Developing Safety-Critical Systems With GNAT Pro & VxWorks
Developing Safety-Critical Systemswith GNAT Pro & VxWorks
Trend 1: Increased Software ComplexityApplication and Kernel1 000 000 lines of codeAdvancedInterconnectAdvancedNetworkingHigh AvailabilityApplication and Kernel100 000 lines of codeMemoryManagementMultiprocessingFile SystemNetworkKernel1980Kernel199019961999
Trend 2: Need to Certify Military AvionicsExample: RTCA DO-178B & EUROCAE/ED-12B (civil avionics)FailureFailure ConditionConditionSoftwareSoftware LevelLevelCatastrophicLevel AHazardous/Severe - MajorLevel BMajorLevel CMinorLevel DNo EffectLevel EOther examples: Def-Stan 055
Typical Avionic System ArchitectureDesigned as a federated architecture of dedicated black-boxeslveeLBApp 1veLelCApp 2lveeLDApp 3lveeLAApp 4
This Architecture is Inherently RobustThe Apps are physically protected from one another.If an App fails, it does not affect the others.lveeLBApp 1veLelCApp 2lveeLDApp 3lveeLAApp 4
This Architecture is Inherently RobustFurthermore you can restart the App after it failedlveeLBApp 1veLelCApp 2lveeLDApp 3lveeLAApp 4
This Architecture is EXPENSIVE to BuildIn terms of COST, POWER, WEIGHTAdding Apps means Adding boxeslveeLBApp 1lEveeLApp 5veLelCApp 2lAveeLApp 8lveeLDApp 3lCveeLApp 7 And is EXPENSIVE to MaintainlveeLAApp 4
Integrated Modular Avionics (IMA) A new architecture model has been developed Common processing subsystems Allows multiple apps to share computing resources Reduces the number of boards in a plane Software abstraction Isolate the application from the underlying HW architecture Reduce the impact of HW obsolescence
IMA: Conceptual ViewTARGETveeLlBApp 1DCelvLelveeLApp 2App 3Software Abstraction LayerProcessorlveeLAApp 4
Before IMA Kernel & App in single address space Protection achieved by means of physical partitioninglveeLBveLelClveeLDlveeLAApp 1App 2App 3App orProcessor
Software Support for IMAApps must be partitioned (protected from one another) Spatial Partitioning Memory protection Resource protection Temporal Partitioning CPU protection Some standards addressing software support from IMA: E.g. ARINC 653, RTCA/DO-255, EUROCAE WG-60
ProtectionMemory ProtectionAn illegal memory access byan App cannot bring down thewhole systemResource ProtectionAn App cannot exhaust all thekernel resourcesTemporal ProtectionAn App cannot starve otherApps by keeping all the CPU toitself
Product FamiliesSafety CriticalGNAT Pro High-Integrity EditionGNAT Pro High-Integrity EditionVxWorks/CertVxWorks AE653PhysicalPartitioningSoftwarePartitioningGNAT ProGNAT ProVxWorks 5.xVxWorks AENon Safety-Critical
VxWorks Certifiable Kernels VxWorks/Cert DO-178B Level A certifiable multitasking RTOS VxWorks AE653 (ARINC 653) DO-178B Level A certifiable multitasking RTOS Spatial Partitioning (memory protection, resource protection) Temporal Partitioning (ARINC 653 scheduler)
VxWorks AE653 ArchitectureTARGETApp 1App 2App 3PartitionOSPartitionOSPartitionOSCore OSProcessor
Partition OSVxWorks 5.xorVxWorks/CertmicrokernelTARGETApp 1App 2App 3 Partition OS threads are called vThreads vThreads run as user-level threadsPartitionOSPartitionOSPartitionOS Priority-based preemptive scheduler Partition OS provides the following APIsto the app within the partition:Core OSProcessor ARINC 653 API POSIX API VxWorks API
vThreads vThreads do not address kernel objects in other partitions vThreads service API calls from the app vThreads allocate resources owned by the partition to the app vThreads pass on kernel calls which need to be serviced by the Core OS But only after the input parameters have been validated The message-passing implementation between the Partition & Core OS isprivate
Core OS: VxWorks AE Technology Allocation of system resources to partitionsTARGET Detection of attempted violations to partitionboundariesApp 1App 2App 3 Kernel protection (user/supervisor protection) Overrun protection: stack, heap, CPUPartitionOSPartitionOSPartitionOSlockouts Resource reclamation: heap, stack, code &data memoryVxWorks AE653Processor ARINC 653 Partition Scheduler Support for inter-partition communication viadistributed messaging
ARINC 653 SchedulerTARGETD1D2D3D1task1 D1task2D2task1 D2task2D3task1 D3task2PartitionOSPartitionOSPartitionOSCore OSWindView showing ARINC-653scheduling of 3 protection domainswith different timeslot allocationsProcessorTime slots for all 3Protection Domains
GNAT Pro High-Integrity EditionThe Ada 95 Solution toDevelop Safety-Critical Systems
GNAT Pro High-Integrity Edition (HIE) Choice of 3 profiles: Profile 1: No Ada run-time (no tasking) Profile 2: Ravenscar tasking Profile 3: User-defined Upwardly compatible with the SPARK profile The high-integrity subset of Ada by Praxis
GNAT Pro: A Single Visual : JuneFCS: Q4
GNAT Pro HIE: 3 ProfilesProfile 3: User-defined Pick & chooseProfile 2: Ravenscar Certify what you need Safe Ada 95 taskingProfile 1: No Ada Run-Time Minimal Ada run-time No Ada tasking Use VxWorks tasks directlyAda ApplicationAda ApplicationMinimal Ada run-timeNo Ada run-timeVxWorks/CertVxWorks/CertAda ApplicationUser-selected featuresVxWorks/Cert
Profile 2: Ravenscar Tasking Ravenscar Ada 95 tasking subset Defined in Ravenscar, UK in 1997, to be part of the next Ada 0Y standard Satisfies the certification requirements of safety-critical real-time systems Allows schedulability analysis (in particular RMA) These design objectives are part of certifiable VxWorks kernels Only 200 Ada SLOCs required to implement Ravenscar on top of VxWorks Very efficient & compact implementation
Profile 3: Extend the Ada Subset Allowed Profile 3 allows users to define their your own Ada subset Why is that useful? To certify an existing application It may be cheaper to customize the Ada subset and certify it Rather than recode the application to meet existing Ada profiles Especially if you do not have to certify at the highest integrity level
Example: Allowing Integer ExponentiationAssemblyAda sourcefunction F (X, N : Integer)return IntegerisY : Integer : X 1;beginreturn Y ** N;end F;GNAT Pro HIEcompilerstwu 1,-8(1)mflr 0stw 0,12(1)addi 3,3,1bl system exnintexn integerintegersystem exnint exnlwz 0,12(1)mtlr 0addi 1,1,8blr-- GNAT Pro run-time unit implementing integer "**"package System.Exn Int ispragma High Integrity;function Exn Integer Left : Integer; Right : Natural) return Integer;end System.Exp Int;
AE653 Supports Heterogeneous AppsTARGETHIE AdaAppHIE AdaAppUserUser-definedprofileNo runtimeprofileRavenscar RTUserUser-selectedfeaturesARINC 653APIVxWorksCertVxWorksCertVxWorksCertHIE AdaAppHIE AdaAppNo runtimeprofileRavenscarprofileVxWorksCertFull AdaAppCAppFull Ada 95runrun-timePOSIXAPIVxWorks5.5VxWorks5.5VxWorks AE653ProcessorCAppVxWorks5.5
AE653 Memory Protection ModelTARGETInvalid memory access!HIE AdaAppHIE AdaAppNo runtimeprofileRavenscarprofileCApptask1Ravenscar RTVxWorksCertVxWorksCertVxWorks AE653Processortask2task2suspendedOther applicationsunaffected!VxWorks5.5AE653 kernelunaffected!
AE653 Memory Protection ModelWhat happens when a task tries to access protected memory? A hardware exception is generated The kernel sends a signal to the errant task If no signal handler available, the task will be suspendedThis prevents an errant pointer access from corrupting another application
GNAT Pro & VxWorks: Key Points DO-178B certifiable solution up to LEVEL A Supporting the development of IMA applications With a tightly integrated, friendly & tool-rich environmentGNAT Pro HIE & VxWorksThe solution of choice for safety-critical systems
Satisfies the certification requirements of safety-critical real-time systems Allows schedulability analysis (in particular RMA) These design objectives are part of certifiable VxWorks kernels Only 200 Ada SLOCs required to implement Ravenscar on top of VxWorks Very efficient & compact implementation
The robot design is based on partitioning the safety-critical and non-safety-critical parts into separate sub-systems. This technique is often known as a safety bag in safety-critical systems design [8], and has been applied in robotics before [9]. The safety-critical part is contained in a black-box sys-
18.2.1. Relevance to Safety Critical Work 75 18.2.2. General assessment and management guidelines 75 18.2.3. Medical criteria for Safety Critical Workers 85 18.3. Diabetes 101 18.3.1. Relevance to Safety Critical Work 101 18.3.2. General assessment and management guidelines 101 18.3.3. Medical criteria for Safety Critical Workers 107 18.4.
Human Factors in Safety Job Safety Analysis Kitchen Safety Laboratory Ladder Safety Laser Safety Lead Lift Trucks Machinery & Equipment Miscellaneous Office Safety Paper Industry Personal Side of Safety Personal Protective Equipment Respirator Safety. Retail Safety Management Safety Talks Supervision Tools Trenching & Shoring
properties of safety critical systems such as dependability, safety and real-time constraint are considered, and formal specification is introduced as a valuable way to understand them. Formal method is considered as an important tech-nique to improve correctness of safety critical systems, as presented in [14]. [7] discusses the standards of .
Avoid DDR to store AI compute data or safety-critical code Real-Time Processor Safety-Critical Decision Making Accelerator RAM (4MB) Stores Safety-Critical Code Holds AI Image & Compute Data . Robotic Perception Systems for Real-Time Control, Safety Critical, and Predictive Maintenance Motion Planner Cloud Connectivity Cybersecurity .
Critical Thinking Skills vs. Critical Thinking Disposition Critical Thinking Skills are the cognitive processes that are involved in critical thinking Critical Thinking Disposition is the attitudes, habits of mind or internal motivations that help us use critical thinking skills.
2.2 Application of Critical Thinking in Nursing Practice 2.3 Traits of the Critical Thinker 2.4 Pitfalls in Critical Thinking 2.5 Critical Thinking Models 2.6 Critical Thinking Skills 2.6.1 Six Core Thinking Skills 2.6.2 Critical Thinking Skills in Nursing 2.6.3 Elements of Thoughts and the N
interface between safety-critical real-time operating systems and application software, as well as a set of functionalities aimed to improve the safety and certification process of such safety-critical systems. The formalization is a complete model of ARINC 653, and provides a necessary foundation for the formal development
