Level 5 — MasteryEmbedded Systems & Real-Time Software

Embedded Systems & Real-Time Software

90 minutes60 marksprintable — key stays hidden on paper

Level: 5 — Mastery (cross-domain: math + physics + coding, build/prove) Time limit: 90 minutes Total marks: 60

Instructions: Answer all three questions. Show all derivations. Where code is requested, C targeting ARM Cortex-M with FreeRTOS is assumed. State every assumption explicitly.


Question 1 — Real-Time Schedulability of an Avionics Sensor Node (24 marks)

An ARM Cortex-M4 node runs three periodic hard-real-time tasks under a fixed-priority preemptive RTOS. Tasks are scheduled Rate-Monotonic (shorter period → higher priority).

Task Period TiT_i (ms) WCET CiC_i (ms)
τ1\tau_1 (IMU sample via ADC+DMA) 5 1.0
τ2\tau_2 (CAN telemetry) 10 2.0
τ3\tau_3 (control law) 20 5.0

(a) Compute the total CPU utilisation U=Ci/TiU=\sum C_i/T_i. State the Liu–Layland least-upper-bound Ulub(n)=n(21/n1)U_{lub}(n)=n(2^{1/n}-1) for n=3n=3 and determine whether the LL test guarantees schedulability. (5)

(b) The LL test is only sufficient. Using exact Response-Time Analysis (RTA) with the recurrence Ri(k+1)=Ci+jhp(i)Ri(k)TjCj,R_i^{(k+1)}=C_i+\sum_{j\in hp(i)}\left\lceil \frac{R_i^{(k)}}{T_j}\right\rceil C_j, compute the worst-case response time R3R_3 of τ3\tau_3 and confirm R3T3R_3\le T_3. Show every iteration. (7)

(c) A shared SPI bus is guarded by a mutex. τ3\tau_3 (lowest priority) holds the mutex for up to B=3B=3 ms while τ1\tau_1 (highest priority) then requests it. (i) Name the failure mode and explain, with a timeline sketch, the worst-case delay to τ1\tau_1 without any protocol. (ii) With the priority-inheritance protocol, add the blocking term to the RTA of τ1\tau_1: recompute R1R_1 and check R1T1R_1\le T_1. (8)

(d) State one reason the ADC sampling in τ1\tau_1 is placed on DMA rather than a per-sample interrupt, in terms of interrupt latency and WCET determinism. (4)


Question 2 — Signal Chain, Nyquist & DAC Reconstruction (18 marks)

The IMU analogue channel is a vibration sensor whose useful bandwidth is 00400 Hz400\text{ Hz}, but the sensor also carries a strong 1.3 kHz1.3\text{ kHz} mechanical resonance tone.

(a) You sample at fs=1 kHzf_s=1\text{ kHz}. Determine the Nyquist frequency and compute the aliased frequency at which the 1.3 kHz1.3\text{ kHz} tone appears in the digital signal. Show the folding arithmetic. (5)

(b) Give the minimum sampling rate that avoids aliasing of the resonance tone without an anti-alias filter, and state the required filter approach if you must keep fs=1 kHzf_s=1\text{ kHz}. (4)

(c) The ADC is 12-bit over a 003.3 V3.3\text{ V} range. Compute the LSB voltage (quantisation step) and the ideal SQNR in dB using SQNR=6.02N+1.76 dB\text{SQNR}=6.02N+1.76\text{ dB}. Then compute the number of bits NN needed so that the LSB is below 0.5 mV0.5\text{ mV} on the same range. (5)

(d) A timer generates PWM at a DAC-reconstruction stage. The timer clock is fclk=80 MHzf_{clk}=80\text{ MHz} and you need 10-bit PWM resolution. Compute the PWM carrier frequency (assume period = 2102^{10} counts, prescaler = 1). (4)


Question 3 — Safe Startup, Memory & CAN Arbitration (18 marks)

(a) Linker/startup (build task). On reset the Cortex-M loads two words from address 0x00000000. State what each is, and write the minimal C reset handler that (i) copies .data from flash LMA to RAM VMA and (ii) zero-fills .bss, using linker symbols _sidata,_sdata,_edata,_sbss,_ebss, before calling main(). Explain why .bss need not be stored in flash. (8)

(b) CAN arbitration (prove). Two nodes start transmitting simultaneously on a CAN bus using dominant-bit (0) / recessive-bit (1) arbitration. Node A has 11-bit identifier 0x2A5, Node B has 0x2A3. Determine which node wins arbitration and at which bit position the loser backs off. Show the bit-by-bit comparison and justify with the wired-AND bus rule. (6)

(c) Redundancy (reason). A flight controller uses TMR with a bit-wise majority voter over three channels producing 8-bit outputs A=0b10110010A=0b10110010, B=0b10100010B=0b10100010, C=0b10110011C=0b10110011. Compute the voted output bit-by-bit. Then state, in one sentence each, the difference between a fail-safe and a fail-operational response when a channel is permanently silent. (4)


End of paper.

Answer keyMark scheme & solutions

Question 1

(a) Utilisation (2 marks): U=15+210+520=0.2+0.2+0.25=0.65.U=\frac{1}{5}+\frac{2}{10}+\frac{5}{20}=0.2+0.2+0.25=0.65. LL bound (2): Ulub(3)=3(21/31)=3(1.25991)=0.7798U_{lub}(3)=3(2^{1/3}-1)=3(1.2599-1)=0.7798. Since U=0.650.7798U=0.65\le0.7798, the LL sufficient test guarantees the set is schedulable under RM (1).

(b) RTA for τ3\tau_3; hp(3)={τ1,τ2}hp(3)=\{\tau_1,\tau_2\} (1 mark for setup). Start R(0)=C3=5R^{(0)}=C_3=5. R(1)=5+5/5(1)+5/10(2)=5+1+2=8.R^{(1)}=5+\lceil5/5\rceil(1)+\lceil5/10\rceil(2)=5+1+2=8. R(2)=5+8/5(1)+8/10(2)=5+2+2=9.R^{(2)}=5+\lceil8/5\rceil(1)+\lceil8/10\rceil(2)=5+2+2=9. R(3)=5+9/5(1)+9/10(2)=5+2+2=9converged.R^{(3)}=5+\lceil9/5\rceil(1)+\lceil9/10\rceil(2)=5+2+2=9 \Rightarrow \text{converged}. R3=9 msT3=20 msR_3=9\text{ ms}\le T_3=20\text{ ms} ⇒ schedulable. (6 marks for iterations + conclusion.)

(c)(i) Failure mode = priority inversion (1). Timeline: τ1\tau_1 preempts and requests mutex held by τ3\tau_3; without protocol, a medium task τ2\tau_2 can preempt τ3\tau_3 (which still holds the lock), so τ1\tau_1 is blocked for an unbounded time — as long as τ2\tau_2-class work keeps running (2 for explanation + sketch). Worst uncontrolled delay ≫ BB. (ii) With priority inheritance the blocking is bounded by one critical section B=3B=3 ms. RTA of τ1\tau_1 (highest priority, hp(1)=hp(1)=\varnothing): R1=C1+B=1+3=4 ms.R_1=C_1+B=1+3=4\text{ ms}. R1=4T1=5R_1=4\le T_1=5 ⇒ still meets deadline. (4 marks: bounded blocking + computation + check.)

(d) DMA moves ADC samples to RAM without CPU per-sample ISR entry, so it removes the per-sample interrupt-latency contribution and the ISR execution time from every task's WCET, making timing deterministic and freeing the core for control. (4)

Question 2

(a) Nyquist =fs/2=500 Hz=f_s/2=500\text{ Hz} (1). Folding: 1300 Hz1300\text{ Hz} with fs=1000f_s=1000: 13001000=300 Hz1300-1000=300\text{ Hz} lies in band; general fold 130011000=300 Hz|1300-1\cdot1000|=300\text{ Hz} (3). Alias appears at 300 Hz (1) — inside the 0–400 Hz band, corrupting the signal.

(b) To satisfy Nyquist for the highest present tone 1.3 kHz1.3\text{ kHz}: fs>2×1300=2600 Hzf_s>2\times1300=2600\text{ Hz}, so ≥ 2.6 kHz (2). If fsf_s must stay 1 kHz, add an analog anti-alias low-pass filter with cutoff ≈400 Hz (below 500 Hz Nyquist) to attenuate the 1.3 kHz tone before the ADC (2).

(c) LSB =3.3/212=3.3/4096=0.8057 mV=3.3/2^{12}=3.3/4096=0.8057\text{ mV} (2). SQNR =6.02(12)+1.76=72.24+1.76=74.0 dB=6.02(12)+1.76=72.24+1.76=74.0\text{ dB} (1). For LSB <0.5 mV<0.5\text{ mV}: 3.3/2N<0.5×1032N>6600N>log26600=12.693.3/2^N<0.5\times10^{-3}\Rightarrow 2^N>6600\Rightarrow N>\log_2 6600=12.69, so N=13N=13 bits (2).

(d) PWM freq =fclk/(prescaler×period)=80×106/(1×1024)=78125 Hz78.1 kHz=f_{clk}/(\text{prescaler}\times\text{period})=80\times10^6/(1\times1024)=78125\text{ Hz}\approx78.1\text{ kHz} (4).

Question 3

(a) At 0x00000000: word0 = initial Main Stack Pointer (MSP); word1 = reset vector (address of Reset_Handler) (2). Code (4):

extern uint32_t _sidata,_sdata,_edata,_sbss,_ebss;
void Reset_Handler(void){
  uint32_t *src=&_sidata, *dst=&_sdata;
  while(dst<&_edata) *dst++=*src++;     // copy .data LMA->VMA
  for(dst=&_sbss; dst<&_ebss;) *dst++=0;// zero .bss
  main();
}

.bss holds zero-initialised variables; only the fact they are zero matters, so storing zeros in flash wastes ROM — the startup code writes zeros at runtime instead (2).

(b) Compare MSB→LSB. 0x2A5 = 101 0100 0101, 0x2A3 = 101 0100 0011. Bits identical until they differ: positions ...0101 vs 0011. At the bit where A sends 1 (recessive) and B sends 0 (dominant): wired-AND bus shows 0. A reads back 0 ≠ its 1, so A loses; B wins (2). Differing bit is the 3rd-from-LSB (value-4 bit): A=1, B=0 (2). Justification: dominant (0) overrides recessive (1); node reading a mismatch backs off non-destructively (2).

(c) Bit-wise majority (voter picks the value present in ≥2 channels): A=10110010, B=10100010, C=10110011. Per bit (MSB→LSB): 1,0,1,1/1/0,0,1,0 → checking bit3(from MSB) A=1,B=0,C=1→1; bit7 A=0,B=0,C=1→0; LSB A=0,B=0,C=1→0. Result 10110010 = A (2). Fail-safe: on channel loss the system moves to a defined safe state (e.g., outputs off/brakes). Fail-operational: the system continues correct operation using remaining healthy channels (2).

[
{"claim":"U=0.65 and LL bound(3) exceeds U","code":"U=Rational(1,5)+Rational(2,10)+Rational(5,20); lub=3*(2**Rational(1,3)-1); result=(U==Rational(13,20)) and (float(U)<=float(lub))"},
{"claim":"RTA R3 converges to 9","code":"import math\nC={1:1,2:2,3:5};T={1:5,2:10,3:20}\nR=C[3]\nfor _ in range(10):\n    nR=C[3]+math.ceil(R/T[1])*C[1]+math.ceil(R/T[2])*C[2]\n    if nR==R: break\n    R=nR\nresult=(R==9 and R<=T[3])"},
{"claim":"R1 with inheritance blocking =4 <=5","code":"R1=1+3; result=(R1==4 and R1<=5)"},
{"claim":"1300Hz aliases to 300Hz at fs=1000","code":"fs=1000;f=1300;a=abs(f-round(f/fs)*fs);result=(a==300)"},
{"claim":"12-bit LSB and 13 bits needed for <0.5mV","code":"lsb=Rational(33,10)/4096;need=13;result=(abs(float(lsb)-0.0008056640625)<1e-9) and (3.3/2**13<0.5e-3) and (3.3/2**12>=0.5e-3)"},
{"claim":"PWM freq =78125 Hz","code":"result=(80000000/(1*1024)==78125)"},
{"claim":"CAN: B(0x2A3) wins over A(0x2A5)","code":"A=0x2A5;B=0x2A3;win=B if B<A else A;result=(win==0x2A3)"}
]