The Many Approaches to Real-Time and Safety Critical Linux Systems
Total Page:16
File Type:pdf, Size:1020Kb
Corporate Technology The Many Approaches to Real-Time and Safety-Critical Linux Open Source Summit Japan 2017 Prof. Dr. Wolfgang Mauerer Siemens AG, Corporate Research and Technologies Smart Embedded Systems Corporate Competence Centre Embedded Linux Copyright c 2017, Siemens AG. All rights reserved. Page 1 31. Mai 2017 W. Mauerer Siemens Corporate Technology Corporate Technology The Many Approaches to Real-Time and Safety-Critical Linux Open Source Summit Japan 2017 Prof. Dr. Wolfgang Mauerer, Ralf Ramsauer, Andreas Kolbl¨ Siemens AG, Corporate Research and Technologies Smart Embedded Systems Corporate Competence Centre Embedded Linux Copyright c 2017, Siemens AG. All rights reserved. Page 1 31. Mai 2017 W. Mauerer Siemens Corporate Technology Overview 1 Real-Time and Safety 2 Approaches to Real-Time Architectural Possibilities Practical Approaches 3 Approaches to Linux-Safety 4 Guidelines and Outlook Page 2 31. Mai 2017 W. Mauerer Siemens Corporate Technology Introduction & Overview About Siemens Corporate Technology: Corporate Competence Centre Embedded Linux Technical University of Applied Science Regensburg Theoretical Computer Science Head of Digitalisation Laboratory Target Audience Assumptions System Builders & Architects, Software Architects Linux Experience available Not necessarily RT-Linux and Safety-Critical Linux experts Page 3 31. Mai 2017 W. Mauerer Siemens Corporate Technology A journey through the worlds of real-time and safety Page 4 31. Mai 2017 W. Mauerer Siemens Corporate Technology Outline 1 Real-Time and Safety 2 Approaches to Real-Time Architectural Possibilities Practical Approaches 3 Approaches to Linux-Safety 4 Guidelines and Outlook Page 5 31. Mai 2017 W. Mauerer Siemens Corporate Technology Real-Time: What and Why? I Real Time Real Fast Deterministic responses to stimuli Caches, TLB, Lookahead Bounded latencies (not too late, not too Pipelines early) Optimise average case Repeatable results Optimise/quantify worst case Page 6 31. Mai 2017 W. Mauerer Siemens Corporate Technology Real-Time: What and Why? II Type Characteristics Use Cases Soft Real-Time Subjective Deadlines Media rendering, I/O 95% Real-Time Deadlines met most of the time, Data acquisition, finance, navi- misses can be compensated gation, . 100% Real-Time Miss deadline: Defects occur Industrial Automation & control, Robotics, Airplanes, . Ensuring Real-Time Statistical testing WCET calculation + schedulability testing Formal verification Page 7 31. Mai 2017 W. Mauerer Siemens Corporate Technology Real-Time: What and Why? II Type Characteristics Use Cases Soft Real-Time Subjective Deadlines Media rendering, I/O 95% Real-Time Deadlines met most of the time, Data acquisition, finance, navi- misses can be compensated gation, . 100% Real-Time Miss deadline: Defects occur Industrial Automation & control, Robotics, Airplanes, . Ensuring Real-Time Statistical testing WCET calculation + schedulability testing Formal verification Page 7 31. Mai 2017 W. Mauerer Siemens Corporate Technology Safety: What and Why? Some undesirables Safety-Critical Systems Brake: Segfault! Malfunctions of the system (may) result in Engines full speed ahead: Segfault! death/injury to people and so on. damage to equipment/property environmental harm Safety = Real-Time, but often coupled! 6 100% RT + fatal consequences Safety ) Page 8 31. Mai 2017 W. Mauerer Siemens Corporate Technology Safety: Standards Robotic Devices Routes to Safety Electrical Power Drive ISO10218 Industrial Process IEC61800 IEC61511 Standard compliant “umbrella” standard Railways Machinery development IEC62278 IEC61508 IEC62061 Proven in use Nuclear Power Plants Medical Device Software Compliant IEC61513 Automotive IEC62304 non-compliant ISO26262 development Challenge: Page 9 31. Mai 2017 W. Mauerer Siemens Corporate Technology Outline 1 Real-Time and Safety 2 Approaches to Real-Time Architectural Possibilities Practical Approaches 3 Approaches to Linux-Safety 4 Guidelines and Outlook Page 10 31. Mai 2017 W. Mauerer Siemens Corporate Technology Approaches to Real-Time Linux € Δt € App App +/- Engineering Δt € Control Application RT Latency € RT Latency Specialised Languages - Standard Languages Control Framework +RT-Bridge +RT-Net Specialised OS + Middleware Proprietary Hardware Dynamic -Overhead Static Linux +RT COTS Hardware +FPGA Why Real-Time Linux? Commodity features Subtractive vs. additive Engineering Multi-Core utilisation ... Page 11 31. Mai 2017 W. Mauerer Siemens Corporate Technology Architectural possibilities I 1 Traditional RTOS in side-device Pros and Cons 2 RT-Enhanced Kernel 3 Countless variants available 3 Separation Kernel 3 Pre-Certified Versions 4 Co-Kernel 3 Extreme simplicity 5 Asymmetric Multiprocessing 7 Hard to extend with state-of-the art IT 7 Vendor lock-in 7 Unusual APIs etc. Page 12 31. Mai 2017 W. Mauerer Siemens Corporate Technology Architectural possibilities I 1 Traditional RTOS in side-device Pros and Cons 2 RT-Enhanced Kernel 3 Leverage existing Linux Know-How 3 Separation Kernel 3 Integration of high-level technologies 4 Co-Kernel with little effort 5 Asymmetric Multiprocessing 7 Certification complicated 7 Complex system 7 Only statistical RT assurance Page 12 31. Mai 2017 W. Mauerer Siemens Corporate Technology Architectural possibilities I 1 Traditional RTOS in side-device Pros and Cons 2 RT-Enhanced Kernel 3 Clean split between RT and non-RT 3 Separation Kernel 3 Substantial certification experience 4 Co-Kernel 7 Typically strong HW coupling 5 Asymmetric Multiprocessing 7 Vendor Lock-In Page 12 31. Mai 2017 W. Mauerer Siemens Corporate Technology Architectural possibilities I 1 Traditional RTOS in side-device Pros and Cons 2 RT-Enhanced Kernel 3 Clean split between RT and non-RT 3 Separation Kernel 3 Ressource efficient 4 Co-Kernel 7 Non-standard maintenance efforts 5 Asymmetric Multiprocessing 7 Implicit couplings Page 12 31. Mai 2017 W. Mauerer Siemens Corporate Technology Architectural possibilities I 1 Traditional RTOS in side-device Pros and Cons 2 RT-Enhanced Kernel 3 Combine advantages of split systems 3 Separation Kernel with single HW basis 4 Co-Kernel 3 Near bare metal performance 5 Asymmetric Multiprocessing 7 Implicit couplings 7 Relatively new development 7 Maintenance overhead Page 12 31. Mai 2017 W. Mauerer Siemens Corporate Technology Architectural possibilities II Commonality System partitioning! Logical instead of physical Workloads of different criticality handled by different system portions Mixed ) Criticality Page 13 31. Mai 2017 W. Mauerer Siemens Corporate Technology Practical Approaches Practical Approaches Preempt-RT Xenomai/ipipe ARM/PRU GPUs/FPGA assisted RT Traditional RTOSes Page 14 31. Mai 2017 W. Mauerer Siemens Corporate Technology Preempt-RT I Enhance Linux with RT capabilities RT Howto Preemption (incl. preemption at kernel Don’t anything stupid level) Lock memory (no paging) No inappropriate syscalls (networking Deterministic (and fine-grained) timing etc.) behaviour No block device access Avoidance of priority inversion (prio ... inheritance/ceiling) Linux Foundation: Official project (goal: upstreaming code) Typical Jitter: 50µs (x86), 150 µs (rpi) Page 15 31. Mai 2017 W. Mauerer Siemens Corporate Technology Preempt-RT II Page 16 31. Mai 2017 W. Mauerer Siemens Corporate Technology 400 Types of patches 300 200 Number of commits 100 0 backport 3.0.101-rt130 3.2.78-rt113 3.4.111-rt141 forwardport 3.6.11-rt31 3.8.13-rt16 3.10.101-rt111 invariant Stack Version 3.12.57-rt77 3.14.65-rt68 3.18.29-rt30 4.0.8-rt6 4.1.20-rt23 4.4.9-rt17 4.6-rc7-rt1 Preempt-RT III: Pros and Cons Advantages Disadvantages 3 Patch availability and community 7 Functional certifiability limited support 7 Achieving smallest latencies requires 3 Re-use of engineering knowledge substantial system knowledge 3 Excellent multi-core scalability 7 Mixing RT and non-RT easy 3 RT in userspace easily possible 7 Fixing problems requires substantial system knowledge Page 17 31. Mai 2017 W. Mauerer Siemens Corporate Technology Xenomai 3.0 I Userspace Task Task Task Task Task Xenomai: RTOS-to-Linux Process Provides skins for traditional RTOSes Scheduler A Preemption Scheduler B Two modes of operation Kernel Run on top of Linux (w. or w/o RT Dispatching and Collaboration Services capabilities) IRQ IRQ IRQ IRQ Run over co-kernel extension Hardware (patched Linux required) ipipe patch: 450-600 KiB (depending on arch), (mostly) stable over time Typical Jitter: 10µs (x86), 50 µs (rpi) Image source: Siemens AG, CC BY-SA 3.0 Page 18 31. Mai 2017 W. Mauerer Siemens Corporate Technology Xenomai 3.0 II: Architecture sketch Image source: Xenomai.org, CC BY-SA 3.0 Page 19 31. Mai 2017 W. Mauerer Siemens Corporate Technology Xenomai 3.0 II: Architecture sketch Image source: Xenomai.org, CC BY-SA 3.0 Page 19 31. Mai 2017 W. Mauerer Siemens Corporate Technology Xenomai 3.0 III: Pros and Cons Cobalt (Co-Kernel) Mercury (Preempt-RT) 3 Clean split between RT/non-RT 3 Architectural basis maintained by (transition is signalled) substantial community 3 Light-weight in low-end platforms (lock 3 Very solid skin framework w/o invasive contention, cache usage etc.) core changes 7 Very limited number of 7 Legacy scheduling not always 100% developers/small community reproducible 7 Porting effort required; availability lag 7 Inadvertently mixing RT and non-RT 7 Regressions on upstream changes easier Page 20 31. Mai 2017 W. Mauerer Siemens Corporate Technology ARM + PRU I ARM Subsystem Programmable Real-Time Unit (PRU) Subsystem PRU0 PRU0 PRU1 I/O (200MHz) (200MHz) Cortex-A PRU1 ShareD Inst. Data