Paul Parkinson

Is safety-critical ready for multi-core?

You may feel that you're experiencing déjà vu reading this blog, but the title 'Is safety-critical ready for multi-core?' is different to an earlier blog, which was 'Is multi-core ready for safety-critical?'.

In the earlier blog, I discussed some recent developments in multi-core processors in the context of their suitability for use in safety-critical systems. In this blog, I want to discuss how a particular type of safety-critical system could exploit the capabilities of multi-core devices. However, before I dive into the details, I should really outline the different types of safety-critical systems (at least in the simple categories which I like to use). These are broadly as follows:

• Type 1: Single application, safety critical
• Type 2: Multiple applications, single level of safety-criticality
• Type 3: Multiple applications, multiple levels of safety-criticality

Type 1 is very common in industrial automation, transportation, defence, and of course aerospace (where it is known as safety-critical federated avionics). This is readily supported by a safety-critical COTS RTOS implementation, such as VxWorks/Cert (subset of 5.4) or the forthcoming safety-critical implementation of VxWorks 6.x.

Type 2 is really a variation on Type 1, but the certification requirements are the same, everything is safety-certified to the same level. In aerospace, this is one instance of Integrated Modular Avionics (IMA).

Type 3 is where things become more interesting, and can apply to a range of different types of applications. In aerospace, this is another instance of IMA, but the different levels of safety criticality (e.g. RTCA DO-178B Level A and Level D) either require that the whole systems is certified to the level of the most critical application (which can be very expensive), or by implementing robust separation of applications.

The ARINC 653 software model provides robust separation through temporal and spatial partitioning, which is implemented in the VxWorks 653 RTOS running on a single processor core.  This architecture is well suited to systems which exhibit cyclic/periodic behaviour and/or perform synchronous I/O, e.g. flight control systems, but there are other types of applications which do not exhibit cyclic/periodic behaviour and/or perform a lot of asynchronous I/O, and may not fit well with the ARINC 653 timeslot scheduling model. These applications sensors such as radar warning receivers and electronic countermeasures (wikipedia) on military fast jets.

The NATO ASAAC IMA model might provide an alternative approach for these these types of application, but this does not have widespread commercial support yet. However, the advent of multi-core introduces another possibility - a system comprising two applications with different-levels of safety-criticality, but running one on a separate instance of a priority-based pre-emptive scheduling kernel on each of the processor cores within a dual-core device - known as  Asymmetric Multi-Processing or AMP (Wind River).

This could potentially be implemented by running the safety-critical subset of VxWorks 6.x on each core in AMP mode.  The VxWorks 6.x multi-core Board Support Package (BSP) would of course need to set up the memory map and I/O devices correctly to avoid coupling (FAA, MS-Word), and any inter-core communication mechanism would need to be robust (i.e. faulty messages from Level D processor core could not impact the operation of the Level A processor core). 

This approach would provide the immediate response required by the sensor applications, and also robust partitioning. In short, the best of both worlds. You could also view this as shrinking the form factor of a traditional dual-processor VME or CompactPCI system onto a single piece of silicon.

Now, when can I get hold of a Freescale PowerPC MPC8641D or Intel Core Duo board to try this out?

Is multi-core ready for safety-critical?

I recently attended the Military & Aerospace Electronics conference in the UK, at which a number of technical presentations were given on new technologies relevant to this sector, including an excellent one by Gordon Hunt of RTI on the Data Distribution Standard (which probably deserves a blog entry in its own right). However, the presentation which I want to comment on here is 'COTS VME processing: 4-way SMP Intel vs. Quad Distributed PowerPC' given by Richard Jaenicke, Director of Technology Integration at Mercury Computer Systems.

Richard gave a considered overview of the different types of multiprocessor architectures and their suitability to different types of application. He then went on to discuss the relative merits of a number of multi-core devices, and their suitability for deployment in the various multiprocessing architectures. This included insights into the performance speed-up of the multi-core Intel Core Duo over single-core Pentium architectures, and why the Dual-Core Intel Xeon is more suitable for 4-way symmetric multiprocessing (SMP) architectures. He also went on to discuss the Freescale PowerPC MPC8641D dual-core processor (Freescale: architecture diagram), and how this can be used in a number of different SMP and distributed shared memory architectures. I was struck by two things: firstly, that the most suitable processor choice really is dependent on the overall system requirements (i.e. it's a question of different horses for different courses); secondly, that Richard had given a very interesting and informative presentation without even talking about Mercury's products (note to self: must make technical seminar presentations more interesting in future).

This was a very useful and timely backgrounder, as I've noticed an increase in interest in using  multi-core devices for A&D applications recently. The benefits of multi-core are becoming well-known: increased performance, higher processing densities, reduced physical footprint (things which have been key factors in the development Integrated Modular Avionics architectures, coincidentally), so I am interested in how multi-core could be exploited in a diverse range of A&D applications, not just avionics.

Since the event, I've been thinking about how software platforms might be implemented on top of these multi-core and multiprocessor architectures. Tomas Evensen recently discussed Intel multi-core support, and Maarten Koning has also considered fault-propagation in multi-core devices, but what really interests me is the suitability of multi-core devices for safety-critical systems. The type of software platform which can be supported seems to be dependent on the level of flexibility of the multi-core architecture, and whether the cores can be configured to operate in an independent manner, or whether there is coupling and/or dependencies between the cores as there are obvious ramifications in a safety-critical environment.

The next question which springs to my mind is: What types of safety-critical software platforms could be supported on multi-core architectures?