Mixed-Criticality Scheduling on Shared SoCs: Why VM Partitioning Alone Isn’t Enough

Mixed-Criticality-Scheduling

 

Quick Overview

Problem: Static VM partitioning enforces spatial memory isolation between ASIL and QM workloads. It does not, on its own, control temporal contention in the shared last-level cache, DRAM controller, or accelerator submission path.

Common failure points: WCET margin evaporates under LLC eviction from a QM neighbour, DRAM request latency drifts under GPU or ISP bursts, interrupt latency drifts on shared GIC routing, accelerator submissions from a QM guest delay safety-relevant work.

Where it appears: Cortex-A cockpit domain controllers, ADAS + cockpit consolidation platforms, industrial safety-plus-vision controllers, medical monitor-plus-display systems.

Engineering focus: Cache coloring in the hypervisor allocator, memory-controller QoS bandwidth control, hierarchical scheduling servers, mediated GPU/NPU submission with priority, and — where appropriate — ASIL decomposition into a redundant safety monitor.

 

 

Production Failure Scenario

The bring-up went cleanly. Two VMs on the same Cortex-A SoC — an ASIL-D safety RTOS in one, a QM Android instrument-cluster + infotainment stack in the other — spatial isolation enforced by an ASIL-assessed hypervisor, MMU-backed memory partitions, and per-core dedication for the safety partition. Bench measurements matched the safety concept. The certification argument was close to sign-off.
 
Then integration testing added the multimedia workload at production intensity. A 4K decode pipeline in the QM VM started running against active navigation and a Bluetooth audio path. The ASIL-D task on the isolated core cluster started missing its deadline intermittently. Nothing in the ASIL-D code had changed. The isolated cores were still isolated. The hypervisor was still enforcing the partition.
 
The interference was not on any surface the hypervisor could see. The QM decoder’s working set was evicting the ASIL-D task’s data out of the shared last-level cache. GPU DRAM traffic was queuing alongside the safety task’s memory requests inside the memory controller. Neither channel showed up in the scheduler view; both extended the ASIL-D task’s execution time past the WCET bound established in isolation.
 
Nothing in the software was broken. The temporal-isolation model needed additional mechanisms below the hypervisor layer.
 

Wrong Assumption

The assumption is straightforward: partition the software with an ASIL-assessed hypervisor, dedicate cores or apply rate-monotonic budgets, protect memory with the MMU, and Freedom from Interference is established. For hypervisors targeting Cortex-R52 real-time domains that assumption largely holds — the shared-resource surface is small.
It becomes brittle when the ASIL partition and the QM multimedia partition sit on the same Cortex-A application-processor SoC and share a last-level cache, a DRAM controller, and an accelerator complex. VM partitioning covers spatial isolation. It does not automatically cover temporal isolation. Cache coherency hardware, memory controllers, and GPU submission queues sit below the hypervisor abstraction, so the WCET bounds established in isolation testing do not automatically survive integration with a real multimedia load.

Why It Fails

Shared last-level cache is a hidden interference channel. Cortex-A55/A78 clusters and comparable application-processor SoCs share an L2 or L3 last-level cache (LLC) across cores. A QM multimedia pipeline decoding a high-resolution frame occupies a substantial fraction of that LLC. When an ASIL control task runs next, its working set has been evicted, and it experiences cache misses that were not present in the isolated WCET measurement. Because the eviction happens in hardware-managed cache logic, it does not cross a VM boundary — the hypervisor cannot observe or enforce against it directly. Arm’s own MPAM specification addresses this by exposing hardware controls for cache partitioning and memory bandwidth; where MPAM is not implemented, software page-coloring in the hypervisor provides an equivalent path.

DRAM controller contention silently extends memory-access latency. GPU rendering, ISP writes, NPU tensor loads, and the ASIL task’s memory reads all queue at the shared DRAM controller. A GPU burst can delay the ASIL partition’s memory requests by the queuing time inside the controller — again, extending execution time past the WCET bound. Mitigation uses the memory controller’s hardware QoS registers, documented on NXP i.MX 8M, TI TDA4VM, and comparable SoCs. Software-only bandwidth policies (a QM app voluntarily throttling itself) are not adequate as ASIL-D FFI evidence. The broader case for enforcing these boundaries inside the hypervisor sits in the secure partitioning in automotive hypervisors discussion.

Accelerator submission is a shared resource without native priority. GPU passthrough gives one VM sole ownership, which forfeits consolidation. Mediated passthrough shares the accelerator, but the submission queue needs a hypervisor-side priority scheduler so that safety submissions overtake QM submissions at dispatch. Certification scope for shared GPU/NPU execution is platform- and release-specific — the safety case has to be checked against the vendor’s Safety Manual, the supported virtualization configuration, and the exact accelerator path used by the safety function. Qualcomm’s Snapdragon Ride Flex and NVIDIA’s DriveOS/Halos programs both describe mixed-criticality architectures with hypervisor isolation and safety-rated compute paths; what each program certifies, and for which release, needs to be read from the current Safety Manual rather than assumed. This is where the hypervisor architecture decision in software-defined vehicles meets the shared-accelerator problem.

Interrupt latency is only partly partitioned. On processors without full interrupt virtualization support, an interrupt that fires during a QM VM’s timeslice can be handled with QM-partition latency instead of ASIL latency — a determinism drift that does not require any explicit interference between workloads, only that they run on the same physical GIC.
 

Hidden System Complexity

VM boundary → MMU spatial isolation → shared LLC (hardware-managed) → shared DRAM controller → shared accelerator submission → shared GIC → runtime behavior → observed WCET.
 
An ASIL deadline miss seen at the RTOS is often generated three layers down: the QM decoder evicts LLC lines, cache misses extend a memory-bound loop inside the safety task, and the schedule assumption drifts. The RTOS did nothing wrong. The hypervisor did nothing wrong. The interference occurred where neither of them could see it.
 
The move from Cortex-R52 real-time domains to Cortex-A application processors is what changed the problem. R52 hypervisors manage relatively homogeneous cores with a small shared-resource surface. The automotive central compute vs zonal architecture transition — cockpit, cluster, and ADAS on one high-performance SoC — moves the same safety claim onto a platform with richer interference channels, and the tooling and certification patterns are still maturing there.
 

Failure Patterns

The scenarios below describe common integration-phase patterns; they are illustrative rather than tied to a specific program.

Scenario 1. A cockpit domain controller runs an ASIL-B instrument cluster and a QM Android infotainment stack on the same Cortex-A cluster with an ASIL-assessed hypervisor. Isolated cluster benchmarks meet a 60 fps rendering budget. Under production load — active navigation, 4K video decode, Bluetooth audio, and telltale animations — a measurable fraction of cluster frames overrun frame time. The LLC working set of the video decoder is evicting cluster rendering state; the fix is cache coloring in the hypervisor page allocator, not a faster GPU.

Scenario 2. An ADAS SoC shares a DRAM controller between an ASIL perception task and a QM navigation renderer. Bench measurements of the perception task pass the timing budget with margin. Under concurrent map-tile streaming, the perception task’s memory latency rises and a small fraction of frames miss the deadline. The DRAM controller exposes QoS registers, but none were configured — the architecture-phase assumption was that VM partitioning covered memory isolation. It didn’t.

Scenario 3. A safety-plus-visualization industrial controller shares an NPU between an ASIL anomaly-detection model and a QM operator-facing analytics dashboard. Both models run inside their measured latency in isolation. Concurrently, dashboard inferences push submission queue depth up, and the safety inference misses its deadline sporadically — correlated with operator interaction, not with machine state.

Mixed-Criticality ECU and Platform Engineering

Mixed-criticality behaviour on shared-SoC platforms is rarely a schedulability problem. It shows up as unbounded LLC eviction, unconfigured memory-controller QoS, and accelerator submission paths without priority mediation — invisible in single-partition testing, visible only under production multimedia and safety workloads running together. Promwad works with automotive and industrial customers on ECU software, Qualcomm/QNX/Linux/AAOS BSP integration, ASPICE CL2 delivery, and ISO 26262 support up to ASIL C, and can advise on the architecture-phase choices that make an ASIL-D consolidation program tractable.

Explore ECU and Platform Engineering →

Engineering Experience Across Automotive Compute Platforms

 

A Cockpit Domain Controller Where Isolated Timing Passed and Integrated Timing Didn’t

A typical cockpit consolidation program targets a high-performance Cortex-A SoC — an ASIL-B instrument cluster in one VM, a QM Android Automotive infotainment stack in another, both scheduled by an ASIL-assessed hypervisor with dedicated cores per partition, MMU-enforced memory partitions, and a shared GPU under mediated passthrough. Isolated bring-up on each partition meets every timing budget, and initial short-integration tests look clean.

Extended integration under production video load surfaces two patterns. Cluster frame rate degrades whenever the infotainment side decodes 4K video, and the degradation tracks LLC utilization on the QM partition — not GPU load, and not CPU load on the cluster side. Separately, GPU submission latency for time-critical cluster telltales varies with Android UI activity, beyond what the hypervisor’s advertised submission priority would predict.

Two mechanisms address the two problems. LLC eviction is closed with cache coloring in the hypervisor page allocator — the ASIL cluster partition gets a reserved LLC region that the QM workload cannot evict. GPU submission jitter is closed with a hypervisor-side priority queue in front of the mediated passthrough path, so ASIL submissions overtake QM submissions at dispatch. Neither requires a silicon respin or a hypervisor swap; both require characterising the SoC’s LLC set-index mapping and reworking the accelerator submission path inside the hypervisor. The safety-case update against ISO 26262 Part 6 is a follow-on document set, not a re-validation of the underlying software.

This is a representative pattern — not a specific delivered program. The point is that the mechanisms exist, and that they belong in the architecture phase rather than the integration phase.

digital cockpit domain controller

Solution Approach

Step 1: Turn temporal interference at the cache into spatial partitioning. Cache coloring in the hypervisor memory allocator assigns non-overlapping LLC set regions to each partition by controlling the physical page addresses granted to each guest. Because the LLC is indexed by a subset of the physical address bits, pages allocated in different “colors” cannot evict each other, regardless of access pattern. Prerequisites are knowledge of the SoC’s LLC set-index-to-physical-address mapping (SoC-specific, typically needs measurement or vendor documentation) and a page allocator that honors color constraints. On Arm application processors, Bao and Jailhouse implement this pattern in the open source space; on Intel/x86 platforms, ACRN uses Intel RDT/CAT for shared-cache partitioning. Several proprietary automotive hypervisors expose equivalent mechanisms in their safety-oriented configurations. Cache coloring converts an unbounded temporal-interference channel into a bounded, hardware-enforced spatial partition, and can form part of the technical evidence supporting the FFI argument at ASIL D — sufficiency in a given program is decided by the safety concept, the SoC, and the validation evidence, not by the mechanism alone.

Step 2: Bound DRAM bandwidth per requester in the memory controller. Configure the memory-controller QoS registers to protect the ASIL partition’s request-latency budget under worst-case QM traffic, either by capping the GPU/ISP/NPU maximum bandwidth or by raising the ASIL partition’s priority class. On NXP i.MX 8M and TI TDA4VM-class SoCs the registers are documented and per-master. On others, this step includes characterising the master-ID assignment and validating the effective bandwidth ceiling with measurement — the QoS setting is only meaningful once verified against a produced traffic mix.

Step 3: Mediate accelerator submission with priority. GPU or NPU passthrough gives one partition sole use of the accelerator, which forfeits consolidation. Mediated passthrough shares the accelerator, but the submission queue needs a hypervisor-side priority scheduler so that safety submissions overtake QM submissions at dispatch. Where the safety concept requires ASIL-D coverage on the accelerator path itself, the practical routes today are either (a) ASIL decomposition into two ASIL-B channels with a redundant safety monitor, (b) restricting the ASIL-D function to a code path that does not use the shared accelerator, or (c) selecting a platform whose Safety Manual explicitly covers the accelerator sharing configuration you intend to use. The redundant-channel route is covered in the safety island design and ASIL decomposition discussion.

Cache and DRAM interference are typically the two channels that survive a “VMs only” architecture into integration. Closing them early — before the safety case is written against a WCET margin that hasn’t been measured under mixed load — is usually cheaper than closing them under integration-phase pressure.


Real Trade-Offs

Reserving an LLC partition to the ASIL VM through cache coloring gives the safety task deterministic cache behaviour but shrinks the effective LLC for the QM multimedia pipeline. On an 8 MB L3, a 2 MB ASIL reservation removes a quarter of the cache the video decoder was relying on; the QM performance impact has to be characterised and accepted in the platform budget.

Capping GPU DRAM bandwidth in the memory controller protects the ASIL partition’s memory-latency budget but forces the QM path to render at a lower texture rate or a reduced frame size. For a cluster + infotainment consolidation, that trade-off is usually acceptable; for a heavier infotainment build with 4K decode plus 3D navigation, it can force a codec bitrate cut.

Certification scope for ASIL-D execution on a shared high-performance SoC depends on the specific hypervisor, GPU/NPU stack, and configuration. Where the vendor Safety Manual does not cover the accelerator sharing path you need, ASIL decomposition into two ASIL-B channels — one on the shared SoC, one on a Cortex-R52 lockstep safety monitor — is a well-understood route, at the cost of additional silicon and a cross-monitor communication path. The decomposition-versus-single-part trade-off is a specific case of the broader functional safety versus conventional hardware design argument at the SoC boundary.

The choice of automotive-qualified hypervisor is not homogeneous. Elektrobit ships EB tresos Safety OS up to ASIL D and EB corbos Hypervisor at ASIL B — they cover different parts of the stack. QNX Hypervisor for Safety is assessed against ISO 26262 ASIL D, with supported configurations and safety-relevant constraints documented in its Safety Manual per release. Each choice has to be validated against the specific SoC, the accelerator sharing model, and the ASIL scope; there is no single “certified hypervisor” that pre-covers every mixed-criticality architecture.

Consolidating multiple ECUs onto one high-performance SoC — the cost saving that software-defined vehicle programs were built to capture — only realises the saving once the interference channels are closed. A consolidated ECU that misses its ASIL timing budget under production load is more expensive than the two ECUs it replaced, once debug cycles and safety-case rework are counted.


Typical Mixed-Criticality Engineering Tasks

Interference Characterisation on Target Silicon

Measuring LLC set-index mapping, DRAM controller queuing under multi-master load, and accelerator submission latency under mixed QM + ASIL workloads on the actual production SoC.

Cache Coloring and Hypervisor Allocator Integration

Extending or configuring the hypervisor’s memory allocator to honor color constraints per partition, and validating the coloring against the SoC’s cache set indexing.

Memory-Controller QoS Configuration and Validation

Setting per-master bandwidth and priority policies, measuring effective request-latency bounds under production traffic mixes, and integrating the settings into the platform boot flow.

Mediated Accelerator Submission and Priority Scheduling

Placing a priority-aware submission scheduler between the hypervisor’s accelerator device model and the guest submission queue, and validating dispatch order under contention.

Safety Concept Advisory for Shared-SoC Programs

Scoping ASIL decomposition, safety-monitor integration, and the boundary between what the shared SoC can carry at what ASIL and what belongs on a dedicated lockstep monitor.

Qualifying Symptoms

  • ASIL task WCET margin measured on the isolated partition disappears when the QM VM runs at production intensity.
  • Cluster or telltale rendering meets its budget in isolation and degrades under concurrent 4K decode on the QM VM, correlated with QM LLC utilization rather than GPU load.
  • Memory-controller QoS registers are documented in the SoC reference manual but were not configured in the platform boot flow.
  • The hypervisor’s assessment covers spatial isolation and scheduling but does not name cache or DRAM temporal isolation.
  • GPU or NPU submission latency for safety-relevant frames varies with QM UI activity.
  • ISO 26262 Part 6 safety-case sign-off is blocked on temporal-interference evidence that isolation testing alone cannot produce.

Solution Context Link

The work at this point is temporal-isolation engineering on the target SoC — cache coloring, memory-controller QoS, mediated accelerator submission — and a safety-case rebuild that names these mechanisms in the FFI evidence. Practically, this sits inside ECU and embedded platform design rather than inside a broader hypervisor licence conversation.

For a cockpit or ADAS consolidation, SoC and hypervisor selection interact with the software-defined vehicle programme’s decomposition strategy, and safety-case documentation with the ASPICE software engineering traceability that ties vehicle-level requirements down to hypervisor configuration values. Where the accelerator path is what needs ASIL coverage, the safety island design and ASIL decomposition discussion covers the redundant-channel route.

Promwad Micro Proof

Promwad’s disclosed automotive work covers ECU and platform software, Qualcomm/QNX/Linux/AAOS BSP integration, ASPICE CL2 delivery, and ISO 26262 support up to ASIL C. The mixed-criticality architecture discussion above sits above that — in the architecture and safety-concept phase where SoC, hypervisor, safety-monitor, and decomposition choices are made against the vehicle’s ASIL and QoS budgets. Programs typically benefit from this analysis before the hardware is fixed.

FAQ

Why does VM partitioning not, on its own, solve mixed-criticality on shared application processors?

 

VM partitioning enforces spatial isolation — one VM cannot address another VM’s memory, and the MMU makes that boundary hardware-enforced. It does not automatically enforce temporal isolation of shared hardware sitting below the hypervisor: the last-level cache, the DRAM controller, the accelerator submission queue, and the GIC on chips without full interrupt virtualization. When a QM VM’s working set evicts an ASIL VM’s cache lines, or a GPU burst delays ASIL memory requests inside the DRAM controller, the resulting WCET drift is invisible to the hypervisor and invalidates timing budgets the safety case depends on. Closing those channels needs cache coloring, memory-controller QoS, and mediated accelerator submission — mechanisms the assessed hypervisor may or may not implement, and that have to be named explicitly in the FFI argument.
 

What is cache coloring and how does it support the ISO 26262 Part 6 argument at ASIL D?

 

Cache coloring assigns non-overlapping LLC set regions to different partitions through controlled allocation of the physical page addresses each partition receives. Because the LLC is indexed by a subset of physical address bits, pages allocated in different “colors” cannot evict each other regardless of access pattern. The ASIL partition ends up with a reserved LLC region the QM partition literally cannot touch, which is a form of spatial partitioning that can be used as evidence for hardware-supported FFI at ASIL D. Implementation requires a hypervisor page allocator that honors color constraints and characterisation of the SoC’s LLC set-index-to-physical-address mapping. Bao and Jailhouse implement the pattern for Arm; ACRN implements a related pattern on Intel/x86 using RDT/CAT; several proprietary automotive hypervisors expose it in safety-oriented builds. Whether it is sufficient for a given safety case depends on the concept and the validation evidence — the mechanism alone is not the argument.
 

When is ASIL decomposition the more practical answer than pursuing full ASIL D on a shared SoC?

 

When the ASIL-D function needs the shared accelerator (GPU, NPU) and the vendor’s current Safety Manual does not cover the exact virtualization configuration you intend to use. Under ISO 26262 Part 9 Clause 5, decomposition splits an ASIL-D requirement into two sufficiently-independent redundant elements at lower ASILs — typically ASIL-B(D) + ASIL-B(D). The shared SoC partition handles perception or control as one ASIL-B channel; a dedicated Cortex-R52 lockstep safety monitor handles the second ASIL-B channel and validates the shared-SoC output. The certification argument for ASIL-B FFI on a shared SoC is much simpler than ASIL-D FFI on the same platform, and the redundant monitor absorbs the residual risk. The cost is an additional silicon component and an extra latency budget on the cross-monitor path.
 

Which hypervisor and safety-OS options should a shared-SoC program consider today?

 

For the real-time domain, EB tresos Safety OS is qualified up to ASIL D and QNX has a long production track record in automotive. QNX Hypervisor for Safety is assessed against ISO 26262 ASIL D, with supported SoCs and configurations documented per release in its Safety Manual; EB corbos Hypervisor targets ASIL B for consolidation use cases. On the Arm application-processor side, Bao and Jailhouse implement cache coloring in the open source space and show the direction; productisation for a specific ASIL-D program is typically project-specific. Any current program should name the specific hypervisor build, its coloring and QoS support, and the SoC’s memory-controller configuration in its safety case rather than rely on a generic “certified hypervisor” claim that skips the temporal mechanisms.
 

Related Engineering Cases

Let’s Review Your Shared-SoC Architecture

Share the SoC, the hypervisor, the ASIL scope, and where the WCET or multimedia budget is failing under integration load. We’ll define the temporal-isolation and safety-concept path.

Tell us about your project

We’ll review it carefully and get back to you with the best technical approach.

All information you share stays private and secure — NDA available upon request.

Prefer direct email?
Write to info@promwad.com

Secured call with our expert in 24h
Secured call with our expert in 24h
Secured call with our expert in 24h
Plug-in model for your full-cycle R&D
Secured call with our expert in 24h
22 years of engineering expertise
Secured call with our expert in 24h
500+ projects for OEMs in EU & US
Secured call with our expert in 24h
MVP in 8–10 weeks — predictable delivery
Secured call with our expert in 24h
Featured at IBC, Embedded World, MWC