Future generations of avionic equipments are expected to embed multi-core processors. Using Components Off-The-Shelf (COTS) processors is considered both by the industrial and academic communities, as well as certification authorities. However, in the safety-critical domain, a common issue with COTS multi-core processors is their lack of predictability, directly linked to the difficulty to foresee and manage inter-core interferences due to shared hardware resources. A possible solution consists in defining a Usage Domain that constrains the use of shared resources down to a level for which interference situations are known and their impact on software execution time is acceptable. Nevertheless, COTS processors have not been designed to see their behavior restricted by such usage domains, and do not provide dedicated mechanisms for that purpose. Hence the usage domains are enforced by more complex mechanisms implemented in dedicated pieces of software running below the applicative level. We call them Deterministic Platform Software (DPS). The objective of this paper is to propose an overview of existing DPS solutions, and propose criteria leading to a uniform classification. Additionally, we propose a mapping of these solutions to a selection of avionic use cases.

No abstract

Robust partitioning enforcement is a mandatory requirement in IMA 1 When this scenario is deployed on modern COTS systems. In this paper, we refine this requirement in the context of multicore processors and discuss a strategy to ensure it. We focus on a scenario in which several ARINC 653 partitions hosted on the same platform are executed at the same time on different cores. 2

No abstract

RésuméCet article est la continuation d'un portefeuille de recherche sur la sécurité des composants sur étagère, dont l'utilisation se répand dans les systèmes avioniques complexes (Condra, 2014). Parmi les composants complexes sur étagère, les processeurs multicoeurs sont l'un des plus étudiés pour leur impact potentiel sur la sécurité associée à l'indéterminisme (Bieth, 2013). Un article précédent (Jean, 2015) discuta des aspects temporels ainsi que des méthodes pour déterminer le Worst-case Execution Time (WCET). Cet article se concentre sur la détermination des types d'erreurs spécifiques des processeurs multicoeurs, la détermination de leurs effets, les moyens de détection et de mitigation de ces erreurs, ainsi que l'existence de critères pour contenir la panne résultante ou pour récupérer de cette erreur. SummaryThis paper is a continuation of a research thrust on safety assurance for Commercial Off-the-Shelf (COTS) which use is becoming widely spread in complex avionics (Condra, 2014). Among complex COTS, multicore processors are one of the components being investigated in terms of their potential safety impacts relative to non-determinism (Bieth, 2013). A previous paper (Jean, 2015) addressed timing issues and the methods to determine Worst-case Execution Time (WCET). The present paper focuses on the determination of error types specific to multicore processors, the determination of the effects of these failure modes, the means of detection and mitigation of these errors, and the existence of criteria for containment of the resulting failure or recovery from the error.