💻 computer science

Jiao: Bridging Isolation and Customization in Mixed Criticality Robotics

This paper presents Jiao, an architecture for mixed-criticality consumer robotics that bridges the gap between platform developers and end-users by integrating hardware-level overrides, parameter synchronization, and safety-aligned communication to achieve significant reductions in timing jitter and isolation on shared multicore platforms.

Original authors: James Yen, Zhibai Huang, Zhixiang Wei, Tinghao Yi, Shupeng Zeng, Liang Pang, Songtao Xue, Zhengwei Qi

Published 2026-05-06

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: James Yen, Zhibai Huang, Zhixiang Wei, Tinghao Yi, Shupeng Zeng, Liang Pang, Songtao Xue, Zhengwei Qi

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are building a high-tech robot arm. This robot has to do two very different jobs at the same time:

The "Brain" (Perception): It needs to look around, recognize objects, and make smart decisions. This is like a busy, creative artist who sometimes gets distracted, takes breaks, or gets overwhelmed by too much information.
The "Muscles" (Control): It needs to move its joints with perfect, split-second precision to avoid crushing things or hurting people. This is like a professional athlete who must react instantly, every single time, without fail.

The Problem: The "Shared Apartment" Disaster
In the past, engineers put the "Brain" and the "Muscles" in separate computers (like putting the artist in one room and the athlete in another). This was safe but expensive and messy.

Now, to save money and space, companies try to put both the Brain and the Muscles on the same computer chip. The paper calls this a "Mixed-Criticality" system.

The problem is that the "Brain" is messy. When it gets busy processing a video or running a complex AI model, it accidentally bumps into the "Muscles." It steals the computer's attention, causing the muscles to stutter or move a tiny bit too late. In robotics, a tiny delay can mean a crash or an injury.

The Old Solution vs. The New Problem
Engineers tried to fix this by building a "virtual wall" (a hypervisor) between the Brain and the Muscles. This wall ensures the Muscles get their own dedicated time and space, so the Brain can't interrupt them.

However, there is a new problem: The Expertise Gap.

The people who built the robot (the experts) know how to build these walls.
The people who use the robot (the integrators) just want to tweak settings, like "move faster" or "grip harder." They don't know how the walls work.
If they try to change a setting, they might accidentally break the safety wall, or they might not know how to send the change through the wall safely. It's like letting a guest in a high-security building try to rewire the alarm system because they just wanted to change the thermostat.

The Solution: JIAO (The "Safety Butler")
The authors created a new system called JIAO. Think of JIAO as a super-smart, unbreakable "Safety Butler" that manages the relationship between the messy Brain and the precise Muscles. It has three main tricks:

1. The Safe IO Cell (The "Emergency Brake Butler")

Imagine a dedicated security guard who sits in a separate room, watching the Muscles. This guard has a direct, physical wire to the robot's emergency stop button and brakes.

What it does: Even if the "Brain" crashes, freezes, or goes crazy, this guard can instantly cut the power to the motors or lock the brakes.
Why it matters: It doesn't trust the software. It has a "hardware override" switch that works even if the computer is broken.

2. The Parameter Synchronization Service (The "Translator")

This is the bridge for the non-expert users.

What it does: It lets a user change settings (like "grip strength") using simple, familiar tools (like a slider on a screen). The system automatically translates that simple request into a complex, secure message that can cross the "wall" to the Muscles.
Why it matters: The user doesn't need to be a computer engineer. They just turn a knob, and the system handles the complex, dangerous part of sending that command safely.

3. The Safety Communication Layer (The "Tamper-Proof Messenger")

When the user sends a message across the wall, it travels through a shared memory space. This is risky because data can get corrupted (like a letter getting smudged or lost in the mail).

What it does: This layer wraps every message in a "tamper-proof envelope." It adds a unique ID number, a timestamp, and a security code (like a wax seal).
Why it matters: If the message arrives late, out of order, or with a smudge (corruption), the Muscles immediately reject it. They don't guess; they just say, "This doesn't look right, I'll ignore it and stay safe."

The Results: A Calmer, Safer Robot
The team tested this on a real robot arm.

Without JIAO: The robot's movements were jittery. Sometimes it would pause for a long time (up to 300 microseconds) because the "Brain" was hogging the computer. This is like a dancer tripping over their own feet because they were distracted.
With JIAO: The movements became incredibly smooth. The "jitter" (the shaking) dropped by 84.5%. The worst-case delays were cut down by nearly 10 times.
The Big Win: They completely eliminated the "big stumbles." In the old system, the robot had big, dangerous pauses. With JIAO, those big pauses disappeared entirely.

In Summary
JIAO is a system that lets you put a messy, creative robot "Brain" and a precise, safety-critical "Muscle" on the same computer chip. It does this by building a secure, unbreakable wall between them, adding a dedicated "Emergency Brake" that works even if the computer fails, and creating a simple, safe way for non-experts to change settings without breaking the safety rules. The result is a robot that is both smart and incredibly steady.

Technical Summary: Jiao: Bridging Isolation and Customization in Mixed-Criticality Robotics

Problem Statement

Consumer and industrial robotics are increasingly consolidating safety-critical control, perception pipelines, and user applications onto shared multicore System-on-Chip (SoC) platforms to meet constraints on cost, weight, and power. While static partitioning hypervisors (common in automotive and aerospace) offer hardware-enforced isolation, directly transplanting these architectures to robotics encounters an expertise asymmetry problem.

In traditional automotive Electronic Control Unit (ECU) architectures, configurations are fixed at manufacturing by engineers with full systems knowledge. In contrast, industrial robots increasingly require runtime adaptation via teach pendants, vision-guided calibration, and cloud-connected tuning. System integrators often modify safety-relevant parameters (e.g., servo gains, force limits) without possessing the low-level systems knowledge required to manage cross-partition protocols or real-time scheduling. Existing solutions fail to address this combination:

Static partitioning provides spatial isolation but leaves data integrity and protocol complexity to application software.
Real-time Linux extensions (e.g., PREEMPT RT, Xenomai) improve temporal scheduling but lack spatial isolation, leaving control loops vulnerable to interference from perception workloads contending for cache, memory bandwidth, and thermal headroom.
Fieldbus safety protocols assume trusted endpoints and fixed configurations, not dynamic, post-deployment customization by non-expert users.

This gap creates a risk where numeric corruption in perception networks or unvalidated parameter updates can cascade into physical hazards, such as erratic motion or unintended torque.

Methodology

The authors present JIAO, an architecture built on the Jailhouse static partitioning hypervisor. JIAO does not propose a new hypervisor but re-architects the partition boundary as a safety interface. The system targets collaborative manipulators, mobile platforms, and multi-axis assembly systems.

The architecture divides the system into three domains:

Non-RT Domain: A Linux root cell running ROS 2 and user applications.
RT Domain: A bare-metal "inmate" executing deterministic control loops (e.g., 1 kHz servo control) with direct fieldbus access.
Safe IO Cell: A dedicated safety partition acting as an independent safety authority.

JIAO integrates three key subsystems to bridge the isolation boundary:

1. Safe IO Cell (Hardware-Level Override)

This component resides on a dedicated partition with direct hardware control over actuator safety interfaces (motor enables, brake relays, emergency stop circuits). It operates independently of the primary controller, monitoring:

Heartbeats: Configurable timeouts to detect unresponsive control partitions.
Command Envelopes: Bounds checking on commanded values.
Safety State Transitions: Governs transitions between normal operation, degraded modes, and safe states.
Crucially, it can force actuators into fail-safe configurations (e.g., engaging brakes) regardless of the state of the primary control path.

2. Parameter Synchronization Service (PSS)

To address the expertise asymmetry, the PSS encapsulates cross-domain complexity behind a familiar ROS-style API.

Workflow: Applications declare parameter types and bounds via standard APIs. The service validates updates, protects them with the Safety Communication Layer, and applies them atomically within the RT Domain.
Mechanism: Updates are packaged with metadata, passed to an encoder, and written to a shared memory channel (ivshmem). A doorbell interrupt notifies the RT Domain, which validates and applies or rejects the update.
Safety: If an update fails validation, the RT Domain continues using the last-known-good parameters, and the Non-RT side retries.

3. Safety Communication Layer (SCL)

The SCL implements IEC 61508-aligned endpoint verification for all cross-domain traffic, treating shared memory as a "black channel."

Integrity Mechanisms: Every message includes a CRC-32C checksum, a monotonic sequence number, and a timestamp.
Failure Handling: The system supports progressive degradation. Transient anomalies trigger warnings, while sustained failures (e.g., replay attacks, stale data, loss) trigger transitions to restricted states or safe stops.
Coverage: This layer addresses failure modes such as corruption, duplication, reordering, and delay, which static partitioning alone cannot prevent.

Key Contributions

Safe IO Cell: An independent safety authority on a dedicated partition that supervises heartbeats and command envelopes while maintaining hardware-level override capability for critical safety circuits.
Parameter Synchronization Service: A mechanism allowing integrators to modify robot behavior via high-level APIs without managing cross-partition protocols, shared memory layouts, or real-time scheduling details.
Safety Communication Layer: An IEC 61508-aligned verification layer providing CRC, sequence numbering, and freshness validation, enabling safe cross-domain customization.

Results

The authors evaluated JIAO on a D9340 Heterogeneous Processor (4× ARM Cortex-A55 application cores + dedicated real-time R-core) running a 1 kHz EtherCAT control loop for a 6-DOF manipulator. They compared a baseline (concurrent perception workloads) against the partition-isolated configuration.

Jitter Reduction: Partition isolation reduced the standard deviation of cycle-period jitter by 84.5% (from 12.58 µs to 1.95 µs).
Tail Risk Elimination: The 99th percentile absolute jitter ( $p99$ ) dropped from 69.0 µs to 7.8 µs (an 8.8× improvement).
Worst-Case Excursions: The maximum jitter excursion decreased from 321.5 µs to 32.8 µs.
Large Excursions: The baseline exhibited 24,442 large excursions ($|jitter| > 50$ µs), representing 2.04% of cycles. The isolated configuration exhibited zero such excursions.
Temporal Stability: The coefficient of variation improved from 1.26% to 0.20%, a 6.4× improvement in timing precision.

Significance and Claims

The paper claims that the primary contribution of JIAO is not merely the reduction of timing jitter, but the provision of an architecture that governs cross-partition customization safely. By co-designing hypervisor configuration, communication protocols, and hardware-level overrides, JIAO enables the consolidation of mixed-criticality workloads on shared hardware without sacrificing the isolation guarantees previously provided by physical separation.

The authors emphasize that their solution specifically addresses the "expertise asymmetry" where non-expert integrators must modify safety-critical parameters. The system ensures that such modifications are validated, atomic, and protected by integrity checks, preventing the propagation of data corruption from perception pipelines to physical actuators. The evaluation demonstrates that this approach eliminates heavy-tailed jitter and large timing excursions that threaten control stability in shared-resource environments.