University of Napoli Federico II Napoli, 27th July 2010 V&V of xLuna Christian Esposito University of Napoli Federico II christian.esposito@unina.it

Napoli, 27th July 2010 ::.. xLuna (1/4) xLuna is a project carried out by Critical Software that aims at providing European Space Agency (ESA) with an open source RTOS, which represents a valid alternative to the several commercial solutions available in the current market. xLuna supports a familiar environment for application development with a minimal learning curve and offering a rich set of features, such as compilers and debuggers, so to facilitate the application development process while still providing all the timeliness and reliability features of a typical RTOS. Project Presentation

Napoli, 27th July 2010 ::.. xLuna (2/4) xLuna has been architected by adopting a dual kernel approach: real-time features are provided by the well known RTEMS, which has been integrated with the Linux kernel so to take advantage of several tools already-available to simplify the issue of application development. Separation between the two kernels is achieved by running Linux kernel as a low priority task in RTEMS, so to still have the real-time features of RTEMS without Linux interfering with it, and allows the user to activate and deactivate Linux as necessary. Project Presentation

Napoli, 27th July 2010 ::.. xLuna (3/4) The integration of RTMES and Linux implied a series of modifications in the two kernels, kept to the minimum. In general, such modifications have the focus to reduce the dependency of the Linux kernel to direct access to hardware devices by introducing a paravirtualization method to convert hardware access actions in communication events towards the underlying xLuna modules. Also modifications to RTEMS kernel have been made to replace the interrupt/trap handling routines of RTEMS with new ones that enable the paravirtualization needed for running Linux kernel in unprivileged mode. Project Presentation

::.. xLuna (4/4) Napoli, 27th July 2010 Linux Task NRT1 … NRTn Linux Kernel HRT1 … HRTn RTEMS xLuna Core Memory Manager IRQ Manager Legend ISC Manager Device Drivers Linux subsystem (user mode) Hardware RTEMS subsystem (privileged mode) Project Presentation

Napoli, 27th July 2010 ::.. V&V Process Verification Are we making the system right? Validation Are we making the right system? Currently, xLuna has to go through a rigorous V&V process so to be used in space missions. Project Presentation

Napoli, 27th July 2010 ::.. V&V Standards ECSS-Q-ST-40C (Safety) and ECSS-M-ST-80C(Risk Management); EuroCONTROL - AIR NAVIGATION SYSTEM SAFETY ASSESSMENT METHODOLOGY; IEC 61508; IEEE Standard for Software Verification and Validation; DO-178B; RTCA - Software Considerations in Airborne Systems and Equipment Certification. Project Presentation

::.. Activities planned to do (1/3) Napoli, 27th July 2010 ::.. Activities planned to do (1/3) It is not possible to carry on a complete V&V process during my secondment, so I have decided to focus on a specific task within this process: Validation of xLuna and demonstration it is able to support the key features of a RTOS. Then, I focused on the question: “What is needed to do in order to validate xLUNA?” Since xLuna is made of the interconnection of RTEMS and Linux, its validation mean to study if separation among the two systems is guaranteed. Project Presentation

::.. Activities planned to do (2/3) Napoli, 27th July 2010 ::.. Activities planned to do (2/3) The first step is to make a performance benchmarking of xLuna without Linux, so to define its baseline behaviour in terms of timeliness and predictability. Then, the same campaign is performed again by making Linux running a proper workload, so to see if the same behaviour is maintained or Linux can compromises the real-time features of RTEMS. This shows the time separation between the two systems. Project Presentation

::.. Activities planned to do (3/3) Napoli, 27th July 2010 ::.. Activities planned to do (3/3) On the other side, there is the space separation, which for me means: “Do failures in Linux have any effects on RTEMS?”. I will make a fault-injection campaign at Linux level and see it effect on RTEMS real-time features. Since proper interrupt handling is a key issue to achieve real-time characteristics, realistic hardware faults will be emulated via fault-injection, so to investigate how xLuna deals with them. Project Presentation

Napoli, 27th July 2010 ::.. Xception The fault-injection campaign will be carried on by using the CSW tool called Xception, which includes a family of fault-injection methodologies (e.g., hybrid SWIFI or SCIFI) and robustness testing features. It architecture resembles the client-server model, with a host computer running management/control modules that sends faults to a target computer hosting the lightweight injection core and monitoring modules. Project Presentation