Dependable Systems made by FIRST

Transcription

1 Dependable Systems made by FIRST Sergio Montenegro FhG FIRST

2 Dependable Systems made by FIRST Automation Traffic Space Missions ICER ELIMA PowerBIRD BOSS

3 BOSS... Real time embedded operating system Design for dependability Design for formal verification Support for fault tolerance Fast, small,... and... Open Source! DLR

4 BOSS... designed for dependability Irreducible complexity Framework technology to reduce complexity component technology to handle complexity (not to create complexity) -> + Formal verification

5 Complexity destroys safety Required mental capacity Safety limit Forbidden area To complex to be safe Eg. BIRD: To complex to exist? Human mental capacity Design and implementation errors have their roots in the high complexity Komplexity Complexity of the underlying System DLR

6 Simple ->Formal Verification BOSS basic functions (for every thing): lists Operations: Insert in list remove from list -> So easy, so safe -> application of formal methods becomes possible Modell checker Theorem prover

7 Simple! 10kB Foot Print

8 BOSS... designed for dependability Irreducible complexity Framework technology to reduce complexity component technology to handle complexity (not to create complexity) -> + Formal verification

9 BOSS Framework external Thread xx; class TestThread: public Thread { // active object void run () { while(1) { {... do something } yield(); {... do something } suspend(); {... do something } suspendfor(1000); resume(xx); } } }; /** Another example: **/ Semaphore monitor; class OtherTestThread : public Thread { void run () { TimeControl timecontrol; //To implement time loops timecontrol.startat(5000); // Time point for the first time timecontrol.every(100); // Cyclus time while(1) { timecontrol.wait(); monitor.enter(); // protected area, {... do something } monitor.leave(); } } }; /** Create 6 threads or applications ***/ TestThread a, b, xx; OtherTestThread x, y, z; OS Framework: modern software technology / engineering Design for real time safety critical applications cost effective

10 BOSS... designed for dependability Irreducible complexity Framework technology to reduce complexity component technology to handle complexity (not to create complexity) -> + Formal verification

11 Complexity mastering by using Components Build the System by plugging applications as components Communication by using Software buses and routers

12 Java VM on BOSS Fast and safe upload of User (not RT) Applications Execution of user precedures Execution of macro commands Interpreter to experiment Mature and cost effectiv interpreter secure safe easy to use standard Powerfull

13 Middle Ware (3): What you can get Fault tolerance support multiple voters monitors TMR and beyond Distributed FT

14 BOSS + Hardware Fault tolerance support multiple voters monitors TMR and beyond Distributed FT

15 BOSS... designed for dependability Irreducible complexity Framework technology to reduce complexity component technology to handle complexity (not to create complexity) -> + Formal verification

16 BOSS... is it correct? Hand Code Hand Code Operational Specification... How to do... BOSS + Applic. C++ HOL semantics of C++ Asserts HOL Time Constraints Temp. Logic Axiomatic Specification: What to do What not to do Gcc Front-End Gcc Front-End Code Generator HOL Generator Machine Code HOL Operat. Spec. Execution/ Test Compiler Checker Isabelle Checker Timing Checker Universität Karlsruhe Valid: Yes/No Logfile with Time Consistent: Yes/No Satisfied: Yes/No

17 Enabling COTS technology for space HARD BIRD modern VLSI technology: 10x faster than rad-hard technology: Imagine all you could do, if you had 10x more computing power... 10x compacter and integrated (less weight and space) 10x less power consumption 100x cheaper Mass production, billions of processors each year... Fault tolerance concepts are being used in millions of devices every day.... and is becoming rad-hard! (submicron & SOI technologies) SOI: rad hard, no SEU, compact, low power, commercial DLR

18 You do not need to be radiation hard to survive radiation!! Human RAD! 3x10^4 RAD 2x10^5 RAD 3x10^6 RAD HARD Deinococcus radiodurans... No radiation hard DNA! -> Redundancy

19 BOSS + Hardware DLR

20 An Example: Control of the Satellite BIRD DLR

21 20 K ions/chip/sec.: no problem for BIRD DLR

22 ROM, RAM: EDC (n:bits), shadow, data replication FPGA: internal redundant codes, internal replication and comparators external: replication latch up protection CPU: SW redundancy: plausibility checks, watchdogs, code program counter traces duplicated execution of code IO: replication DLR

23 UART parallel 64 Analog Input Ethernet I 2 C COBT Timer UART 8 x serial Modem Input Down Link Image Data 64 x Analog Input Serial I/O Interface UART 8 X RS 485 Latch-up Monitor Modem Interface Debug Port Power PC MPC823 (66 MHz) FPGA Telemetry I/O Interface (Downlink) Flash 4 MByte Ethernet Memory EDC DRAM 8 MByte Example: Node Computer of the BIRD Satellite DLR

24 Next Step... Replications, redundant codes (EDC) and reconfiguration management DLR

25