Keywords

1 Introduction

Avionics system is the core component of aircraft, which is essentially a complex real-time system, that is, the system must correctly respond to the changes of external physical processes within the specified time range [1]. The system is also considered as safety critical system because its failure can cause catastrophic consequences such as loss of lives [2]. In modern aircraft avionics, more and more functions traditionally transition from federated to integrated system architectures. In federated architectures, computers connected by buses usually host one application, while in integrated architectures, such as the Integrated Modular Avionics (IMA) [3], many applications are often integrated on powerful platforms of mixed criticality. This can improve systems in several dimensions, such as weight, space, energy consumption and maintainability etc. Now, next generation of new aircraft avionic programs will integrate more new functions, including safety functions, information services and comfort features, which will greatly increase the demand of avionics processing performance. The traditional approach to improve processing performance was to increase CPU clock frequency or increase pseudo-parallel processing on code level. However, with the development of semiconductor technology based on Moore's law, this method has reached its limit. The increase of CPU frequency will lead to sharp rise in power consumption, which will bring trouble to heat dissipation. In addition, increasing CPU frequency will also introduce more and more problems caused by chip internal and external crosstalk, and chip signal integrity. As one of the ways of parallel processing, multi-core processing has become an important measure to improve processing capacity of processors in recent years. In avionics system, multi-core processing is increasingly favored by system developers because of its advantages of high performance, high integration and low power consumption.

2 Challenges of the Application of Multi-core Processor

2.1 The Architecture of Multi-core Processor

Software designer of single core processor can directly improve the performance by deploying the existing software to the CPU with higher frequency and faster speed without modification. CPU is the only shared resources in single core system. Once a task obtains the execution right of CPU, it will be able to control other hardware resources of the system. But in multi-core system, as shown in Fig. 1, resource sharing exists in multiple dimensions. Parallel tasks not only need to share multiple processing cores, but also share hardware resources such as cache, bus, memory controller and main memory. The sharing among multiple dimension leads to interdependence and interference among tasks, which leads to the high unpredictability of the overall performance and time behavior of the system, and it is difficult to guarantee the logical correctness [4].

Fig. 1.
figure 1

Architecture of shared resource of multi-cores

Full size image

2.2 The Problem of Shared Resources

Cache sharing interference. In multi-core system, a possible cache interference situation is that one core will continuously drive out cache blocks useful to another core, which will not bring significant performance improvement, but also increase the cache miss rate of the system and reduce system performance. Reference [5] shows that the shared cache interference between cores will increase the completion time of tasks by 40% compared with that running on a single core. In addition, the disordered preemption timing among cores makes it very difficult to analyze the system behavior. Inter tasks interference leads the WCET of a task not only rely on the task itself, but also affected by other tasks executed in parallel [6]. Moreover, the interaction among tasks explodes exponentially with the increase of the number of cores.

Bus sharing interference. Each core needs to access the off chip memory through the shared bus, which will cause the interference of the shared bus and increase the response time of the task on multi-core system. The bus access request of the task does not carry the priority attribute, so the bus will be reordered according to the access of the task, which may cause the access request service time of high priority task later than that of the low priority task. The delay of task bus access request, that is, determining the bus access service order, depends not only on the bus arbitration mechanism, but also the bus access volume of parallel tasks concurrently. So how to analyze the response time considering the interference of shared bus is still a challenging task.

Software interference. Software interference only occurs when the software is running concurrently. Interference severity mainly depends on the software architecture and the way the software utilizes shared resources of the cores. The existing operating system and software applied in avionics system comply with ARINC653 standard, which has been implemented and applied on a single core platform without considering the characteristics of multi-core platform. Previously, the system software only needed to consider avoiding shared resource conflict between partitions running concurrently. Now the system software must prevent unintended coupling and must not introduce additional interference due to concurrent access to shared resources among different cores and different partitions.

3 Research Development of Multi-core Processing in Avionics

Reference [7] proposed a static analysis method to solve the impact of shared cache on WCET to a limited extent. Considering the complexity of the problem, these solutions need to introduce some assumptions to simplify the problem. Such as only analyze the behavior of instruction cache and ignore the influence of data cache, and assuming that the data can always be accessed in data cache, this method cannot be verified on the actual multi-core computing platform. These simplified assumptions also limit the availability of the proposed solution. Therefore, some scholars turn to specific design to avoid or reduce the interference between cores, for example, time division multiple access (TDMA) arbitration mechanism [8]. Rosen described a scheme of TDMA bus scheduling on multi-core computing platform [9]. All tasks are scheduled based on the off-line scheduler and the scheduler is written to the memory of bus arbiter. When the system is running, the bus access request is coordinated and controlled according to the schedule, so as to avoid bus interference. However, these studies need system customization and re-development, which induced high cost and cannot meet the needs of generalization and marketization. Especially in avionic multi-core applications, if it cannot support incremental certification, the application will be greatly restricted. As described by Corradi [10], the semiconductor industry is facing technical and economic challenges, where fewer chip suppliers can afford the investments, safety-related and avionic semiconductor market is too small for semiconductor companies to provide economically competitive safety specific solutions compliant with defined certification standards. Therefore, it is expected that multi-core devices used in safety-related and avionics systems will have to select COTS chip. This is also in line with the goal of reducing life cycle costs for avionics system. Therefore, starting with the application mode, that is, the software architecture of the operating system, is also an optional method [11]. Multi core application modes include AMP (asymmetric multi-processing) and SMP (symmetric multi-processing) [12,13,14].

In AMP mode, each core is configured with an independent operating system, and the blueprint is configured to manage shared resources. The operating environment of AMP is similar to the traditional single core system, so it has good portability and is easy to inherit the software of single processor. AMP only needs to select an operating system that can provide distributed programming mode to maximize the use of multi-core. Applications on one core are allowed to communicate transparently with applications or system services on another core. In AMP mode, multiple partitions are executed in parallel, and all partitions run on their corresponding cores at the same time. When the number of processors increases, the system performance can be significantly improved.

In SMP mode, there is an operating system controls the simultaneous activities of all cores. Since these tightly coupled processors access a common memory area, they must synchronize with each other through a communication mechanism based on low latency shared memory. Since there is only one operating system, local communication between different cores is completed through process communication, which greatly improves the communication efficiency between processes. At the same time, it also allows the operating system to dynamically schedule any process to run on any core. SMP provides much more flexibility and a better load balancing than that of AMP. But The SMP software layer is more complex since it needs to protect its internal data and the internal data need to be arranged very carefully by system.

Incremental authentication is also a requirement that must be considered in multi-core integration, especially in civil avionics, traditional avionics software has completed certification and the process has been proved to be effective by the airworthiness authority. In multi-core processing system, how to inherit existing certification results and avoid providing additional interference related information to certification authority are also the key balancing factors for the system user.

4 The Promote Methods and Potential Solutions

4.1 The Test Result of AMP Mode Application

In AMP mode, each core runs its operating system instance, so the resources occupied by operating system instances increased with the number of cores. Therefore, the performance proportion of dual core is doubled in theory while the resource occupation is small, especially when there is no conflict in memory access. Based on a dual core processor platform, this paper introduces AVIC operating system conforming with ARINC653 standard, hosting the spec cpu2006 test cases which tests the integer performance and floating-point performance of the processor. These cases mainly tests the real computing performance of the processor with relatively few memory accesses. The test results are shown in Table 1 and Fig. 2. The smaller the test value, the better the performance. It can be seen that the measured performance of each core in dual core is the same as that of single core activated, which means that dual core can indeed achieve double performance improvements to a certain extent. It should be noted that in F_433_milc test case, the performance of dual core is not double in all, which may related to the fact that the test case uses more shared storage resources.

Table 1. Dual core processor spec 2006 integer and floating point benchmark results
Full size table
Fig. 2.
figure 2

Dual core processor spec 2006 integer and floating point benchmark results

Full size image

4.2 Low Critical Application

Due to its good compatibility and inheritance, AMP mode is considered as the first step of multi-core processing application in avionics system. However, due to the limited number of cores and application scenarios, its performance improvement is also limited. In order to adapt more cores and significantly improve performance, a more effective way is to use SMP mode operating system with better flexibility and scalability. However, SMP mode needs to provide more additional evidence to airworthiness authority to ensure that the whole design process is approved. In fact, due to intellectual property restrictions, almost no suppliers are willing to provide detailed design documents of processor and operating system software to prove that it complies with the certification process of DO-254 or DO-178. An alternative way is to provide service experience to certification authority and prove that there is no problems happened with the operating system and multi-core processing when in service. If the highest IDAL of multi-core processing system is below C, the authentication process does not require equipment and software to conduct interference analysis, so as to avoid additional evidence collection process. Therefore, multi-core processing system can be firstly applied in the low critical aviation system to gather in-service data and problem reports as a basis for the application of mixed criticality in avionics system.

4.3 An Applicable Schedule Configuration for SMP

In fact, future IMA platform should not only meet high performance requirements, but also meet the requirements of lower criticality and critical applications running simultaneously. These applications may also be consistent with ARINC 653 standard. The operating system configuration must support exclusive access of platform resource for the most critical applications. The operating system AVIC OS is a good example that can be configured to meet the needs of mixed critical applications, from which less critical applications can get high performance and highly critical applications can get exclusive resources for determinism and isolation. Figure 1 shows a possible configuration of the AVIC OS partition scheduler.

The configuration is assumed to be based on a quad-core CPU, the major time frame is divided into three time partition windows. To avoid interference on hardware and software level, the critical application that is running on partition 3, will only execute on core ‘3’ during ‘T3’ time slice. Although it seems to waste CPU time, it ensures critical application have exclusive access to a single core and have exclusive access to entire platform resource during its allocated time window, which guaranteed highest isolation (Fig. 3).

Fig. 3.
figure 3

A configuration using the AVIC OS Scheduler for mix-critical application

Full size image

5 Conclusion

In addition to IMA platforms, the use of multi-core processing is necessary for future avionics system to meet high performance requirements. Dual-core CPUs using AMP mode are suitable for scenarios with less memory access and high computational requirements for performance improvement. Multi-core processing needs to be firstly introduced in less critical systems to gather in service experience and then be applied in critical systems with no problems. We also demonstrate a schedule configuration of multi-core platform with AVIC OS for critical applications with exclusive resources. Multi-core devices are envisioned to support the development of next-generation avionics systems.