Real time multi-task process and operating system

[0001] The present invention concerns a real time process and multi-task operating system, particularly in an ATSU-type calculator.

[0002] An ATSU (Air Traffic Services Unit) type calculator is an avionic calculator responsible for managing new ground/on board communications systems based on the use of information technology networks with global coverage. Such a calculator has a software architecture characterised by the implementation of a real time multi-task POSIX operating system.

[0003] This calculator can include software with different criticality levels. A high priority level is allocated to the most critical tasks so as to satisfy their real time constraints whatever the behaviour of the less critical tasks. Nevertheless, the latter do not have a minimum guaranteed access to the calculation resource that can be monopolised in part or in total by the most critical tasks.

[0004] One of the resources that can be shared by a POSIX real time operating systems, such as the one described in the document entitled, “POSIX document: Institute of Electrical and Electronic Engineers. Portable Operating system Interface—Part 1: System Application Program Interface (API),” is the calculation time (central unit time). Distribution is implemented by a router that relies on a criterion of priority and a measure of the execution time of tasks to implement a scheduling policy.

[0005] In such a real time operating system of the known technique the execution period of a task is generally measured with the help of so-called “tic” clock pulses generated by a period material counter and counted by an interruption programme in the software counters. Each clock pulse is allocated to the task that has the central unit resource at the time of the generation of the corresponding interruption. The systems keeps a global counter (or absolute clock) updated. It contains the number of clock pulses from the start-up of the system and a counter by task (or relative clock) that contains the number of clock pulses that have occurred while this task has the central unit resource.

[0006] So as not to damage the performance of such a system the duration between two clock pulses should be sufficiently long for their consideration time to remain negligible. This way of measuring the time leads to imprecise measurement of the duration of tasks as is shown by the chronogram illustrated in FIG. 1 with IT interruption-clocks. The measurement of the duration of two T1 and T2 tasks of the same 10.5 ms duration gives a measured value of 30 ms for the first task and 0 ms for the second task; the parts greyed “10” illustrate the use of the central unit resource.

[0007] The chosen scheduling mode in a ATSU-type calculator is the FIFO (First in-First Out) mode. In this mode the scheduler allocates the whole central unit resource for an indeterminate time to the task ready to be executed and of the highest priority. If several tasks of the same priority are ready to be executed they are managed in chronological order and the first in the list is executed until it is blocked. In this event the following in the list is executed. If a higher priority task becomes ready, the task being executed is pre-empted (it loses the central unit resource) and the higher priority one is executed. The scheduler guarantees that a task that has been pre-empted remains at the head of the list to resume execution before the others.

[0008] The functioning of such a scheduler is illustrated on FIG. 2. Operating system 11 includes a POSIX/UNIX 12 system interface. The applicative tasks are referenced 13. Time management unit 15 that receives IT interruptions of the material counter updates software counters (arrow 16). It sends to scheduler 18 (arrow 19) a rescheduling request during the expiration of the quantum time of the current task. Scheduler 18 allocates (arrow 20) the central unit resource to the task that has the highest priority ready to be executed.

[0009] Such a distribution policy naturally penalises the lower priority tasks since the central unit time that can be used by them depends on the time left free by the higher priority tasks.

[0010] An item of the known technique, as discussed in the document “Soft Real Time Scheduling for General Purpose Client-Server Systems” by David Ingram, considers the real time application scheduling problem in a general use operating system. This system is modified so as to take advantage of real time scheduling time while preserving the existing software. The architecture considered uses a POSIX-type scheduler. A QOS (Quality of Service) coefficient is defined by a couple of parameters: central unit time t, period of time t. A contract corresponding to such a coefficient defines that at least one duration t should be allocated to a task in each period T. the scheduler is informed'of the parameters to use for each task.

[0011] The aim of the invention is to compensate for the inconveniences defined above while proposing a real time multi-task process and operating device, particularly in an ATSU-type calculator.

[0012] The present invention concerns a real time multi-task operating process in which is defined a set of fixed adjustable duration observation windows, characterised by the fact that it includes:

• • [0013] an allocation stage of a maximum execution duration for each task in each window during which a scheduler guarantees a minimum execution time for lower priority tasks;
  • [0014] A calculation stage for time spent by each task during each observation window;
  • [0015] A sanction stage during which the tasks which exceed their quota in a given observation window are sanctioned and can only resume the central unit resource during the following observation window. The advantage of this during the calculation stage is that the value supplied by a global software counter is used and refined by adding to it the time passed since the last clock pulse read at one go in a material counter as well as a rerouting stage: a first rerouting point existing in the scheduler code, a second rerouting point existing in the interruption programme for treating clock pulses. The latter, which has higher priority than all the tasks of the system, allows the time spent by the task in progress to be calculated and to sanction it if its quota is exceeded.

[0016] The sanction stage takes place during a change of task (has the outgoing task exceeded its quota?) or during the generation of a clock pulse (has the current task exceeded its quota?). The sanction stage can consist of a lowering of the task priority, a stoppage of the task or a destruction of the task.

[0017] In a beneficial implementation mode the invention process includes:

• • [0018] a start-up stage in which:
    • [0019] rerouting procedures are installed
    • [0020] a supervision task is launched
    • [0021] the duration of the observation window is configured
  • [0022] a management task stage in which:
    • [0023] during the creation of a task:
      • [0024] the maximum duration of use of the central unit resource is configured in the observation window and the sanction to apply in the event of overshoot
      • [0025] the surveillance of this task is launched
    • [0026] during the termination of this task:
      • [0027] the surveillance of this is inhibited
    • [0028] during the switching of his outgoing ask to another entering task:
      • [0029] the event is dated
      • [0030] the time for start-up activation of the entering task is recorded
      • [0031] the time spent on the outgoing task during the observation window is calculated
      • [0032] a sanction is applied if the time spent by the outgoing task is higher than the maximum allocated
  • [0033] a clock pulse management stage or “tic” in which:
    • [0034] the time spent by the task in progress is calculated
    • [0035] a sanction is applied if the time spent is higher than the maximum allocated time
  • [0036] an observation window management stage in which:
    • [0037] at the beginning of the window the time spent on tasks is put at zero
    • [0038] at the end of the window the sanctioned tasks are rehabilitated

[0039] The invention also concerns a real time multi-task operating system, characterised by the fact that it includes a surveillance module which contains a rerouting procedure code for putting in place rerouting points, an interface, for example a UNIX standard of accessible functions by a supervision task, a time management unit and a scheduler.

[0040] The invention system makes it possible, beyond temporal segregation constraints, to ensure a fairer distribution of the central unit resource and to improve the robustness of the system by controlling an exclusive potential use of the resource. It can also be advantageously used in an ATSU type calculator.

[0044] In the invention process a set of observation windows is defined, of a fixed adjustable duration. In each window a maximum execution duration (a quota) is allocated to each task. During a given windows the task that exceeds their quota are sanctioned and can only resume the central unit resource during the following window. Also so as not to fall into the problem of measuring the previous technique such as previously described and to guarantee a reliable control of the distribution of the central unit resource, a precise calculation of the time spent in each task is made. In the invention process it is no longer the clock pulses, as described previously, which are counted according to the task in the process of execution. Instead, it is the dates for the beginning and end of their activation. To date these events, the value supplied by the global software counter is used; which is refined by adding to it the time spent since the last clock pulse (residue) read at one stroke in the material counter.

[0045] The dating of events during a change of task necessitates the putting into place of a rerouting point (“Hook” procedure) in the scheduler's existing code. Such a “Hook” process is a simple routine call familiar to the professional. Nevertheless this sole rerouting point does not allow the detection of an exclusive use of the central unit by a high priority task since specifically no change of task context can operate. Another rerouting point is thus placed in the process interruption programme of the clock pulses. The latter, with higher priority than all the system tasks makes it possible to calculate the time spent by the task in progress and to sanction it if its quota is exceeded. The reaction time of the sanction depends on the clock pulse duration. Thus in an operating system set to 10 ms, a task which consumes time excessively is sanctioned at the most 10 ms after exceeding its quota.

[0046] A surveillance module is integrated into the operating system as a pilot or “driver”. It contains the rerouting procedures' code and offers a standard UNIX interface of accessible functions by the supervision task (parameterisation of surveillance, recovery of information about the consumption of tasks, reading of the history of overshoots).

[0047] A sanction can be applied at two points: on a change of task (has the outgoing task exceeded its quota?) or on the generation of a clock pulse (has the current task exceeded its quota?). A sanction is the subject of a trace preserved in a history that can be consulted by the supervision task. It can take several forms—lowering of task priority, stoppage of the task, or destruction.

[0048] FIG. 3 illustrates the functioning of a scheduler in the real time multi-task, operating process of the invention. The elements that already existed on FIG. 2 preserve the same references. The supervision task is referenced 30. Time management unit 15 enables at the same time (arrow 31):

• • [0049] updating of software counters
  • [0050] recovery of time residue A surveillance module 32 enables (arrow 33) an adjustable surveillance and sends (arrow 34) information on the status of tasks. It also enables (arrow 35):
  • [0051] dating of events.
  • [0052] control of use of central resource unit.
  • [0053] A sanction.

[0054] It receives (arrow 37) IT interruptions of the software counter for the start of each observation window.

[0055] Time management unit 15 receives from surveillance module 32 message 38 for reading current time and sends counter event message 40 via rerouting process 39. Scheduler 18 sends task change event 43 to surveillance module 32 via rerouting process 42.

[0056] The functioning of such a system is summed up in table 1 located at the end of the description that is a table of states of the surveillance 32.

[0057] Two characteristics of the POSIX 1.d standard can be compared with the invention process:

• • [0058] the “sporadic” server
  • [0059] the surveillance and specific measurement of the execution time.

[0060] In this standard, this sporadic server consists of constantly keeping a reserve of central unit time in a so-called filling time for aperiodic tasks in the system. To the idea of a reserve is linked a notion of high priority processing. As soon as an aperiodic task is activated it passes to a high priority and draws from its time reserve. If its time reserve has passed it goes to low priority until the next filling time. In increasing the priority of lower priority tasks during a given time quota the latter are sure of being taken into account for a certain time.

[0061] On the other hand the approach of scheduler 18 according to the invention is the opposite. To guarantee an execution time for lower priority tasks this limits the execution time of higher priority tasks.

[0062] The POSIX.1b also suggests real time extensions for time management. It offers the opportunity to have access to an absolute clock with a greater precision than that given by the clock pulses' global software counter. It enables definition software alarms via this clock. The POSIX.1d standard suggests, also, the use of a relative clock concept: the execution time of each task is kept updated with greater precision than that given by the clock pulses' local software counter. In the same way as with the absolute clock it is possible to programme alarms associated to each relative clock. The expiration of the alarm triggers a signal to the task concerned which can decide itself to be suspended for a certain time before resuming the central unit resource: the global control of the execution time is the responsibility of each task and is a decentralised control.

[0063] The measurement of execution time of each task in the invention's scheduler 18 takes up this principle again but the decision to sanction a task is taken at the level of the scheduler in a centralised way.

[0064] We shall now describe the UNIX 12 standard interface. To control the parameters of the invention's scheduler 18 and to supervise the activities in a UNIX-type operating system, the pilot code or “drivers” is accessible by the user through a special file. The invention scheduler is a pilot that offers a user interface in the form of generic services applied on the special file and described in the POSIX 1003.1 standard. A specific implementation corresponds to a generic service specific to the pilot. Opening and closing file operations (with control of access rights), reading the overshoot history and finally the control/adjustable operation of the invention scheduler are all separate. The rerouting procedures are internal pilot services not directly accessible from the programme user.

[0065] The functioning of such an interface is illustrated in table 2 located at the end of the description.

Application of the Invention Procedure in an Avionic Configuration

[0066] The invention procedure can be used in the on board context of an ATSU (Air Traffic Services Unit) which manages the links between certain aeroplane equipment and ground/on board communication resources. The main functions of this calculator are carried out by the following applications:

• • [0067] the air traffic service application or ATC (management of crew dialogue/CPDLC/AFN, ADS surveillance)
  • [0068] the company operational communication or AOC applications

[0069] When the ATSU calculator is delivered the client company can implement its own applications, developed by itself or developed for it by a third party. The constraints associated with such a requirement are manifested by an acceptance structure enabling:

• • [0070] these different developments to be made as autonomous as possible.
  • [0071] The guaranteeing of the non perturbation of an ATC by an AOC application
  • [0072] The guaranteeing of a processing capacity for each task

[0073] Thus in the invention procedure quotas are allocated for the different tasks to guarantee a minimum execution time for AOC applications (lower priority than ATC applications). As soon as the quota is reached for an application a trace is preserved in the overshoot history and a sanction is applied. The quotas and sanctions for each ATSU application are listed in a configuration file. This file is read by the privileged process responsible for launching all the applications. This process thus positions the scheduling attributes for each application and enters in a surveillance mode in the expectation of possible quota overshoots.

[0074]

	TABLE 1
	SYSTEM
	EVENT	ACTION OF SURVEILLANCE MODULE 32
	Start-up of	install the rerouting procedures
	the system	launch the supervision task
		configure the duration of the observation
		window (done by supervision task 30)
	Creation of	configure the maximum duration of use of
	a task	the central unit resource in an observation
		window and the sanction to apply in the
		event of overshoot (done by supervision task
		30)
		launch task supervision
	Termination	inhibit the task surveillance
	of a task
	Switching a	date the event (from clock pulse software
	task	counters and the material counter residue)
		record the activation time of the
		entering task
		calculate the time spent by the outgoing
		task during the observation window
		(accumulation of activation times)
		apply a sanction if the time spent is
		longer than the maximum allocated time
		(quota)
	Material	calculate the time spent for the task in
	clock pulse	progress
	(“tic”)	apply a sanction if the time spent is
		longer than the maximum allocated time
		(quota)
	Beginning	put at zero the time spent for system
	of the	tasks
	observation
	window
	End of the	rehabilitate the sanctioned tasks
	observation
	window

[0075]

TABLE 2
UNIX/POSIX
system		Function carried
interface	Parameters	out in the driver
Int open	.filename=/devfss0	Check that the
(char*filename,	.mode-0_RDWR	application which
int mode)	(Reading, writing)	opens the file has
	returns a file	the super-user
	descriptor	privileges
Int close (int fd)	.fd= file	Check that the
	descriptor	application which
		closes the file
		has the super-user
		privileges
Int read (int	.fd=file	Consult the
fd,	descriptor	history of quota
Char*buf, int	.buf=memory zone	overshoots
size)	in which the (s)
	historic elements
	will be remounted
	.size=buf size
Int write	Not implemented	Not implemented
(intfd, int cmd
Char*arg)
Int ioctl (int	.fd= file	Launch the period
fd, int cmd,	descriptor	software counter
char*arg)	.cmd=START_WINDOW	which defines the
	.arg not used	duration of the
		observation window
	.fd=file	Stop the periodic
	descriptor	counter
	.cmd=STOP_WINDOW
	.arg not used
Int ioctl (int	.fd=file	Configure the
fd, int cmd,	descriptor	duration of an
char*arg)	.cmd=SET_WINDOW_DE	observation window
	LAY
	.arg= value in
	milliseconds of
	the duration of
	the observation
	window
	.fd=file	Recover the
	descriptor	scheduling
	.cmd=GET_SCHED_VAL	attributes for an
	arg=scheduling	activity (quota
	attribute	and sanction)
	(quota and
	sanction
	positioned for a
	process)
	.fd=file	Position the
	descriptor	scheduling
	.cmd=GET_SCHED_VAL	attributes for an
	arg=scheduling	activity (quota
	attributes	and sanction type)
	.fd=file	Recover the
	descriptor	current values
	.cmd=GET_SCHED_VAL	used by the driver
	.arg=measurement	to count the time
	values of the time	of a task
	spent by a task in
	the observation
	window