Developing Safety-Critical Java Applications with oSCJ

Developing Safety Critical Java applications with oSCJ/L0

Ales Plsek, Lei Zhao, Veysel H. Sahin, Daniel Tang, Tomas Kalibera† , Jan Vitek
Purdue University †Charles University

ABSTRACT and certification process. Safety critical software is writ-
We present oSCJ, an implementation of the draft of Safety ten to be verifiable, often in a restricted subset of a general
Critical Java (SCJ) specification. SCJ is designed to make purpose programming language such as C or Ada. How-
Java amenable to writing mission- and safety-critical soft- ever, with growing size of code bases – million line systems
ware. It does this by defining a subset of the Real-time are not unusual – increasing software productivity is becom-
Specification for Java that trades expressiveness for verifia- ing a driving force behind the move to adopt technologies
bility. This paper gives a high-level description of our im- such as Java. The Java programming language and platform
plementation of the first compliance level of the SCJ speci- bring a number of features that facilitate the cost-effective
fication, a library called oSCJ, and reports on performance development of large software systems.
evaluation on the Ovm real-time Java virtual machine. We To support safety-critical development in Java, the JSR-
compare SCJ to C on both a real-time operating system 302 expert group was tasked with defining a new standard
on the LEON3 platform and Linux on a x86. Our results – the Safety Critical Java (SCJ) specification [5]. The SCJ
suggest that a high-degree of predictability and competitive specification is based on a subset of Real-Time Specification
performance can indeed be achieved. for Java (RTSJ) [2] and is designed to enable the creation of
applications, infrastructures, and libraries that are amenable
to certification under safety critical standards (such as DO-
Categories and Subject Descriptors 178B, Level A). The SCJ presents embedded developers
D.3.4 [Programming Languages]: Processors—run-time with a simplified programming model centered around in-
environments; D.3.3 [Programming Languages]: Lan- dependent tasks called missions which have access to a re-
guage Constructs and Features—classes and objects; D.4.7 stricted version of scoped memory. Other features of the
[Operating Systems]: Organization and Design—real-time Java platform, such as threading, reflection, and class load-
systems and embedded systems. ing, are restricted to reduce the code base and simplify cer-
tification. As mission- and safety-critical applications can
have very different requirements, the SCJ specification offers
General Terms three compliance levels with increasingly richer program-
Languages, Experimentation. ming models allowing developers to tailor the platform to
the needs of their application.
Keywords This paper introduces oSCJ, an open-source implementa-
tion of the first compliance level of the draft SCJ specifica-
Safety Critical Systems, Java virtual machine, Memory man- tion. We implemented SCJ as an independent Java library
agement. with a well defined interface to the underlying virtual ma-
chine. To run it efficiently we modified the Ovm [1] real-
1. INTRODUCTION time JVM by removing features that were not required and
Software reliability is a central concern for mission- and adapting data structures and algorithms to the simpler SCJ
safety-critical systems such as avionics control systems, med- model. A set of tools comes with oSCJ. In particular, a
ical instrumentation or space applications. A failure or mal- static checker for proving certain properties of SCJ applica-
function may result in damage to equipment, serious injury tions [10] and a Technology Compatibility Kit [11]. For eval-
or even death. Thus, safety-critical applications are required uation, we refactored the CDx benchmark [6] and ran it on
to follow an exceedingly rigorous development, validation, the LEON3 architecture, a platform that is used by NASA
and ESA, and the RTEMS real-time operating system. The
performance evaluations shows that SCJ has performance
competitive with C. The library, VM, and the benchmark
Permission to make digital or hard copies of all or part of this work for are freely available under an open-source license1 .
personal or classroom use is granted without fee provided that copies are The SCJ specification is still under development, the API
not made or distributed for profit or commercial advantage and that copies and examples presented in this paper are subject to change.
bear this notice and the full citation on the first page. To copy otherwise, to
republish, to post on servers or to redistribute to lists, requires prior specific
permission and/or a fee.
JTRES’10 August 19-21, 2010 Prague, Czech Republic 1
Copyright 2010 ACM 978-1-4503-0122-0/10/08 ...$10.00. The oSCJ is available from www.ovmj.net/oscj.

2. THE SAFETY CRITICAL JAVA SPECI- size. A mission manager is then created, in mission mem-
FICATION ory, to control the mission’s schedulable objects. The three
phases of the mission are all executed in mission memory.
The complexity of safety critical software varies between ap- All schedulable objects are created in the initialization phase
plication; the SCJ specification lets developers tailor the ca- of the mission; they are then started upon entering execu-
pabilities of the platform to the needs of application through tion phase. A mission runs forever unless a termination
compliance levels. The first level, Level 0, provides a simple,
request is sent explicitly by one of its schedulable objects. If
frame-based cyclic executive model which is single threaded
a termination request is sent, the mission enters the cleanup
with a single mission. Level 1 extends this model with multi- phase. The cleanup phase includes storing or reporting the
threading via aperiodic event handlers, multiple missions, outcomes of a mission, as well as releasing all acquired re-
and a fixed-priority preemptive scheduler. Level 2 lifts resources. Once the mission is completed, all mission-specific
strictions on threads and supports nested missions. In the
objects are deallocated as the mission memory is reclaimed.
remainder we will focus on Level 0.

2.1 Missions ImmortalMemory
setup missions teardown
SCJ programs are organized as missions, which are inde-
pendent computational units with respect to lifetime and MissionSequencer - getNextMission()

resources needed. Each mission is composed of a bounded
number of schedulable objects. Missions are launched accord-
ing to a pre-defined order. Figure 1 shows the three phases M1 ... Mi ... Mn

of a mission: initialization, execution, and cleanup. After a current

mission terminates, the next mission is released if there is - creates MissionMemory
one. MissionMemory - runs in

initialization execution cleanup
current mission
- startAll()
MissionManager
- waitAll()
setup initialization execution cleanup teardown

SO1 ... ... SOn
next mission

Figure 1: Mission life cycle.
- runs in

PrivateMemory PrivateMemory
The concept of schedulable object is inherited from RTSJ.
A schedulable object contains both computation logic and
some scheduling constraints, such as release time, deadline, Figure 2: SCJ mission classes.
priority, and so on. In the SCJ specification, schedulable ob-
jects have a dedicated thread and are restricted to periodic
event handlers (PEH), aperiodic event handlers (AEH), and 2.2 Scoped Memory
managed threads (MT) to simplify feasibility analysis. The scope-based memory model introduced by RTSJ is re-
At Level 0, the cyclic executive model defines a mission as tained in the SCJ specification. The main differences with
a set of computations, each of which is executed periodically the RTSJ are that the heap has been completely abandoned
in a precise, clock-driven timeline, and processed repetitively and that scoped memory has been further restricted to make
throughout the mission. The only schedulable objects per- certification easier. The SCJ specification has three types
mitted at Level 0 are Periodic Event Handlers. All PEHs of memory areas: immortal memory, mission memory, and
execute under control of a single underlying thread, so the private memory. Immortal memory spans the lifetime of the
implementation can safely ignore synchronization in the ap- virtual machine; therefore, only objects that should survive
plication. In this scenario, an operation which blocks will the entire program execution should be allocated there. The
block the entire application. A Level 0 application runs on lifetime of the latter two memory areas is bounded. Each
a single CPU. mission has a mission memory which is shared by the mis-
Different parts of the SCJ APIs are available during the sion’s schedulable objects and used to allocate data that
various phases of a mission. For instance, during the ini- must persist throughout the mission. Each schedulable has
tialization phase, a private memory area is made available its own private memory area for the data that is needed
to the application for allocating temporary objects which for only a single activation of the schedulable. The enter-
will be reclaimed before any of the schedulable objects of PrivateMemory(s, logic) method creates a nested private
the mission get to run. Other features of the platform are
similarly restricted. PEH PEH

Figure 2 illustrates some of the core classes of the SCJ
specification. At the beginning of program execution, the P3

primordial thread – the first thread created by the system P2 P2
starts in immortal memory and creates a mission sequencer P1 P1
after executing the setup procedure. The mission sequencer Mission
holds references to all of the missions and repeatedly selects
Immortal
the next mission to launch. The mission sequencer and all
mission instances live in immortal memory. Upon launching
a mission, the mission memory is allocated with the desired Figure 3: Memory structure of a SCJ program.

memory of size s, enters it, and execute the logic within it. altimeThread class. Furthermore, since there is only one
A scope stack is a logical data structure that represent the thread, we have turned off synchronization.
scoped memory areas that a given schedulable object has
entered implicitly (each schedulable object implicitly enters 3.1 Virtual Machine Interface
mission memory and its private memory), or by calling en- Our SCJ library is designed to be independent from the un-
terPrivateMemory() or executeInArea(). Figure 3 illus- derlying VM. Therefore, we have designed an interface that
trates this with the stacks of schedulable objects — two serves as a unique connection point between the library and
periodic event handlers. The stacks grow logically from im- the VM. Figure 5 lists the methods in the VM interface.
mortal memory up to private memories. Unlike the RTSJ The main tasks delegated to the VM are responsible for
where cactus stacks are allowed, the SCJ specification re- creation and deletion of memory areas, switching of alloca-
stricts navigation to linear sequences of scopes. This is tion context as well as other memory-related services. The
achieved by removing the RTSJ’s enter() method and re- delayCurrentThreadAbsolute() method is used by the Cy-
placing it with the more restricted enterPrivateMemory() clicExecutive class to wait for the start time of the next
which which only creates a subscope if there isn’t one active execution frame. The getCurrentTime() and getClockRes-
already. olution() methods are dedicated to time related services.
Another simplification in the SCJ is that private memo-
ries are always accessed by a single schedulable object, and interface VM_Interface {
thus do not require synchronization on entry or exit. At Opaque makeExplicitArea(long size);
Level 1 and 2, mission memory and immortal memory can void destroyArea(Opaque area);
be accessed concurrently by multiple threads. Opaque makeArea(MemoryArea ma, long size);
For memory safety, every write to a field holding an object Opaque setCurrentArea(Opaque scope);
reference must be checked to prevent dangling references. Opaque getCurrentArea();
An optional set of annotations can be used to prove that MemoryArea getAreaMirror(Opaque area);
at compile-time that all stores are safe. When these anno- Opaque getImmortalArea();
tations are used, an implementation is permitted to omit Opaque areaOf(Object ref);
scope checks. long getScopeSize(Opaque scope);
long memoryConsumed(Opaque scope);
3. IMPLEMENTING SCJ long memoryRemaining(Opaque scope);
Development of a SCJ infrastructure is a non-trivial task. void resetArea(Opaque area);
Figure 4 illustrates such an infrastructure with SCJ applica- long sizeOf(Class clazz);
tions running on top of a SCJ library which, itself, commu- long sizeOfReferenceArray(int length);
nicates with a dedicated virtual machine. Most of the oSCJ long sizeOfPrimitiveArray(int length,
functionality has been implemented in the library with a Class clazz);
clear interface to the underlying virtual machine to ease the void storeInOpaqueArray(Opaque[] arr,
task of porting it across VMs. For the virtual machine, we int index, Opaque val);
have modified Ovm [1] to provide only the features required int delayCurrentThreadAbsolute(long nanos);
to be compliant with SCJ. The runtime support for our VM long getCurrentTime();
is lightweight. It contains two components: the memory long getClockResolution();
manager and an OS abstraction layer for thread manage- }
ment. The runtime currently runs on POSIX-like platforms
such as Linux, NetBSD, and on top of the RTEMS classic Figure 5: oSCJ VM interface.
API.
We have optimized the in-memory representation of objects
such that each Java object has a two-word header. The first
oSCJ Level 2 L2 - No Heap RealtimeThreads
word is a pointer to type information for the object and the
Level 1 L1 - Aperiodic Event Handlers second is unused (we intend to store a scope descriptor in
L0 - Periodic Event Handlers this field to speed up scope checks). Lock and GC fields are
Level 0 not needed, and, as object never move in SCJ, hash codes
oSCJ VM - running on top of
can be computed based on the objects’ addresses.
oSCJ VM OS or directly on bare hardware
3.2 Memory Model
RTEMS RTEMS OS In our implementation, physical memory is organized in
three levels as illustrated in Figure 6. The top level con-
HARDWARE
Xilinx FPGA board with sist of immortal memory and all active missions. Each mis-
LEON 3 architecture
sion has a mission memory and what we call a backing store
level. This level is made up of a stack of private memory
Figure 4: oSCJ infrastructure. areas. Finally, the scope level, describes the organization
of the memory within a scope where objects are allocated
Since we focus on Level 0, we reduced the number of VM contiguously.
threads to a single thread. This thread performs both the At the top level, memory management is simple. Im-
boot and initialization sequences of the VM and then starts mortal memory is pre-allocated and is never de-allocated,
executing the SCJ application. This required changing the and missions are added under the control of the mission se-
type of Ovm’s primordial thread to be instance of the Re- quencer. At Level 0, there is at most a single mission active

top level storeCheckSlow. In the slow path, we first check if y is in
the immortal memory, which would cause the check to suc-
BS level (PEH ) BS level (PEH)
ceed. Then we check if x is in the immortal memory, since
y is not in immortal, this would cause the check to fail. We
Im M1 P1 P2 P3 P1 P2 special case the checking for the immortal memory, since its
boundaries are not included in the boundaries of the scope
memory backing store due to engineering reasons. Finally,
we are safe to retrieve scope information of x and y from
the array that keeps track of the living scope memories. If
scope level the variables are in the same scope, the assignment is legal,
otherwise the scope check fails since x resides in a scope that
Figure 6: Physical memory is organized as three
lives longer than the scope of y.
levels of stacks: the top level, backing-store level,
and scope level.
void storeChecks(Oop x, Oop y) {
int rx = x.asInt() >>> blockShift;
at any given time. The size of a mission is given by a stor- int ry = y.asInt() >>> blockShift;
age configuration parameter that is attached to the mission. if (rx >= ry) OK;
At the backing store level, schedulable objects are created at else storeChecksSlow(rx, ry);
mission startup and space is reserved for each of them. Their }
private memories are managed using a stack discipline and
are laid out contiguously in the space assigned their schedu- void storeChecksSlow(int rx, int ry) {
lable. Private memory areas are allocated when they are if (ry < immortalEndIndex) OK;
entered and reclaimed when they are exited. At scope level, else if (rx < immortalEndIndex) FAIL;
objects are allocated in bump pointer fashion. Deallocation else {
is implicit when the private memory is reclaimed. Area x_scope = scopeOwner[rx - scopeBase];
This implementation has low-overhead. Allocation is con-
Area y_scope = scopeOwner[ry - scopeBase];
stant time, as it boils down to bumping a pointer. Deal-
if (x_scope == y_scope) OK;
location is linear in the size of the scope (due to the time
else FAIL;
spent zeroing memory on exit). The bookkeeping overhead
for scope stacks is just two pointers (base and top). More- }
over, there is no fragmentation due to scopes. SCJ requires }
the programmer to specify maximum memory requirements Figure 7: Scope check implementation.
in advance, and our memory layout can fulfill any sequence
of allocation requests that fits in the scopes. However, the
raw size of memory allocated for each scope memory area 4. EVALUATION
is slightly bigger than the requested memory size as it is We now set out to demonstrate that oSCJ can be com-
aligned by a memory page size, which depends on the archi- petitive with hand-written C code in performance and pre-
tecture of the system. Lastly, none of the allocation oper- dictability. To this end, we set up a representative workload
ations requires synchronization in Level 0. (For other com- on a realistic platform. For our workload, we selected the
pliance levels, private memory are thread local and thus do CDx [6] benchmark that we refactored to use the SCJ API.
not require synchronization). The refactored version is called miniCDj. We used a set of
The scope-stack that keeps track of entered memory areas SCJ annotations to prove that the benchmark is allocation
is implemented as an array. A pointer into the array is safe [10], this allowed us to disable scope checks in the VM
referencing the currently active scope. As the list of entered during the benchmarking.
memory areas grows, the array size is being dynamically We compare miniCDj to CDc, a C implementation of the
adjusted. same [7] that matches closely the Java version, with one
3.3 Scope Checks source file per Java class. Our experiments were run on
a GR-XC3S-1500 LEON development board. The board’s
The VM implements scope checks to verify each memory ac- Xilinx Spartan3-1500 field programmable gate array was
cess. Consider the assignment x.f=y. It is safe if the scope flashed with a LEON3 configuration, without a floating-
in which y is allocated is longer lived than the scope of x. point unit, running at 40MHz, with an 8MB flash PROM
Since our VM memory areas are continuously starting with and 64MB of PC133 SDRAM split into two 32MB banks.
immortal memory, continuing with mission memory, and the The version of RTEMS is 4.9.3. Our second platform is an
backing stores of schedulable objects, nested private mem- Intel Pentium 4 3.80GHz single core machine with 3GB of
ory areas are allocated with longer lived areas first. Memory RAM, running Ubuntu Linux 9.04 with the 2.6.28-15-generic
areas allocated on lower addresses are longer lived than ar- 32-bit SMP kernel.
eas allocated on higher addresses. The code of the scope
check is given in Figure 7. On the fast path, we check if 4.1 Benchmark overview
the x and y are allocated in the same block of memory or if The CDx benchmark suite [6] is an open-source family of
the block of memory where x resides is in a higher address benchmarks that can be used to measure performance of var-
space. In case this holds, the check succeeds since the re- ious hard and soft real-time platforms2 . A CDx benchmark
gion where x is allocated will be reclaimed earlier or at the
2
same time as y. In case this does not hold, we enter the See www.ovmj.net/cdx tags “miniCDj v1.1”, “CDc v1.1”.

500

500
Number of Samples
(logarithmic scale)
50

50
10

10
5

5
1

1
20 40 60 80 100 120 20 40 60 80 100 120
CDc: Duration of Iteration Execution on LEON3 in miniCDj: Duration of Iteration Execution on LEON3 in
Milliseconds Milliseconds
Figure 8: Histograms of execution times on LEON3. The observed worst-case for C is 34% faster Java.
90
Iteration Execution Time in Milliseconds

miniCDj miniCDj worst case
80
Milliseconds

50 60 70

CDc CDc worst case
40

400 450 500 550 600
Figure 9: A detailed runtime comparisonNumber 200 iterations on LEON3.
Iteration of for
Iteration
500

500
Number of Samples
(logarithmic scale)

50
50

10
10

5
5

1
1

0.2 0.3 0.4 0.5 0.6 0.2 0.3 0.4 0.5 0.6

CDc: Duration of Iteration Execution on x86 in miniCDj: Duration of Iteration Execution on x86 in
Milliseconds Milliseconds

Figure 10: Histograms of execution times on X86. The observed worst case for C is 4% faster than Java.
0.50
Iteration Execution Time in Milliseconds

CDc worst case miniCDj worst case
CDc
0.45
0.40
Milliseconds

0.35
0.30
0.25

miniCDj
0.20

2000 2050 2100 2150 2200
Figure 11: A detailed runtime comparison ofNumber
Iteration CDc and miniCDj for 200 iterations on x86.
Iteration

@SCJAllowed(value=LEVEL_0, members=true) @SCJAllowed(value=LEVEL_0, members=true)
@Scope("immortal") @Scope("cdx.Level0Safelet")
public class Level0Safelet extends CyclicExecutive { @RunsIn("cdx.CollisionDetectorHandler")
public Level0Safelet() { super(null); } public class CollisionDetectorHandler
extends PeriodicEventHandler {
public void setUp() {
new ImmortalEntry().initialize(); private final TransientScopeEntry cd = new
new Simulator().generate(); TransientScopeEntry(new StateTable(), VOXEL_SIZE);
} public boolean stop;

@RunsIn("cdx.Level0Safelet") public CollisionDetectorHandler() {
protected void initialize() { super(null, null, null, TRANSIENT_SIZE);
new CollisionDetectorHandler(); }
}
public void handleEvent() {
public void tearDown() { dumpResults(); } if (stop)
Mission.getCurrentMission().requestSequenceTermination();
public CyclicSchedule getSchedule( else
PeriodicEventHandler[] handlers) { runDetectorInScope(cd);
CyclicSchedule.Frame[] frames = new CyclicSchedule.Frame[1]; }
frames[0] = new CyclicSchedule.Frame(
new RelativeTime(PERIOD, 0), handlers); public void runDetectorInScope(TransientScopeEntry cd) {
return new CyclicSchedule(frames); RawFrame f = ImmortalEntry.frameBuffer.getFrame();
} cd.setFrame(f);
cd.processFrame();
public long missionMemorySize() { return DETECTOR_SIZE; } ImmortalEntry.frames++;
} stop = (ImmortalEntry.frames == MAX_FRAMES);
}
}

Figure 12: miniCDj code example showing Level0Safelet and CollisionDetectorHandler classes.

consists of a periodic task that takes air traffic radar frames 4.3 SCJ vs. C on x86
as input and predicts potential collisions. The benchmark it- In this second experiment, we compared miniCDj to CDc on
self measures the time between releases of the periodic task, x86. We configured the benchmark to run with a more inten-
as well as the time taken to compute potential collisions. For sive workload, using 60 planes with a 60 millisecond period
our evaluation, we used a pre-simulated formula to generate for 10,000 iterations. The increased number of planes brings
the radar frames to achieve a consistent workload across ex- more detected collisions, which consequently poses higher
ecutions. The benchmark is floating-point intensive. demands on data structures, arithmetics, and memory al-
The benchmark is well-suited to the cyclic executive model, location. The histogram in Figure 10 shows the frequency
creating miniCDj was fairly straightforward. Data is recorded of execution times for SCJ and C. The data demonstrates
in immortal memory and is used for report generation after that on average miniCDj is by 12% faster than CDc. Look-
the mission terminates. The main computation is done in a ing at the worst-case performance times, miniCDj has a 4%
periodic event handler, as the primary computation in CDx overhead over CDc. We can observe again that the results
is periodic. However, since the algorithm relies on positions are highly correlated. In fact, for the most of the time,
in the current and previous frame for each iteration, it is miniCDj performance times stay below those of CDc. It is
not enough to simply have a periodic event handler, whose unclear why Java would be faster than C. We believe that
memory is wiped after each iteration. A state table keeps Ovm facilitates inlining by generating a single C file and
track of the previous positions of each airplane. Since the removing most of the polymorphism around methods calls,
state table is only relevant during the lifetime of the mission, but this should have the same effect on both platform. The
placing it inside the mission memory is the ideal solution. x86 workload performs more allocation and CDc uses mal-
miniCDj is approximately 3300 lines of code. loc/free which is more expensive than the bump-pointer
allocation used for scoped memory in SCJ. Lastly, the SCJ
performance on LEON3 may have been skewed by the fact
4.2 SCJ vs. C on LEON3 that the Java code performs more floating point operations
In our first experiment, we compared CDc with miniCDj on (the C code was optimized by hand) and the LEON3 does
the LEON3 platform. The periodic task runs every 120 mil- not have a hardware fp unit.
liseconds with 6 airplanes and 10,000 iterations. Figure 8
gives the runtime performance of CDc and miniCDj. No
deadlines were missed in any executions. On average, the 5. EXAMPLE
execution time of one iteration in CDc is around 53 millisec- To illustrate the use of SCJ API we provide a code snip-
onds, while for miniCDj it is around 69 milliseconds. The pet of the miniCDj benchmark. Figure 12 shows two key
median execution times for CDc are only 28% smaller than classes of the benchmark : Level0Safelet and Collision-
the median for miniCDj. For real-time developers, the key DetectorHandler. The Level0Safelet class extends the
metric of performance is the worst case. C is 34% faster CyclicExecutive class and represents an instance of a Level
than SCJ in the worst-case. Figure 11 shows a more de- 0 mission. It defines the specific actions that will be exe-
tailed view of a subset of the iterations. There is a strong cuted during the initialization (the setUp() method) and the
correlation of execution times between CDc and miniCDj. cleanup of the mission (the cleanUp() method). First, the
In this benchmark, Java is as predictable as C. oSCJ infrastructure asks for required mission space by call-

ing missionMemorySize() method and creates a correspond- we have modified the Ovm real-time Java virtual machine
ing mission area. Furthermore, the initialize() method is to implement the oSCJ interface. We have successfully de-
executed to instantiate all the periodic event handlers that ployed oSCJ on LEON3 and x86 and shown that it is capable
will be periodically executed during the mission. Therefore, of running a representative, safety critical workload on an
the infrastructure instantiates the CollisionDetectorHan- embedded operating system and hardware platform, deliv-
dler class and creates a corresponding private memory - the ering predictability and throughput that is comparable to C
size of the private memory is given in the constructor of the code.
handler. Finally, the getSchedule() represents a Level 0
scheduler and defines the frequency of the handler execu- Acknowledgments. This work was partially supported by
tion. NSF grants CNS-0938256, CCF-0938255, CCF-0916310 and
The CollisionDetectorHandler class represents a Peri- CCF-0916350. The authors thank Petr Maj, Filip Pizlo, and
odicEventHandler dedicated to the mission and defines the Ghaith Haddad and Gaisler Inc.
code that will be executed each time the handler is sched-
uled to run. The handler is executed by the infrastructure 8. REFERENCES
code calling the handleEvent() method. Inside the han-
[1] Austin Armbuster, Jason Baker, Antonio Cunei,
dleEvent() method we delegate the functionality to the
David Holmes, Chapman Flack, Filip Pizlo, Edward
runDetectorInScope() method that first receives a data
Pla, Marek Prochazka, and Jan Vitek. A Real-time
frame holding the current positions of the aircraft3 and pro-
Java virtual machine with applications in avionics.
cess these data by calling cd.processFrame().
ACM Transactions in Embedded Computing Systems
As the SCJ specification defines, a termination of the mis-
(TECS), 7(1), 2007.
sion is explicitly under the control of the handler. In this
case, once the number of processed frames reaches the Con- [2] Greg Bollella, James Gosling, Benjamin Brosgol, Peter
stants.MAX_FRAMES limit, the stop variable is set to true. Dibble, Steve Furr, and Mark Turnbull. The
This will cause the handler to call Mission.getCurrentMi- Real-Time Specification for Java. Addison-Wesley,
ssion().requestSequenceTermination() during the next June 2000.
execution of the handleEvent() and the mission will be ter- [3] Alan Burns. The Ravenscar Profile. ACM SIGADA
minated. Ada Letters, 19(4), 1999.
Finally, note that both the classes contain the SCJ anno- [4] HIJA. European High Integrity Java Project.
tations specifying their level and runtime allocation context, www.hija.info, 2006.
these annotations are used during the static analysis to prove [5] JSR 302. Safety critical Java technology, 2007.
allocation safety of the application. [6] Tomas Kalibera, Jeff Hagelberg, Filip Pizlo, Ales
Plsek, and Jan Vitek Ben Titzer and. CDx: A Family
6. RELATED WORK of Real-time Java Benchmarks. In International
Workshop on Java Technologies for Real-time and
The only other implementation of the SCJ specification is
Embedded Systems (JTRES), 2009.
the reference implementation developed by the JSR-302 ex-
[7] Filip Pizlo, Lukasz Ziarek, Ethan Blanton, Petr Maj,
pert group. It is built on top of RTSJ and meant for pro-
and Jan Vitek. High-level programming of embedded
totyping purposes. SCJ itself has roots in previous safety-
hard real-time devices. In EuroSys Conference, 2010.
critical profiles for Java and Ada. Ravenscar Ada [3] in-
spired a restriction of the RTSJ proposed in [8]. That works [8] Peter Puschner and Andy Wellings. A profile for high
was similar to SCJ Level 1. Another profile was proposed integrity real-time java programs. In Proceedings of the
within the HIJA project [4]. Yet, another profile [9] argues 4th IEEE International Symposium on Object-oriented
against reusing RTSJ-based classes to avoid inheriting un- Real-time distributed Computing (ISORC), 2001.
safe RTSJ features. Similar to SCJ, the authors propose a [9] Martin Schoeberl, Hans Sondergaard, Bent Thomsen,
mission mode that permits recycling CPU time budgets for and Anders P. Ravn. A Profile for Safety Critical
different phases of the application. Java. In Int. Sym. on Object and Component-Oriented
Fiji VM [7] is a new Java virtual machine dedicated to em- Real-Time Distributed Computing (ISORC), 2007.
bedded, hard real-time devices that, similarly to the oSCJ [10] Daniel Tang, Ales Plsek, and Jan Vitek. Static
VM, compiles Java code to C and supports a wide set of Checking of Safety-Critical Java Annotations. In
platforms, including x86 and the LEON3 architecture run- International Workshop on Java Technologies for
ning the RTEMS operating system. The Aonix PERC Pico Real-time and Embedded Systems (JTRES), 2010.
VM introduces stack-allocated scopes, an annotation sys- [11] Lei Zhao, Daniel Tang, and Jan Vitek. A Technology
tem, and an integrated static analysis system to verify scope Compatibility Kit for Safety Critical Java. In
safety and analyze memory requirements. International Workshop on Java Technologies for
Real-time and Embedded Systems (JTRES), 2009.
7. CONCLUSION
This paper presented an implementation of the Safety Crit-
ical Java specification. The oSCJ library is isolated from
the underlying virtual machine by a clearly defined inter-
face and can thus be easily ported to different virtual ma-
chines. In order to perform some performance experiments
3
Do not mistake with the execution frames from the
getSchedule() method.

Developing Safety-Critical Java Applications with oSCJ

More Related Content

What's hot (18)

Viewers also liked (17)

Similar to Developing Safety-Critical Java Applications with oSCJ (20)

Recently uploaded (20)

Developing Safety-Critical Java Applications with oSCJ