Mixed-Criticality System

The system enforces a fixed, pre-determined time-division multiplexing schedule where each virtual machine or container is allocated a dedicated time slot on the processor. This prevents a runaway non-critical application from consuming CPU cycles needed by a safety-critical control loop.

• Time-Triggered Scheduling: Tasks execute according to a static timetable, not dynamic events, ensuring deterministic worst-case execution time.
• Zero Interference: A fault in a Linux-hosted analytics container cannot delay a real-time PLC function executing in its designated window.
• Mechanism: Relies on a real-time hypervisor or a PREEMPT_RT kernel with strict CPU pinning to enforce the schedule at the microsecond level.

Hardware-enforced memory partitioning ensures that each software component operates within its own private address space. A buffer overflow or memory leak in a non-critical edge analytics process cannot corrupt the memory of a safety-rated controller executing on the same silicon.

• IOMMU/SMMU: The system uses an Input-Output Memory Management Unit to map device DMA accesses to specific memory regions, preventing rogue peripherals from overwriting critical data.
• Static Allocation: Memory for critical partitions is allocated at boot time and never dynamically requested, eliminating the risk of out-of-memory errors.
• MPU/MMU Enforcement: Leverages the Memory Protection Unit on ARM cores or the Memory Management Unit on x86 to trap illegal access attempts immediately.

Data exchange between critical and non-critical partitions does not use shared memory, which would break spatial isolation. Instead, communication occurs via asynchronous message passing over a hypervisor-mediated virtual network or a shared memory ring buffer with strict access control.

• Virtual Ethernet: A point-to-point virtual NIC pair connects a real-time OS partition to a general-purpose OS partition, with traffic policed to prevent bandwidth saturation.
• OPC UA Pub/Sub over TSN: For external communication, the system uses publish-subscribe protocols over Time-Sensitive Networking to guarantee bounded latency even on converged networks.
• Bounded Queues: Message queues have fixed depths; a non-critical subscriber that stops consuming messages will never cause the critical publisher to block.

The entire mixed-criticality stack rests on a Type-1 hypervisor that has been certified to IEC 61508 SIL 3 or ISO 26262 ASIL D. This minimal software layer is formally verified to ensure its own failure rate is negligible.

• Minimal Trusted Computing Base (TCB): The hypervisor consists of only a few thousand lines of code, making exhaustive formal verification feasible.
• Lockstep Execution: For the highest safety levels, the hypervisor can run a redundant VM in lockstep on a separate core, comparing outputs cycle-by-cycle to detect silent data corruption.
• Health Monitoring: A dedicated watchdog partition monitors the liveness of all other partitions and can trigger a safe state transition if a critical function misses its deadline.

Single Root I/O Virtualization allows a single physical network interface card to present multiple virtual functions directly to individual virtual machines. This bypasses the hypervisor for data-plane I/O, eliminating virtualization overhead for latency-sensitive control traffic.

• Direct Device Assignment: A real-time VM gets exclusive, direct access to a dedicated virtual function of the NIC, achieving bare-metal I/O latency.
• Bandwidth Reservation: Each virtual function is allocated a guaranteed slice of the physical link bandwidth, preventing a non-critical data logger from starving a motion control stream.
• Interrupt Steering: Hardware interrupts from a specific virtual function are routed directly to the assigned physical CPU core, avoiding cache pollution on cores running other workloads.

The system employs scheduling policies that dynamically adapt to the criticality level of the current operational mode. If the system transitions to a high-criticality state, non-critical tasks may be temporarily suspended to guarantee resources for safety functions.

• Vestal Model: The classic mixed-criticality scheduling model where each task has multiple worst-case execution time estimates, one per criticality level. The scheduler uses the more conservative estimate when criticality escalates.
• Criticality Mode Change Protocol: A formal handshake ensures all partitions are aware of the current system-wide criticality level, preventing a non-critical partition from continuing to consume resources during an emergency.
• Graceful Degradation: Non-critical functions like predictive maintenance dashboards are paused or run at reduced fidelity, not crashed, preserving system state for post-incident analysis.