Composable and Predictable Dynamic Loading for Time-Critical Partitioned Systems

Abstract

Abstract-In time-critical systems such as in avionics, for safety and timing guarantees, applications are isolated from each other. Resources are partitioned in time and space creating a partition per application. Such isolation allows fault containment and independent development, testing and verification of applications. Current partitioned systems do not allow dynamically adding applications. Applications are statically loaded in their respective partitions. However dynamic loading can be useful or even necessary for scenarios such as on-board software updates, dynamic reconfiguration or re-loading applications in case of a fault. In this paper we propose a software architecture to dynamically create and manage partitions and a method for composable dynamic loading which ensures that loading applications do not affect the running applications and vice versa. Furthermore the loading time is also predictable i.e. the loading time can be bounded a priori. We achieve this by splitting the loading process into parts, wherein only a small part which reserves minimum required resources is executed in the system partition and the other parts are executed in the allocated application partition which ensures isolation from other applications. We implement the software architecture for a SoC prototype on an FPGA board and demonstrate its composability and predictability properties. I. INTRODUCTIONTime-critical systems such as in the avionics domain have strict safety, real-time and fault tolerance constraints. To ensure these constraints and for fault-containment, applications are isolated from each other at the cycle-level. That is applications cannot affect each other even by a single cycle. With temporal and spatial partitioning, faults in an application cannot affect the rest of the system and applications can be developed, tested and verified independently. Without isolation, each small change to an application, requires the system and all applications to be re-verified. Allocating dedicated hardware to achieve isolation has disadvantages of increased cost and weight, therefore integrated architectures with shared resources are proposed in avionics with Integrated Modular Avionics (IMA) [1]. In IMA, resources are partitioned in time and space to create logical containers for each application. For commercial deployment, avionics industry has standardized partitioning with the ARINC 653 API [2] and AIR (ARINC in Space RTOS) [3] standards.The aforementioned partitioned systems are static systems, wherein all applications are integrated at design-time. In standards such as ARINC653 and AIR, applications are statically loaded in their respective partitions and the system iterates through a static Time Division Multiplexed (TDM) schedule at run time [4]. They do not cope with dynamic aspects such as adding new applications at run-time or on-board application software updates or dynamic reconfiguration in case of a fault.Consider the example of a spacecraft. The operation plan of a spacecraft can be changed to deal with u...

A Scenario-Aware Dataflow Programming Model

“…Bundles can be loaded composably at any time in a running system [19]. Loading a bundle consists of a number of steps.…”

“…When the same scenario is detected, the loaded scenario can be executed again and the switching time is reduced to transferring t 2 and the token produced by a to the other VP. It can be derived from [19] that it takes around 21 cycles on average to load one byte of object code. That time is both bounded and predictable.…”

“…The trade-off between the throughput gain of FSM-SADF and cost for switching must be carefully considered. If we assume a realistic bundle is at least 10 kB, loading will take hundreds of thousands of cycles [19]. Besides the scheduling complications and FIFO implementation issues, this is yet another drawback.…”

Composable and predictable dynamic loading for time-critical partitioned systems on multiprocessor architectures

“…Predictable loading ensures that the loading process completes in a known bounded time. In our previous work [19] we addressed the problem of composable and predictable loading for partitioned uniprocessor platforms. In this work we extend these results for loading multiprocessor applications on partitioned multiprocessor platforms.…”

Run-time middleware to support real-time system scenarios

“…VEPs are created and run composability and predictably, i.e. cause no interference to other applications running their own VEPs, as described in [17]. Multiple applications can boot and/or execute at the same time.…”