Mixed Criticality¶
Cohosting differently critical computing functions while accounting for interference and preserving their required guarantees.
Core Idea¶
A mixed-criticality computing system hosts functions with materially different assurance or failure stakes on shared resources and accounts for their interference while preserving the required guarantees. The defining roles are differently critical functions, shared carrier, differentiated requirements, and an interference account. It does not require an overload mode switch or prove that every design has been deployed and certified.[ref-f5dc8dfc0f45][ref-f0353898610e]
Scope of Application¶
The literal scope is shared computing architecture with differing assurance or timing obligations.
- Avionics: NASA integrated modular avionics work analyzed partitioned applications and spatial/logical noninterference on common computing resources.[ref-f5dc8dfc0f45][ref-5468e70799c4]
- Automotive modeling: a four-ECU/FlexRay model combined three safety-critical control and two time-critical applications under synthesized timing and control constraints.[^ref-f0353898610e]
Clarity¶
Priority labels alone do not establish criticality; identify the functions' requirements and shared interference paths. DiVito's formal model addresses spatial/logical isolation, not every temporal guarantee, and requires common kernel services and the ACR to meet the highest admitted criticality.[^ref-f5dc8dfc0f45] The automotive result is a modeled schedule solved on a PC, not a documented vehicle installation or safety certificate.[^ref-f0353898610e] An overload mode that sheds lower-criticality work is one possible technique, not a condition of these two cases.
Manages Complexity¶
List each resident function, its assurance or timing obligation, the shared processor, kernel, memory or network path, and the argument that controls interference on that path. Keep property types separate: address-space isolation does not prove timing isolation, and modeled deadline feasibility does not prove physical deployment. The four-role map prevents a partition diagram or priority list from standing in for evidence.[ref-f5dc8dfc0f45][ref-f0353898610e]
Abstract Reasoning¶
Remove one role at a time. If requirements do not materially differ, the mixed-criticality relation disappears; if functions share no carrier, the cohosting interference problem disappears. For a qualifying system, trace each guarantee through the shared resource and ask what the cited proof, analysis or implementation actually establishes. Evaluate modeled control performance separately from schedule feasibility.[ref-f5dc8dfc0f45][ref-f0353898610e]
Knowledge Transfer¶
The four-role test applies to both partitioned avionics and modeled automotive scheduling, though their evidence and mechanisms differ. Scheduling explains one possible timing method, while Interference and Contention helps identify shared-resource risks; either can occur without functions having differentiated assurance requirements. Outside computing, high- and low-stakes work is an analogy unless the technical shared carrier and guarantee roles are present.
Neighborhood in Abstraction Space¶
Mixed Criticality sits in a sparse region of the domain-specific corpus (89th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.
Family — Unclustered & Miscellaneous (2721 abstractions)
Nearest neighbors
- Shared memory — 0.80
- Dining philosophers problem — 0.79
- Parallel computing — 0.79
- Cache coherence — 0.79
- Real-time computing — 0.79
Computed from structural-signature embeddings · 2026-10-17
References¶
[^ref-f5dc8dfc0f45]: Ben L. DiVito, "A Formal Model of Partitioning for Integrated Modular Avionics" (1998), NASA/CR-1998-208703, official full report, PDF pp. 6, 8, 10 (printed pp. 1, 3, 5). The report treats different-criticality applications on shared resources, a highest-admitted-application qualification bound for kernel services and ACR, and spatial/logical noninterference; its formal result is not proof of all temporal properties.
[^ref-5468e70799c4]: Mark L. Mangieri and Jason Vice, "Kedalion: NASA’s Adaptable and Agile Hardware/Software Integration and Test Lab" (2011), AIAA Space 2011, full NASA-hosted paper, PDF p. 0 full title and authors, pp. 2–3, section “Orion Avionics Instantiation: Integrated Modular Avionics.” The section discusses different-criticality applications in operating-system partitions; further adaptation was contemplated.
[^ref-f0353898610e]: Dip Goswami et al., "Time-Triggered Implementations of Mixed-Criticality Automotive Software" (2012), DATE conference paper, DOI 10.1109/DATE.2012.6176680, full original author-uploaded text, Abstract, §I, §V Table I and Results, Conclusions. The evaluated four-ECU/FlexRay setting is a model, with solver execution on an Intel i5 PC rather than reported deployment in a vehicle.