Antonio Kung, Trialog. HIJA technical coordinator. Scott Hansen, The Open Group. HIJA coordinator

Transcription

1 HIJA Antonio Kung, Trialog HIJA technical coordinator Scott Hansen, The Open Group HIJA coordinator 1 Presentation Outline HIJA project ANRTS platforms Requirements for ANRTS platforms Profiles based on RTSJ Integration in the software process Lessons learned and conclusion Extract from JTRES06 presentation 2

2 HIJA Project HIJA (High Integrity Java Applications) STREP (embedded system) Mission: create the technology conditions that will allow architecture neutrality for high-integrity applications High Integrity Applications: Applications which need assurance level Safety critical systems e.g. avionics Business critical systems e.g. telematics 3 HIJA Project Partners Coordination The Open Group Technology partners Trialog Aonix Aicas Academic partners FZI Karlsruhe U. Karlsruhe U. York U. P. Madrid User partners Thales Centro Riserche Fiat Telecom Italia Bellstream 4

3 ANRTS Platform Architecture Neutral Real Time System Add real-time system (RTS) features to Java Applications AN Platform (Java) High-Integrity Applications ANRTS Platform (Java) 5 Requirements for ANRTS Platforms Architecture Neutrality Take into account resource constraint Take into account assurance constraint impact on application design (e.g. static approach) Real-time Availability of schedulability analysis tools Availability of worst case usage resource determination features 6

4 Requirements for ANRTS Process Functional correctness assurance Processor independent verification Allowing for dynamic downloading of verified programs e.g. proof carrying code Integration in development process to achieve assurance level Application behaviour specification (e.g. modelling) Platform independent Behaviour can be extracted from the AN form Platform behaviour specification Derive a model of the platform behaviour from the design of the hardware and OS design 7 ANRTS Platforms based on RTSJ Need for profiles Not the same needs depending on level of assurance e.g. RTSJ platform too complex for applications with static approaches for assurance Support of distribution Profiles HRTJ Profile: Hard Real-Time Java Safety critical apps, Mission critical apps SRTJ Profile: Soft Real-Time Java Mission critical apps, Business critical apps FRTJ Profile: Flexible Real-Time Java Business critical apps including future ambient intelligent apps 8

5 HRTJ Profile Relies on a Java programming model allowing predictable and reliable execution of application programs Follows philosophy of the Ravenscar profile Some language features are removed Programs are statically analysable JVM similarly restricted Specialisation of schedulable objects Allows for schedulability analysis Restriction in resource dynamic allocation capability Implies two execution phase: initialisation phase and mission phase 9 SRTJ Profile Relies on a Java programming model based on dynamic resource enforcement in terms of CPU and memory Real-time garbage collection mechanisms Does not support RTSJ scoped and immortal memory Relies on RTSJ process group for CPU enforcement Applications are structured into separate process groups with specific CPU budgets Mechanisms for memory enforcement and admission control New mechanism Need for a component called QoS Manager 10

6 FRTJ Profile Environment in which multiple independent applications can execute Each independent application could require a specific HRTJ or SRTJ profile (most of the time SRTJ) Framework for multiple independent applications with provisioning capabilities OSGi : Open Service Gateway Initiative Each individual application is represented as an OSGi bundle 11 Multiple Independent Applications Are business critical systems, e.g. telematics platform App A App B Platform Required level of assurance : application system resource (CPU, Memory ) protection allocation of resources for new applications App A App C App B Platform 12

7 QoS Requirement QoS collective effect of service and performances that determine the degree of satisfaction of the service Platform QoS requirement ensure system resource protection to each individual application App A App B App C QoS A QoS B QoS C Platform 13 Resulting FRTJ Platform A resource aware JVM+OS implementing the following mechanisms Admission control Resource accounting QoS enforcement Assumption Application declares resource needs Applications Framework for Multiple Independent Applications Resource Aware Java Virtual Machine Resource Aware Operating System FRT profile Platform 14

8 Integration in Software Process Need for appropriate tool chain to help ensure Application functional correctness Resource constraints Ideally integrated in more comprehensive environments (e.g. model-based tool environments) Tool chain used differently according to profile HRTJ: user provide statically identified constraints SRTJ and FRTJ: tools provide data on constraint. Run-time monitoring tool collect data on specific constraints Tool chain uses JML annotations 15 Tool Chain Data flow analyser determines conservative approximation of set of values held by a variable can be used to prove absence of certain error conditions Worst case memory usage Analyser uses annotation and DFA output Worst case execution time Analyser users annotation and DFA output depends on hardware 16

9 Tool chain Schedulability analyser calculates the worst-case response time bounds of each schedulable object depends on hardware Protocol verifier correctness of communication between threads from different virtual machine Functional verifier determines whether the code implements its specification based on KeY uses the design by contract paradigm (assertions using JML annotations) 17 Tool Chain Annotated Java Code Auxiliary Annotations Network Analyser javac Schedule Analyser *.class Data Flow Analyser Protocol Verifier Functional Verification KeY Annotation Parser/Editor Builder Flow Information Annotation Checker Constraints WCMU Analyser Executable WCET Analyser Runtime Monitoring 18

10 HIJA Implementation HRTJ Power PC Thales implementation of Ravenscar profile with partitioning capabilities Jamaica VM RMI-HRT based on AFDX (RT network protocol for avionics systems) FRTJ 32 StrongARM and PC Linux in pre-emptive mode Jamaica VM OSCAR OSGi framework RMI-QoS on top of IP 19 HIJA Implementation Tool chain extension of Aicas tool chain builder Jamaica VM DFA WCMUA Run-time monitoring Annotation parser KeY for functional verification MAST for scheduling analysis Protocol verifier based on UPPAAL 20

11 Applications Avionics application Flight management and guidance system (FMS) Uses HRTJ Telematics application Diagnosis application + other independent applications Uses FRTJ Ambient intelligent application Site navigator Uses FRTJ 21 Lessons learned Avionics application Validates the HRTJ profile Telematics and Ambient Intelligence application Validates the FRTJ profile Further work Solving issues Integration of ANRTS in process Integration of AN platforms with underlying RTOS Provision of QoS Enhancing toolchain 22

12 2 years after... Highlights : HRTJ related products Aicas : Jamaica ( Aonix : Perc ( Still a major issue Transversal resource awareness Framework + JVM + OS Further initiatives New processor architectures Jeopard (parallel processor systems) Trusted platforms TECOM (trusted embedded platforms) 23 Questions? 24