Aerospace & Defense

Northrop Grumman X-47B UCAS-D Running on Wind River VxWorks Catapults from Aircraft Carrier

By Chip Downing

Today, the Northrop Grumman X-47B unmanned aircraft achieved a successful catapult launch from the deck of the USS George H.W. Bush carrier, the first of its kind in aviation history.  This marks a very proud day for Wind River knowing that our VxWorks real-time operating system is a key technology for this aircraft, developed as part of the Navy’s Unmanned Combat Air System Carrier Demonstration (UCAS-D) program.

Northrop Grumman's X-47B is a tailless, strike fighter-sized unmanned aircraft currently under development for carrier operations. VxWorks serves as the foundation for the Common Core System, the backbone of UCAS-D computers, networks, and interfacing electronics on the X-47B. Built on VxWorks, Northrop Grumman engineers were able to rapidly create, deploy and maintain the safety-critical control system. 

This is a significant achievement following a series of proof of concept demonstrations to assess the viability of an unmanned system's operation aboard a carrier.  The video of the X-47B doing its first carrier launch can be seen here.

This started with the first flight in July 2012 at Pax River Naval Air Station, after several flights it then performed the first land based catapult launch in November 2012, and performed its first arrested landing in May this year. As well as flight testing, the X-47B performed sea trials and performed a series of tests, included taxiing the X-47B on the flight deck, maneuvering the aircraft up to the ship's catapults, taxiing the aircraft over the ship's arresting cables, conducting fuelling operations and mixing the X-47B with other manned naval operations.  And now this historic catapult launch milestone can be added to the list.

Congratulations to the U.S. Navy and Northrop Grumman!

 

For additional information from Wind River, visit us on Facebook. 

Securing Critical Infrastructure with MILS

By Paul Chen

On February 12, the White House released the Presidential Policy Directive 21 (PPD-21), Critical Infrastructure Security and Resilience. The DHS website describes PPD-21 as “advancing a national policy to strengthen and maintain secure, functioning, and resilient critical infrastructure.” Sixteen different critical infrastructure sectors are identified, including: Chemical, Communications, Energy, Financial Services, Healthcare and Public Health, Food and Agriculture, Nuclear Reactors, Transportation, and Water and Wastewater Systems.

On the same day PPD-21 was released, President Obama also signed Executive Order 13636 for “Improving Critical Infrastructure Cybersecurity.” The Executive Order directs NIST (National Institute of Standards and Technology) to develop a framework for “reducing cyber risks to critical infrastructure,” for which they have issued an RFI and plan a workshop in late May.

And on March 26, the BSI (Bundesamt für Sicherheit in der Informationstechnik, the German Federal Office for Information Security) published the Protection Profile for the Gateway of a Smart Metering System. Such devices will securely collect, process, and store information from smart meters, adding security to smart electricity distribution grids. The protection profile notes that the threat from a remote cyberattack is much higher than that from a local physical attack, since the attacker in network has the potential to compromise not just one, but many components of the infrastructure, or even the corresponding grid.

These developments highlight the focus on improving critical infrastructure security as attacks from cyber-terrorism have increased over the last decade and, alarmingly, in the past year on power, water, and nuclear systems. A recent report states that, indeed, most cyber-attacks now target critical infrastructure, moving “away from hacking and financially motivated crime” to attacks to “deny, disrupt, and destroy” service. For most of us, even the most destructive cyber-attacks like Stuxnet are fairly remote and don’t impact us; but if critical infrastructure services are denied, disrupted, or destroyed, cyber-attacks could become devastatingly personal.

Critical infrastructure systems often use distributed control systems (DCS), industrial control systems (ICS), and supervisory control and data acquisition (SCADA) systems for process monitoring and control. Usually networked and often connected to the public Internet, these DCS, ICS, and SCADA systems are potentially vulnerable to cyber-attacks. Developing more secure DCS, ICS, SCADA systems, and other components of critical infrastructure using the MILS (Multiple Independent Levels of Security) architecture can help improve the overall security of such infrastructure: I explain how below.

The MILS architecture enables security architects to configure the system following the principle of least privilege, which requires that each system component be granted access only to the resources needed to complete its functions. This enables the development of devices and systems that are more resilient against attacks, and better at mitigating potential damage from defective or malicious software. Also, the MILS architecture uses a separation kernel to provide time and space partitioning, information flow control, and fault containment. By providing these capabilities, security-critical components (such as a data guard or process controller) can be separated and protected from less secure components (such as an Internet gateway or network interface) when these components run on the same hardware platform to reduce size, weight, and power (SWaP) requirements. And by reducing SWaP, MILS allows devices and systems to be more cost effective to develop, deploy, operate, and maintain.

Underscoring Wind River’s commitment to delivering trusted systems with built-in security capabilities, we have just launched VxWorks MILS Platform 3.0, which implements the MILS architecture with a secure, hypervisor-based separation kernel compliant to the U.S. Government Protection Profile for Separation Kernels in Environments Requiring High Robustness (SKPP), version 1.03. Although NIAP has sunset the SKPP as the basis of a component-level certification process, NSA continues to recommend the use of separation kernels for security-critical systems, making VxWorks MILS Platform an appropriate choice for use in critical infrastructure sub-systems. And to support a wide range of potential evaluation activities, VxWorks MILS Platform provides a complete set of artifacts to support a system-level evaluation process, based on the internationally recognized Common Criteria.

VxWorks MILS Platform 3.0 is an ideal foundation for building secure, cost-effective, and evaluatable DCS, ICS, SCADA, and other security-critical systems. And it’s available today to help secure national critical infrastructure.

 

For additional information from Wind River, visit us on Facebook. 

Avionics Europe 2013 Conference

By Paul Parkinson

Last week I attended the Avionics Europe 2013 conference, which was held in Munich for the last time perhaps (as it is moving to Abu Dhabi in 2014).

The theme of this year's conference was 'Tackling the Challenges in Avionics: Single Sky Many Platforms,' which continued to focus on the growth in air traffic across Europe and challenges arising for air traffic management and navigation. However, rather than continuing to focus on the regulatory challenges as in 2012 (which I have discussed previously), there was a shift in emphasis towards the implementation of technologies such as SESAR.

One of the keynote speakers, Captain Sascha Unterbarnscheidt, A320 Captain and Director Operations Support, Lufthansa Germany made some very interesting observations in his address 'Single European Sky - Delivery to Daily Operations.' In particular, how the fragmented European air space (compared to the United States), led to ATM inefficiencies in 2011 resulting in 17.9m minutes of ATM delays, 8.1m tonnes of wasted CO2, and increased costs of around 5billion Euros (with the effect on passengers of delayed flights, longer flight times, wasted fuel and increased noise). He then went on to explain how the increased levels of automation and productivity through SESAR would result in increased capacity, reduced costs and lower accident rates.

The impact and benefits of SESAR were also discussed in a number of other presentations at the conference, but the one which really caught my attention was the one which proposed changing the ATM model from peer-to-peer communication over proprietary network infrastructure, to making all airborne and ground-based information available to all users on (publicly-accessible) IP-based networks. I was alarmed at the obvious security implications of this approach, but the potential cyber security threats and their mitigation weren't even mentioned during the presentation. When networking critical infrastructure systems together, security must be considered from the outset rather than as an afterthought!

I also presented a conference paper, 'Use of ARINC 653 and ARINC 661 in Developing a Touch Screen Avionics Display,' which I had co-authored with David Randall of Presagis. This included a discussion on the requirements of the upgrade of a cockpit avionics display for a military rotary-wing platform, and the use of standards-based architectures including ARINC 653 and ARINC 661 with COTS hardware platforms. The paper also presented the experience gained by the use of these technologies on a European military helicopter programme, including the benefits in overcoming hardware obsolescence and the contributions towards reductions in operational and through-life costs.

If you weren't able to attend the conference, we will make the paper available on the Wind River website soon.

For additional information from Wind River, visit us on Facebook.

The Advent of Multi-core MILS

By Paul Parkinson

It has been a rather long time since my previous blog post. I intended to post a blog before the holidays regarding our partner Curtiss-Wright's announcement about VxWorks MILS support on the VPX6-187, but I simply ran out of time! So here it is as my first blog post of 2013.

The Curtiss-Wright new release was actually quite a game changer. To the casual reader, it may just appear to be about the release of another board support package (BSP) on a leading-edge COTS processor card, but the fact that this BSP supports multi-core for a MILS architecture is what makes this announcement so significant.

When the MILS software architecture was proposed in 1984 by the computer scientist Dr. John Rushby, microprocessors at the time were inherently single-core, and computing performance advances were being driven by clock speed increases and die size, at a rate following Moore's Law.

Over the last decade, single-core processors with robust MMU partitioning have become sufficiently performant to enable viable MILS separation kernels (SK). In recent years, Wind River has implemented VxWorks MILS on single-core processor architectures (PowerPC MPC8548), and on multi-core processors, but only running on a single core (dual-core PowerPC MPC8641D, quad-core Intel Core i7).

However, with the VxWorks MILS Platform, Multicore Edition, the VxWorks MILS separation kernel now runs on all eight cores of the Freescale QoriQ P4080 processor concurrently. Yes that's right, I am talking about (MILS & multi-core) rather than (MILS XOR multi-core). This enables the integration of many MILS solutions on a single processor, creating reduced size, weight and power (SWaP) benefits - even high assurance security-critical systems have tough performance requirements.

The advent of multi-core processor architectures over the last few years has had a dramatic and disruptive effect on the embedded market. This has provided significant benefits in terms of reducing size, weight and power (SWaP), but has also presented some interesting challenges for safe and secure application domains.

For example, the global aerospace market has very mature processes for DO-178B safety-certification on single core processors. Similarly, the security community is approaching maturity for Common Criteria security evaluation on single core processors. But both segments are challenged when driving multicore systems through their respective processes.

There has also been an emerging trend in recent years of individual systems needing to meet both safety-certification and security evaluation, and now with the emergence of multi-core, this presents some new regulatory challenges, but the benefits will be worth the effort.

This convergence is discussed in more detail in the white paper 'Safety, Security and Multicore' which is available for download from the Wind River website.

For additional information from Wind River, visit us on Facebook.

MSL: How Big Is It?

By Mike Deliman

I’ve been asked here and there “Just how big is this MSL thing?”

It’s a question I can give several answers to, depending on what the asker means.  In physical terms, you could ride on it.  Here is a good example…in this photo of a worker and MSL, you can see the cruise shell is large enough to house a small couch with more than one person sitting on it.  The rover itself is quite large, I’d imagine good comparisons would be something on the order of a ride-on tractor-mower. 

 

But that isn’t really the only answer.  In scientific terms, this is huge.  This rover is a well-equipped geological laboratory on wheels.  It carries equipment every high-school and university would be proud to have available.  Laser spectrometer, chemical analyzers, close-up and long-distance cameras, not to mention an advanced autonomous robot running it all.  Any of these tools would be excellent for investigating or teaching/learning about the earth.

Even more so, it represents a huge leap forward in technologies. “Earth sciences” (or Mars) can benefit from miniature spectrometers and imaging tools as are carried on this rover.  An automated flying crane could be applied to many tasks here on Earth, not just dropping scientific payloads where humans should never go (like in a volcano, for instance).  Automated robots could be used to perform maintenance and inspection inside the infrastructures of large cities where humans cannot go, and would be especially useful if they could identify items of interest (like cracks inside a pipeline).  MSL inherited code tested on Opportunity that is able to identify rocks of interest and photograph them, so that our scientists may have the ability to investigate them more closely.

What’s more it’s doing all of this on another planet, sending back results that will once again change what we teach in science classes.

You may ask “Right, but all of this doesn’t really help me now, does it?”  Wind River has benefited immensely from scientific use of our software.  As a for-instance, one of our most powerful tools evolved from investigations made by JPL while testing Mars Pathfinder.  Wind River's System Viewer tool is extremely useful for customers classifying the nominal operations of a system or looking into anomalies. It has grown-up alongside VxWorks, which is at the heart of Curiosity, and is capable of monitoring activities on multiple cores simultaneously.  This can be used to make all of the gizmos we rely on day-to-day much more reliable.

That is pretty huge!

 

For additional information from Wind River, visit us on Facebook.

 

All Your Mars are Belong to US!

By Mike Deliman

It's time to celebrate. We have returned to Mars with the most complex roving robotic laboratory ever sent to another planet. We have demonstrated and proved the Sky Crane concept, which opens doors onto other worlds that we have never had before. We can successfully deliver 1 metric ton to the surface of Mars.

This is an achievement beyond words. A new day is dawning on Mars, a day marked with the ability to achieve incredible scientific goals. A team of over 7000 individuals made this happen. A true testament to humankind. None of these contributors could have done this without the support of their families and significant others.  And I am extremely proud to work for Wind River, a company whose technology helped make all of this possible.

I'm a California boy. It takes someone very special to have this kind of draw, to pull me to Indiana.  Here we are.  It’s late.  This is a historic evening.

All times in Central time (Valparaiso, Indiana):

10:30pm - we tuned in to the press transmissions on both NASA-TV and USTREAM on JPL channel 3. We spent the next several hours toggling between the audio feeds, glued to the monitor.

10:40 pm - DSN ready to relay signals. EDL team is getting setup. EDL "tone screens" were being finalized. Chatter in the flight control room was muted.

10:52 pm - Mars View from MSL is about 20 degrees - she's getting close.

10:54 pm - EDL - all workstation minor alarms are cleared

10:55 pm - Bent Pipe downlink is ready on UHF

11:00 go/no-go? disable uplink transmitter? 90 minutes to ED&L

11:06 go/no-go roll call. Go! Window @ 0410UT/11:10pm

11:11 MSL is now within the orbit of Deimos (Moon of Mars)
Uplink shut-off, Curiosity is on her own, on Auto pilot.

11:12 MRO Com - MRO sequencers are open for recording and all instruments have been safed.
MO has been commanded to maneuver to attitude to relay ED&L, rolling for bent-pipe.

11:14 MO is radio silent, we should have telem back by 0500UT

11:15 All telecom ready for EDL

11:18 readiness checks begin. We're heading for Gale, which is even lower than Valles Marineris. If water flowed on Mars, it most likely flowed here.

11:20 ETV and MAX are "GO"

11:21 Oddy - MO - flies in a low enough orbit that even a slight rise or small hill could easily block the bent pipe; MRO can still store-and-forward, but it would be a several hour delay vs. the bent pipe. Data would need to be recovered then processed before we'd have all the telemetry we'd want.

11:25 Pete Theisinger covers the technical advancements between MPF, MER, and MSL. There is a slide that shows the improvements in landing ellipses made on each landing / mission. We are getting better and better at this.

11:29 GDL is on station.
MO - should re-acquire telem in about 30 or 40 minutes, just in time for ED&L. She's still rolling into position. To do this we have to "safe" the antennae for the duration.

11:30 We're a little "north" of the most-perfect EDL, in other words, so far, ED&L sequences are right on target. Navigation terminal is having issues.

11:31 FTSB test bed switches to a local net

11:33 ED&L lead briefs public on activities going on

-> 10:06 Pasadena time, will start anchor processes, 10:11 pm communication will shift to "tones". Loss of telemetry - about 13.5 minutes. In a few minutes we will link to Mars Odyssey to start the "bent pipe". Parachute will deploy. We will likely lose telem at the point when the parachute opens.

11:39 Dropped 2-way coms, re-acquired one-way data from MSL. No longer getting packet data.

11:30 data 1-way recovered after Goldstone xmitter was switched off. T-44 minutes to ED&L.

11:42 EDL disabled alarms, time to prep for ED&L main program.

11:43 Alarms disabled

11:44 FSTB flight sysetems test-bed shutting down.

11:45 EDL start and anchor are starting - main transition table enabled.
Flight Transition for EDL competed.

11:47 heaters powered off.

11:49 packets for rtpd - on - FSTB better test, no peachese

11:50 standby for delta poll
Telem is being recorded, recording telem.

11:52 Deltas (poll) is being conducted.

11:53 Verify EDL sequence is in main mode, and all devices nominal.
Systems are nominal. Cruise stage heaters - off. MARDI heater off. Main valve is at 34C, OK but a couple degrees warmer than expected. Avionics - green. Backup computer is Green. FSW metrics are green after Anchor. Only realtime data products are being returned. Ranging via DSN is disabled.

11:55 Mars is visible at 38 degrees of view to the craft.
EDL team takes over from the Cruise team. Cruise team is now unemployed. Congratulations to the cruise team for delivering Curiosity to Mars, ready to land, in fantastic shape.

11:58 Cruise phase is officially over. EDL...
11:58 Peanuts open and passed around. History - Ranger 6 team had no peanuts, and the Ranger had problems. Ranger 7 team had peanuts and was successful. Ranger 7 helped pave the way for the Apollo landing teams.

12:01 Bent Pipe data flow is starting from Odyssey; gold, yellow and red are open.

12:02 22 minutes from Entry. Status is nominal. Ody should start relaying data soon.
(to recap, Odyssey had to "roll" to a position where she could receive data from MSL and relay it to Earth in real time. This requires that antennae be stowed, the roll performed, then antenna be re-deployed. Recently Ody lost a reaction wheel, so she is running on a spare - this required the team to "re-learn" how to pilot the craft, because there are only 4 reaction wheels in total - one for X, Y, Z, and the spare "slew" wheel. The spare wheel is locked - motionless - unless one of the others fails.)

12:04 - waiting for Ody "Bent Pipe" relay data.

12:06 EDL Ops - Odyssey status - unlocked on time; realtime telemetry "things look good", but waiting on the status of the slew and waiting for data relay.

12:07 Nav filter is dropping, EDL prep for anchor complete

12:08 Phase - EDL - MSL is moving about 1 mile per second.

12:10 EDL - tones indicate vehicle is ready and pyros are enabled

12:11 pyro bus is armed and enabled

12:12 Pyros: firing. Momentum has shifted indicating coolant is venting (expected)

12:13 Tones for EDL: GO!

12:14 GO for EDL support. Carrier and tones are good. Seeing heartbeat and strong tones signal. RCS thrusters ok. Waiting for cruise stage separation.

12:15 Heartbeat and tones have had a minor drop in intensity, expected; this means the cruise stage "doughnut" has been ejected and flown "past" MSL (a good thing)

12:16 RCS warm-up - MSL is spinning-down and turning for entry (MSL was rotating while flying through space, this maneuver makes her ready for controlled entry)

12:17 Spindown complete. Turn complete. Tone indicates mass devices have ejected. 5.4 KM/Sec; signals at expected levels.

12:18 EDL begins, everything is going well

12:19 Heartbeat is good. 6 minutes; entry interface is OK. Tones good. 5.5KM/S.
All good.

12:20 Rockets have rotated the craft for entry. Craft will bank right, left, right while flying in. Ody -not- piping in data yet.

12:21 MRO should be storing data for store-and-forward support

12:23 1 minute to entry. (Terror starts soon.)

12:24 Losing signal... dropped. Tones are back... looking good
(TERROR!)

12:25 About to start thrusting. Stand by for guided entry.

12:12+ guided entry started

12:26 steering to targeted entry, 1st micro-burst completed. Peak deceleration and heat is passed (11 to 12 Earth G's)

12:26+ Odyssey bent-pipe receiving but no data on pipe yet

12:27 Ody - data is good.
12:27+ heading to target...
12:27++ team reports all good, heat shield reporting good data

12:28 Mach 2.4 at 17 KM altitude, flying "like a plane" now
12:28+ standby for parachute
12:28++ mass is jettisoned

12:29 - chute deployed... thrusters enabled... Deceleration confirmed.
12:29++ ground lock on radar... we see the ground!

12:30 waiting for thrusters.. Earth has "set" from Mars point of view, direct data lost. Ody's bent-pipe is working fine.
12:30+ backshell standby.. powered flight on...
12:30++ Ody signals strong, 500M and falling... Sky Crane ready.
FOUND A FLAT PLACE TO LAND!

12:31 Sky Crane started...
12:32 Deltas are nominal, flight is stable.. TOUCHDOWN we are ON MARS.\
(The 7 minutes of terror are over.)

Waiting for images.

12:33 Sky Crane is at safe distance. Heartbeat and telemetry is good.
Images being transmitted
12:34 First image coming down via bent-pipe
12:34+ First thumbnail in. You can see the horizon and a wheel. We are on Mars.
"It's the wheel!"

12:36 More images - a higher-res image from the rear hazcam. There is dust on the lens covers, some sun-flares on lenses, and blurry horizon through the dust.

12:37 Horizon is clear, you can see rocks/pebbles - the surface of Mars, and a wheel.

12:38 Front hazcam image is down, Curiosity's shadow is clearly visible on Mars. Ody is now setting behind Mt Sharp; bent pipe is closed.

Mood: Landed

 

For additional information from Wind River, visit us on Facebook.

Complexity

By Mike Deliman

This afternoon I watched the press conferences for Mars Science Laboratory “Curiosity” that were hosted by NASA/JPL from Pasadena, Ca.  These conferences were broadcast over NASA-TV, both on the cable/satellite channels and over the web.  If you haven’t seen the Seven Minutes Video I encourage you to watch it.

Various scientists, directors and managers of the project discussed various aspects of the mission, including discussing how the craft does what it’s designed to.  The biggest message I carry away from today’s two conferences is “Complexity”.  This is by far the most complex robotic probe ever launched to space, perhaps the most complex robotic probe mission ever.

If you watch the video, you will notice that during the landing, the probe plummets through the atmosphere like a well-guided rock.  This is literally what it is doing – falling like a rock that knows how to keep itself upright.  It manages to do this by using guidance rockets, a heat shield with a “just right” shape, and weights that help keep one side tilted slightly towards the ground.  While it’s in this configuration, the guidance rockets make minute adjustments as needed, keeping the probe on course.  This precision guided entry is a large part of how Curiosity is able to make the landing ellipse small.  This whole phase is a series of fantastic engineering achievements.  It is tied in history to the Apollo reentry methods, where we brought astronauts back to Earth, safely.

At just the right time, the probe will deploy its parachute.  Parachutes are something you can see almost every day.  There are folks who jump out of airplanes for the fun of it, and assemble as groups, doing acrobatic maneuvers on their way down.  There are military personnel who do various dangerous styles of parachute jumping.  It seems like this isn’t such a big deal, right?  All of those humans carry back-up chutes, just in case something goes wrong.  Sometimes even those fail.  MSL does not have a backup.  That one parachute is all it’s got.  And it’s deployed when the robot is plummeting at about a thousand miles an hour in an atmosphere much thinner than the Earths!

Then we get to the part where the heat shield pops-off, the radar and images kick in, and the robot starts looking for the right place to land.  When it’s getting close, it will deploy the sky crane and cut the parachute cords.

Why do a sky crane?  We could have done an airbag system like the previous rovers, or a “hard landing” like we did with Viking and Phoenix, right?  Well… no.  The impact would be so hard with airbags that there isn’t cloth anywhere in the world that could withstand the landing, it would shred on impact.  That would be catastrophic for the rover.  The hard-landing style Viking and Phoenix used are also inappropriate for this lander.  The problem is two-fold – these landings are difficult enough for robots that don’t move after landing – they have to fire up and shut-off retro rockets at just the right times.  Even harder, to deploy a roving robot, the lander would have to land on perfectly flat terrain to avoid falling over, and stick that landing better than an Olympic gymnast.  This lander weighs about a metric ton.  It would have to have incredible legs!

One of the engineers coined the phrase “we’re landing a small compact car with a trunk loaded with scientific instruments on Mars!”  We can’t afford to get it there and not be able to let it rove.  The retros would have to be very strong to slow it down enough to prevent damage, and this presents a problem itself:  pressure.  With the rockets down low, the terrain and thinness of the atmosphere could make back-pressure unpredictable, increasing the likelihood that the lander could flip over.

So we have the sky crane left as the only really viable solution for providing a gentle landing, with enough precision that the rover will be able to choose where it lands.

All of these events are controlled autonomously by the computers, operating system, and applications on-board.  There will be no human interaction possible.  By the time we get receive the signal indicating it has entered the atmosphere, MSL will have already been on the surface of Mars for about 7 minutes.  The computer does all of this work without human intervention!  What a marvelously complex robot!

It’s going to take a while for the rover to check itself out – perform all the health checks necessary before it can start “doing” much on the surface.  This will take perhaps up to a month.  During that time, though, we will use the satellites we’ve placed around Mars to relay back the data and pictures it’s collected on the way down to the surface.  It may take another month before it starts running chemistry experiments.  That’s about 60 days before we see it sample Mars itself.  Thinking about it though, that’s less than 10% into the mission, we will have over 600 more days to crawl about – an entire Martian year.

 

For additional information from Wind River, visit us on Facebook.

Seven Minutes

By Mike Deliman

This week, NASA hosted the Jet Propulsion Laboratory (JPL) scientists in charge of the Mars Science Laboratory rover, Curiosity, for a pre-landing press conference.  The landing sequences, called “ED&L” – Entry, Descent, and Landing – are the most action packed and critical operations other than the initial launch.  Pete Theisinger has described the EDL sequence as “7 minutes of terror.”

This stage of exploration is similar to that of other landers NASA has sent – Mars Pathfinder, Mars Exploration Rovers, and Mars Polar Lander all survived their landings on the red planet after their 7 minutes of EDL terror.  It was these experiences that led Pete to this description.

The NASA/JPL press conference was about an hour long, and packed full of information.  The long and short of it is that we have made giant strides in advancing the technology of placing payloads on the surface of Mars, and the science returned so far has drastically changed our understanding of the red planet, and of planetary evolution in general.

When choosing a place to land on Mars we have to take into account just how accurately we can place a lander and how much space it requires to come to a stop.  With the rovers we’ve sent previously, using the parachute and airbag method (“drop, bounce, roll”), we needed a significant area just to arrest the horizontal momentum of the craft.  By using a retro-rocket method, that area is reduced greatly.  Combining a heat-shell and parachute with the retro-rockets, we can reduce that area and reduce the weight of the rockets required to land a vehicle.

Using retro-rockets has its own problems – mostly, the rockets need to be under the lander, and may contaminate the area landed on.  A rover can get away from the contamination, but if there are exhaust nozzles under the rover, they can hang up on objects and prevent the rover from…well, roving.  Enter the idea of the sky crane. The sky crane will provide the final slowing of descent and horizontal momentum, and place the rover on the best spot it can sense using radar.  This provides the ability to place the rover with precision, upright, without the danger of hanging-up on thrust nozzles after landing.  The crane will fly off to gently crash elsewhere.

Curiosity will be using a host of science instruments to explore Mars looking for evidence that fulfills the mission objectives.  The basic objective is to confirm whether or not Mars could have – at any time in history – been able to support life as we know it.  This means looking for more evidence of liquid water on the surface.  It will also be looking for evidence of biologically related organic chemicals.  There are some organic molecules that can result from purely physical processes, and others that can only result from biological activity.  Curiosity will rove to a mountain in the center of the crater it is landing in – taller than any mountain in the 48 contiguous states – in search of this evidence.

A confirmation of life on Mars would be the discovery of the century for sure.  But considering the technologies we’re testing and improving just getting to Mars, a successful landing is a marvel of technology itself.  A precision landing instrument like the Sky Crane could enable us to send provisions for manned exploration, delivering them spot-on to sites easily accessible to a crew temporarily living on Mars – not to mention it is technology we could use to make precision deliveries to our own Moon and other planets and moons, as well!

The part Wind River’s VxWorks real-time operating system plays is similar to the role it plays in devices you use every day without knowing we are there.  It is the “smarts” that provides the coordination necessary to carry out precision actions in response to the operating environment, with extreme accuracy.  It helps provide the ability to manage the terror in the 7 minutes of ED&L, making such incredible feats possible.

Wind River is proud of NASA / JPL for these achievements over the past two decades of exploring our solar system.  I am extremely fortunate to have worked with such excellent and passionate engineering teams, and I am looking forward to watching the EDL coverage on the evening of August 5^th!

 

For additional information from Wind River, visit us on Facebook.

The New FACE of Avionics

By Chip Downing

Earlier this year, Wind River announced its support of the Future Airborne Capability Environment (FACE) technical standard, which hopes to resolve two fundamental problems with military procurements.

First, current aviation systems are typically developed for a unique set of requirements by a single vendor for a single aircraft, resulting in limited portability of software components, increased costs, and creating barriers to competition within and across airborne systems.

Second, the military aviation community has not created standardized architectural and software interface standards to sufficiently enable portability of software components across DoD aviation systems.  Commercial aerospace suppliers have standardized on open common core platforms based upon ARINC 653, which is a standard API for integrated modular avionics (IMA), but this has simply not occurred in military avionics systems.

The FACE technical standard will create an open, modular, multi-vendor software environment enabling portability and reuse of software components across multiple programs and platforms.  Combining this technical standard with a the FACE Business Guide will expand the selection options for military software components, reduce up-front procurement costs, reduce system integration cost and risk, and reduce upgrade and technical refresh costs.

To read the full blog post visit Military Embedded Systems

Identifying Backdoors in Production-Ready Code

By Ido Sarig

The security world is abuzz with news about a “backdoor” - undocumented  access to its programmatic interface -  found in a popular FPGA manufactured in China and used in US military applications.

Whether you are concerned that this is a deliberate Chinese plot to attack Western militaries, or relieved to hear that this is just a "common" backdoor, put in for debugging purposes, you should take note of the following:

"Backdoors are a common problem in software. About 20% of home routers have a backdoor in them, and 50% of industrial control computers have a backdoor. The cause of these backdoors isn't malicious, but a byproduct of software complexity. Systems need to be debugged before being shipped to customers. Therefore, the software contains debuggers. Often, programmers forget to disable the debugger backdoors before shipping.” 

Sometimes, this is not an inadvertent omission. Developers may deliberately leave “test APIs” in the code, thinking it may be useful in the future, for diagnostics, should a problem surface at a customer site.

One of the key benefits of an automated software testing solution is its ability to easily identify such debug APIs and backdoors that are inadvertently (or worse – deliberately!) left in production code.  For example, Wind River Test Management can analyze uninstrumented, production-ready binaries – the same code you will be shipping to your end users after all the “debug only” APIs should have been removed – and provide you with detailed reports on the coverage achieved by your entire test suite running against that binary image. If there are any “debug-only” APIs in the code, they will typically not be touched by any of your  test cases, since they have no requirements associated with them and hence no test cases to validate those requirements. They will be quickly highlighted by Wind River Test Management’s reports.

Additionally, using Wind River Test Diagnostics (a system that links product development teams in an intelligent, collaborative workflow so they can efficiently validate embedded devices and rapidly resolve issues) you do away with the need to leave such backdoors in the code for diagnostic purposes in the first place. Utilizing our patented Sensorpoint technology, Wind River Test Diagnostics can dynamically add diagnostic code  to a running, uninstrumented binary, delivering you with all the needed diagnostic information without the security risk of a backdoor.

The good news is that when issues like this arise, it gets the conversation started, and it is a very important conversation to be having.  I’d be interested know what you’re hearing.

 

For additional information from Wind River, visit us on Facebook.