Determinism in Embedded Real-Time Systems and EDMS

Introduction

ETAS Deterministic Middleware Solution (EDMS, formerly AOS) is a middleware framework targeting the specific challenges and requirements of automotive applications, especially for advanced driver assistance systems (ADAS) and autonomous driving (AD). It provides tools, a runtime environment, and integration capabilities to support development of high-performance, safety-relevant applications.

Determinism in Embedded Real-Time Systems

What is determinism

Determinism in embedded real-time systems refers to the predictability and repeatability of system behavior under specified conditions. In a deterministic system, given the same initial state and inputs, the system will always produce the same outputs and follow the same sequence of actions. Predictability is critical in real-time systems, which must meet timing requirements while ensuring reliable and correct operation.

Time determinism

Time determinism denotes predictability and repeatability of system behavior with respect to time. A system is time-deterministic when its timing behavior is consistent and can be predicted precisely.

Factors that influence time-deterministic behavior include:

• Fixed execution time: Each task or process should have a known, bounded execution time to ensure consistent completion times.
• Predictable task scheduling: The scheduling algorithm should be predictable so task execution order and timing can be determined in advance.
• Minimal interrupt latency: Interrupts can preempt normal execution. Interrupt latency, the time between interrupt occurrence and start of handling, should be minimized and predictable.
• Consistent hardware performance: Processors, memory, and peripherals should exhibit consistent and repeatable performance characteristics, as hardware variability causes timing uncertainty.
• Real-time clock accuracy: A stable clock source with precise timing is required for accurate scheduling and time measurement.
• Deterministic communication: Communication protocols between components should provide bounded delivery times, limited latency, and minimal jitter.
• Resource reservation and allocation: Reserving resources, such as fixed time slots for specific tasks, ensures tasks receive required resources within known time windows.
• Avoidance of non-deterministic delays: Reduce or manage sources of unpredictability, such as unpredictable I/O access or waiting for external events.

Achieving time determinism is complex, but it is essential for safety-critical domains like automotive control systems, avionics, medical devices, and industrial automation.

Data determinism

Data determinism refers to consistency and predictability of system behavior in terms of data processing. Given the same input dataset, and assuming identical initial conditions and execution environment, a data-deterministic system will produce the same output.

Key aspects of data determinism in embedded real-time systems include:

• Consistent data processing: Ensures sensor data, control signals, and other inputs are processed consistently to generate identical outputs under the same conditions.
• Deterministic algorithms: Data-processing algorithms should be designed to be deterministic. Non-deterministic algorithms can produce variable results even with identical inputs, undermining real-time guarantees.
• Avoidance of non-deterministic elements: Minimize or carefully manage sources of variability, such as random number generators, asynchronous external events, or unpredictable interrupt handling.
• Reproducibility: Deterministic behavior enables consistent reproduction of scenarios for testing, debugging, and verification.
• Real-time constraints: Meeting timing requirements also depends on deterministic data processing, since decisions based on sensor data must be made within specified time windows.
• Deterministic communication protocols: Use communication protocols that guarantee predictable transmission and reception for consistent system-level determinism.
• Validation and verification: For safety-critical applications, verification processes rely on predictable and consistent data handling to demonstrate correctness.

Implementing data determinism requires careful design of algorithms, data structures, and communication mechanisms, and often involves addressing sources of nondeterminism in both hardware and software.

Determinism in EDMS

Systems built with EDMS for ADAS/AD emphasize data determinism because consistent and predictable data processing is essential for verifying system correctness. The following sections describe EDMS scheduling mechanisms and how deterministic recompute accelerates ADAS/AD development.

EDMS Scheduling Mechanisms

Overview of scheduling

In automotive embedded software, scheduling determines the execution order and timing of tasks and processes the system must perform. Automotive systems often have strict real-time requirements and must complete tasks within specified deadlines to ensure correct vehicle operation.

Why scheduling is needed

Scheduling is critical to ensure system safety, reliability, and predictability. Proper scheduling techniques help meet time constraints of various automotive applications and ensure critical tasks execute within required time windows under all operating conditions.

Data-driven scheduling

Data-driven scheduling makes task execution decisions based on runtime data and current conditions rather than relying solely on predefined priorities or fixed schedules.

Time-driven scheduling

Time-driven scheduling executes tasks according to a predefined schedule that is typically fixed before runtime. Tasks are assigned specific time slots or intervals during which they are expected to run.

Typical ADAS/AD architecture

Many sensors, such as cameras, radar, lidar, and ultrasonic sensors, produce high-rate measurement data. Sensor data is processed to detect and extract objects, and results are transformed into a common coordinate system using SoCs that include microprocessors and hardware accelerators.

Preprocessed sensor data is fused to form a coherent view of the surrounding environment. Planning computes driving actions based on that fused view. Before actuating, those planned actions are synchronized and typically executed on microcontrollers.

Choosing the appropriate scheduling mechanism

Different subsystems in ADAS/AD have different scheduling needs:

• Perception tasks that include feature extraction are sensor-driven. Event-driven scheduling is well suited for these tasks because it provides low latency.
• Sensor fusion and planning are actuator-driven. Time-triggered activation is preferable for these tasks because it ensures high predictability, which is critical for safety of the intended function (SOTIF).

Scheduling in EDMS-based systems

To meet ADAS/AD scheduling requirements, EDMS supports activities triggered by time and by data.

Ensuring data consistency

EDMS enforces the following concepts to ensure data consistency:

• Freeze input data at activity start: An activity's input data is fixed and does not change after the activity starts.
• Delay output until activity end: Output produced by an activity is held and not released until the activity completes.
• All-or-nothing data visibility between activities: Data visibility between activities follows an all-or-nothing model. Either all data from one activity is visible to another, or none is visible.
• Delayed activation to avoid parallel execution: If another activity is running, activation is delayed to ensure activities do not run in parallel.

Properties of EDMS-based systems

• Fewer system states compared with purely data-driven systems: Systems built with EDMS typically have significantly fewer possible states than purely data-driven systems.
• Lower latency than purely time-driven systems: EDMS-based systems often exhibit much lower latency than fully time-driven systems.

Determinism in EDMS-based systems

Due to scheduling and computational jitter, a system composed of activities is not completely time-deterministic: jitter introduces non-time-deterministic behavior.

However, EDMS-based systems can provide reproducible behavior in the following ways:

• Software lockstep (real-time): Activities in software can be synchronized and executed in lockstep.
• Fully identical recompute: The system can reproduce identical results through recompute, enabling consistent development scenarios such as forensic recompute or verification for problem analysis and debugging.

Deterministic Recompute and Virtual Drives

Overview

Autonomous driving systems must navigate complex environments. Deterministic recompute, together with virtual drives, provides a powerful approach for validation and development.

Deterministic recompute and virtual drives

Recompute processes recorded or generated data using the AD system. Deterministic recompute guarantees identical outputs for identical inputs. Virtual drives create a simulated environment that reproduces real-world driving scenarios, forming a controlled digital space for testing without extensive on-road validation.

Non-deterministic behavior in ROS

The Robot Operating System (ROS) is an open middleware framework used to develop robotic systems and is often used in ADAS/AD research. Although ROS provides many development facilities, recomputing with identical input data can yield different outputs due to nondeterministic behavior.

Deterministic behavior in EDMS

EDMS is designed specifically for ADAS/AD development. Recomputing with identical input data in EDMS yields identical results.

Use cases for deterministic recompute

Deterministic recompute typically supports three main applications:

• Problem analysis and debugging
• Function development
• Simulation-based validation

Problem analysis and debugging

When an issue occurs in the field, deterministic recompute together with virtual drives allows developers to reproduce defects on a desktop development environment. This forensic capability simplifies investigation, aids debugging, and speeds fault localization.

Function development

In a virtual drive environment, deterministic recompute enables developers to quickly analyze new functions and software changes, shortening feedback cycles and accelerating development. This combination ensures seamless integration with the virtual environment for precise testing.

Simulation-based validation

Continuous validation relies on robust regression testing. Deterministic recompute and virtual drives enable large-scale, repeatable regression testing for each software change. This supports software reliability and integrates with broader validation and verification processes.

Significance for automotive safety and development

For safety-critical automotive systems that must comply with ISO 26262 and ASIL-D requirements, deterministic recompute and virtual drives help meet verification and validation needs. Real-time execution, large-scale data processing, and long-duration recording are essential capabilities for simulation-based testing.

By reproducing internal system data rather than storing massive datasets, deterministic recompute can optimize testing and greatly reduce storage requirements, representing an important step in accelerating AD system development.