a valuable opportunity as it has rich hardware support, an open-source development model, a well-established programming environment, and avoids vendor lock-in. Although Linux was initially developed as a general-purpose operating system, some real-time capabilities have been added to the kernel over many years to increase its predictability and reduce its scheduling latency. Unfortunately, Linux currently has no support for time-triggered (TT) scheduling, which is widely used in the safety-critical domain for its determinism, low run-time scheduling latency, and strong isolation properties. We present an enhancement of the Linux scheduler as a new low-overhead TT scheduling class to support offline table-driven scheduling of tasks on multicore Linux nodes. Inspired by the Slot shifting algorithm, we complement the new scheduling class with a low overhead slot shifting manager running on a non-time-triggered core to provide guaranteed execution time to real-time aperiodic tasks by using the slack of the time-triggered tasks and avoiding high-overhead table regeneration for adding new periodic tasks. Furthermore, we evaluate our implementation on server-grade hardware with Intel Xeon Scalable Processor.

cs.OS↗

arXiv2023

Energy-aware Time- and Event-triggered KVM Nodes

Industries are considering the adoption of cloud and edge computing for real-time applications due to current improvements in network latencies and the advent of Fog and Edge computing. Current cloud paradigms are not designed for real-time applications, as they neither provide low latencies/jitter nor the guarantees and determinism required by real-time applications. Experts estimate that data centers use 1% of global electricity for powering the equipment, and in turn, for dealing with the produced heat. Hence, energy consumption is a crucial metric in cloud technologies. Applying energy conservation techniques is not straightforward due to the increased scheduling overheads and application execution times. Inspired by slot shifting, we propose an algorithm to support energy-aware time-triggered execution of periodic real-time VMs while still providing the ability to execute aperiodic real-time and best-effort VMs in the slack of the time-triggered ones. The algorithm considers energy reduction techniques based on dynamic power management and dynamic voltage and frequency scaling. We implement our algorithm as an extension to the Linux kernel scheduler (for use with the KVM hypervisor) and evaluate it on a server-grade Intel Xeon node.

cs.OS↗

arXiv2023

Reducing End-to-End Latencies of Multi-Rate Cause-Effect Chains for the LET Model

The Logical Execution Time (LET) model has been gaining industrial attention because of its timing and data-flow deterministic characteristics, which simplify the computation of end-to-end latencies of multi-rate cause-effect chains at the cost of pessimistic latencies. In this paper, we propose a novel method to reduce the pessimism in the latencies introduced by LET, while maintaining its determinism. We propose a schedule-aware LET model that shortens the lengths and repositions LET's communication intervals resulting in less pessimistic end-to-end latencies. By adding dependencies between specific task instances, the method can further reduce the pessimism in the latency calculations of the LET model. If needed, e.g., for legacy reasons, our method can be applied to a subset of tasks only. We evaluate our work based on real world automotive benchmarks and randomly generated synthetic task sets. We compare our results with previous work and the LET model. The experiments show significant reductions of worst-case data age and worst-case reaction latency values.

eess.SY↗

arXiv2023

Extensions for Shared Resource Orchestration in Kubernetes to Support RT-Cloud Containers

Industries are considering the adoption of cloud computing for real-time applications due to current improvements in network latencies and the advent of Fog and Edge computing. To create an RT-cloud capable of hosting real-time applications, it is increasingly significant to improve the entire stack, including the containerization of applications, and their deployment and orchestration across nodes. However, state-of-the-art orchestrators (e.g., Kubernetes) and underlying container engines are designed for general-purpose applications. They ignore orchestration and management of shared resources (e.g. memory bandwidth, cache, shared interconnect) making them unsuitable for use with an RT-cloud. Taking inspiration from existing resource management architectures for multicore nodes, such as ACTORS, and for distributed mixed-criticality systems, such as the DREAMS, we propose a series of extensions in the way shared resources are orchestrated by Kubernetes and managed by the underlying Linux layers. Our approach allows fine-grained monitoring and allocation of low-level shared resources on nodes to provide better isolation to real-time containers and supports dynamic orchestration and balancing of containers across the nodes based on the availability and demand of shared resources.

cs.DC↗

arXiv2022

Assessing Intel's Memory Bandwidth Allocation for resource limitation in real-time systems

Industries are recently considering the adoption of cloud computing for hosting safety critical applications. However, the use of multicore processors usually adopted in the cloud introduces temporal anomalies due to contention for shared resources, such as the memory subsystem. In this paper we explore the potential of Intel's Memory Bandwidth Allocation (MBA) technology, available on Xeon Scalable processors. By adopting a systematic measurement approach on real hardware, we assess the indirect memory bandwidth limitation achievable by applying MBA delays, showing that only given delay values (namely 70, 80 and 90) are effective in our setting. We also test the derived bandwidth assured to a hypothetical critical core when interfering cores (e.g., generating a concurrent memory access workload) are present on the same machine. Our results can support designers by providing understanding of impact of the shared memory to enable predictable progress of safety critical applications in cloud environments.

cs.DC↗

arXiv2021

Clock Synchronization in Virtualized Distributed Real-Time Systems using IEEE 802.1AS and ACRN

Virtualization of distributed real-time systems enables the consolidation of mixed-criticality functions on a shared hardware platform thus easing system integration. Time-triggered communication and computation can act as an enabler of safe hard real-time systems. A time-triggered hypervisor that activates virtual CPUs according to a global schedule can provide the means to allow for a resource efficient implementation of the time-triggered paradigm in virtualized distributed real-time systems. A prerequisite of time-triggered virtualization for hard real-time systems is providing access to a global time base to VMs as well as to the hypervisor. A global time base is the result of clock synchronization with an upper bound on the clock synchronization precision. We present a formalization of the notion of time in virtualized real-time systems. We use this formalization to propose a virtual clock condition that enables us to test the suitability of a virtual clock for the design of virtualized time-triggered real-time systems. We discuss and model how virtualization, in particular resource consolidation versus resource partitioning, degrades clock synchronization precision. Finally, we apply our insights to model the IEEE~802.1AS clock synchronization protocol and derive an upper bound on the clock synchronization precision of IEEE 802.1AS. We present our implementation of a dependent clock for ACRN that can be synchronized to a grandmaster clock. The results of our experiments illustrate that a type-1 hypervisor implementing a dependent clock yields native clock synchronization precision. Furthermore, we show that the upper bound derived from our model holds for a series of experiments featuring native as well as virtualized setups.

cs.DC↗

arXiv2018

Analysis of Dynamic Memory Bandwidth Regulation in Multi-core Real-Time Systems

One of the primary sources of unpredictability in modern multi-core embedded systems is contention over shared memory resources, such as caches, interconnects, and DRAM. Despite significant achievements in the design and analysis of multi-core systems, there is a need for a theoretical framework that can be used to reason on the worst-case behavior of real-time workload when both processors and memory resources are subject to scheduling decisions. In this paper, we focus our attention on dynamic allocation of main memory bandwidth. In particular, we study how to determine the worst-case response time of tasks spanning through a sequence of time intervals, each with a different bandwidth-to-core assignment. We show that the response time computation can be reduced to a maximization problem over assignment of memory requests to different time intervals, and we provide an efficient way to solve such problem. As a case study, we then demonstrate how our proposed analysis can be used to improve the schedulability of Integrated Modular Avionics systems in the presence of memory-intensive workload.

cs.DC↗