Patent Application
20240311215
A system and method are provided for synchronizing communications and, more particularly, for synchronizing communications between a synchronizing interface network controller (SINC) and two or more processors that each define a plurality of user partitions.
In order to increase the availability, reliability and integrity (safety) of a system, such as a computer system, various operations may be performed in a redundant manner. For example, software applications may be operated in a redundant manner with the same software application being performed by each of two or more processors. By executing the same software application on each of two or more processors, the availability and reliability of the software application is increased.
In order to increase system integrity and therefore system safety, synchronous communication enables high integrity application messages to be compared and adjudicated. For example, one concurrently executing application may generate erroneous data due to radiation single event upset (SEU) or one application may become corrupted and thereby lose the ability to transmit one or all subsequent messages. In these cases, synchronous communication enables detection of message comparison mismatch or failure of one or more concurrent applications to transmit messages in a timely manner can be timeout detected. Overall system safety is enhanced by ensuring data integrity at the source with erroneous high integrity application messages being dropped so as not to propagate to other software applications within the system.
Redundant execution of a software application by two or more processors may be performed for various applications that demand high levels of reliability. For example, at least some of the software applications performed onboard an aircraft may be integral to the performance of the mission or to ensure continued safety of flight and, as a result, may require need to have a high degree of reliability. Thus, at least some of the software application execution onboard an aircraft may be redundantly performed by two or more processors so as to increase their reliability.
While useful for increasing the reliability of a software application, the redundant execution of a software application by two or more processors can create message input and message output inefficiencies including the consumption of additional processor and memory resources required to provide data to and read data from user partition memory, an increase in data latency caused by extra message memory copies and the imposition of various scheduling constraints. As an example of the challenges associated with the redundant execution of a software application, network switch loop back has been employed to provide the same data as input to the redundant execution of the same software application by different processors. However, network switch loop back is a relatively complex process that may introduce undesirable data latencies. As another example of the challenges, one or more additional memory devices may need to be added to the system to support the transmission of messages to and from the redundant execution of a software application with the additional memory device(s) being shared between the processors executing the same software application. The inclusion of additional memory devices not only requires additional hardware with corresponding increased power requirements, but may also require additional software to provide mutual access to the shared memory devices for the two or more processors executing the same software application.
A system and method are provided in accordance with an example embodiment to synchronize communication, such as by synchronizing communication between a synchronizing interface network controller (SINC) and a plurality of identical user partitions instantiated on two or more processors that are in communication with the SINC. By synchronizing communications in accordance with an example embodiment, the system and method may reduce data latency and may reduce scheduling constraints otherwise potentially created by the redundant execution of a software application by the two or more processors. In addition, the overall processing efficiency may be improved by the system and method of an example embodiment by reducing the instances in which data is written to and read from various memory locations, while still providing for the concurrent redundant execution of the same software application by two or more processors to improve the reliability and integrity of the software application.
In an example embodiment, a system is provided that is configured to synchronize communications. The system includes a SINC and two or more processors in communication with the SINC. Each processor defines a plurality of user partitions. Each user partition comprises dedicated memory space associated with a software application to be executed by the respective processor. The SINC is configured to synchronously and directly push a message to memory of one or more user partitions associated with the software applications that are being currently executed by the two or more processors. As such, the one or more user partitions being executed by the two or more processors receive the same message from the SINC. The one or more user partitions being executed by the two or more processors and associated with identical software applications are configured to directly transmit a message to the SINC. As such, the SINC receives the same message from one or more user partitions being concurrently executed by the two or more processors.
The SINC of an example embodiment is configured to access a plurality of message queues for storing respective messages. Each respective message queue is associated with a respective user partition. In this example embodiment, the two or more message queues associated with different user partitions may be configured to store the same message in an instance in which the different user partitions consume the same data. In an example embodiment, a number of different message queues are associated with different user partitions. The SINC of an example embodiment is further configured to determine and provide an indication that a queue associated with the respective user partition is full or has experienced an overflow condition.
The SINC of an example embodiment is configured to push the message to a respective user partition by pushing the message to one or more memory locations of the two or more processors that are dedicated to the respective user partition. In an example embodiment, the SINC is configured to concurrently push both standard integrity messages (routed to a single processor) and high integrity messages (routed to two or more processors after bit level comparison check) without prioritization of the high integrity messages. The SINC of an example embodiment can further be commanded to start and stop transmission of messages to one or more user partitions by issuing a partition level indicator. In an example embodiment, the SINC is further configured to provide a message timestamp for determining whether the message pushed to one or more user partitions is outdated. In this example embodiment, a user partition is configured to compare a reference time to a message level timestamp to determine whether a message is stale and no longer valid. In an instance in which the messages received by the SINC are of a predetermined type, such as high integrity messages, the SINC of an example embodiment is further configured to compare the same messages received from the one or more user partitions being concurrently executed by the two or more processors and drop message comparison mismatched messages to avoid erroneous data propagation, thereby transmitting the messages only if they are identical.
In another example embodiment, a method is provided for synchronizing communication between a SINC and two or more processors communicating with the SINC. Each of the two or more processors defines a plurality of user partitions with each user partition including dedicated memory space associated with a software application to be executed by a respective processor. The method includes synchronously and directly pushing a message from the SINC to memory of one or more user partitions associated with the software applications that are being concurrently executed by the two or more processors. As such, some of the one or more user partitions being executed by the two or more processors receive the same message from the SINC.
The method also includes directing transmission of a message from one or more user partitions that are executed by two or more processors and associated with identical software applications to the SINC. As such, the SINC receives the identical message from one or more user partitions that are being concurrently executed by the two or more processors.
The method of an example embodiment also includes storing respective messages in a plurality of queues maintained by the processors. Each message queue is associated with the respective user partition. The method of this example embodiment stores respective messages in the plurality of message queues by storing the same message in two or more message queues associated with different user partitions in an instance in which the different user partitions consume the same data. The method of this example embodiment also includes associating a different number of message queues with different user partitions. The method may also include determining, by the SINC, and providing an indication to the processor that a queue associated with the respective user partition is full or has experienced an overflow condition.
The method of an example embodiment pushes the message from the SINC to a respective user partition by pushing the message from the SINC to one or more memory locations of the one or more processors that are dedicated to the respective user partition. The method of an example embodiment pushes the message from the SINC by concurrently pushing both standard integrity messages and high integrity messages from the SINC without prioritization of the high integrity messages. In an example embodiment, the method also includes flushing messages or starting and stopping transmission of messages to one or more user partitions by issuing a partition level indicator to the SINC. The method of an example embodiment also includes indicating that the message pushed to one or more user partitions is outdated by comparing a reference time and a message timestamp to determine whether the message is valid or invalid (age expired).
In an instance in which messages received by the SINC are of a predetermined type, such as high integrity messages, the method of an example embodiment may also include comparing, at the SINC, the same messages received from the one or more user partitions being concurrently executed by the two or more processors and dropping any message that does not identically match or when one or more messages are not received within a pre-configured timeout period, thereby insuring that messages are only transmitted to the network by the SINC if the messages are identical.
Having described certain examples of the present disclosure in general terms above, reference will now be made to the accompanying drawings, which are not necessarily drawn to scale and wherein:
Some examples of the present disclosure will now be described more fully hereinafter with reference to the accompanying drawings, in which some, but not all examples of the present disclosure are shown. Indeed, these examples may be embodied in many different forms and should not be construed as limited to the examples set forth herein; rather, these examples are provided so that this disclosure will satisfy applicable legal requirements. Like numbers refer to like elements throughout. As used herein, the terms “message”, “data,” “content,” “information,” and similar terms may be used interchangeably to refer to data capable of being transmitted, received, and/or stored in accordance with examples of the present disclosure. Thus, use of any such terms should not be taken to limit the spirit and scope of examples of the present disclosure.
A system and method are provided for synchronizing communications between a SINC and two or more processors and a plurality of user partitions that are in communication with the SINC. By synchronizing communications between the SINC and the two or more processors, identical software applications may be concurrently executed by the two or more processors to enhance availability, redundancy, and data integrity thereby increasing the reliability and safety of the software application and the overall system. Additionally, the concurrent execution of identical software applications by the two or more processors may be performed in accordance with an example embodiment in an efficient manner with less data latency. Indeed, messages may be transmitted directly between the SINC and user partitions instantiated on the two or more processors to facilitate the timeliness and efficiency with which the identical software applications are executed.
Referring to
As shown in
As noted above, each processor 14 defines a plurality of user partitions 16. Each user partition 16 includes memory space of the respective processor 12 with the memory space being associated with a software application to be executed by the respective processor. The memory space of a respective user partition 16 may be associated with the software application in various manners including memory space in which the software application is stored, memory space that is utilized during execution of the software application and/or memory space that serves to store results generated by execution of the software application.
As shown in
As introduced by
In this regard and also shown in block 40 of
The message queues 32 accessed by the SINC 12 that are associated with user partition 16 instances may vary in depth from one processor 14 to another. As shown in
Messages that are pushed by the SINC 12 and stored by a queue 32 may be read by the processor 14 that supports the user partition 16 with which the queue is associated such that the message may be processed by the software application to which the message is directed. See blocks 44 and 48 of
The software application associated with a respective user partition 16 may also write outbound messages to the SINC 12, in particular, to the memory space 34, such as to a buffer within the SINC 12 associated with the respective user partition. See block 50 of
Although the messages may be written from a user partition 16 to a predefined memory space 34 of the SINC 12, the system 10 and method of another alternative embodiment may include a SINC 12 having memory queues into which the messages from respective computing lanes are pushed. The messages may then be read by the SINC 12 from the queues for processing and/or transmission via the network 18. In this embodiment, a write pointer may be maintained by the processors 14 to identify the location within the queue into which a message is to be written and a read pointer may be maintained by the SINC 12 to identify the location from which the SINC 12 reads a message.
In an example embodiment, a system 10 for synchronizing communications between a SINC 12 and two or more processors 14 in communication with the SINC 12 may be configured to synchronously and directly push a message from the SINC 12 to one or more user partitions 16 associated with the software applications that are concurrently executed by the two or more processors. By pushing the same message from the SINC 12 to user partition(s) 16 associated with a software application that is being concurrently executed by two or more processors 14, the same message may be received and processed by the user partition(s) of the two or more processors. As such, concurrent execution of the same software application based upon the same input messages provided by the SINC 12 is supported, thereby enabling the generation of identical software application output messages.
In relation to the SINC 12 pushing a message to a respective user partition 16, the SINC 12 of an example embodiment is configured to push the message from the SINC 12 to memory queue(s) 32 of the one or more processors 14 that are dedicated to the respective user partition 16. The memory queue(s) 32 are within the memory space 20 associated with the software application being executed by the respective processor 14. The SINC 12 may be configured to push the message in the same manner regardless of the relative integrity of the message. For example, the SINC 12 may be configured for standard integrity messages (routed to a single processor) to be pushed to a user partition 16 of a single processor 14 and for high integrity messages (routed to two or more processors following a bit level comparison check) to be pushed to two or more user partitions 16 associated with software applications being concurrently executed by two or more processors 14 without prior execution of the high integrity messages.
As noted above, upon receipt and storage in the temporary buffer 33, the SINC 12 of an example embodiment performs network protocol processing and internal lane message comparisons prior to pushing the message to the respective user partition 16 of the respective processor 14 and, more particularly, to the message queue 32 associated with the respective user partition 16 of the respective processor 14. To support concurrent and synchronous execution of the same software application by a user partition 16 of each of two or more processors 14, the SINC 12 of an example embodiment is configured to store the same message in two or more temporary buffers 33 and, in turn, to push the same message to the message queues 32 associated with different user partitions, such as user partitions of different processors, in an instance in which the different user partitions consume the same data, such as an instance in which the different user partitions each execute the same software application. See, for example, the message designated MsgA stored in two different message queues 32 associated with two different user partitions 16 in
In some instances, the queue 32 associated with a user partition 16 and accessed by the SINC 12 may become full, such as in an instance in which a message is stored in each index of the queue or may experience an overflow condition in which one or more indexes of the queue are overwritten or new messages are dropped prior to the old messages being read into memory 20 by the user partition 16. In this instance, the SINC 12 is configured to provide an indication to the user partition 16 that the queue 32 is full or that the queue has experienced an overflow condition. The SINC 12 may be configured to identify that the queue 32 is full or that the queue has experienced an overflow condition in various manners, but, in one embodiment, identifies that the queue is full or has experienced an overflow condition based upon a comparison of the read and write pointers. By way of example with respect to a queue 32 in the form of a circular buffer, the SINC 12 may be configured to identify that the queue is full in an instance in which the write buffer has a value that is 1 less than the read buffer. This indication may also be stored, at least temporarily by the SINC 12, as a Queue Full/Tail Drop Indication 36 and, in some embodiments by the metadata 22 of the user partition 16. In the instance in which the indication is that the queue is full, the user partition 16 may flush the queue or more quickly read one or more messages from the queue 32 to reduce the likelihood of another overflow condition occurring. However, in an instance in which an overflow condition has occurred, the user partition 16 is informed such that the user partition can either take remedial action and request retransmission of the messages that were dropped or at least proceed with knowledge that the one or more messages were lost.
As shown in
In an example embodiment and in an instance in which the messages received by the SINC 12 are of a predetermined type, such as a high integrity message, the SINC 12 may be configured to compare the same messages received from the one or more user partitions 16 that are being executed by the two or more processors 14. These operations may occur even in an instance where the application being concurrently executed by two or more processors is not running synchronously in each processor as a result of buffering the incoming messages. For example the SINC 12 may include a comparator 37 as shown in the embodiment of
A SINC 12 of an example embodiment is also configured to provide a timestamp within each message metadata that is pushed to one or more user partitions 16. The timestamp may be based upon the reference time as defined by the wall clock counter value 35 that is maintained by the SINC 12. Additionally, the reference time as also defined by the wall clock counter value 35 may be latched by the processor 14 on a repeated basis, such as once per start of periodic epoch. The reference time may also be stored in the metadata of one or more user partitions. This information enables the user partition 16 of processor 14 to process a message, such as to determine message staleness. See block 46 of
As indicated in
As described above, a system 10 and method are provided in accordance with an example embodiment in order to synchronize user partition communication, such as by synchronizing communication between a SINC 12 and two or more processors 14 that are in communication with the SINC 12. By synchronizing communications in accordance with an example embodiment, the system 10 and method may reduce data latency and may reduce scheduling constraints otherwise potentially created by the redundant execution of a software application by the two or more processors 14. In addition, the overall processing efficiency may be improved by the system 10 and method of an example embodiment by reducing the instances in which data is written to and read from various memory locations, while still providing for the concurrent redundant execution of the same software application by two or more processors 14 in order to improve the reliability of the software application and high integrity data transmission.
The flowchart blocks support combinations of means for performing the specified functions and combinations of operations for performing the specified functions. It will be understood that one or more blocks of the flowchart, and combinations of blocks in the flowchart, can be implemented by special purpose hardware-based computer systems which perform the specified functions, or combinations of special purpose hardware and software instructions.
In some examples, some of the operations above may be modified or further amplified. Furthermore, in some examples, additional optional operations may be included. Modifications, amplifications, or additions to the operations above may be performed in any order and in any combination.
Many modifications and other examples of the present disclosure set forth herein will come to mind to one skilled in the art to which the present disclosure pertains having the benefit of the teachings presented in the foregoing descriptions and the associated drawings. Therefore, it is to be understood that the present disclosure is not to be limited to the specific examples disclosed and that modifications and other examples are intended to be included within the scope of the appended claims. Moreover, although the foregoing descriptions and the associated drawings describe examples in the context of certain example combinations of elements and/or functions, it should be appreciated that different combinations of elements and/or functions may be provided by alternative examples without departing from the scope of the appended claims. In this regard, for example, different combinations of elements and/or functions than those explicitly described above are also contemplated as may be set forth in some of the appended claims. Although specific terms are employed herein, they are used in a generic and descriptive sense only and not for purpose of limitation.
