Building Partitioned Architectures Building Partitioned - - PowerPoint PPT Presentation
Building Partitioned Architectures Building Partitioned Architectures based on the based on the Ravenscar Profile Profile Ravenscar Brian Dobbing Brian Dobbing Chief Technical Consultant Chief Technical Consultant Aonix Europe Limited, UK
brian brian@ @uk uk. .aonix aonix.com .com
SIGAda SIGAda 2000 Laurel, November 2000 2000 Laurel, November 2000
2
What is it? Why is it needed for high integrity systems?
What is it? Why is it suited for high integrity systems?
Example using the ARINC 653
3
■ Requirements to maximize processor usage
l But must ensure protection to preserve integrity
■ Within Safety Critical / High Integrity
l Spatial firewall to control access to code / data
■ Within Hard Real Time Systems
l Temporal firewall to guarantee time deadlines
■ Requirements for High Availability
l Replication to protect against faults l Dynamic re-configuration on node failure
■ ■ Requirements to maximize processor usage
l l But must ensure
■ ■ Within Safety Critical / High Integrity
l l Spatial firewall to control access to code / data
■ ■ Within Hard Real Time Systems
l l Temporal firewall to guarantee time deadlines
■ ■ Requirements for High Availability
l l Replication to protect against faults
l l Dynamic re
4
Controlled Communication
5
6
Replicated Communication
7
■ ARINC 653 Application Executive
l Partitioning for Integrated Modular Avionics l Kernel is the “Module Operating System”
t Controls the Module (usually the board) t Schedules the Application Partitions
l Partition local control is via the
t Controls its Application t Schedules the Application Threads
■ ■ ARINC 653 Application Executive
l l Partitioning for Integrated Modular Avionics
l l Kernel is the “Module Operating System”
t t Controls the Module (usually the board)
Controls the Module (usually the board)
t t Schedules the Application Partitions
Schedules the Application Partitions
l l Partition local control is via the
t t Controls its Application
Controls its Application
t t Schedules the Application Threads
Schedules the Application Threads
8
■ The Kernel (Module Operating System):
l Is Highly Trusted Software l Directly controls the Hardware (Supervisor mode) l Manages the Spatial Firewalls using the MMU l Manages the Temporal Firewalls using
l Controls Communication with other kernels via
l Controls Detection of Faults, e.g. traps, and timeouts l Supports Application Partitions written in any
■ ■ The Kernel
l l Is
l l Direct
l l Manages the Spatial Firewalls using the MMU
l l Manages the Temporal Firewalls using
l l Controls Communication with other kernels via
l l Controls Detection of Faults, e.g. traps, and
l l Supports
9
■ The Application Partition :
l Can use Internal Threads or be Sequential l Can be written in any Language using standard API l Contains Code / Data all at one Criticality Level l Usually Executes in User Mode l Executes within its own Address Space l Executes within its Fixed Time-Slice
■ The Partition Operating System:
l Schedules its Internal Threads l Implements Internal Thread Services l Interfaces to the Kernel for Inter-Partition Services
■ ■ The
l l Can
l l Can be written in any Language using standard API
l l Contains Code / Data
l l Usually Executes in User Mode
l l Executes within its own Address Space
l l Executes within its Fixed Time
■ ■ The Partition
l l Schedules its Internal Threads
l l Implements
l l Interfaces to the Kernel for Inter
10
Ada RTS
Ada Flight Control System
H/W
Ada RTS
Java VM In-flight entertain- ment
POS for Java
11
■ Ravenscar Profile – Ada tasking subset for…
l
t Suitable for the most rigorous certification requirements
l
t Support functional static analysis and verification
l
t Support temporal static analysis t Bounded Worst Case execution times and interrupt latency
l
t Very small runtime footprint, very fast execution times
■ ■ Ravenscar
l l
t t Suitable for the most rigorous certification requirements
Suitable for the most rigorous certification requirements
l l
t t Support functional static analysis and verification
Support functional static analysis and verification
l l
t t Support temporal static analysis
Support temporal static analysis
t t Bounded Worst Case
Bounded Worst Case e execution xecution t times imes and interrupt latency and interrupt latency
l l
t t Very small runtime footprint, very fast execution times
Very small runtime footprint, very fast execution times
12
■ Major output from the 8th International
l Held at Ravenscar, UK in April 1997
t Defined in Ada Letters Vol 17 No 5 October 1997 t See also www.cs.york.ac.uk/rts t See also paper in Proceedings of Ada-Europe 1998
l Revised 9th/10th International Real-Time Workshops
■ Included in an ISO Standard Technical Report
l “Guide for the use of Ada in High Integrity Systems” l See ISO/IEC TR 15942:2000 l Work in progress to consider how to add it to Ada0Y
■ ■ Major output from the 8
th International
l l Held at
t t D
Defined efined in in Ada Ada Letters Letters Vol Vol 17 No 5 October 1997 17 No 5 October 1997
t t See also www.
See also www.cs cs. .york york.ac. .ac.uk uk/ /rts rts
t t See also paper in Proceedings of
See also paper in Proceedings of Ada Ada-
Europe 1998
l l Revised 9
th/10
th International
■ ■ Included in an ISO Standard
l l “Guide for the use of
l l See
l l Work in progress to consider how to add it to Ada0Y
13
l Restricted tasking model for static timing analysis
t All tasks created at startup, and run forever t Periodic task release via access to real-time clock device t Sporadic task release via event signalling or interrupt t Mutual exclusion via priority ceiling protocol emulation t Support for (nested) interrupt handlers
l l Restricted
t t All tasks created at
t t Periodic task release via access to real
t t Sporadic task release via event signalling or interrupt
t t Mutual exclusion
t t Support for (nested) interrupt
14
package RT renames Ada.Real_Time; task body T1 is Current_Frame : RT.Time := T1_Start_Time; Frame : constant RT.Time_Span := RT.Microseconds (200); begin loop delay until Current_Frame;
Current_Frame := Current_Frame + Frame; end loop; end T1; 200 Frame Current_Frame time
15
package STC renames Ada.Synchronous_Task_Control; package Sync is SO : STC.Suspension_Object; protected Trigger is procedure Int_Handler; -- Body performs Set_True(SO) pragma Attach_Handler (Int_Handler, Trap_Number); end Trigger; end Sync; task body T2 is begin loop STC.Suspend_Until_True (Sync.SO);
end loop; end T2; time Deadline Deadline Deadline
16
protected Trigger is procedure Signal (D : in Data); entry Wait (D : out Data); private Data_Store : Data; Signal_Arrived : Boolean := False; end Trigger; task body T3 is My_Data : Data; begin loop Trigger.Wait (D => My_Data); Process (My_Data); -- Aperiodic processing code end loop; end T3;
time Deadline Deadline Deadline
17
Put Get
priority 40 20 priority 40 30
Task 1 Task 2 Task 2 ready
protected Resource is function Get return Data_Type; procedure Put (Latest : in Data_Type); private Data : Data_Type := Null_Data; pragma Priority (40);
end Resource;
time time
18
get Periodic Task Sporadic Task Interrupt Handler Protected Object put Protected entry
wait H/w interrupt run
19
“ObjectAda Raven™”
D O
7 8 B C e r t i f i a b l e
l Ravenscar tasking subset plus ... l … Deterministic sequential execution model l Open architecture for application-specific
l Runtime System Certifiable to DO-178B Level A
t Can map to other standards too e.g. Def-Stan 00-55
l l Ravenscar
l l … Deterministic
l l Open architecture for application
l l Runtime System Certifiable to DO
t t Can map to other standards too e.g.
Can map to other standards too e.g. Def Def-
Stan 00 00-
55
20
The APEX kernel (MOS) The Partition O/S (POS) A Safety Critical Application Partition
Otherwise I wouldn’t be doing this talk
21
Internal Execution Behavior
t Startup / shutdown actions t Task scheduling at synchronization points t Storage management t Response to Exceptions t Task death and possible re-start
External Execution Environment
t Bare board or over an external executive / RTOS
t t Startup / shutdown actions
t t Task scheduling
t t Storage management
t t Response to Exceptions
t t Task
t t Bare board or over an external executive
22
Is non-tasking Is Interrupt-driven (timers, traps, I/O etc)
t Requires pragma Attach_Handler
Must initialize the hardware at start-up
t SVC mode, MMU settings, trap handlers, etc
Must perform partition context switching Must perform I/O to/from other modules
t t Requires
t t SVC mode, MMU settings, trap handlers, etc
23
24
■ The POS …
l Supports multiple threads (static configuration)
t Requires global tasks
l Supports Inter-Thread services (via Standard API)
t Events, Blackboards, Buffers, … t Requires control over scheduling at synchronization points t Requires mutual exclusion, queuing, timeouts
l Supports Health Monitoring task
t Must get control on trap, exception, time overrun etc t Requires task restart or partition restart (or ignore fault)
l Supports Inter-Partition Message Passing
t Send message, Wait for message
■ ■ The POS …
l l Supports multiple threads (static configuration)
t t Requires global tasks
Requires global tasks
l l Supports Inter
t t Events, Blackboards, Buffers, …
Events, Blackboards, Buffers, …
t t Requires control over scheduling at synchronization points
Requires control over scheduling at synchronization points
t t Requires mutual exclusion, queuing, timeouts
Requires mutual exclusion, queuing, timeouts
l l Supports Health Monitoring task
t t Must get control on trap, exception, time overrun etc
Must get control on trap, exception, time overrun etc
t t Requires task restart or partition restart (or ignore fault)
Requires task restart or partition restart (or ignore fault)
l l Supports Inter
t t Send message, Wait for message
Send message, Wait for message
25
26
■ APEX API used for all voluntary suspension
l “I’m ready to start” l “I’ve finished my cycle” l “I’m waiting for an event” l “I’m waiting for a resource” l “I’m waiting for a message”
■ POS handles pre-emption events directly ■ Requirement is for POS to :
l Suspend current task and to ready a new task l Achieved via per-task Suspension Objects
■ ■ APEX API used for all voluntary suspension
l l “I’m ready to start”
l l “I’ve finished my cycle”
l l “I’m waiting for an event”
l l “I’m waiting for a resource”
l l “I’m waiting for a message”
■ ■ POS handles pre
■ ■ Requirement is for POS to :
l l Suspend current task and to ready a new task
l l Achieved via per
27
28
Program Library Predefined Library Board Support Libraries Board Support Libraries Program Library
C e r t i f i a b l e
Executable
29
■ User-customizable Board Support Package
l Board Interface
t Machine level interface (for building a kernel in Raven) t Void when building an Ada user-mode Raven partition
l Operating System Interface
t Almost void for a bare machine kernel t Interface to kernel services for an Ada user-mode partition
l Raven Instrumentation (RTS event handlers)
t Almost void for a bare machine kernel t Response to events such as exceptions for user partitions
■ ■ User
l l Board
t t Machine level interface (for building a kernel in Raven)
Machine level interface (for building a kernel in Raven)
t t Void when building a
Void when building an n Ada Ada user user-
mode Raven partition
l l Operating
t t Almost void for a bare machine kernel
Almost void for a bare machine kernel
t t Interface to kernel services for a
Interface to kernel services for an n Ada Ada user user-
mode partition
l l Raven Instrumentation
t t Almost void for a bare machine kernel
Almost void for a bare machine kernel
t t Response to events such as exceptions for user partitions
Response to events such as exceptions for user partitions
30
■ The MOS can be constructed with its BSP
l Run in supervisor mode l Control the board l Control the partitions
■ The POS can be constructed with its BSP
l Run in user mode l Control the threads l Interface to the MOS for external services
■ ■ The MOS can be constructed with its BSP
l l Run in supervisor mode
l l Control the board
l l Control the partitions
■ ■ The POS can be constructed with its BSP
l l Run in user mode
l l Control the threads
l l Interface to the MOS for external services
31
Program Library Predefined Library Raven Library Raven Library System Library System Library Board Library Board Library
C e r t i f i a b l e
Executable
32
Program Library Predefined Library Raven Library Raven Library System Library System Library Board Library Board Library
C e r t i f i a b l e
Executable
33
■ Partitioning is very important requirement for
l Safety Critical l High Integrity l High Availability / Fault Tolerance
■ Ravenscar Profile targets these sectors
l Natural choice as the implementation environment
■ A COTS Implementation of the Profile can
l Implement a Partitioning System kernel l Implement an Operating System for an Ada Partition l Implement Ada Partition Application Code running
■ ■ Partitioning is very important requirement for
l l Safety Critical
l l High Integrity
l l High Availability / Fault Tolerance
■ ■ Raven
l l Natural choice as the implementation environment
■ ■ A COTS Implementation of the Profile can
l l Implement a Partitioning System kernel
l l Implement an Operating System for an
l l Implement
34