1. Developing Safety Critical
Applications in Java with
oSCJ/L0
Ales Plsek, Lei Zhao, Veysel H. Sahin, Daniel Tang, Tomas Kalibera, Jan Vitek
www.ovmj.net/oscj
oSCJ
Open Safety-Critical Java
Friday, August 20, 2010

2. oSCJ Overview oSCJ
Open Safety-Critical Java
SCJ Library oSCJ Level 2 L2 -
• Level 0 support L1 -
Level 1
SCJ-compliant VM L0 -
Level 0
• RTEMS/LEON3 and x86
platforms oSC
oSCJ VM OS o
Tools
• Static Checker for SCJ Annotations RTEMS RTE
• Technology Compatibility Kit (TCK)
Xilinx
Benchmark HARDWARE LEO
• miniCDj benchmark
Friday, August 20, 2010

3. The Mission Concept
current mission
setup initialization execution cleanup teardown
ImmortalMemory next mission
setup missions teardown
MissionSequencer - getNextMission()
M1 ... Mi ... Mn
current
- creates MissionMemory
MissionMemory - runs in
initialization execution cleanup
- startAll()
MissionManager
- waitAll()
SO1 ... ... SOn
- runs in
PrivateMemory PrivateMemory
Friday, August 20, 2010

4. Memory Model
Private
Memory 3
enterPrivate
executeInArea()
Memory()
Private
Memory 2
enterPrivate
Memory()
Private
Memory 1
enter()
Mission Mission
Memory Object PEH 1 PEH 2
enter()
Immortal Memory
Friday, August 20, 2010

5. Compliance Levels
Level 0
• Only Periodic Event Handlers, single mission, single threaded
• Frame-based cyclic-execution model
• No synchronization support required
PEH 1 Frame PEH 2 PEH 1 Frame PEH 2
Level 1
• Aperiodic Event Handlers, fixed-priority preemptive scheduler
Level 2
• Sub-missions, ManagedThreads
Friday, August 20, 2010

6. oSCJ library
oSCJ library
• focused on SCJ Level 0
interface VM_Interface {
Opaque makeExplicitArea (long size);
Opaque makeArea (MemoryArea ma, long size);
Opaque setCurrentArea(Opaque scope);
Opaque getCurrentArea( );
...
VM Interface
• a dedicated interface for Opaque getCurrentTime{};
communication with the VM long getClockResolution();
...
int delayCurrentThreadAbsolute(long nanos);
}
Friday, August 20, 2010

7. SCJ VM Design
• based on Ovm
• a metacircular Virtual Machine
• similarly as J9, FijiVM, Squawk VM, etc. Java Class Library
Loader Java code
• a small C loader is responsible for loading Verifier Transformer
the boot image at runtime.
Memory Thread
• Java code compiled down to C Manager Scheduler
Compiler
• supported platforms : RTEMS/LEON3,
x86
Device Driver Architecture
I/O Library Native Code
C code
Friday, August 20, 2010

8. Memory Model Implementation
top level
BS level BS level
IM M1 P1 P2 P3 P1 P2
scope level
Friday, August 20, 2010

9. Optimizations
Synchronization Support Java Object Model
• Level 0 - single threaded BluePrint
Hash-Code
Monitor
Primordial Thread GC info
• modified to be RealtimeThread DATA
SCJ Object Model
Object Model
BluePrint
• optimized fields Monitor
• hash-code, GC information DATA
Friday, August 20, 2010

10. Evaluation
• CDx Benchmark
• miniCDj - periodic real-time task
• Platform
• Xilinx FPGA GR-XC3S-1500 development board
• LEON3 40 MHz, 8MB flash PROM, 64MB SDRAM, no FPU
• RTEMS 4.9 OS
• SCJ configuration
• no scope checks, miniCDj statically analyzed by SCJ Checker
Friday, August 20, 2010

11. Results - LEON3 board
miniCDj worst case
Iteration Execution Time
miniCDj
in Milliseconds
CDc
CDc worst case
# Iteration Results Summary
Workload:
6 planes avg max
120 milliseconds CDc 52.8 67.9
period
miniCDj 69.6 91.2
10 000 iterations
Overhead: 31% 34%
Friday, August 20, 2010

12. Results - x86
CDc worst case miniCDj worst case
Iteration Execution Time
CDc
in Milliseconds
miniCDj
# Iteration
Results Summary
Workload: avg max
60 planes
120 milliseconds CDc 0.39 0.47
period
miniCDj 0.34 0.49
10 000 iterations
Overhead: -15% 4%
Friday, August 20, 2010

13. Conclusion
Implementation Summary
• SCJ library - 3 months
• SCJ VM
• Memory model - 3 weeks
• VM Optimizations - 2 weeks
• porting VM to RTEMS - 2 months
oSCJ Distribution
• library, VM, tools and benchmark
• open-source at www.ovmj.net/oscj
oSCJ
Open Safety-Critical Java
Friday, August 20, 2010