Embedded Systems & Real-Time Software
Level: 5 — Mastery (cross-domain: math + physics + coding, build/prove) Time limit: 90 minutes Total marks: 60
Instructions: Answer all three questions. Show all derivations. Where code is requested, C targeting ARM Cortex-M with FreeRTOS is assumed. State every assumption explicitly.
Question 1 — Real-Time Schedulability of an Avionics Sensor Node (24 marks)
An ARM Cortex-M4 node runs three periodic hard-real-time tasks under a fixed-priority preemptive RTOS. Tasks are scheduled Rate-Monotonic (shorter period → higher priority).
| Task | Period (ms) | WCET (ms) |
|---|---|---|
| (IMU sample via ADC+DMA) | 5 | 1.0 |
| (CAN telemetry) | 10 | 2.0 |
| (control law) | 20 | 5.0 |
(a) Compute the total CPU utilisation . State the Liu–Layland least-upper-bound for and determine whether the LL test guarantees schedulability. (5)
(b) The LL test is only sufficient. Using exact Response-Time Analysis (RTA) with the recurrence compute the worst-case response time of and confirm . Show every iteration. (7)
(c) A shared SPI bus is guarded by a mutex. (lowest priority) holds the mutex for up to ms while (highest priority) then requests it. (i) Name the failure mode and explain, with a timeline sketch, the worst-case delay to without any protocol. (ii) With the priority-inheritance protocol, add the blocking term to the RTA of : recompute and check . (8)
(d) State one reason the ADC sampling in is placed on DMA rather than a per-sample interrupt, in terms of interrupt latency and WCET determinism. (4)
Question 2 — Signal Chain, Nyquist & DAC Reconstruction (18 marks)
The IMU analogue channel is a vibration sensor whose useful bandwidth is –, but the sensor also carries a strong mechanical resonance tone.
(a) You sample at . Determine the Nyquist frequency and compute the aliased frequency at which the tone appears in the digital signal. Show the folding arithmetic. (5)
(b) Give the minimum sampling rate that avoids aliasing of the resonance tone without an anti-alias filter, and state the required filter approach if you must keep . (4)
(c) The ADC is 12-bit over a – range. Compute the LSB voltage (quantisation step) and the ideal SQNR in dB using . Then compute the number of bits needed so that the LSB is below on the same range. (5)
(d) A timer generates PWM at a DAC-reconstruction stage. The timer clock is and you need 10-bit PWM resolution. Compute the PWM carrier frequency (assume period = counts, prescaler = 1). (4)
Question 3 — Safe Startup, Memory & CAN Arbitration (18 marks)
(a) Linker/startup (build task). On reset the Cortex-M loads two words from address 0x00000000. State what each is, and write the minimal C reset handler that (i) copies .data from flash LMA to RAM VMA and (ii) zero-fills .bss, using linker symbols _sidata,_sdata,_edata,_sbss,_ebss, before calling main(). Explain why .bss need not be stored in flash. (8)
(b) CAN arbitration (prove). Two nodes start transmitting simultaneously on a CAN bus using dominant-bit (0) / recessive-bit (1) arbitration. Node A has 11-bit identifier 0x2A5, Node B has 0x2A3. Determine which node wins arbitration and at which bit position the loser backs off. Show the bit-by-bit comparison and justify with the wired-AND bus rule. (6)
(c) Redundancy (reason). A flight controller uses TMR with a bit-wise majority voter over three channels producing 8-bit outputs , , . Compute the voted output bit-by-bit. Then state, in one sentence each, the difference between a fail-safe and a fail-operational response when a channel is permanently silent. (4)
End of paper.
Answer keyMark scheme & solutions
Question 1
(a) Utilisation (2 marks): LL bound (2): . Since , the LL sufficient test guarantees the set is schedulable under RM (1).
(b) RTA for ; (1 mark for setup). Start . ⇒ schedulable. (6 marks for iterations + conclusion.)
(c)(i) Failure mode = priority inversion (1). Timeline: preempts and requests mutex held by ; without protocol, a medium task can preempt (which still holds the lock), so is blocked for an unbounded time — as long as -class work keeps running (2 for explanation + sketch). Worst uncontrolled delay ≫ . (ii) With priority inheritance the blocking is bounded by one critical section ms. RTA of (highest priority, ): ⇒ still meets deadline. (4 marks: bounded blocking + computation + check.)
(d) DMA moves ADC samples to RAM without CPU per-sample ISR entry, so it removes the per-sample interrupt-latency contribution and the ISR execution time from every task's WCET, making timing deterministic and freeing the core for control. (4)
Question 2
(a) Nyquist (1). Folding: with : lies in band; general fold (3). Alias appears at 300 Hz (1) — inside the 0–400 Hz band, corrupting the signal.
(b) To satisfy Nyquist for the highest present tone : , so ≥ 2.6 kHz (2). If must stay 1 kHz, add an analog anti-alias low-pass filter with cutoff ≈400 Hz (below 500 Hz Nyquist) to attenuate the 1.3 kHz tone before the ADC (2).
(c) LSB (2). SQNR (1). For LSB : , so bits (2).
(d) PWM freq (4).
Question 3
(a) At 0x00000000: word0 = initial Main Stack Pointer (MSP); word1 = reset vector (address of Reset_Handler) (2). Code (4):
extern uint32_t _sidata,_sdata,_edata,_sbss,_ebss;
void Reset_Handler(void){
uint32_t *src=&_sidata, *dst=&_sdata;
while(dst<&_edata) *dst++=*src++; // copy .data LMA->VMA
for(dst=&_sbss; dst<&_ebss;) *dst++=0;// zero .bss
main();
}.bss holds zero-initialised variables; only the fact they are zero matters, so storing zeros in flash wastes ROM — the startup code writes zeros at runtime instead (2).
(b) Compare MSB→LSB. 0x2A5 = 101 0100 0101, 0x2A3 = 101 0100 0011.
Bits identical until they differ: positions ...0101 vs 0011. At the bit where A sends 1 (recessive) and B sends 0 (dominant): wired-AND bus shows 0. A reads back 0 ≠ its 1, so A loses; B wins (2). Differing bit is the 3rd-from-LSB (value-4 bit): A=1, B=0 (2). Justification: dominant (0) overrides recessive (1); node reading a mismatch backs off non-destructively (2).
(c) Bit-wise majority (voter picks the value present in ≥2 channels):
A=10110010, B=10100010, C=10110011.
Per bit (MSB→LSB): 1,0,1,1/1/0,0,1,0 → checking bit3(from MSB) A=1,B=0,C=1→1; bit7 A=0,B=0,C=1→0; LSB A=0,B=0,C=1→0. Result 10110010 = A (2). Fail-safe: on channel loss the system moves to a defined safe state (e.g., outputs off/brakes). Fail-operational: the system continues correct operation using remaining healthy channels (2).
[
{"claim":"U=0.65 and LL bound(3) exceeds U","code":"U=Rational(1,5)+Rational(2,10)+Rational(5,20); lub=3*(2**Rational(1,3)-1); result=(U==Rational(13,20)) and (float(U)<=float(lub))"},
{"claim":"RTA R3 converges to 9","code":"import math\nC={1:1,2:2,3:5};T={1:5,2:10,3:20}\nR=C[3]\nfor _ in range(10):\n nR=C[3]+math.ceil(R/T[1])*C[1]+math.ceil(R/T[2])*C[2]\n if nR==R: break\n R=nR\nresult=(R==9 and R<=T[3])"},
{"claim":"R1 with inheritance blocking =4 <=5","code":"R1=1+3; result=(R1==4 and R1<=5)"},
{"claim":"1300Hz aliases to 300Hz at fs=1000","code":"fs=1000;f=1300;a=abs(f-round(f/fs)*fs);result=(a==300)"},
{"claim":"12-bit LSB and 13 bits needed for <0.5mV","code":"lsb=Rational(33,10)/4096;need=13;result=(abs(float(lsb)-0.0008056640625)<1e-9) and (3.3/2**13<0.5e-3) and (3.3/2**12>=0.5e-3)"},
{"claim":"PWM freq =78125 Hz","code":"result=(80000000/(1*1024)==78125)"},
{"claim":"CAN: B(0x2A3) wins over A(0x2A5)","code":"A=0x2A5;B=0x2A3;win=B if B<A else A;result=(win==0x2A3)"}
]