Implementing logical synchrony in integrated modular avionics

Abstract

Many avionics systems must be implemented as redundant, distributed systems in order to provide the necessary level of fault tolerance. To correctly perform their function, the individual nodes of these systems must agree on some part of the global system state. Developing protocols to achieve this agreement is greatly simplified if the nodes execute synchronously relative to each other, but many Integrated Modular Avionics architectures assume nodes will execute asynchronously. This paper presents a simple design pattern, Physically Asynchronous/Logically Synchronous (PALS), that allows developers to design and verify a distributed, redundant system as though all nodes execute synchronously. This synchronous design can then be distributed over a physically asynchronous architecture in such a way that the logical correctness of the design is preserved. Use of this complexity reducing design pattern greatly simplifies the development and verification of fault tolerant distributed applications, ensures optimal system performance, and provides a standard argument for system certification.

Formalization and Correctness of the PALS Architectural Pattern for Distributed Real-Time Systems

“…We first explain how this work is related to other work on PALS involving our colleagues at Rockwell-Collins and at UIUC [20,2,31]. The PALS transformation itself and its optimal period, as well as the active standby example, are also presented in [20,2,31].…”

“…The PALS transformation itself and its optimal period, as well as the active standby example, are also presented in [20,2,31]. The main new contributions of the work presented here are the formal specification of PALS as a real-time rewrite theory parameterized by the input synchronous ensemble and the performance bounds, the proof of correctness of such a formal model, and the mathematical justification of the method by which the verification of temporal logic properties of the DRTS thus obtained can be reduced to the verification of such properties on the typically much simpler synchronous model.…”

“…Our models are based on an AADL [30] model for active standby developed by Abdullah Al-Nayeem at UIUC of a similar active standby specification developed by Steve Miller and Darren Cofer at Rockwell-Collins. The active standby system is extensively discussed in [20]. As explained in Section 9.1, the active standby system consists of three components.…”

“…In this paper we present a formal specification and a proof of correctness for one such pattern, namely the Physically Asynchronous Logically Synchronous 3 (PALS) architectural pattern, which we have developed in collaboration with colleagues at Rockwell-Collins and UIUC (see [20,2,31]). This pattern provides a generic engineering solution to the problem of designing a DRTS that must be virtually synchronous in spite of its asynchronous nature.…”

Formal Semantics and Analysis of Behavioral AADL Models in Real-Time Maude

“…The AADL2Maude tool has been used by Edgar Pek to verify an AADL model developed by Abdullah Al-Nayeem of an active standby specification by Steve Miller from Rockwell-Collins for deciding which of two computer systems is active in an aircraft [11]. The active standby system is a simplified example of a fault-tolerant avionics system.…”