01
Overview
An Embedded Real-Time Operating System (RTOS) refers to a type of lightweight operating system that operates in resource-constrained environments (space and time) and can respond to external events within a defined time frame while executing functions.
Since the release of the first embedded real-time kernel VRTX32 by Ready System in 1981, the RTOS industry has undergone 40 years of development. NASA has been using real-time operating systems in spacecraft since the late 1980s. For example, both the Mars Pathfinder in 1997 and the Perseverance rover in 2021 utilized the VxWorks real-time operating system. In 1999, the pSOS real-time operating system was successfully applied in China’s Practice-5 satellite.
As a crucial component of aerospace models, software products directly impact the success or failure of aerospace missions. It is essential to use RTOS as a foundational platform to ensure real-time task scheduling, resource optimization, effective device management, and rapid fault detection and handling, thereby reducing the complexity of upper-layer application software, allowing it to focus on core functions, improving software product quality, shortening development cycles, and enhancing system determinism, reliability, and agility.
02
Analysis of RTOS Characteristics
Compared to general-purpose operating systems (such as Windows, Android, iOS), RTOS exhibits significant differences in three dimensions: “Precision,” “Stability,” and “Efficiency.”
1. Precision:
“Precision” refers to the ability of an RTOS to provide services within a defined response time in any scenario. The defined response time means that the RTOS must respond correctly to internal or external events before a given deadline; exceeding this deadline can lead to severe consequences. The term “any scenario” indicates that the timely service with predictable timing must maintain consistent service quality regardless of the current system operating state, load conditions, or resource allocation.
Timeliness is the most fundamental technical characteristic of RTOS, essential for meeting the demands of time-sensitive applications such as real-time calculations and precise synchronization, which are particularly critical for ensuring aerospace missions. Aerospace model tasks must satisfy both logical correctness and time constraints, meaning that processing must be completed within a certain time frame, ensuring not only the logical correctness of the results but also the reliability of the timing.
For example, the solar orbiter developed jointly by ESA and NASA in 2020 can reach temperatures of 450°C when facing the sun. To withstand high temperatures, the solar orbiter was designed with an insulating shield, but it is crucial to strictly control the spacecraft’s position and tilt to keep the spacecraft and instruments shaded by the insulating shield. The time limit from detecting a trajectory deviation to completing a posture adjustment is 50 seconds; otherwise, it risks being scorched. To accomplish this time-sensitive task, ESA used the RTEMS real-time operating system to ensure that the spacecraft could operate normally under sunlight 13 times stronger than that on Earth.
In contrast to RTOS, general-purpose operating systems exhibit significant unpredictability. For instance, in a performance evaluation of smartphones, the total time taken to launch 17 apps was recorded for the iPhone XS Max (running iOS) and the Samsung S10 Plus (running Android) under two scenarios: system cold start and application preloading. After a cold start, the iPhone took 2 minutes and 54 seconds to open apps, while the Samsung took 2 minutes and 30 seconds; after application preloading, the iPhone took 42 seconds, while the Samsung took 46 seconds. The time difference between the two tests was 3-4 times, illustrating the impact of changing application scenarios on system performance and highlighting the unpredictability of general-purpose operating systems.
Various factors can lead to uncertainty in operating system response times, such as non-preemptive kernels, non-nested interrupt reentrancy, priority inversion caused by resource contention, continuous cache misses, and network transmission jitter. Therefore, precise analysis, careful design, meticulous implementation, and comprehensive testing are required to eliminate various unpredictable randomness in RTOS.
It is worth mentioning that the “Precision” of RTOS emphasizes providing timely services within a limited time frame, while the speed of that limited time must be evaluated using real-time performance metrics. As the application scenarios for aerospace products vary, the real-time requirements of the system differ widely, ranging from microsecond-level strong real-time applications to millisecond-level general real-time applications, and even second-level weak real-time applications.
2. Stability:
Stability is the core technical characteristic of RTOS and is a crucial infrastructure for ensuring the reliable operation of aerospace systems. It has been proven that using a stable and reliable RTOS significantly reduces issues such as concurrency and competition errors, interrupt usage errors, and interface mismatches, thereby dispersing technical risks and improving software quality.
Spacecraft operate in harsh space environments for extended periods, enduring cosmic radiation and extreme temperature variations, which can lead to transient or permanent hardware failures. This poses challenges to software products, especially the stability, robustness, and fault tolerance of RTOS, necessitating the implementation of preventive measures and pre-prepared response strategies based on system operating modes and conditions. For unforeseen external condition changes, the fault tolerance value at the operating system level lies in its ability to detect abnormal conditions early, activate fault protection mechanisms, and take effective measures to minimize losses, thereby maximizing business continuity and ensuring spacecraft safety.
For example, before the Apollo 11 lunar landing, a new operational configuration implemented by the astronauts caused the guidance computer’s memory to run out, resulting in a system overload error that led to multiple computer restarts. Although this error was not detected during ground testing, the onboard operating system effectively ensured that critical system tasks and navigation data were unaffected, allowing the lunar landing mission to proceed as planned.
Similarly, the Mars Pathfinder experienced an unexpected priority inversion error on the 10th day after landing, caused by low-priority tasks preempting mutex resources, leading to high-priority task scheduling timeouts, resulting in hardware resets and data loss. To resolve the error, the priority inheritance protocol provided by the VxWorks real-time operating system was ultimately enabled.
Aerospace equipment is one of the most challenging safety-critical systems, and the “Stability” of RTOS directly affects the lifespan of spacecraft. Therefore, it is necessary to design a robust RTOS using various technical means such as error prevention, error detection, fault tolerance, and error correction, based on deep collaboration between software and hardware, and to implement technical measures that comply with safety-critical system programming standards (such as MISRA C), followed by strict formal verification of core functional modules, thus forming a reliable foundation for aerospace software products.
3. Efficiency:
General-purpose operating systems have abundant available resources and can be widely applied to various application fields without restrictions. In contrast, RTOS is a specialized operating system designed for specific application domains with limited available resources. The term “specific application domain” means that RTOS must adapt to the software and hardware conditions of the application system and the characteristics of task loads; “limited available resources” means that RTOS must meet the constraints of the application system in terms of functionality, performance, cost, size, and power consumption. Therefore, RTOS emphasizes precise adaptation, tailored solutions, and the elimination of redundancy, focusing on optimization for applications.
Specifically, RTOS employs various optimization techniques to “save” resources, primarily reflected in: saving time (e.g., system startup time, interrupt response time, task switching time, etc.), saving storage (e.g., code storage space, system runtime memory, data cache, etc.), saving interaction (e.g., task synchronization, task communication, network communication, etc.), and saving energy consumption. For example, ThreadX is a deeply embedded real-time operating system whose minimum kernel requires only 2 KB of instruction storage space and 1 KB of RAM for operation, can complete startup in 120 cycles, and requires only 0.4 microseconds for task context switching at a 200 MHz clock frequency. In contrast, smartwatches running Android or iOS have a battery life of 2-3 days, while smartwatches running an energy-optimized RTOS can achieve battery life of over two weeks.
To maximize resource potential and achieve quality and efficiency improvements, RTOS has adopted unique technical approaches. Taking RTOS kernel performance optimization technology as an example, ThreadX proposed a preemptive threshold priority scheduling strategy to improve task context switching efficiency; μC/OS designed a priority bitmap algorithm to ensure the determinism of task scheduling time; RTEMS and VxWorks adopted kernel preemption point models and delayed work queue kernel reentrancy models, respectively, to shorten interrupt response times; while INTEGRITY performed deep performance optimization on kernel system call services.
To accurately match hardware characteristics and application requirements, software developers can use functional configuration and trimming tools to customize RTOS as needed, providing minimal hardware resource usage and optimal operating performance. The configuration process can be divided into three steps: first, build a minimal kernel that supports clock interrupts; second, select functional components that meet application requirements (such as schedulers, semaphores, message queues, etc.); and finally, perform fine-grained configuration of internal options within functional components, such as the configuration options for the scheduler component, which include the number of task priority levels and whether to use time-slicing. By configuring these options, the final generated image file contains only the code relevant to the application, trimming unnecessary redundant code, achieving a tailored fit.
For aerospace products like the launch vehicle, which have a wide range of hardware platforms and diverse functional requirements, how to achieve rapid personalized adaptation and functional reconstruction poses three demands on the adaptability of RTOS. First, the system needs a loosely coupled architecture with minimal dependencies and configurability to support the flexible addition, removal, or updating of functional components; second, it needs to optimize system resource usage diligently to maximize resource utilization; and third, it requires a sharp “Occam’s razor” to accurately analyze and eliminate redundant functional code, thereby maintaining a simple, compact, stable, and smooth-running system.
03
Observations and Thoughts
Although RTOS is a specialized operating system for specific application domains, developing an operating system suitable for aerospace safety-critical system applications involves technologies that extend beyond the operating system itself. It requires at least real-time system theories and methods, fault tolerance technology principles and methods, performance optimization technologies, software architecture design, and compilation dependency analysis, among others. Additionally, a series of supporting tools (including runtime libraries, development environments, toolchains, debuggers, simulators, and analyzers) must be developed, along with a mastery of operating system testing theories and methods.
Thus, the research and evolution of RTOS is a platform-based system engineering endeavor, with its maturity reflected in the establishment of a reliable, complete, and independently controllable software technology stack. Currently, leading RTOS products such as VxWorks and INTEGRITY maintain a complete technology platform that includes a series of foundational software such as operating systems, compilers, and debuggers, ensuring a solid foundation for technological development and service capabilities. After being acquired by Microsoft, the global third-largest real-time operating system, ThreadX, has further improved and enriched its technology platform.
04
Review and Outlook
Over the past 40 years of RTOS development, it has roughly gone through four stages:
1) In the 1980s, real-time kernels represented by VRTX, OS-9, and pSOS.
2) In the 1990s, represented by VxWorks, INTEGRITY, and RTEMS, forming a more complete RTOS product form.
3) Entering the 21st century, represented by VxWorks 653 and INTEGRITY-178, adopting virtualization and time-space partitioning two-level scheduling technologies to achieve strong fault tolerance and isolation protection, subsequently upgrading to the multi-core versions of VxWorks 653 and INTEGRITY-178 tuMP, supporting homogeneous and heterogeneous multi-core processors, enhancing real-time performance.
4) In recent years, supporting various AI-enabled smart devices, empowering intelligent edge, and achieving AI-driven edge-side real-time intelligence has become a new hotspot in the RTOS field.
Currently, the global aerospace industry has entered a new stage characterized by the construction of internet constellations, space resource development, manned lunar exploration, and deep space exploration. High reliability and intelligence are the main features of future intelligent spacecraft, and RTOS will strongly support the development, deployment, operation, and service of intelligent aerospace products, undoubtedly helping China’s spacecraft to fly more reliably, agilely, accurately, and spectacularly!
SkyEye, a fully digital real-time simulation software (click to view details about SkyEye), is a hardware behavioral-level simulation platform based on visual modeling, capable of providing a virtual runtime environment for embedded system development, testing, and verification.By simulating the software modeling of unit modules of real hardware systems, SkyEye can provide a virtual runtime environment for various embedded software, allowing embedded software development and testing to no longer rely on real hardware.
SkyEye employs a unified clock scheduling mechanism to achieve time control of the entire target system and ensure its real-time performance, meaning that regardless of the host processor’s performance, SkyEye can guarantee a consistent number of instructions executed per second, allowing RTOS to run well in a virtual environment, facilitating developers in the development, testing, and verification of upper-layer applications.
END
Recommended Reading
Product Introduction
Dige Software is a leading provider of embedded digital prototypes in China, with the mission of “empowering the leap of China’s high-end equipment manufacturing industry” and aims to “become a world-class basic software supplier.”
