On-the-fly healing of race conditions in ARINC-653 flight software

Abstract

The ARINC-653 standard architecture for flight software specifies an application executive (APEX) which provides an application programming interface and defines a hierarchical framework which provides health management for error detection and recovery.In every partition of the architecture, however, asynchronously concurrent processes or threads may include concurrency bugs such as unintended race conditions which are common and difficult to remove by testing. A race condition toward a shared data, or data race, is a pair of unsynchronized instructions that access a shared variable with at least one write access. Data races threaten the reliability of sharedmemory programs seriously and latently, because they result in unintended nondeterministic executions of the programs.To heal data race during executions of ARINC-653 flight software, this paper instruments on-the-fly race detection into the target program and incorporates on-the-fly race healing into the health management of the ARINC-653 architecture. The race detection signals to the health monitor using the corresponding APEX call, if a data race is detected. The health monitor then responds by invoking an aperiodic, user-defined, error handling process that is assigned the highest possible priority. This special process uses an APEX call to identify and then heals the occurrence of race condition as an application error, one of seven error types defined by ARINC-653. This race-healing process allows the target programs to be assured at run-time that the execution result of the healed program could have been in the original program and therefore no new functional bug has been introduced. This paper evaluates efficiencies of the on-the-fly mechanisms to argue that they are practical to be configured under the ARINC-653 partitions.

Uncertainty Analysis of Race Conditions in Real-Time Systems

“…The time intervals and confidence levels of all events in the application are measured statistically and shown in the Table II, Table III and Table IV. We use the equations (4) and (5) to get the unbiased estimators of the expected value and the variance of occurrence times of each event, and then the equation (6) is used to estimate the confidence level of the observed time interval of each event.…”

“…Static approaches [2] [3] are usually performed during compile time, and try to yield high coverage by considering the space of all possible program executions and identifying race conditions that might occur in any of them. Opposite to static approaches, dynamic approaches [4] [5], including on-the-fly [5]- [8] and postmortem [4] [9] techniques, perform race condition detections dynamically at runtime or in a reproduced execution based on information collected at runtime. Dynamic approaches shift the emphasis from exploring all possible execution paths to precisely locating a race condition when it occurs during a particular execution.…”

AR653: Dynamic Detection Tool for Atomicity Races in ARINC 653 Applications

“…However, it is difficult to use these information and to check exist atomicity races in the applications, because detecting atomicity races requires to understand parallel executions of processes and to predict their nondeterministic behaviors. Therefore, in general, a range of automatic detection tools based on sophisticated techniques [10][11][12][13][14][15][16][17][18][19][20][21][22][23][24][25][26][27] is employed to locate atomicity races which exist in ARINC 653 applications. A representative tool for detecting atomicity races in the avionics application is CodeSonar.…”

Configuration Tool for ARINC 653 Operating Systems

“…The ARINC 653 Specification [1 [3] has been developed as a standardized interface definition of real-time operating system to simplify the development of Integrated Modular Avionics (IMA) [4][5][6][7][8][9]. This standard specifies an Application Executive (APEX) which provides services comprised of a set of fifty-one routines to enable the development of portable applications on an IMA platform.…”

“…The ARINC 653 Specification [1][2][3] has been developed as a standardized interface definition of real-time operating system to simplify the development of IMA [4][5][6][7][8][9]. The ARINC 653 provides a strict and robust time and space partitioning [10][11][12] to guarantee the reliability of avionic systems by isolating the failures of the system.…”