AUTOBEST: A microkernel-based system (not only) for automotive applications Marc Bommert, Alexander Züpke, Robert Kaiser vorname.name@hs-rm.de
Outline Motivation AUTOSAR ARINC 653 AUTOBEST Architecture Certification Research Status + Outlook 2
Motivation Safety requirements for shared resources IEC 61508 An E/E/PE* safety-related system will usually implement more than one safety function. If the safety integrity requirements for these safety functions differ, unless there is sufficient independence of implementation between them, the requirements applicable to the highest relevant safety integrity level shall apply to the entire E/E/PE safety-related system. ISO 26262 Freedom of interference * E/E/PE: electrical / electronic / programmable electronic 3
Motivation Mixed-criticality system Partitioning P1 P2 P3 P4 ARINC 653 (Avionics) Spatial Partitioning most critical critical less critical least critical Time Partitioning Does this fit into a car as well? Kernel 4
Motivation Independent partitions Isolation P1 P2 P3 P4 (Limited) interference most critical critical less critical least critical Degraded mode Is this possible on today's ECUs with limited resources? Kernel 5
Motivation Requirements Different kind of partitions AUTOSAR partitions P1 P2 P3 P4 ARINC 653 partitions POSIX partitions most critical critical less critical least critical Static configuration Partitioning / MPU Partition Scheduling Tasks, Events, Alarms,... Goal: save as much RAM as possible! Kernel 6
AUTOSAR 7
AUTOSAR Automotive Software Stack Component Architecture Vendor neutral Design driven development Tools... Most components are outside the kernel Use existing 3 rd party components where possible Source: http://www.autosar.org 8
AUTOSAR Automotive Software Stack Component Architecture Vendor neutral Design driven development Tools... Most components are outside the kernel Use existing 3 rd party components where possible Source: http://www.autosar.org 9
ARINC 653 10
ARINC 653 Avionics OS Standard Part 1 - Required Services Part 2 - Extended Services Part 3 - Conformity Test Spec. Part 4 - Subset Services Multicore Services? Driven by IMA (Integrated Modular Avionics) SWaP (Size, Weight, and Power) Source: http://www.wikipedia.org 11
AUTOBEST Architecture 12
AUTOBEST Architecture Observation: OSEK and ARINC 653 have a lot of similar design patterns: Tasks Processes 4 Task States Static Initialization Initialization at Startup Priority based FIFO scheduling Synchronization using Priority Ceiling Protocols Application Modes Partition States No conflicting requirements! Use a common microkernel architecture 13
AUTOBEST Architecture Special Features OSEK / AUTOSAR Counters + Alarms Schedule Tables Interrupt Handling Interrupts are partitioned Interrupt handler are mapped to high priority tasks DisableInterrupts() raise priority to partition maximum 14
AUTOBEST Architecture Special Features ARINC 653 Partition Communication Queueing- and Sampling-Ports 64-bit Nanosecond Timeout API Health Monitoring Strict Error handling Partitioning API Start & Shutdown of other partitions Privileged system calls 15
AUTOBEST Architecture Component Architecture AUTOSAR Application ARINC 653 Application AUTOSAR Library ARINC 653 Library Configuration Configuration user mode supervisor mode Architecture Layer Kernel Component Configuration Board Component Processor 16
AUTOBEST Architecture Device Drivers Low-level AUTOSAR components like MCAL need adaption: Put some parts into kernel, others in user space Pragmatic approach: put performance critical drivers (CAN) into kernel put highly complex drivers (EEPROM) in dedicated partitions 17
Certification 18
Certification Documented Software Design Process Focus on Traceability Multiple levels of Requirements High Level Interfaces Component APIs Internal Design Requirement-based Testing Analyses: Coverage, Timing,... Reviews Processes, Requirements, Design, Code, Tests,... 19
Certification AUTOSAR: typically highly configurable SW Integration becomes problematic #ifdefs lead to a large configuration set Did you really test every combination??? AUTOBEST Kernel: (almost) no #ifdefs all features enabled by default Configuration on binary data Binary component re-use! Simplify re-certification and software testing 20
Research 21
Research Topics Engineering challenges Make it safe Make it fast? Low memory consumption Research challenges Techniques to mitigate costs of partitioning Interrupt-Handling Strict Temporal Isolation Bounded Interference on Multicore 22
Implementation 23
Implementation Implementation in C99 with GNU extensions Compiler: GCC Supported Architectures: ARM v7 Cortex-R4: Texas Instruments TMS570 Cortex-A8: BeagleBone Black (for testing) QEMU PowerPC e200 MPC5646c (Bolero3M) QEMU 24
Status + Outlook Current Status / Done (October 2014): Full OSEK API + AUTOSAR extensions Full ARINC 653 Part 1 Supplement 3 support Resource partitioning + MPU support 11,900+ LOC C + asm for kernel and architectures specific code 7,700+ LOC Perl + C# code for tools Work in progress: Multicore Support Infineon AURIX 25
Thank you for your attention! Questions? 26