Reconfiguration as a mean to enhance platform availability

Transcription

1 SCAlable & ReconfigurabLe Electronics platforms and Tools - Towards the next generation of Integrated Modular Avionics Reconfiguration as a mean to enhance platform availability Workshop APRES 2009 Pierre Bieber, Eric Noulard, Claire Pagetti, Thierry Planche, Frédéric Vialard and all the Scarlett partners October 11 th, 2009 Page 1

2 IMA-1G -3 C1 C2 A429 AFX A AFX B -1 A1 A2 A3-1 A1 A2 A3-5 E1 E2-2 B1 B2 B3-7 G1 G2-7 G1 G E1 E2 B1 B2 B Page 2

3 IMA-2G objectives IMA-1G Is only used for selected applications Characterized by several types of because of I/O adherence oes authorize better reuse and less part number but not reconfigurability IMA-2G Will separate I/O from computing resource () Will bring enhanced performance enabling a greater number of applications to be hosted on the same Will allow the reconfiguration on some applications Page 3

4 Outline 1. What may cause a reconfiguration? 2. Reconfiguration scenarios 3. Reconfiguration process Page 4

5 Reconfiguration purpose oes not necessarily improve the safety, but must not impact it Must improve the operational reliability efinition [Reliability]: the ability/probability that a system will perform its intended function during a specified period of time under stated conditions efinition 1 [Operational Reliability civil aircraft]: the percentage of scheduled flights that depart and arrive without incurring chargeable (technical) operational interruption. efinition 2 [Operational Interruption]: an operational interruption of a scheduled flight is chargeable when it is caused by a known or suspected aircraft basic malfunction of a system or component, the checking of the same, or necessary corrective action. elays due to weather conditions, air traffic control, spare shortage, controller unavailability are not chargeable. Page 5

6 Candidate for reconfiguration Applicable failure for reconfiguration: - Failure of a that hosts an application whose loss has an impact on operational reliability - The function loss is delaying the flight - It can be found in the pilot procedure: the MEL Page 6

7 Minimum Equipment List (MEL) list the instruments and equipments that may be inoperative without jeopardizing the safety of the aircraft; give the procedures for flight crews to follow when securing or deactivating inoperative instruments or equipment; specific for the aircraft and the type of operation; approved by the appropriate authority (the FAA for civil registered aircraft in the United States, EASA for civil registered aircraft in Europe, etc). Airframer provides MMEL (Master Minimum Equipment List) Page 7

8 MMEL for IMA - example Equipment Number for nominal mode Number for degraded mode Condition and limitation One may be inoperative provided the alarm 1 is not raised. GO IF May be inoperative GO Switch 8 6 May be inoperative provided a) The alarm 2 is not raised, b) The alarm 3 is not raised. GO IF Other not mentioned NO GO Page 8

9 MEL usage -3 C1 C2 MEL -1 A1 A2 A3-1 A1 A2 A3-5: NO GO -5 E1 E2-2 B1 B2 B3-7 G1 G2-7 G1 G E1 E2 B1 B2 B3 try a reconfiguration Page 9

10 Outline 1. What may cause a reconfiguration? 2. Reconfiguration scenarios 3. Reconfiguration process Page 10

11 Scarlett Platform Architecture Principles C1 C2 F1 F2 Cluster 1 A1 A2 A3 C2 A1 A2 A3 E1 E2 B1 B2 B3 G1 G G1 G2 C3 E1 E2 B1 B2 B3 C4 Page 11

12 Several Scenarios examined Scenario 1 : Using a spare On ground (during Turn Around Time) or in flight Scenario 2 : Partition migration over any other s On ground or in flight Page 12

13 Scenario 1 Spare 1 F1 SWITCH 2 1 F2 F CONFIGURATION TABLES 2 3 F4 F5 F6 F7 F8 F9 spare ATA N cluster Page 13

14 Scenario 1 Spare CPM 1 F1 SWITCH 2 1 F2 F CABINET CONFIGURATION TABLES 2 3 F4 F5 F6 F7 F8 F9 spare ATA N F1 F2 1 F3 cluster Page 14

15 Outline 1. What may cause a reconfiguration? 2. Reconfiguration scenarios 3. Reconfiguration process 1. Scarlett choices 2. Off-line reconfiguration services 3. On line reconfiguration services 4. Work in progress Page 15

16 Reconfiguration Supervisor (RS) RS is a new function which is responsible for taking reconfiguration decision, applying the best reconfiguration and managing reconfiguration information RS Characteristics The aircraft should be able to fly without RS We identified two parts: offline (i.e. design time) for the elaboration of reconfiguration online part (operational part) for the selection of the best reconfiguration. Page 16

17 Outline 1. What may cause a reconfiguration? 2. Scenarios of reconfiguration 3. Reconfiguration process 1. Scarlett choices 2. Off-line reconfiguration services 3. On line reconfiguration services 4. Work in progress Page 17

18 Reconfiguration during design Configurations Characteristics All applicable configurations shall be known at design time this is a certification/validation requirement Each possible configuration shall be validated just as a stand-alone configuration (same as IMA-1G) Each transition from one configuration to another shall be known and validated. Page 18

19 Generate a set of configurations cpm CPM #2 A2 cpm CPM #3 A3 cpm CPM #1 A1 cpm CPM #4 A4 Switch cpm CPM #S Leads to a graph of reconfigurations A1/1,A2/2,A3/3,A4/4,OFF/S FAIL1 FAIL2 FAIL3 FAIL4 KO/1,A2/2,A3/3,A4/4,A1/S A1/1, KO/2,A3/3, A4/4, A2/S A1/1,A2/2,KO/3,A4/4,A3/S A1/1, A2/2,A3/3,KO/4, A4/S Page 19

20 Configuration efinition [Configuration]: A configuration is an allocation of avionics applications on computing elements. Conf : Application Computing _ Element where the set Computing_Element is defined by Cluster ( Basic _ Module Spare _ Module) ( Basic _ Partition Spare _ Partition) Page 20

21 Reconfiguration policy Generic rules for the reconfiguration (defined off-line). Policy 1 :no priority among avionics applications. Once a spare has been occupied, no other application can be hosted on this spare. If a spare fails, the hosted applications are not reconfigured. Policy 2: priority level assigned to the applications. Once a spare has been occupied, no other application can be hosted on this spare. A spare is also reconfigurable. Page 21

22 Number of configurations level reconfiguration 1. Local reconfiguration: a can only be reconfigured in the same cabinet, with the policy 1 C 0 k sm k k bm Asm c configurations For c=4, bm=5, sm=1 => 1296 configurations 2. istant reconfiguration: a can only be reconfigured in the any cabinet, with the policy 1 0 k ( c sm) C c A k bm k c sm For c=4, bm=5, sm=1 => configurations configurations Page 22

23 Outline 1. What may cause a reconfiguation? 2. Scenarios of reconfiguration 3. Reconfiguration process 1. Scarlett choices 2. Off-line reconfiguration services 3. On line reconfiguration services 4. Work in progress Page 23

24 The reconfiguration steps STEP 1 Step 1: confirmation. STEP 2 Step 2: Lookup all possible configurations STEP 3 STEP 4 Step 3: The RS will go through the ordered list of selectable target configurations and select the best configuration Step 4: Execute the selected reconfiguration procedure STEP 5 Step 5: Update of information Page 24

25 Reconfiguration in action partition FAULTY partition SPARE partition partition partition partition system system Power Off faulty Switch Reconf Switch LCS Upload Module Configuration Run: Upload Module Configuration failure Module Test CMS Run: Module Test (Faulty ) Run: Module Test Power On Spare CPM CMS = Central Maintenance System LCS = ata Loading and Control System RS Choose Target Configuration Check MEL MEL Page 25

26 Outline 1. What may cause a reconfiguation? 2. Scenarios of reconfiguration 3. Reconfiguration process 1. Scarlett choices 2. Off-line reconfiguration services 3. On line reconfiguration services 4. Work in progress Page 26

27 Work in progress Conception 1. Prove that the reconfiguration supervisor does not degrade the IMA safety 2. Study the possible failures of the reconfiguration supervisor function 3. Evaluate several architectural principles (redundancy, master/checker ) emonstrator 1. emonstrator of automated reconfiguration in Scarlett Page 27