https://www.mdu.se/

A piece of software, that we define as a software system, can consist of anything from a few lines of program code or the entire software stack in a vehicle. Software systems can be divided into smaller and partially independent parts called subsystems/partitions (we use the words partition and subsystem interchangeably). The non-functional isolation of subsystems, that appears when the software system is hierarchically divided, has great advantages when it comes to preventing fault propagation between subsystems. The hierarchical division, that we refer to as hierarchical scheduling, has other advantages as well. It facilitates re-usability and it makes timing analysis of software systems easier. Hierarchical scheduling has been shown to be a useful tool in counteracting the verification challenges that comes from the growing complexity in software. For example, the avionics-specification ARINC653 and the safety-critical operating systems seL4 and PikeOS safely divide resources for independent safety-critical applications by using hierarchical scheduling.

Hierarchical scheduling can be implemented in many different ways, depending on what resource that is supposed to be shared among applications. The resource could be the CPU, memory, network etc. The work in this thesis is focused on the practical aspects of timing isolation among subsystems, i.e., sharing of the CPU resource. Hence, this work elaborates on how to adapt and extend the operating-system task-scheduler to support hierarchical scheduling. We have focused on both independent and semi-dependent subsystems. Independent subsystems only share general resources such as the CPU and memory. Semi-independent subsystems share not only the general resources, but also other logical resources that can only be accessed in a mutually exclusive way, i.e., by one subsystem at a time. An example of such a resource could be a shared memory-space, e.g., a database, a memory-mapped device etc.

This thesis has two main parts related to hierarchical scheduling: scheduler synthesis, and synchronization.

Scheduler synthesis is related to implementation and design strategies when adding support for hierarchical scheduling in an operating system. We have focused on various operating systems that were lacking the feature of hierarchical scheduling. The two most interesting operating systems that we worked on was Linux and seL4. These two operating systems represent two extremes, where Linux is more focused towards soft real-time systems and seL4 towards pure hard real-time (safety-critical) systems. Linux-based systems have in general less strict demands on correctness and more requirements on usability. Usability implies less installation efforts and less limitations in the usage of the available Linux functionality. The usability aspect is especially important for Linux systems since kernel updates occur much more frequently compared to any other operating system. Hence, extending/modifying the functionality of Linux must be done in a way that does not require any modifications to the kernel. seL4 on the other hand has strict requirements on safety, i.e., functional and non-functional correctness, but also performance efficiency. Guaranteeing correctness implies a potential loss of performance due to the added overhead that the verified software can bring. The correctness aspect includes strategies on how to verify hierarchical schedulers, but also how to minimize the scheduler overhead and achieve as good run-time performance as possible. Conclusively, there are many challenges when it comes to scheduler synthesis. There are requirements on performance, usability, correctness etc. The contribution in the synthesis part includes a scheduler framework called ExSched (External Scheduler). We have also contributed with a novel approach to verify hierarchical schedulers, and a code generator called TAtoC (Timed Automata to C) which contributes to the effective run-time performance of synthesized timed-automata models.

The second part of this thesis, synchronization, is an important general aspect of hierarchically scheduled systems since the isolation of subsystems makes resource sharing among subsystems more challenging. We have advanced the state-of-the-art in this research area by introducing a new synchronization protocol called RRP (Rollback Resource Policy) that improves on the robustness and run-time performance compared to the existing protocols. We have also conducted a large scale experimental evaluation of all existing protocols that we have implemented in the widely used real-time operating system VxWorks.