Real-Time Hypervisor

A Type-1 hypervisor installs directly onto the physical hardware without an underlying host operating system. This eliminates the overhead and jitter introduced by a general-purpose OS, granting the hypervisor direct control over CPU cores, memory, and I/O devices. By sitting at the hardware level, it enforces strict spatial and temporal isolation between virtual machines (VMs), ensuring a real-time operating system (RTOS) guest can execute deterministic control loops while a general-purpose operating system (GPOS) runs analytics or HMI workloads on adjacent cores without interference.

To guarantee deterministic execution, the hypervisor dedicates specific physical CPU cores exclusively to a single VM through CPU pinning. This prevents the scheduler from migrating real-time threads, eliminating cache misses and translation lookaside buffer (TLB) flushes that cause non-deterministic jitter. Advanced implementations extend this with cache allocation technology (CAT) to partition the last-level cache (LLC), reserving a dedicated cache way for the RTOS. This prevents the GPOS from evicting critical control loop data, ensuring consistent memory access latency measured in single-digit microseconds.

Single Root I/O Virtualization (SR-IOV) allows a single physical network interface card (NIC) to present itself as multiple independent virtual functions (VFs). The hypervisor assigns these VFs directly to VMs, bypassing the virtual switch in the hypervisor layer entirely. For a real-time VM communicating via EtherCAT or PROFINET IRT, this direct hardware access eliminates the latency and non-determinism of software-based packet forwarding, enabling cycle times down to 31.25 µs for motion control applications.

The foundational requirement for a mixed-criticality system is absolute isolation. Temporal isolation guarantees that the RTOS VM receives its allocated CPU time slice with microsecond precision, regardless of the GPOS workload. This is enforced through a strict hierarchical scheduler. Spatial isolation prevents any VM from accessing another's memory region, protecting a Safety Integrity Level (SIL) certified control function from corruption by a non-critical Linux application. This allows a single edge server to consolidate what previously required separate physical controllers.

While VMs are strictly isolated, high-throughput data exchange is essential for a consolidated system. A real-time hypervisor provides a zero-copy shared memory (ivshmem) mechanism. The RTOS VM writes sensor data to a designated memory region, and the GPOS VM reads it directly without a network stack. This achieves sub-microsecond latency for data handoff, enabling a Linux-based AI inference engine to process real-time telemetry from a virtualized PLC without impacting the control loop's determinism.

In high-availability architectures, a real-time hypervisor enables live migration of a running VM between two physical hosts without stopping the control application. The hypervisor iteratively copies the VM's memory state to the destination while the source continues executing. During the final cutover, the system pauses for a brief, deterministic window—often under 100 milliseconds—to transfer the remaining dirty pages and CPU state. This allows industrial operators to perform hardware maintenance or load balancing without a production line stoppage.

A real-time hypervisor allows a single industrial PC to simultaneously host a Soft PLC running a real-time operating system for motion control and a general-purpose OS for edge analytics and visualization. This eliminates the need for separate physical controllers and industrial PCs, reducing hardware footprint, cabling complexity, and energy consumption. CPU pinning and SR-IOV ensure that the control workload receives dedicated processor cores and direct I/O access, preventing the analytics workload from introducing jitter into the deterministic control loop.

In safety-certified environments, a real-time hypervisor enforces strict temporal and spatial isolation between a Safety Integrity Level (SIL) rated control function and non-critical monitoring tasks. The hypervisor's partitioning guarantees that a fault in the general-purpose OS cannot corrupt the memory or steal the CPU cycles of the safety function. This architecture supports IEC 61508 compliance by providing freedom from interference, allowing a certified safety controller to run alongside a Linux-based HMI on shared silicon without compromising the safety case.

High-availability production lines leverage live migration to move a running virtualized PLC instance from a failing or maintenance-bound physical host to a healthy standby server without stopping the control process. The real-time hypervisor preserves the exact execution state, memory contents, and network connections during the transfer. This capability enables predictive maintenance of the compute hardware itself—technicians can service or replace edge servers during production runs without incurring costly line stoppages or losing production state.

Before physical deployment, a real-time hypervisor hosts the actual production PLC code in a virtual machine connected to a digital twin simulation of the manufacturing cell. This hardware-in-the-loop configuration validates control logic, timing behavior, and exception handling against a high-fidelity virtual model. Engineers can test edge cases and destructive scenarios safely, drastically reducing on-site commissioning time. The same hypervisor image used for virtual commissioning is deployed directly to the factory floor, ensuring binary-identical execution between test and production.

A real-time hypervisor partitions a Neural Processing Unit (NPU) and GPU alongside dedicated CPU cores, allowing a vision inspection model running on a Linux VM to share hardware with a deterministic motion controller on an RTOS VM. The hypervisor manages accelerator resource allocation to prevent the AI inference workload from starving the control task of compute cycles. This architecture enables closed-loop quality control where a defect detected by computer vision triggers an immediate, deterministic rejection action from the PLC—all on a single edge node.

A real-time hypervisor hosts a Virtualized Network Function (VNF) such as a TSN-aware industrial switch or OPC UA Pub/Sub broker alongside control workloads. This enables software-defined networking on the factory floor, where traffic shaping and VLAN segmentation are configured programmatically rather than through physical rewiring. The hypervisor guarantees that Time-Sensitive Networking (TSN) schedules are enforced with microsecond precision, ensuring isochronous real-time traffic coexists with best-effort IT data on a single converged Ethernet fabric.

The technique of binding a specific virtual machine vCPU or process thread exclusively to a dedicated physical processor core. This eliminates cache thrashing and scheduling jitter in latency-sensitive control applications.

• Prevents the hypervisor scheduler from migrating critical threads
• Ensures L1/L2 cache warmth for isochronous control loops
• Often combined with interrupt affinity for complete determinism

A consolidated computing architecture where safety-critical control functions (SIL 3) and non-critical edge applications execute on a single hardware platform. The real-time hypervisor enforces strict temporal and spatial isolation between domains.

• Prevents low-criticality tasks from starving high-criticality ones
• Uses hardware-assisted virtualization (VT-x/AMD-V) for memory isolation
• Reduces hardware footprint while maintaining certifiable separation