Aerugo – RTOS for aerospace uses written in Rust

by todsacerdoti • 2 years ago

150 46 2 years ago

jiehong• 2 years ago

Can someone clarify this part like I’m 5:

Its design is inspired by purely functional programming paradigm and transputers architecture.
RTOS is implemented in a form of an executor instead of classic scheduler and doesn't support preemption. Executor runs tasklets, which are fine-grained units of computation, that execute a processing step in a finite amount of time.

Transputers seem to be a leftover technology from the 80s, and lack of preemption seems hard to reconcile with real time guarantees?

flyinglizard• 2 years ago

No preemption makes this an organizer more than an RTOS.

csdreamer7• 2 years ago

Would you please explain more?

qayxc2• 2 years ago

As far as my very limited understanding goes, the transputer reference is simply referring to a highly parallel message-passing system based on message queues, not actual hardware implementations.

As for lack of preemption, that's explained by the system not implementing a scheduler. The system "just" implements an executor.

An Executor is a component that handles subscriptions (e.g. to interrupts or events/messages), services (both clients and servers), timers, and QoS events (deadline missed, invalid QoS request, task died/unresponsive, etc.), which are implemented as tasks (Aerugo calls them "tasklets") and registered with the executor.

• Subscriptions are tasks that subscribe to a topic (of a message).

• Service servers are tasks that are invoked when a request from a client is received.

• Service clients are tasks that are invoked whenever a response from a server is received.

• Timers trigger when a timer expired.

• QoS events are fired when a deadline has been missed, a task died/became unresponsive, and other stuff like a QoS request couldn't be met, etc.

Aerugo supports a subset of these capabilities, namely message queues (for subscribers/clients and producers/servers), events (IRQs, h/w signals, etc.), and cyclic execution (execute the task n-times or forever).

Scheduling - i.e. the priority of things - is handled by the user or built into the Executor itself. For Aerugo the former is the case, so if you need control over priorities and order of task execution, you'd have to implement it on top of it.

Now the realtime-part isn't really affected by any of this. It still allows for weaker RT systems. RT just means there's a time constraint on executed tasks. Weaker systems have average runtime guarantees (e.g. a tasks have to finish within a limit on average, i.e. outliers are allowed). Stronger systems are stricter in the sense that tasks always have to finish within the limit. The strongest systems even enforce an exact limit (that is, tasks aren't even allowed to finish sooner - they have to take exactly a given amount of time).

Preemption is required if tasks have to be scheduled w.r.t. to different priorities, especiallyy in multi-threaded scenarios. Lack of it means that the executor will never interrupt a running task to execute tasks that take priority - at least from what I understand, which might be wrong.

RossBencina• 2 years ago

A couple of things of note:

Run-to-completion scheduling is a thing in the real-time world. See for example Miro Samek's book Practical UML Statecharts in C++.

XMOS makes real-time embedded CPUs supporting task-per-core architecture and hardware message passing. Commonly used in consumer real-time audio hardware, to pick one example. I believe some of the original Transputer people are involved.

toast0• 2 years ago

> Executor runs tasklets, [...] that execute a processing step in a finite amount of time.
lack of preemption seems hard to reconcile with real time guarantees?

Depends on the requirements and the bounds of the finite time allowed and the enforcement of it. For example, Erlang claims to be soft real-time; it doesn't have preemption, but any function call can result in yielding, and as a functional language there are no loops without calling functions.

jacquesm• 2 years ago

And that works because it is a VM that is executing the instructions. The higher level of the VM can switch threads at will. The measure used is the number of reductions, once a set limit is used or something more urgent crops up a context switch will occur. This functionally indistinguishable from a hardware interrupt for the task that was executing but because it is all done in software you don't actually have that interrupt. It's more as though every reduction has the potential to interrupt a task just like you can expect an interrupt everywhere in a regular stream of machine code for some processor.

The nice benefit of the Erlang method is that you can graft this onto a user process without a need for special privilege or exception handling, nothing ever really has to deal with interrupts or the messy aftermath of it, it's much cleaner than an interrupt driven system.

sigmonsays• 2 years ago

can someone please make an ode to "write in C" (1) entitled "Write in Rust"

(1) https://www.youtube.com/watch?v=wJ81MZUlrDo

bee_rider• 2 years ago

Was this song written in like 1990 and recorded/posted in 2013, or something?

hlandau• 2 years ago

A bit surprised to see a common MCU used here rather than one designed for safety applications (e.g. TMS570). Is there any rationale to this?

steveklabnik2• 2 years ago

I don't see a super explicit one, but: https://activities.esa.int/4000140241

The proposed activity is to evaluate the usage of Rust programming language in space applications,
The design of the system will be guided to support potential future qualification activities.
This application will showcase the viability of the developed RTOS and provide input to a Lessons Learned report, describing the encountered issues, potential problem and improvement areas, usage recommendations and proposed way forward.

Looks like it's not intended for real applications, but instead to gain some experience. What better way to ensure that you don't ship the prototype than by doing it on hardware that is similar but different enough to ensure that it won't be used in production.

Just a guess though!

sesm• 2 years ago

I hope they also publish the Lessons Learned report mentioned above, would be an interesting read.

topspin3• 2 years ago

Is there any rationale to this?

It's all ARM Cortex? The RTOS doesn't care.

xyx0826• 2 years ago

The choice of microcontroller matters. Functional safety qualified MCUs might have the same CPU core but is built in a way that minimizes interference or common cause of failures between peripherals. The software needs to be written closely following the safety manual of such a MCU to make maximum use of those safety guarantees.

SteelPh0enix3• 2 years ago

While our RTOS in fact doesn't care about it, because it's up to the user to implement the abstraction for the platform, the bigger issue is Rust support for more exotic architectures used in space - for example, SPARC (LEON3), which we'd like to consider for a Rust project, but it's compiler support seems relatively bad.

SteelPh0enix3• 2 years ago

Hello, one of the devs of Aerugo here.

The rationale is rather simple - SAMV71 is used in critical applications (it has some functional safety certificates), and I have past experience of writing critical software for it at N7.

matt3210• 2 years ago

The program cannot be verified against the standard to be correct. There is no standard, how can it be verified.

steveklabnik2• 2 years ago

Because verification does not require a standard. rustc has already been qualified (though not for any aerospace-specific things yet that I'm aware of, but in my understanding the shape is the same) (via Ferrocene[1]), even though there is no Rust Standard. No issues here.

1: https://ferrous-systems.com/blog/qualifying-rust-without-for...

Also, I don't see where this project claims to be verified.

Xylakant• 2 years ago

If by "no standard" you mean that there is no language specification for rust, then there is no standard. However, a language specification is not sufficient to verify program correctness, nor is it required.

A standard may (and the C standard for example does) leave parts of the behavior as "implementation specific" and there's quite a few edge cases - and that's not even talking about "undefined behavior", of which there is plenty. An even in the behavior that is neither implementation specific nor undefined you'll find enough rope to hang yourself (all the beautiful pointers). There's a reason things such as MISRA C exist - effectively a standard on top of a standard.

On the other hand, the rust language - while having no formal spec - is fairly well described, in the form of its RFCs and testsuite. We (the ferrocene team) were able to derive a descriptive specification from the existing description fairly easily. So while there is no ISO standard, and no spec that would be sufficient to write a competing implementation, there is a description of what the language behaves like. You can read up on it at https://spec.ferrocene.dev/

As for verification of correct behavior of such a program, you can employ a host of different techniques depending on what your requirements are - down to verification of the produced bytecode by means of blackbox testing or other.

addaon2• 2 years ago

There is no standard, how can it be verified.

The behavior of the generated binary can be verified against the requirements. Yeah, the most common way to do this is to verify certain properties at the source code level, and then rely on various ways to show equivalence between the source code and the generated assembly, the generated assembly and the generated binary, and the formal semantics of the generated binary and the as-executed semantics on the chosen hardware; but it's perfectly reasonable, and not even particularly unusual, to skip the first equivalence and verify the assembly against the requirements directly.

foundry272• 2 years ago

(n.b. The project looks awesome, and it’s awesome that it’s written in Rust and working well. Great job folks!)

I’ve been the managing functional safety engineer for several safety-critical real-time embedded systems and safety-related components/SEooCs (including a RTOS), and something stood out to me after reading through the repository: This is not a safety-critical operating system, despite the project’s claim.

There was clearly requirements engineering and verification work done, and the authors are under absolutely no obligation to publish the requirements and methodologies. But there’s no safety manual / integrator’s guide provided, no evidence of any qualitative or quantitative safety analysis or modelling at any abstraction level having been performed, no evidence of a safety concept, and no evidence of a safety case. I recognize that this is likely intended as a PoC from the description of it being exploratory to produce a “Lessons Learned” report, but the website for the ESA initiative that’s driving this development claims that “The design of the system will be guided to support potential future qualification activities”. If that was done, there should be evidence of some of all of those work products, because that’s how you support future qualification. You cannot retroactively sprinkle safety on top of a system that hasn’t been designed with safety in mind.

aknfffn• 2 years ago

I’d love to learn more about this — can you recommended any resources for building something from the ground up with the relevant safety-critical considerations? Appreciate any pointers

kejaed2• 2 years ago

Here’s a decent textbook that covers the software side in aerospace (DO-178):

https://www.amazon.ca/Developing-Safety-Critical-Software-Pr...

You can read up on the system safety side in documents like ARP5754 and ARP4761 and hardware side in DO-254.

foundry272• 2 years ago

Late reply, I know, but I would highly recommend skimming through “Embedded Software Development for Safety-Critical Systems” by Chris Hobbs. I think it does a good job at getting people thinking about how they can start adopting a safety mindset for their projects, what techniques are applicable, and what common pitfalls are.

f1shy2• 2 years ago

A little bit like the famous saying in court: “It is not how safe you made it, it’s about how much you can prove you made it safe!”

SteelPh0enix3• 2 years ago

Hey, one of the devs of Aerugo here! Thanks for feedback!

You are absolutely right - at current state, this is not a safety-critical OS, however the project doesn't claim that explicitly - it's "safety-critical applications oriented". It's a small detail, but you're right to point it out.

The lack of mentioned documents is due to the fact that this RTOS was not qualified for any criticality. And this is due to our resource constraints for this project - ESA provided us with a year of time and funds for ~2 full-time developers. It would be physically impossible to create this project from scratch (as we did) and qualify it, even for crit C, in that timeline.

We would love to do a follow-up activity on Aerugo, and one of our ideas was the qualification (maybe not for Crit A, but B would be nice for an RTOS). However, that's a thing for the future, and we don't know what exactly will happen next with Aerugo yet - we're working on it.

I'd also like to point out that we have designed this system with safety in mind - we've been regularly analyzing potentially problematic design choices and code with that in mind (especially unsafe code and functions). There is a ground for criticality qualification, it just needs a lot of work to make it a fact.

PS: We do intend to release our "Lessions Learned" report in near future to the public!

pitherpather• 2 years ago

I have not read the ESA document, but in their defense one possibly applicable principle is this:

If you get too far from understanding/practicing implementation, soon enough you will not be competent enough to produce a specification.

f1shy2• 2 years ago

This is so so often the case. Specially in the last decades, when it is profitable to setup a company which basically does nothing more than writing specifications

Aerugo – RTOS for aerospace uses written in Rust

Related Stories