Safety-critical Java level 2: motivations, example applications and issues

Safety Critical Java defines three compliance levels: Level 0, Level 1 and Level 2. Applications that can be scheduled using cyclic-executive techniques can be implemented at Level 0. Applications that can use simple analysable fixed-priority scheduling can be implemented at Level 1. However, Level 2 also targets fixed-priority scheduling, so this cannot be used to decide whether to use Level 1 or Level 2. The SCJ specification is clear on what constitutes a Level 2 application in terms of its use of the defined API, but not the occasions on which it should be used. Hence, it is not clear what application requirements dictate a Level 2 solution. This paper broadly classifies the features that exist only at Level 2 into three groups: support for nested mission sequencers, support for managed threads, including the use of the Object.wait, Object.notify, HighResolutionTime. waitForObject and Services.delay methods, and support for global scheduling across multiple processors. In this paper we explore the first two groups to derive possible programming requirements that each group of features support. We identify several areas where the specification needs modifications in order to support fully these derived requirements. These include support for terminating managed threads, the ability to set a deadline on the transition between missions, and augmentation of the mission sequencer concept to support composibility of timing constraints.