Dynamic software updates for real-time systems

Wahler, Michael; Richter, Stefan; Manuel, Oriol

doi:10.1145/1656437.1656440

Cited by 37 publications

(24 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Other specific operating systems where used on EmbedDSU [31] and Gracioli [32]. While EcoDSU [33] works purely on bare metal, without the support of an operating system, Wahler [34] and FASA (Future Automation System Architecture) [35][36][37][38] are operating system agnostics. This means that any operating system can be used.…”

Section: Analysis Of Existing Systemsmentioning

confidence: 99%

Analysis of existing dynamic software updating techniques for safe and secure industrial control systems

Mugarza¹,

Parra²,

Jacob³

2018

Int. J. SAFE

View full text Add to dashboard Cite

Higher interconnectivity among devices, machines, the cloud and humans is envisioned in the actual trend of automation, also known as Industrial Internet of Things (IIoT). These industrial control systems, which may require high availability and/or safety related capabilities, are no longer isolated from the corporate environment or Internet. Software updates will be needed during the product life cycle, due to the long service life, the increasing number of security related vulnerabilities discovered on these industrial control systems and the high interconnectivity desired in IIoT. These updates aim at fixing all these security weaknesses, bugs and vulnerabilities that could appear, while the required safety integrity levels are ensured. Security-related concerns have just been addressed by the safety engineering community, because of the increasing number of cyber-attacks against safety-critical systems, such as Stuxnet. Moreover, system shut-downs caused by software updates could not be plausible when high availability is required. Typically, in order to perform the software update, the whole industrial process or the production is halted, so that the software upgrade is safely applied. However, this scenario might not be applied in critical infrastructures, such as nuclear or hydroelectrical power plants, where these production and service interruptions are not acceptable from the business and service point of view. This article presents an analysis of existing dynamic software updating techniques, which may be applied for safe and secure industrial control systems. These techniques aim at updating the running code, without the need of a halt and restart, increasing the availability of the industrial system.

show abstract

Section: Analysis Of Existing Systemsmentioning

confidence: 99%

Analysis of existing dynamic software updating techniques for safe and secure industrial control systems

Mugarza¹,

Parra²,

Jacob³

2018

Int. J. SAFE

View full text Add to dashboard Cite

show abstract

“…In this way they ensure that adding new application does not affect the realtime guarantees of existing applications. In [10], the dynamic update is performed in idle time in a system which runs an RTOS. By performing the update in slack time, the real-time guarantees of existing applications are not affected, however no timing guarantees are provided with regards to loading.…”

Section: Related Workmentioning

confidence: 99%

Composable and Predictable Dynamic Loading for Time-Critical Partitioned Systems

Sinha

Koedam

Wijk

et al. 2014

2014 17th Euromicro Conference on Digital System Design

View full text Add to dashboard Cite

Abstract-In time-critical systems such as in avionics, for safety and timing guarantees, applications are isolated from each other. Resources are partitioned in time and space creating a partition per application. Such isolation allows fault containment and independent development, testing and verification of applications. Current partitioned systems do not allow dynamically adding applications. Applications are statically loaded in their respective partitions. However dynamic loading can be useful or even necessary for scenarios such as on-board software updates, dynamic reconfiguration or re-loading applications in case of a fault. In this paper we propose a software architecture to dynamically create and manage partitions and a method for composable dynamic loading which ensures that loading applications do not affect the running applications and vice versa. Furthermore the loading time is also predictable i.e. the loading time can be bounded a priori. We achieve this by splitting the loading process into parts, wherein only a small part which reserves minimum required resources is executed in the system partition and the other parts are executed in the allocated application partition which ensures isolation from other applications. We implement the software architecture for a SoC prototype on an FPGA board and demonstrate its composability and predictability properties. I. INTRODUCTIONTime-critical systems such as in the avionics domain have strict safety, real-time and fault tolerance constraints. To ensure these constraints and for fault-containment, applications are isolated from each other at the cycle-level. That is applications cannot affect each other even by a single cycle. With temporal and spatial partitioning, faults in an application cannot affect the rest of the system and applications can be developed, tested and verified independently. Without isolation, each small change to an application, requires the system and all applications to be re-verified. Allocating dedicated hardware to achieve isolation has disadvantages of increased cost and weight, therefore integrated architectures with shared resources are proposed in avionics with Integrated Modular Avionics (IMA) [1]. In IMA, resources are partitioned in time and space to create logical containers for each application. For commercial deployment, avionics industry has standardized partitioning with the ARINC 653 API [2] and AIR (ARINC in Space RTOS) [3] standards.The aforementioned partitioned systems are static systems, wherein all applications are integrated at design-time. In standards such as ARINC653 and AIR, applications are statically loaded in their respective partitions and the system iterates through a static Time Division Multiplexed (TDM) schedule at run time [4]. They do not cope with dynamic aspects such as adding new applications at run-time or on-board application software updates or dynamic reconfiguration in case of a fault.Consider the example of a spacecraft. The operation plan of a spacecraft can be changed to deal with u...

show abstract

“…We consider a periodic task model [1,21] 2 Note that all the analytic results in this paper are also applicable to sporadic tasks in which p g i represents the minimum separation, not the exact separation.…”

Section: A System Model Assumptions and Notationsmentioning

confidence: 99%

“…However, today's real-time systems are more dynamic, requiring dynamic change of task parameters, in order to cope with changing environments and physical system's state, improve system performance with new protocols/functionalities, and/or accommodate the tasks migrated from other failed sub-systems. Furthermore, such transition of tasks should be done without missing/delaying systems' periodic control updates in many systems, such as real-time control systems in power and automation domains [2][3][4]. In these systems, an additional transition delay that skips/suspends control updates may cause system instability or incur high control cost.…”

Section: Introductionmentioning

confidence: 99%

Schedulability Analysis for a Mode Transition in Real-Time Multi-core Systems

Lee

Shin

2013

2013 IEEE 34th Real-Time Systems Symposium

View full text Add to dashboard Cite

Abstract-To enable real-time systems to adapt to dynamically changing environments, update functionalities and/or accommodate those tasks migrated from other failed sub-systems, there have been a number of studies on making timing guarantees while accounting for change of parameters and addition/deletion of tasks. While most of them have dealt with "transition" protocols that delay next task releases or discard the unfinished tasks released before the transition, such protocols are not suitable for many control systems in which missing/delaying control updates (by completing periodic tasks) even during a transition or mode-change may cause system instability or incur a significant incremental operational cost. In this paper, we focus on a transition protocol that does not miss/delay control updates during a system transition, and develop a new schedulability analysis for the transition in a real-time multi-core system, which provides sufficient timing guarantees without requiring any online information, such as the release and execution patterns of tasks and the start time of a transition. To achieve this, we extend an existing popular schedulability analysis framework for nontransitional tasks, and identify the scenarios that maximize the duration of a task's interference to another task in the case of a transition. Since the analysis works for any arbitrary transition order of tasks, we can improve the schedulability performance by enforcing a specific order. We formulate the problem of assigning an optimal transition order, and develop a solution by deriving some properties of optimality. Our evaluation results demonstrate that the proposed solution finds more schedulable task sets, which are not covered by naive approaches.

show abstract

Dynamic software updates for real-time systems

Cited by 37 publications

References 13 publications

Analysis of existing dynamic software updating techniques for safe and secure industrial control systems

Analysis of existing dynamic software updating techniques for safe and secure industrial control systems

Composable and Predictable Dynamic Loading for Time-Critical Partitioned Systems

Schedulability Analysis for a Mode Transition in Real-Time Multi-core Systems

Contact Info

Product

Resources

About