Achieving Functional Safety using Time-Triggered Architectures

Size: px

Start display at page:

Download "Achieving Functional Safety using Time-Triggered Architectures"

Douglas King
6 years ago
Views:

1 - 1 - Achieving Functional Safety using Time-Triggered Architectures Michael J. Pont, PhD SafeTTy Systems Ltd Vector UK Conference 2014 Functional Safety 18 June 2014 Abstract This talk will explore some of the ways in which the use of time-triggered (TT) system architectures may offer benefits to organisations that need to achieve functional safety. When implementing TT systems, there is only one interrupt enabled. This single interrupt is usually linked to a timer Tick : such Ticks may occur (for example) every millisecond, and are used to drive all of the activity in the system. This presentation will provide an overview of the steps required to design, implement and test TT embedded systems. The presentation will also explore some of the techniques that can be used for run-time monitoring in TT designs. References will be made to various international standards and guidelines, including ISO 26262, IEC 61508, IEC and IEC Copyright 2014 SafeTTy Systems Ltd

2 - 2 - About SafeTTy Systems At SafeTTy Systems, we provide support for developers of reliable, real-time embedded systems in sectors including aerospace, medical, industrial, automotive, marine, defence, satellite systems and high-end consumer goods. Our ReliabiliTTy family supports the development of products in compliance with IEC 60730, IEC 62304, IEC 61508, ISO 26262, DO-178c and similar international standards and guidelines. Our products and services are based on the use of time-triggered architectures. TM 3 Copyright 2014 SafeTTy Systems Ltd Would you like a full copy of the slides? Please contact me via our WWW site: [Direct not provided to reduce risk of spam if this document is place online] 4 Copyright 2014 SafeTTy Systems Ltd

3 - 3 - Introduction 5 Copyright 2014 SafeTTy Systems Ltd DO-178c (2012) Software considerations in airborne systems and equipment certification US guidelines: RTCA DO-178 European equivalent: EUROCAE ED-12 6 Copyright 2014 SafeTTy Systems Ltd

- 4 - IEC 61508 (2010) IEC 61508 is concerned with functional safety, achieved by safety-related systems that are primarily implemented in electrical and/or electronic and/or programmable electronic

4 - 4 - IEC (2010) IEC is concerned with functional safety, achieved by safety-related systems that are primarily implemented in electrical and/or electronic and/or programmable electronic (E/E/PE) technologies, i.e. E/E/PE safety related systems. The standard is generic in that it applies to these systems irrespective of their application.... The following are examples of E/E/PE safety-related systems: emergency shut-down system in a hazardous chemical process plant; crane safe load indicator; railway signalling system; guard interlocking and emergency stopping systems for machinery; variable speed motor drive used to restrict speed as a means of protection; system for interlocking and controlling the exposure dose of a medical radiotherapy machine; dynamic positioning (control of a ship s movement when in proximity to an offshore installation); fly-by-wire operation of aircraft flight control surfaces; automobile indicator lights, anti-lock braking and engine-management systems; remote monitoring, operation or programming of a network-enabled process plant; an information-based decision support tool where erroneous results affect safety. 7 Copyright 2014 SafeTTy Systems Ltd ISO (2011) ISO is the adaptation of IEC to comply with needs specific to the application sector of electrical and/or electronic (E/E) systems within road vehicles. This adaptation applies to all activities during the safety lifecycle of safety-related systems comprised of electrical, electronic and software components. Safety is one of the key issues of future automobile development. New functionalities not only in areas such as driver assistance, propulsion, in vehicle dynamics control and active and passive safety systems increasingly touch the domain of system safety engineering. Development and integration of these functionalities will strengthen the need for safe system development processes and the need to provide evidence that all reasonable system safety objectives are satisfied. 8 Copyright 2014 SafeTTy Systems Ltd

5 - 5 - IEC (2006) Medical device software Software life-cycle processes Software is often an integral part of MEDICAL DEVICE technology. Establishing the SAFETY and effectiveness of a MEDICAL DEVICE containing software requires knowledge of what the software is intended to do and demonstration that the use of the software fulfils those intentions without causing any unacceptable RISKS. This standard provides a framework of life cycle PROCESSES with ACTIVITIES and TASKS necessary for the safe design and maintenance of MEDICAL DEVICE SOFTWARE. This standard provides requirements for each life cycle PROCESS. Each life cycle PROCESS is further divided into a set of ACTIVITIES, with most ACTIVITIES further divided into a set of TASKS. 9 Copyright 2014 SafeTTy Systems Ltd BS EN : 2011 [IEC : 2010] BS EN : 2011 applies to automatic electrical controls for use in, on, or in association with equipment for household and similar use, including controls for heating, air conditioning and similar applications. This standard is also applicable to controls for appliances within the scope of IEC Copyright 2014 SafeTTy Systems Ltd

6 - 6 - Links between various standards The various standards considered in this brief talk cover: aircraft flight control systems controller for electric vehicles factory automation systems portable medical devices household appliances In almost all cases, these standards are used when developing real-time, embedded, single-program computer systems As you would expect, there are many links between the different documents Copyright 2014 SafeTTy Systems Ltd IEC (2006) IEC (2006) Medical device software Software life cycle processes This standard is to be used together with other appropriate standards when developing a MEDICAL DEVICE [IEC (2006), Section C.1] Readers of the standard are encouraged to use IEC as a source for good software methods, techniques and tools, while recognising that other approaches, both present and future, can provide equally good results. [IEC (2006), Section C.7] 12 Copyright 2014 SafeTTy Systems Ltd

7 - 7 - DO-178 vs. ISO 26262? DO-178 DO-178C introduced 2012 DO-178B introduced 1992 DO-178A introduced 1985 ISO Introduced Copyright 2014 SafeTTy Systems Ltd From DO-178 to ISO Many common techniques e.g. MC/DC DO-178c (2012) ISO (2011) 14 Copyright 2014 SafeTTy Systems Ltd

8 - 8 - From DO-178 to ISO Many common techniques e.g. MC/DC DO-178c (2012) ISO (2011) Two-year service interval Copyright 2014 SafeTTy Systems Ltd From DO-178 to ISO Many common techniques e.g. MC/DC DO-178c (2012) ISO (2011) DESIGN FOR TEST DESIGN FOR RUN-TIME MONITORING 16 Copyright 2014 SafeTTy Systems Ltd

Photo from Google - 9 - Looking ahead Dutch plan for self-driving trucks could boost introduction of driverless cars June 16, 2014 A plan to allow self-driving trucks to deliver goods in the

9 Photo from Google Looking ahead Dutch plan for self-driving trucks could boost introduction of driverless cars June 16, 2014 A plan to allow self-driving trucks to deliver goods in the Netherlands could accelerate the introduction of driverless cars onto public roads. Under a plan by a group of logistics and technology companies unveiled on Monday, trucks without drivers could begin delivering goods from Rotterdam, Europe's largest port, to other Dutch cities within five years. The Netherlands is reviewing traffic laws to make large-scale testing of the technology possible on public roads, Infrastructure and Environment Minister Melanie Schultz van Haegen wrote to parliament in a letter outlining the plan. Automotive News Europe 17 Copyright 2014 SafeTTy Systems Ltd ISO (2011) Safety mechanism A technical solution implemented by electrical/electronic elements or other technologies, to detect faults or control failures in order to achieve or maintain a safe state. [Adapted from ISO (2011), 1.111] 18 Copyright 2014 SafeTTy Systems Ltd

10 IEC (example) An electronic engine throttle control where the end-to-end safety function is prevent undemanded acceleration. The end-to-end safety function is implemented by two processors. The element safety function of the primary controller is the ideal demand/response behaviour of the throttle. The element safety function of the secondary processor is a diverse monitor (see IEC C.3.4) and applies an emergency stop if necessary. [Adapted from (2010), Section ] 19 Copyright 2014 SafeTTy Systems Ltd System architecture (IEC 61508) Main Processor Diverse Monitor The combination of the two processors gives higher confidence that the endto-end safety function prevent undemanded acceleration will be achieved. [Adapted from (2010), Section ] 20 Copyright 2014 SafeTTy Systems Ltd

- 11 - IEC EN 61508 example From Infineon design brochure (March 2009) 21 Copyright 2014 SafeTTy Systems Ltd Reliability requirements in other sectors

11 IEC EN example From Infineon design brochure (March 2009) 21 Copyright 2014 SafeTTy Systems Ltd Reliability requirements in other sectors What happens if a child can open the door during the spin cycle? (What is the product life? Will it ever be serviced?) 22 Copyright 2014 SafeTTy Systems Ltd

- 12 - BS EN 60730-1: 2011: Why does it matter?

23 Copyright 2014 SafeTTy Systems Ltd BS EN 60730-1:

12 BS EN : 2011: Why does it matter? What can possibly go wrong with a FREEZER? 23 Copyright 2014 SafeTTy Systems Ltd BS EN : 2011: Why does it matter? Photo from ITV News 24 Copyright 2014 SafeTTy Systems Ltd

- 13 - BS EN 60730-1: 2011: Why does it matter? Six members of the same family died in a house fire in 2011. The fire was caused by a faulty freezer.

13 BS EN : 2011: Why does it matter? Six members of the same family died in a house fire in The fire was caused by a faulty freezer. Photo from BBC News WWW site 25 Copyright 2014 SafeTTy Systems Ltd BS EN : 2011: Annex H Annex H details test and diagnostic methods that are intended to ensure the safe operation of embedded control hardware and software for appliances. Three classifications for automatic electronic controls: Class A Control functions, which are not intended to be relied upon for the safety of the equipment. E.g. room thermostats, humidity controls, lighting controls, timers, and switches. Class B Control functions, which are intended to prevent unsafe operation of the controlled equipment. E.g. thermal cut-offs and door locks for laundry equipment. Class C Control functions, which are intended to prevent special hazards (e.g., explosion of the controlled equipment). E.g. automatic burner controls and thermal cut-outs for closed, un-vented water heater systems. Large appliance products, such as washing machines, dishwashers, dryers, refrigerators, freezers, and cookers/stoves will tend to fall under the classification of Class B. 26 Copyright 2014 SafeTTy Systems Ltd

14 BS EN : 2011: Design options From a design perspective, IEC allows manufacturers to take one of three approaches to address these issues: a single-channel architecture accompanied by functional testing at the point of manufacture; a single-channel with periodic self-test (while the device is in use); a dual-channel architecture that utilizes two MCUs, each performing related tasks in lock step and one checking the other. 27 Copyright 2014 SafeTTy Systems Ltd Key challenges for certified embedded systems... DESIGN for TEST and DESIGN for RUN-TIME MONITORING 28 Copyright 2014 SafeTTy Systems Ltd

15 Achieving Functional Safety using Time-Triggered Architectures 29 Copyright 2014 SafeTTy Systems Ltd Time-triggered software architectures When saying that an embedded system has a time-triggered architecture we mean that it executes at least one set of tasks according to a predetermined schedule. The schedule determines the order of the task releases, the time at which each task is released, and whether one task can interrupt (pre-empt) another task. In practice, TT usually means: One interrupt source per CPU The interrupt is often (not always) a timer tick Peripherals are polled 30 Copyright 2014 SafeTTy Systems Ltd

$.. System ticks Time BACKGROUND PROCESSING while(1) { Go_To_Sleep(); } FOREGROUND PROCESSING Update(); (Interrupt) Tasks (functions) Called from here: E.g.$

16 Building a TT design: Simple TTC scheduler Update() Update() Update()... System ticks Time BACKGROUND PROCESSING while(1) { Go_To_Sleep(); } FOREGROUND PROCESSING Update(); (Interrupt) Tasks (functions) Called from here: E.g. a long switch statement A simple time-triggered system with co-operative tasks (TTC) 1 ms timer 31 Copyright 2014 SafeTTy Systems Ltd A practical TTC scheduler void main(void) { SCH_Init_T2(); // Set up the scheduler PID_MOTOR_Init(); PC_LINK_O_Init_Internal(9600); Further information: // Add tasks SCH_Add_Task(PID_MOTOR_Poll_Speed_Pulse, 1, 1); SCH_Add_Task(PID_MOTOR_Control_Motor, 300, 1000); SCH_Add_Task(PC_LINK_O_Update, 3, 1); SCH_Start(); while(1) { SCH_Dispatch_Tasks(); } } 32 Copyright 2014 SafeTTy Systems Ltd

17 Example Tick List Tick 0 Task A Task B Tick 1 Task C Task E Tick 2 Task A Task E Task F Task G Task I Tick 3 Task A Task B Task C Task E Tick 4 Task B Task G Task I Task L Task M Copyright 2014 SafeTTy Systems Ltd What can we do with a Tick List? We can determine: System response times Task jitter levels Maximum CPU load TT supports our Design for Test requirement 34 Copyright 2014 SafeTTy Systems Ltd

18 C vs. MISRA C MISRA C A safe subset The C programming language 35 Copyright 2014 SafeTTy Systems Ltd TT vs ET architectures TT systems A safe subset Event triggered systems with multiple interrupt sources 36 Copyright 2014 SafeTTy Systems Ltd

19 Interrupt Interrupt Example: TTC scheduler (Run-time monitoring) t = 0 t = 1 t = 2 t = 3 t = 4 t = 5 t = 6 t = 7 t = 8 t = 9 Expected t = 0 cycle t = 1 of activity t = 2 is known t = 3 PRECISELY t = 4 at t = run 5 time t =... 6 t = 7 t = 8 t = 9 Co-operative task Pre-empting task TT supports our Design for Run-Time Monitoring [Various TT schedulers supported requirement in RapidiTTy toolsets] 37 Copyright 2014 SafeTTy Systems Ltd Why use a TT architecture? Easy implementation Low release jitter Low run-time (CPU) overhead Low memory overhead Schedule is extremely predictable The foundation of systems which are: Easy to test Easy to detect faults at run time Easy to certify Suitable for use in Level A / ASIL D / SIL 4 systems But don t just take my word for it 38 Copyright 2014 SafeTTy Systems Ltd

20 IEC (2010) TT architectures are Highly Recommended for systems of Safety Integrity Level (SIL) 2 or above [IEC (2010), Table A.2] Static synchronisation of access to shared resources - a key characteristic of all TT designs is Recommended (SIL3) / Highly Recommended (SIL4) [IEC (2010), Table A.2] Limited use of interrupts - a defining characteristic of TT designs - is Recommended for SIL1 and SIL2 systems and Highly Recommended for SIL3 and SIL4 systems. [IEC (2010), Table B.1] 39 Copyright 2014 SafeTTy Systems Ltd ISO (2011) Annex D With respect to timing constraints, the effects of faults such as those listed below can be considered for the software elements executed in each software partition: blocking of execution; deadlocks; livelocks; incorrect allocation of execution time; incorrect synchronization between software elements. [To deal with these problems] mechanisms such as... time-triggered scheduling, monitoring of processor execution time, program sequence monitoring... can be considered. 40 Copyright 2014 SafeTTy Systems Ltd

21 Conclusions 41 Copyright 2014 SafeTTy Systems Ltd Conclusions If we wish to create reliable, certified, embedded systems, (in a wide range of sectors) we need to focus on: Design for Test and Design for Run-Time Monitoring Use of time-triggered architectures as part of an approach to engineering embedded systems can help us to meet these requirements 42 Copyright 2014 SafeTTy Systems Ltd

- 22 - TM We believe that this is a revolutionary new platform for developing reliable embedded systems in compliance with IEC 61508, ISO

Pont, CEO, SafeTTy Systems Ltd http://www.safetty.

Pont is a comprehensive guide to the development of single-program, realtime embedded systems.

22 TM We believe that this is a revolutionary new platform for developing reliable embedded systems in compliance with IEC 61508, ISO 26262, IEC 62304, EN 50128, IEC 60730, DO-178c and related international standards and guidelines. Dr Michael J. Pont, CEO, SafeTTy Systems Ltd 43 Copyright 2014 SafeTTy Systems Ltd The Engineering of Reliable Embedded Systems (ERES) by Michael J. Pont is a comprehensive guide to the development of single-program, realtime embedded systems. Published in 2014, the particular focus of this new book is on the construction of systems based on time-triggered architectures, using the ReliabiliTTy platform. Sample chapters now available for download Copyright 2014 SafeTTy Systems Ltd

The agri-motive safety performance integrity level Or how do you call it?

TÜV Rheinland InterTraffic GmbH Safety in Transportation 4 The agri-motive safety performance integrity level Or how do you call it? Dipl.-Ing. Sebastian Gräfling, TÜV Rheinland InterTraffic GmbH Contents