Diving Deeper into Multi-core Certification Activities

In the recent Wind River and Rockwell Collins joint webinar “Plan with Confidence: Route to a Successful DO-178C Multi-Core Certification”, we discussed a number of topics related to the planning, design, testing and analysis for RTCA DO-178C / EUROCAE ED-12C DAL A safety certification of avionics software systems running on multiple cores on multi-core processors. If you weren’t able to attend the webinar live, the webinar is still available online as an Open Systems Media archived webcast.

A lot of interesting questions were submitted online during the webinar related to the configuration, testing and analysis of multi-core systems. We provided answers to some of these during the webinar Q&A session, but due to time limitations, we weren’t able to cover all of the questions raised.

The webinar was based on the joint white paper “Civil Certification of Multi-core Processing Systems in Commercial Avionics”which is also available for download. We have been working on longer more formal conference papers which cover multi-core interference and analysis in more technical depth. We intend to present these papers at avionics and safety conferences in the near future.

However, given the level of interest in multi-core analysis during the webinar, we thought that readers might be interested in a sneak preview of one of the topics which we will discuss in more technical detail in one of the conference papers, specifically how Interference Channel Analysis (as discussed in the webinar) can be undertaken through effective use of Interference Channel Methodology.

Interference Channel Methodology

In modern multi-core processor system-on-chip (SoC) designs, the potential for multi-core interference is real, and avoiding it completely is not possible. So, the Interference Channel Methodology takes a pragmatic approach with the goal of guaranteeing deterministic performance in the presence of all potential forms of SoC interference – these include potential shared communications channels and attached resources (memory, input/output, devices, etc.).

Individual SoC designs will of course have unique communication channels and associated performance characteristics in the presence of interference, but this methodology is equally applicable to any complex SoC processing platform. The Integrated Modular Avionics (IMA) Platform Supplier should undertake interference channel analysis of the SoC processing platform in supported configurations.

For each interference channel, mitigation methods are required, and for some interference channels this can be achieved through system-level design. Performing analysis of actual system usage is also necessary for each source of interference.

Mitigation of the interference channels is achieved through measurement, analysis, and monitoring techniques. Specific analysis for each SoC is unique and may require access to proprietary information from the SoC vendor.

In order to assess the overall multi-core processor performance, the Interference Channel Methodology uses comparisons to similar single core processors to show equivalent or better performance (for each core), even under maximum contention scenarios. For example, highly interfering test applications can be used to cause maximum interference for SoC resources, in excess of what could be experienced in a normally functioning application.

Graph: Rockwell Collins

The graph shows the results for normal memory access read times on a previous-generation single core processor (column 1), and this is compared against the normal read access times for a single core on the T2080 (column 2), and against the results for memory read while under extreme contention from all other cores (columns 3-5). This shows that applications still experience better performance in the target T2080 processor than in previous generation single core processors. This type of analysis provides confidence that the chosen methodology can produce acceptable performance for existing and new IMA applications.

We are planning to address other topics in the conference papers, including how changes in critical configuration settings can impact multi-core interference, and how interference channel measurements can provide the basis for determining worst-case execution timing (WCET) analysis.

In the meantime, if you would like to learn more about VxWorks 653 on multi-core platforms, please feel free to contact our global sales team.