IMPROVING ARINC 653 SYSTEMS RELIABILITY BY USING FAULT-TOLERANT PARTITION SCHEDULING

• Main Author: GILBRAN (NIM: 13513015), AUFAR
• Format: Final Project
• Language: Indonesia
• Online Access: https://digilib.itb.ac.id/gdl/view/21317
• Institution: Institut Teknologi Bandung

The ARINC 653 specifies multiple real-time operating system components to provide isolation <br /> <br /> <br /> <br /> between partitions. This means failure on one partition does not affect any other <br /> <br /> <br /> <br /> partition. When a failure occurs, the system will handle the failure through health monitor <br /> <br /> <br /> <br /> component. Health monitor will detect a failure when it occurs and try to do recovery acts <br /> <br /> <br /> <br /> to make sure the system stays stable. Unfortunately, some failure cannot be handled by recovery <br /> <br /> <br /> <br /> procedures defined in the standard. This means the failure will persists and while <br /> <br /> <br /> <br /> each partition cannot affect the other partitions, the failure still happens and possibly leads <br /> <br /> <br /> <br /> to failure to the whole system. <br /> <br /> <br /> <br /> In this research, partition scheduler specified in ARINC 653 standard is extended to improve <br /> <br /> <br /> <br /> reliability in ARINC 653 compliant systems. Scheduler is developed based on ARLX, an <br /> <br /> <br /> <br /> existing ARINC 653 prototype built on top of Xen hypervisor. The scheduler will modified <br /> <br /> <br /> <br /> to support primary-backup scheduling scheme when scheduling partitions on the systems. <br /> <br /> <br /> <br /> This means, the scheduler can choose a backup partition if primary partition experienced a <br /> <br /> <br /> <br /> failure. <br /> <br /> <br /> <br /> The extended scheduler then tested to measure increase in reliability and worst-case latency <br /> <br /> <br /> <br /> when the system used said scheduler. Test result shows that system reliability increased <br /> <br /> <br /> <br /> significantly on the system, but with high worst-case latency. This means the system is less <br /> <br /> <br /> <br /> affected by failures, but cannot be used as productiono technology yet because the system <br /> <br /> <br /> <br /> could not provide real-time performance by industry standards.