Partitioned Operating System Research Articles

A Comprehensive Formal Specification of ARINC 653 With Conformity Proof

ABSTRACTAs the predominant standard for partitioning operating systems, ARINC 653 has been applied in many critical domains. However, its reliance on informal textual languages presents challenges for ensuring both the correctness of the standard itself and the conformity of a specification or an OS to this standard. This paper addresses the gap through formal work on the ARINC 653 standard. We provide a comprehensive formal specification of multi‐core ARINC 653 Part 1–5 using Isabelle/HOL that encompasses all the 68 services and covers all components outlined in the standard, then conduct a formal proof of conformity of the specification according to ARINC 653 Part 3A. Our work marks the first comprehensive multi‐core ARINC 653 specification with a formal conformity proof. Notably, we identify and address three defects in the standard document during the formal specification and proof.

Research on schedulability analysis algorithm of airborne multi partition system

Partition operating system conforming to ARINC653 is widely used in airborne to support application software integration. Under the two-level scheduling model for partition operating system, the demanding real-time requirements of airborne software are usually difficult to obtain effective deterministic guarantee, so it is very important to analyze the schedulability of the system. Judging whether the scheduling table can meet the real-time requirements of the process in the partition through the schedulability analysis algorithm is an effective means to ensure that all processes in the system complete the computing task within the specified time. Based on the method of operations research and the introduction of virtual process, a schedulability analysis algorithm for multi partition system is designed, and the numerical verification is carried out. The verification results show that the algorithm can accurately judge whether the scheduling table matches the process time attribute, give the qualitative analysis conclusion of whether the system can be scheduled, help the system integrator to verify the rationality of the scheduling table before the actual operation of the system, and reduce the risk of test and flight test.

Research on Real-time Scheduling Algorithm of Partition Operating System in Single Core Environment

In an embedded environment, applications have a strong demand for real-time scheduling, but it is difficult to ensure the real-time scheduling performance under a partitioned operating system, mainly because in a multi-operating system environment. It is difficult to determine the real-time schedulability within and between partitions. The research of this paper will focus on the real-time scheduling algorithm of partition operating system with simple task model in single-core environment.

Design and implementation of partition Operating System based on ARINC653 standard

The ARINC series of standards are mainly used to define how to use the computing resources of avionics. The ARINC 653 standard applies to the service interface of the spacecraft’s integrated electronic operating system to the upper-layer application software. It isolates the application software from the underlying processor architecture and meets the requirements of the on-board real-time system with good scalability. This article will follow the ARINC 653 standard, design and implement a partition operating system, providing basic system static configuration capabilities, space partition capabilities, time sharing capabilities, inter-zone communication capabilities, and security monitoring capabilities

A Formal Model of a Partitioned Real-Time Operating System in Promela

Real-time partitioned operating systems meet the current avionics standard of reliable software; they are capable of responding to events from devices with an expected speed, as well as sharing processor time and memory between isolated partitions. Model-based Checking is a formal verification technique in which a software model is developed and then it is automatically checked for the compliance with formal requirements. This method allows proving the correct operation of the model on all possible input data, all possible ways of processes switching and interactions. In this article, we describe a formalized model of an open-source partitioned operating system POK. We implement the model in Promela language for SPIN tool with the purposes of formal verification using the Model Checking method. The model is designed to describe the behavior of: partition and process schedulers, system calls through a software interrupt, kernel libraries for working with synchronization primitives and processes awaiting, user code which consists of several processes in different partitions that are synchronized through a semaphore. The described approach can be used to verify the correct synchronization, the proper operation of the scheduler algorithms, and the accurate data access from different partitions by introducing the corresponding requirements in the form of formulas of the linear-time temporal logic.

A Formal Model of a Partitioned Real-Time Operating System in Promela

Real-time partitioned operating systems meet the current avionics standard of reliable software; they are capable of responding to events from devices with an expected speed, as well as sharing processor time and memory between isolated partitions. Model-based Checking is a formal verification technique in which a software model is developed and then it is automatically checked for the compliance with formal requirements. This method allows proving the correct operation of the model on all possible input data, all possible ways of processes switching and interactions. In this article, we describe a formalized model of an open-source partitioned operating system POK. We implement the model in Promela language for SPIN tool with the purposes of formal verification using the Model Checking method. The model is designed to describe the behavior of: partition and process schedulers, system calls through a software interrupt, kernel libraries for working with synchronization primitives and processes awaiting, user code which consists of several processes in different partitions that are synchronized through a semaphore. The described approach can be used to verify the correct synchronization, the proper operation of the scheduler algorithms, and the accurate data access from different partitions by introducing the corresponding requirements in the form of formulas of the linear-time temporal logic.

Designing robust quadcopter software based on a real-time partitioned operating system and formal verification techniques

The creation of reliable unmanned aerial vehicles (drones) now is an important task in the science and technology, because such devices can have a lot of use-cases in the digital economy and modern life, so we need to ensure the reliability here. In this article, it is proposed to assemble a quadcopter from low-cost components in order to obtain a hardware prototype and to develop a software solution for the flight controller with high-reliability requirements, which will meet avionics software standards using existing open-source software solutions, and also apply the results as a model for teaching courses “Components of operating systems” and “Software verification”. In the study, we proceed to analyse the structure of quadcopters and flight controllers for them, represent a self-assembly solution. We describe Ardupilot as open-source software for unmanned aerial vehicles, the appropriate APM controller and methods of PID control. Today's avionics standard of reliable software for flight controllers is a real-time partitioning operating system that is capable of responding to events from devices with an expected speed, as well as sharing processor time and memory between isolated partitions. A good example of such OS is the open-source POK (Partitioned Operating Kernel). In the repository, it contains an example design of a system for the quadcopters using AADL language for modeling its hardware and software. We apply such a technique with Model-driven engineering to a demo system that runs on real hardware and contains a flight management process with PID control as a partitioned process. Using a partitioned OS brings the reliability of flight system software to the next level. And to increase the level of control logic correctness we propose to use formal verification methods and provide examples of verifiable properties at the level of code using the deductive approach as well as at the level of the cyber-physical system using Differential dynamic logic to prove the stability.

Formal Specification and Analysis of Partitioning Operating Systems by Integrating Ontology and Refinement

Partitioning operating systems (POSs) have been widely applied in safety-critical domains from aerospace to automotive. In order to improve the safety and the certification process of POSs, the ARINC 653 standard has been developed and complied with by the mainstream POSs. Rigorous formalization of ARINC 653 can reveal hidden errors in this standard and provide a necessary foundation for formal verification of POSs and ARINC 653 applications. For the purpose of reusability and efficiency, a novel methodology by integrating ontology and refinement is proposed to formally specify and analyze POSs in this paper. An ontology of POSs is developed as an intermediate model between informal descriptions of ARINC 653 and the formal specification in Event-B. A semiautomatic translation from the ontology and ARINC 653 into Event-B is implemented, which leads to a complete Event-B specification for ARINC 653 compliant POSs. During the formal analysis, six hidden errors in ARINC 653 have been discovered and fixed in the Event-B specification. We also validate the existence of these errors in two open-source POSs, i.e., XtratuM and POK. By introducing the ontology, the degree of automatic verification of the Event-B specification reaches a higher level.

멀티코어 기반 파티셔닝 운영체제를 이용한 분산 복구 블록 설계 기법 및 응용

최근 항공기, 자동차와 같은 시스템들은 크기, 무게, 전력 등의 문제로 기존 연합형(Federated) 구조에서 모듈형(Modular) 구조로 개발되는 추세이며, 단일 하드웨어에 파티션 개념을 적용하여 다수의 논리적 노드들을 운용할 수 있는 파티션 운영체제도 등장하고 있다. 분산 복구 블록은 실시간 시스템에 적용 가능한 소프트웨어 결함 허용 기법으로 다수의 물리적 노드들을 동기화 시켜 동작시킴으로써 실시간 절체가 가능하도록 하는 설계 기법이다. 분산 복구 블록은 노드들 간의 실시간 동기화를 필요로 하기 때문에 단일 코어 기반의 파티션 구조에는 적합하지 않으며, 적용을 위해서는 멀티코어를 기반으로 하고 또한 AMP(Asymmetric Multi-Processing) 방식을 이용한 파티션 구조에 적용되어야 한다. 본 논문에서는 멀티코어 기반 supervised-AMP 가상화 방식의 파티션 운영체제를 이용한 분산 복구 블록 설계 기법을 제안한다. 또한 제안된 설계 기법의 유용성을 보이기 위하여 항공기용 비행제어시스템 시뮬레이션을 이용한 사례 연구를 보인다. Recently, embedded systems such as aircraft and automobilie, are developed as modular architecture instead of federated architecture because of SWaP(Size, Weight and Power) issues. In addition, partition operating system that support multiple logical node based on partition concept were recently appeared. Distributed recovery block is fault tolerance design scheme that applicable to mission critical real-time system to support real-time take over via real-time synchronization between participated nodes. Because of real-time synchronization, single-core based computer is not suitable for partition based distributed recovery block design scheme. Multi-core and AMP(Asymmetric Multi-Processing) based partition architecture is required to apply distributed recovery block design scheme. In this paper, we proposed design scheme of distributed recovery block on the multi-core based supervised-AMP architecture partition operating system. This paper implements flight control simulator for avionics to check feasibility of our design scheme.

Next generation space avionics: layered system implementation

Advances in electronics over the past decade have produced major improvements in the power and flexibility of computer systems. Unfortunately current avionics systems for space applications typically have not leveraged these COTS advantages. A decade ago, the state-of-the-art for avionics systems made a step change to the Integrated Modular Avionics (IMA) used in the Boeing 777. This next generation avionics architecture is not based upon traditional Byzantine redundancy structures, but on a truth-based scheme where each element knows when an internal failure occurs and removes itself from the system. IMA utilizes a lock-step microprocessor design that communicates to a COTS Backplane for input/output, and to a Virtual Backplane/spl trade/ (a reliable high-speed serial bus) for intra-system communication. The system functions are implemented using a time and space partitioned operating system. The entire system provides the simplicity of a simplex system, implements the highest level of reliability providing complete flexibility to reconfigure both software applications and hardware interfaces, allows for rapid prototyping using low-cost COTS hardware, and is easily expandable beyond the initial point implementation. As the only 5/sup th/ generation avionics architecture, the concepts incorporated into Honeywell's IMA are ideally suited to be the backbone of the next generation Space Exploration Program avionics architectures.

Cellular disco

Despite the fact that large-scale shared-memory multiprocessors have been commercially available for several years, system software that fully utilizes all their features is still not available, mostly due to the complexity and cost of making the required changes to the operating system. A recently proposed approach, called Disco, substantially reduces this development cost by using a virtual machine monitor that laverages the existing operating system technology. In this paper we present a system called Cellular Disco that extends the Disco work to provide all the advantages of the hardware partitioning and scalable operating system approaches. We argue that Cellular Disco can achieve these benefits at only a small fraction of the development cost of modifying the operating system. Cellular Disco effectively turns a large-scale shared-memory multiprocessor into a virtual cluster that supports fault containment and heterogeneity, while avoiding operating system scalability bottlenecks. Yet at the same time, Cellular Disco preserves the benefits of a shared-memory multiprocessor by implementing dynamic, fine-grained resource sharing, and by allowing users to overcommit resources such as processors and memory. This hybrid approach requires a scalable resource manager that makes local decisions with limited information while still providing good global performance and fault containment. In this paper we describe our experience with a Cellular Disco prototype on a 32-processor SGI Origin 2000 system. We show that the execution time penalty for this approach is low, typically within 10% of the best available commercial operating system formost workloads, and that it can manage the CPU and memory resources of the machine significantly better than the hardware partitioning approach.

Cellular Disco

Despite the fact that large-scale shared-memory multiprocessors have been commercially available for several years, system software that fully utilizes all their features is still not available, mostly due to the complexity and cost of making the required changes to the operating system. A recently proposed approach, called Disco, substantially reduces this development cost by using a virtual machine monitor that leverages the existing operating system technology.In this paper we present a system called Cellular Disco that extends the Disco work to provide all the advantages of the hardware partitioning and scalable operating system approaches. We argue that Cellular Disco can achieve these benefits at only a small fraction of the development cost of modifying the operating system. Cellular Disco effectively turns a large-scale shared-memory multiprocessor into a virtual cluster that supports fault containment and heterogeneity, while avoiding operating system scalability bottle-necks. Yet at the same time, Cellular Disco preserves the benefits of a shared-memory multiprocessor by implementing dynamic, fine-grained resource sharing, and by allowing users to overcommit resources such as processors and memory. This hybrid approach requires a scalable resource manager that makes local decisions with limited information while still providing good global performance and fault containment.In this paper we describe our experience with a Cellular Disco prototype on a 32-processor SGI Origin 2000 system. We show that the execution time penalty for this approach is low, typically within 10% of the best available commercial operating system for most workloads, and that it can manage the CPU and memory resources of the machine significantly better than the hardware partitioning approach.