Dependable Systems made by FIRST Sergio Montenegro FhG FIRST www.first.fhg.de/~sergio sergio@first.fhg.de
Dependable Systems made by FIRST Automation Traffic Space Missions ICER ELIMA PowerBIRD BOSS
BOSS... Real time embedded operating system Design for dependability Design for formal verification Support for fault tolerance Fast, small,... and... Open Source! DLR
BOSS... designed for dependability Irreducible complexity Framework technology to reduce complexity component technology to handle complexity (not to create complexity) -> + Formal verification
Complexity destroys safety Required mental capacity Safety limit Forbidden area To complex to be safe Eg. BIRD: To complex to exist? Human mental capacity Design and implementation errors have their roots in the high complexity Komplexity Complexity of the underlying System DLR
Simple ->Formal Verification BOSS basic functions (for every thing): lists Operations: Insert in list remove from list -> So easy, so safe -> application of formal methods becomes possible Modell checker Theorem prover
Simple! 10kB Foot Print
BOSS... designed for dependability Irreducible complexity Framework technology to reduce complexity component technology to handle complexity (not to create complexity) -> + Formal verification
BOSS Framework external Thread xx; class TestThread: public Thread { // active object void run () { while(1) { {... do something } yield(); {... do something } suspend(); {... do something } suspendfor(1000); resume(xx); } } }; /** Another example: **/ Semaphore monitor; class OtherTestThread : public Thread { void run () { TimeControl timecontrol; //To implement time loops timecontrol.startat(5000); // Time point for the first time timecontrol.every(100); // Cyclus time while(1) { timecontrol.wait(); monitor.enter(); // protected area, {... do something } monitor.leave(); } } }; /** Create 6 threads or applications ***/ TestThread a, b, xx; OtherTestThread x, y, z; OS Framework: modern software technology / engineering Design for real time safety critical applications cost effective
BOSS... designed for dependability Irreducible complexity Framework technology to reduce complexity component technology to handle complexity (not to create complexity) -> + Formal verification
Complexity mastering by using Components Build the System by plugging applications as components Communication by using Software buses and routers
Java VM on BOSS Fast and safe upload of User (not RT) Applications Execution of user precedures Execution of macro commands Interpreter to experiment Mature and cost effectiv interpreter secure safe easy to use standard Powerfull
Middle Ware (3): What you can get Fault tolerance support multiple voters monitors TMR and beyond Distributed FT
BOSS + Hardware Fault tolerance support multiple voters monitors TMR and beyond Distributed FT
BOSS... designed for dependability Irreducible complexity Framework technology to reduce complexity component technology to handle complexity (not to create complexity) -> + Formal verification
BOSS... is it correct? Hand Code Hand Code Operational Specification... How to do... BOSS + Applic. C++ HOL semantics of C++ Asserts HOL Time Constraints Temp. Logic Axiomatic Specification: What to do What not to do Gcc Front-End Gcc Front-End Code Generator HOL Generator Machine Code HOL Operat. Spec. Execution/ Test Compiler Checker Isabelle Checker Timing Checker Universität Karlsruhe Valid: Yes/No Logfile with Time Consistent: Yes/No Satisfied: Yes/No
Enabling COTS technology for space HARD BIRD modern VLSI technology: 10x faster than rad-hard technology: Imagine all you could do, if you had 10x more computing power... 10x compacter and integrated (less weight and space) 10x less power consumption 100x cheaper Mass production, billions of processors each year... Fault tolerance concepts are being used in millions of devices every day.... and is becoming rad-hard! (submicron & SOI technologies) SOI: rad hard, no SEU, compact, low power, commercial DLR
You do not need to be radiation hard to survive radiation!! Human 3000000 RAD! 3x10^4 RAD 2x10^5 RAD 3x10^6 RAD HARD Deinococcus radiodurans... No radiation hard DNA! -> Redundancy
BOSS + Hardware DLR
An Example: Control of the Satellite BIRD DLR
20 K ions/chip/sec.: no problem for BIRD DLR
ROM, RAM: EDC (n:bits), shadow, data replication FPGA: internal redundant codes, internal replication and comparators external: replication latch up protection CPU: SW redundancy: plausibility checks, watchdogs, code program counter traces duplicated execution of code IO: replication DLR
UART parallel 64 Analog Input Ethernet I 2 C COBT Timer UART 8 x serial Modem Input Down Link Image Data 64 x Analog Input Serial I/O Interface UART 8 X RS 485 Latch-up Monitor Modem Interface Debug Port Power PC MPC823 (66 MHz) FPGA Telemetry I/O Interface (Downlink) Flash 4 MByte Ethernet Memory EDC DRAM 8 MByte Example: Node Computer of the BIRD Satellite DLR
Next Step... Replications, redundant codes (EDC) and reconfiguration management DLR