The Boeing Team Perspective on Mixed Criticality Architecture Requirements a Briefing at the AFRL Safe & Secure Systems & Software Symposium (S5)
Total Page:16
File Type:pdf, Size:1020Kb
The Boeing Team Perspective on Mixed Criticality Architecture Requirements a briefing at the AFRL Safe & Secure Systems & Software Symposium (S5) 04 June 2009 Dayton, Ohio BOEING is a trademark of Boeing Management Company. Copyright © 2009 Boeing. All rights reserved. Approved for Public Release. Case Number: 88ABW-2009-2135 Outline Boeing Research & Technology MCAR Team • Overview of Boeing Team Approach to MCAR • Formal Architecture Requirements Processes leveraged in Boeing Effort • MCAR Key Concepts Summary • Interesting Research Areas • Summary Copyright © 2009 Boeing. All rights reserved. 2 MCAR in Boeing Context Boeing Research & Technology MCAR Team ScanEagle HALE (High-Altitude Long Endurance) MCAR Embedded Software Stack Phantom Ray Conventional Layers Multiple Partitioned Integrator Layers Partition 2 Applications Applications Partition n Flight Components Middleware Surfaces within each layer may Middleware Guest RTOS Deployed vary Host RTOS Host Separation Kernel/Hypervisor Hardware or Hardware Interface Abstraction X-48B ScanEagle Compressed Carriage Copyright © 2009 Boeing. All rights reserved. 3 Boeing Team Organization Boeing Research & Technology MCAR Team Program Manager Patrick Stokes Boeing Phantom Works PI – HCRTOS Option PI – Baseline MCAR Program PI – Middleware Option Boeing James Barhorst Dr. James L. Paunicka Dr. Douglas A. Stuart MCAR Associate Technical Fellow Technical Fellow Boeing Phantom Works Core Boeing Phantom Works Boeing Phantom Works Team Systems Engineering Lead Requirements Analysis Lead Core Study Team Member Core Study Team Member William W. Schoening Don O’Connell Patrick H. Goertzen Kenn Luecke Technical Fellow Technical Fellow Boeing Phantom Works Boeing Phantom Works Boeing Phantom Works Boeing Phantom Works Boeing MCAR Advisory Team Management IDS Programs (Current, Emerging, Future) Notes: Phantom Works Research Personnel PI = Principal Investigator Boeing Technical Fellow Community IDS = Integrated Defense Includes Representative from The Insitu Group Systems The Insitu Group is the manufacturer of the Boeing ScanEagle UAV Objective Real-Time Green Hills LynuxWorks Wind River Interface Innovations Software Systems Systems Makers of DDS Middleware Makers of INTEGRITY and Makers of VxWorks, Makers of PCSexpress Makers of LynxOS and INTEGRITY-178B RTOS VxWorks for ARINC 653, & and ORBexpress LynxOS-178 RTOS and VxWorks for DO-178B Middleware RTOS Joseph M. Jacobs Copyright © 2009 Boeing. All rights reserved. RTOS Industry Teammates Middleware Industry Teammates 4 Review of Boeing Approach Boeing Research & Technology MCAR Team NSF and the Academic Research Air Force Community Boeing Current, Emerging, and Future Programs Research Challenge Results Needs / ” Research Results Platform Customer Difficult Issues / Expectations ArchitectureRequirements InsightsBoeing Needs OpenProblems “ Boeing Analysis RequirementsCapture Boeing MCAR Guidance Requirements Advisory Boeing Preferences Team MCAR Boeing MCAR Program Team Requirements Working Group Inputs from Definition Meetings (4) - Spiral Other Boeing ArchitectureIdeas (System, Airframers R&D HCRTOS, Teams Middleware) Protected Protected After 4th Privileged PIA Working High Fidelity Communications Candid Vendor Boeing Requirements Group Boeing Needs and Product Adjustments from Industry-Leading Capability Self- Working Group MCAR System, HCRTOS and Embedded Software RTOS Assessments Middleware Requirements and Middleware Teammates and Plans for Baseline Embedded Innovations • Supports Air Force Goals • Supports Boeing RTOS Industry • Supports Our Industry • Have Confidence the Embedded Requirements are Achievable Due to Software Middleware Industry Teammate Industry Involvement Copyright © 2009 Boeing. All rights reserved. • Ready for MCAD (Design) 5 Boeing Team Members – HCRTOS Boeing Research & Technology MCAR Team Jim Barhorst – PI • Green Hills Software • INTEGRITY and INTEGRITY-178B RTOS • C-17, X-45 variant, Long-Term Mine Reconnaissance System (LMRS), F-22, F-35, Boeing 777-ER & 787, B-1B, Sikorsky S-92 • INTEGRITY-178B compliant with ARINC 653-2 • LynuxWorks • LynxOS and LynxOS-178 RTOS • Boeing 777, KC-135, F-35, MH-60, MH-47, CH- 47F • Wind River Systems • VxWorks, VxWorks for ARINC 653, & VxWorks for DO-178B RTOS • P-8A MMA, KC-767 Tanker, C-130 AMP, Boeing 787 Copyright © 2009 Boeing. All rights reserved. 6 Boeing Team Members – MCAM Boeing Research & Technology MCAR Team Doug Stuart – PI • Objective Interface Systems (OIS) • Makers of PCSexpress and ORBexpress Middleware • AWACS, AEW-737 Wedgetail, MH-60 Multi-Mission Helicopter, AH-64 Apache Longbow, CV-22, • Real-Time Innovations (RTI) • Makers of DDS Middleware • Insitu Group UAVs, AWACS, B- 1B, F-35 Copyright © 2009 Boeing. All rights reserved. 7 Top-Level MCAR Considerations Boeing Research & Technology MCAR Team • Boeing Requirements Hierarchy / Categories • System • Application • Middleware • RTOS • Hardware • Composition Process • Tool Support • Goal – MCAR Requirements that are • Achievable Technically • Affordable • Acceptable Risk • Adequately Meet Stakeholder Needs Copyright © 2009 Boeing. All rights reserved. 8 Origin of Requirements Boeing Research & Technology MCAR Team • Boeing Program Inputs • Programs across the lifecycle • Programs across platform space • Customer Groups • AFRL, NASA, Army and Navy stakeholders • RTOS and Middleware Industry • Team members via PIA • Others in the MCAR community • Working Group collaborations • University Collaborators brokered by NSF • The Boeing MCAR Advisory Team • Boeing Core Team engineering judgment • Architectural analysis and requirements validation • Formal Quality Attribute Workshop (QAW) • Formal Architecture Tradeoff Analysis Method (ATAM) Copyright © 2009 Boeing. All rights reserved. 9 Additional MCAR Activities Boeing Research & Technology MCAR Team • Participation at MCAR Working Groups • Perspectives shared among contractors • Perspectives from outside the group • Interaction with NSF researchers • Helping guide the future • The “group” white paper with Lockheed Martin and Northrop Grumman • Formal statement from the industry • SBIR topic recommendations • Leveraging the investment Copyright © 2009 Boeing. All rights reserved. 10 A Modular, Layered Reference Architecture Boeing Research & Technology MCAR Team • Notional module layer view shows how major software components are grouped, & how a Separation Kernel is used to enforce partitioning. • Each partition hosts a separate Guest HC-RTOS Conventional Layers Multiple Partitioned that does not interact with Layers other Guest RTOS’. Partition 2 • Each layer above the Applications Applications Partition n Separation Kernel or Hypervisor represents – Components Middleware applications, middleware, within each and Guest RTOS’. layer may Middleware Guest RTOS vary • The MCAR Middleware layer Host RTOS Host Separation Kernel/Hypervisor also contains scheduling, resource management, Hardware or Hardware Interface Abstraction power management, and fault tolerance/redundancy management components that are service based. Copyright © 2009 Boeing. All rights reserved. 11 Formal Architecture Requirements Analysis Techniques Leveraged on Boeing Effort Boeing Research & Technology MCAR Team • QAWSM (Quality Attribute Workshop) • Boeing refinement of formal Software Engineering Institute (SEI)-defined process • Gathered key stakeholders to help describe, qualify and quantify desired architectural attributes (“Quality Attributes”) for an MCAR-based system • ATAMSM (Architecture Tradeoff Analysis Method) • Boeing refinement of formal SEI-defined process • Assessed the impact of architectural decisions on quality attribute requirements and business goals • Qualitative analysis assessed many quality attribute categories – E.g., modifiability, security, performance, extensibility, usability Copyright © 2009 Boeing. All rights reserved. 12 Chronology of Formal Analysis Events Boeing Research & Technology MCAR Team • QAW held prior to to Working Group #2 • Boeing stakeholders representing embedded flight system developers and R&D community – Proprietary articulation of future needs • Cognizance of manned and unmanned fixed-wing and rotary- wing DoD flight platforms, as well as commercial platforms • Explored dozens of run-time and design-time scenarios – Exploring requirements for system / application, middleware, and Real-Time Operating System (RTOS) capabilities – Exploring requirements for design analysis and V&V environments – Supporting Mixed-Criticality, Composability, Reconfiguration, Availability, Isolation, Separation, Security, Scheduling Copyright © 2009 Boeing. All rights reserved. 13 QAW Boeing Research & Technology MCAR Team • QAW used to define and understand architectural requirements • Architectural requirements are those that describe qualities such as performance, availability, interoperability, data integrity and certification • QAW populated with a wide variety of SMEs • Workshop contents • Overview of the business drivers and architecture • Generate MCAR QAW type scenarios • Analyze scenarios to understand – Why a scenario is important – What is hard about it – What is an issue about it – Why the architecture must be concerned about the scenario Copyright © 2009 Boeing. All rights reserved. 14 Quality Attributes Identified Boeing Research & Technology MCAR Team • From the QAW: • Safety • Composability / Configurability / Modifiability / Portability / Integrability • Performance • Affordability • Confidence / Assurance / Reliability • Security •