Aerospace & Defense

VxWorks Cert Now Supports ARM!

By Alex Wilson

Aerospace and defense has relied on rugged embedded vehicle mounted computers for many years, but as devices become more mobile, and with increased demand to reduce SWaP (Size, Weight, and Power), ARM-based computers become an interesting alternative.  Added to that is the wealth of functionality available in ARM devices that make it a good choice, not only to reduce SWaP in the core CPU, but to reduce overall chipset sizes to a single SoC.

If we look at an example of an ARM-based device, such as the TI OMAP3530, this is a perfect device with which to build a software defined radio for example. It has a high performance, low powered Cortex A8 Core, with numerous IO devices to help connectivity and display.  Designed as a mobile device, for example, it supports Android -- and the OMAP3530 is also well suited to other areas of A&D such as soldier mounted systems, or remote sensors.

When it comes to avionics systems, aircraft also have a range of devices, from the high end central control computers running multiple applications (such as the common core computer of the Boeing 787) down to remote sensors and actuators that run on 8- or 16-bit processors, and maybe do not need to use an operating system.  TI also produces devices targeted at this market, which not only reduce SWaP, but are tested to the required standards for avionics applications, including extended temperature ranges, and using avionics friendly packaging.  For example, the OMAP-3530, is available as a OMAP3530-HIREL (PDF Datasheet) with extended temperature ranges from -45C to +105C.

So with this in mind, it is great to see our leading real-time operating system's latest release with support for ARM processors.  VxWorks Cert already supports both Freescale and Intel, with certification evidence for RTCA DO-178B (EUROCAE ED-12B) Level A, and has been certified on platforms such as the Eurocopter EC-225 Helicopter, or Cobham900E series Air Refuelling Pods on the A330MRTT.  This latest release adds support for ARM Cortex A8 and A9, as well as some updates to the Freescale coverage.

Support for ARM Processors gives our safety-critical customers the choice and flexibility they needed in order to meet the tough SWaP, functionality, and certification requirements for the demanding avionics applications, and I am looking forwards to seeing some great innovations in the next few years!

 

For additional information from Wind River, visit http://www.facebook.com/WindRiverSystems.  

Security needed everywhere!

By Alex Wilson

It's been a busy couple of months at Wind River with conferences and seminars as we lead up to year end.  One key theme at the various events I have been to is that of the increased need for cyber-security, a theme that is becoming important in all areas of embedded computing.

The subject first came up in Toulouse at the SAE Aerotech conference.  I was there co-hosting a session with Airbus on use of multicore technology in safety certified systems, with a great presentation by our own Joachim Hampp, and also to present a paper on our VxWorks 653 solution as a guest of BARCO.  Apart from some very interesting sessions on IMA, Unmanned Vehicles, and safety certification, the other critical area was an update on cyber-security with presentations from Airbus, Boeing and government.

The area covered by Government included an update on both WG 72 and SC 202.  These have now started to go through the standardisation process, with RTCA DO-326 / EUROCAE ED 202 being the first, to be followed by further guidance on how you go about security testing avionics systems. The next release will be ED 203 (No RTCA number yet as it is issued when the document is released) which will cover the additional work required to augment safety testing with security requirements.

Of personal interest, as I fly a lot, and also very reassuring, is that this is already happening today, with increased focus on security testing for both Airbus A380, and Boeing 787.  The Boeing 787 of course runs our own VxWorks 653 in the common core computer.  Both Airbus and Boeing outlined the increased security practices they are using, and also continually working on, to protect aircraft from security threats, both during ground maintenance, and also with increased use of passenger systems (here I was very jealous to hear that the a lot of US operators already supply WiFi as standard through the GoGo service).

Following SAE Aerotech, I attended the Interoperable Open Architectures (IOA) conference in London, hosted by our partner RTI.  This was a fascinating mix of presentations from industry and from government, stating the need for IOA, and creating an interesting tension between government and industry. On the one hand you had folks such as General Nick Justice, who stated that IOA was the only way the US Army could afford the future, and on the other hand you had the major defence suppliers seeing their future revenue stream being eroded!

Getting back to security, one thing that all of the IOA projects included, whether it was ground based (GVA), or future aircraft (FACE), or unmanned (USCGS), was the need for increased security testing as the systems become more connected.  This was especially true, if they "evolve" to include military app stores as provocatively presented by Curt Schacker in his session on “Achieving System Level Interoperability in Open Architecture and also discussed during the briefing on FACE.

Finally, this week I have been down to Jerusalem to present at theIADC conference, on the subject of cyber-security.   I presented our view on the end-to-end challenges around security protection, which is exactly what IOA need to implement, and what companies like Airbus and Boeing are already implementing to protect our aircraft.

 

For additional information from Wind River, visit http://www.facebook.com/WindRiverSystems.   

Secure Mobility Message Resonates at MILCOM 2011

By Chip Downing

MILCOM 2011 last week in Baltimore, MD was not only educational, but it was a watershed event.   Last year, it was a “coming out” party for custom Android devices; this year however, was the year where many companies are now using COTS hardware and software to their fullest extent, along the entire supply chain, from core to edge and user devices.   I believe this COTS adoption is driven by two powerful forces – the exploding capabilities of commercial tablet devices, and global military budget pressures.

The vastly increasing power and capability of commercially available mobile communications devices is simply amazing. Just a few years ago, almost everything in this military communications space was purpose built, and most commercial products were simply inadequate to address the rugged and complex system demands of military communications systems.   As seen at MILCOM 2011, this has officially changed -- COTS end-to-end communications domains rule.

So if all of these MILCOM vendors are not making customized hardware and software, what are they doing?   Wind River had over 500 people visit its booth at MILCOM this year, and most of the discussions I had with both suppliers and end users at the show were about increasing device security and leveraging high volume COTS components in demanding deployment scenarios.

Security is always a challenging problem.  There are many ways to secure a device and its data, and we have found that for systems that need single level security (SLS), our customers really warmed up to our Linux Secure product.   This product is derived directly from our standard Wind River Linux platform that has full traceability back to source and build files, but which also adds COTS Common Criteria EAL4+ and FIPS 140-2 certification evidence for ARM, Freescale, Intel, and TI OMAP processors.   Suppliers can now increase the security of their devices with a COTS Common Criteria path, reducing both time and risk. 

The Common Criteria certification work that we have done for Linux can be expanded to secure Android platforms.  Developers can leverage the work that Wind River has already performed and completed for kernel.org Linux and simply expand those artifacts to include Android capabilities layered on top of the Linux kernel used in Android.

And speaking of Android, securing Android systems was on everyone’s mind this year.   There is certainly a push to create additional and/or layered security on COTS Android devices, which would enable state-of-the-art commercial platforms to be used on the edge of critical military communications systems.  One of the best ways to do this is to insert a platform hypervisor underneath Android to abstract away direct access to the hardware.  Once this very thin abstraction layer is inserted, one can also then add additional Android or other operating environments to a device, enabling very clever and unique devices that can separate key capabilities into controlled execution spaces.  For example, one could mix together a traditional VxWorks-based software defined radio (SDR) environment with an Android or Linux environment using the Wind River Hypervisor.

For customers who need multi-level security (MLS), our VxWorks MILS product fits best.  This secure hypervisor product enables the creation of a robust partitioning architecture supporting multiple independent levels of security (MILS).  Rockwell Collins showcased its SecureOne Cross Domain Technologies in the Wind River booth at MILCOM 2011, which uses a VxWorks MILS foundation.  SecureOne Guard and SecureOne Processor components use VxWorks MILS technology to produce a system for aircraft that can securely connect networks of different classifications, thereby reducing operator workload and reducing the number of systems required to access critical data.  This platform consolidation approach drives down size, weight, and power (SWaP) demands, and, therefore, system costs.

Wind River also showcased two more products at our booth that accelerate the delivery of complex software into advanced custom and COTS silicon – Wind River Simics and Wind River Framework for Automated Software Testing (FAST) product. 

Wind River Simics is a system simulator capable of simulating systems of arbitrary complexity, from a simple processor and memory, to a system-on-chip (SoC), to a complete board, to a networked system, and even a complete system-of-systems.   Simics enables software developers to immediately and reliably access military communication hardware designs with ease, without the burden of scheduling the availability of actual hardware and associated support equipment.

Finally, our (FAST) product is a meta-test framework that automates software and system tests and their results for mobile Linux and Android devices.  Each individual test framework, test, or application is encapsulated within a "wrapper" script that is executed by FAST during the test run. This wrapper allows the test to be abstracted across multiple product platforms.  FAST includes the full Android Compliance Test Suites (CTS), and accepts existing legacy tests, open source tests, and Wind River–authored tests to accelerate your product testing and delivery. 

It will be interesting to attend next year’s MILCOM in Orlando to see what new communication devices will emerge from this powerful combination of COTS hardware/software platforms, layered security, and advanced tooling that accelerate these systems into the global battle space.

 

For additional information from Wind River, visit http://www.facebook.com/WindRiverSystems.

Another Great Design Win for VxWorks MILS!

By Alex Wilson

Having been at Wind River for 15 years, it is always a pleasure to see products coming to market that are based on our technology, and at MILCOM 2011 we are proud to be announcing the use of Wind River’s VxWorks MILS Platform in Rockwell Collins' SecureOne Processor and SecureOne Guard, components of a family of high assurance technologies for military tactical systems.

Part of my job at Wind River is evangelizing new products and attending conferences, such as MILCOM. Over the past few years one of the main topics of conversation is around cyber-security and how we can address the needs of connected systems in the security world. New issues around cyber-security threats meet us every day, another example being the recent vulnerability discussed by Joe Wlad in his blog post.

MILS is a concept that defines how you can build open architecture solutions that not only meet your security requirements, but allow you to reduce size, weight, and power (SWaP) requirements of a system by hosting multiple applications in different security domains on the same computer. A good description of building high assurance systems based on MILS technology was written by Paul Parkinson and Arlen Baker, and can be found on our website at: http://www.windriver.com/whitepapers/whitepaper.php?f=WP_high_assurance_systems_development_MILS_1110.pdf

Rockwell Collins  proved that high assurance open architecture  solutions can be achieved through their SecureOne Cross Domain Technologies.  SecureOne uses Wind River’s VxWorks MILS technology to produce a system for aircraft that achieves the following optimized system goals:

• Securely connecting different classified networks through the SecureOne Guard, thus allowing the operator(s) to view data from several sources (assuming they have the correct security clearance!)
• Reducing workload
• Reducing the number of systems required to access the data

All of these capabilities tied together through VxWorks MILS give Rockwell Collins a product that provides increased situational awareness for their customers, whilst offering the benefit of reduced workload and savings on SWaP – all huge benefits in the current economic climate in order to protect our national assets from the threat of cyber warfare without breaking the budget.

For those of you at MILCOM 2011, visit Wind River's booth #721 to see a demonstration by Rockwell Collins running VxWorks MILS to power its SecureOne Guard.

For additional information from Wind River, visit: www.facebook.com/WindRiverSystems.

Unmanned Systems: More Reports of Security Vulnerabilities

By Joe Wlad

By now, you’ve likely heard the latest report of security holes in unmanned ground control systems. This time, a key-logging virus has been found on one or more hard drives at the Nevada operations center for the Predator and Reaper unmanned vehicles. While the investigation is ongoing and impact of the virus is determined, the real concern is just how vulnerable are these systems and what might happen next? This is not the first time security gaps have been uncovered in unmanned vehicles. In 2009, Iraqi insurgents were able to intercept unencrypted video feeds from operational Predator UAVs using inexpensive software downloaded from the Internet.

People in the public and private sector are expressing deep concern over how things like this can happen and to how address these problems. As for the “how we got here” question, it’s relatively simple to answer. Essentially, the unmanned air vehicle has been a victim of its own success. Many of these programs, Global Hawk, Predator and others were never designed to be deployed in operational environments. In fact, the DoD in many cases, sought to build these vehicles as prototypes or proof-of-concepts. When the programs were awarded, the diligent contractors for these vehicles used the best of commercial technology to demonstrate the capabilities. The hope was that successful demonstrations would lead to production contracts where the systems could be designed to meet specific security and safety requirements.

However, the demonstrations went so well and the need for support in the war zones in Iraq and Afghanistan led the DoD to give operational birth to these systems before many of the safety and security requirements could be fully addressed. The designers of these vehicles built ground control stations using standard Windows and Linux platforms. They may even be using a virtualized platform based on either open-source or proprietary type-2 hypervisors like VMWare.  It’s likely the operators who control the vehicles use standard methods of moving information to and from the UCS platform. This might include the use of removable media which is one of the suspected channels for propagation of the virus in Nevada.

To address the virus issues, the DoD must implement a routine of identifying security loopholes and vulnerabilities as they appear and then fixing each one – the so-called, patch-and-hope tactic. There is a better way to address these issues, and in time (we hope before the next problem appears) the DoD will deploy the next-generation of Unmanned Control Systems (UCS) which will be designed to address both safety and security requirements. This architecture will help operators avoid the problems of the past and ensure future unmanned systems are safe and secure.

Wind River is a member of the UCS Working Group and we are playing a big role in helping to define the safety requirements for the next-generation of UCS. This working group and the DoD have a goal to ensure that all of these systems are interoperable, safe and secure. At the foundation, the UCS architecture is defined as a partitioned platform where separation is provided by a time/space partitioned operating system which supports open standards such as ARINC653 or POSIX, cross-domain services for high assurance and mixed levels of safety criticalities. The exact architecture for any specific UCS platform can vary based on the use case.

There are a number of different use cases for these architectures, called deployment views. The UCS architecture can be fixed (as in the case of the operations center in Nevada), transportable (meaning mobile, but enabling direct vehicle control) and dismounted (meaning mobile and agile, but not necessarily enabling direct vehicle control). In each of these scenarios, the safety and security requirements of the UCS will vary. A UCS designer could use one or more of our products to address safety, security or both safety and security requirements, depending upon the use case of the UCS.

For the fixed system, the UCS designer may take advantage of Wind River MILS as the architecture solution which enables and supports DO-178B, Level A and Common Criteria EAL6+ certification. VxWorks MILS will provide UCS designers with the safety and security protections needed by fixed-platforms plus it will provide a migration path for software applications written on Linux or Windows platforms because both Windows and Linux are supported as guest operating systems on VxWorks MILS.

For the transportable or dismounted UCS platforms where security may be paramount, designers could use Wind River Linux Secure (which is certified to meet the Common Criteria security standard to EAL4+ or they could use our standard Wind River Hypervisor (which supports DO-178B, Level A requirements) for platforms where only safety is paramount. Additionally, all of our technology can be augmented with application run-time protection from McAfee. Wind River is working closely with our partner company, McAfee, to bring virus protection, security intelligence and threat assessment capabilities to embedded applications. The combined capabilities of Wind River and McAfee will enable future UCS application developers to protect us all from unwanted and potentially harmful behavior of unmanned systems.

For those who are interested in the specific safety and security requirements being addressed by the UCS Working Group, they are summarized below. :

• NATO STANAG 4671: UAV Systems Airworthiness Requirements
• RTCA DO-178B: Software Considerations in Airborne Systems and Equipment Certification
• DIACAP: DoD IA Certification and Accreditation Process
• CNSSI 1253: Security Categorization and Control Selection for National Security Systems
• MIL-STD-882D: System Safety
• MIL-HDBK-516B: Airworthiness Certification Criteria

 You can learn more about UCS and the evolution of the architecture at:

http://www.ucsarchitecture.org/page/home

Boeing 787: The long certification journey comes to an end

By Joe Wlad

Today, Boeing delivered its first 787 aircraft to All Nippon Airways (ANA) marking a huge technical, moral and financial achievement. Lorraine Bolsinger, president and CEO, GE Aviation Systems, commented in today’s news release: “This is an opportunity for 787 partners to celebrate their role in bringing the 787 Dreamliner to ANA and the world.” We at Wind River are immensely proud to be part of the supplier team on the Boeing 787 program and our VxWorks 653 operating system environment has enabled Boeing to reduce size, weight and power of the avionics platform thereby reducing aircraft operating costs for its customers.

Certification of the Boeing 787 has been a long road. While some people have focused on the challenges surrounding production and certification delays of the Boeing 787, it’s important to understand how revolutionary this airplane really is. The 787 is the most fuel efficient, technically advanced aircraft ever certified. Given how much new technology is built into the 787, it’s understandable that the certification process took longer than some had hoped. Key attributes of the 787 include a mostly composite aircraft structure (replacing many aluminum parts), elimination of pneumatics to power aircraft systems, a highly efficient wing design and Integrated Modular Avionics which reduce weight and enable reusability of software, among others.

Boeing has raised the bar in commercial aviation technology and challenged its competitors to keep up. In fact, if you take an historical look Boeing’s designs, they’ve always lead the way in aircraft design. From the 707 to the 747, Boeing took great risks in investing in new airplane technology. There were many on the board of directors at Boeing who staunchly opposed investing in the Boeing 747 in 1968. Boeing had to build an entirely new factory to support production and called on engine suppliers to design an engine that could support the performance objectives and do all of this without going bankrupt. Essentially, Boeing bet the entire company on the success of the 747. The early results did not look promising, instead they looked downright disastrous.

When the first 747s rolled off the production line, no engines were available, so they sat with concrete weights hanging from the pylons to prevent them from falling over. Once the plane was certified and put into operation by Pan Am, things started to look up until the oil embargo of 1973 took place. Then most 747 operators had to park their aircraft in the desert and others either delayed or cancelled 747 orders with Boeing. Boeing was on its knees and some predicted the end of commercial aviation. In 1974, the market value of Boeing was less than the value of the Boeing 747s it had in inventory. If an optimistic investor had gambled $1000 on Boeing stock back then and held it until 1989, they were rewarded with an investment worth $50,000. Indeed, aviation did not die; instead it grew well beyond anyone’s expectations.

I think the same philosophy holds true today. While there have been many challenges with the latest Boeing aircraft, I believe the future is bright for the Boeing 787 and commercial aviation. Beyond the 787, the VxWorks 653 operating system provided by Wind River has been embraced by 120 avionics suppliers and is now installed on over 45 aircraft worldwide. We look forward to continued successes on the Boeing 787 as well as other new aircraft programs that raise the bar on efficiency, reliability and technology.

DSEi 2011: submarine periscopes and invisible tanks

By Paul Parkinson

Last week, I attended the DSEi defence & security exhibition in London. As usual, it was an enormous event with a huge number of exhibitors, and it seemed to be even better attended than the 2009 event.

I visited some of Wind River's customers and partners, and I was really pleased to see a demo of the VxWorks-powered Astute submarine optronic mast on Thales' stand, which showed the huge difference that the 3-axis image stabilisation makes when using the periscope in rough seas.

While I was at the event, I also took the opportunity to look around at some of the state-of-the-art technologies on display. There were lots of new systems which were focused on 'cyber security', and 'cyber defence', and the application of military-grade cyber security for protecting critical national infrastructure.

However, the system which seemed the most revolutionary to me, was BAE SYSTEMS' ADAPTIV camouflage. There is a long-established problem of military vehicles being vulnerable to detection, and whilst covering tanks with traditional camouflage material can help disguise them in the visible spectrum, this doesn't prevent their detection from infrared (IR) sensors.

BAE SYSTEMS has developed an innovative solution to this problem using state-of-the-art technologies, which is being reported in the media as an 'infrared invisibility cloak'. ADAPTIV provides the ability to hide, blend, disrupt, and disguise the appearance of military targets, and also provides Identification Friend-or-Foe (IFF) for coalition operations to prevent friendly fire.

Unfortunately, the CV90 tank on display at DSEi didn't perform a live demo of ADAPTIV, but the official video teaser on YouTube is so impressive, that I decided to embed it below:

Linux, Common Criteria and OS Protection Profiles

By Paul Parkinson

In 2011, computer and network security news stories, which were previously the preserve of specialist journals and blogs, have become commonplace in the mainstream media. There are now many different types of threat, which are sometimes categorised into hacktivist, e-crime and most recently, advanced persistent threats (APT). Whilst some of these attacks have exploited zero day vulnerabilities, many of these attacks have simply taken advantage of the fact that systems have not been configured securely for their deployment environment.

To use an easy–to-understand analogy, consider a wireless router. This device will generally be shipped from the factory in the most flexible, open communication configuration, which will have many or all of the security options disabled. This will be fine if the wireless router is intended to be used as a free public Wi-Fi access point (e.g., cyber cafe), but not for a private business or home office if you want to prevent drive-by wireless hacks).  In these cases, wireless encryption such as WPA2 will need to be enabled for the router and clients, and access may even need to be restricted to specific clients via MAC addresses, etc.

For the developer wanting to create a secure product using embedded Linux, the wealth of configurable functionality and security packages can seem overwhelming. In the critical device space, the key question is, "How can one create a Linux configuration for their product which can be secure and meet the security requirements of the product's targeted international markets?"  The answer is straightforward and well defined - use standards-based approaches to both configure and prove security robustness.

For IT security, there is one globally-recognised standard, Common Criteria, that a product can be evaluated against, and this evaluation ensures that connected IT products are performed to high and consistent standards. Because Common Criteria is now recognized by 26 countries, product security evaluation using this standard eliminates the burden of duplicating security evaluations in multiple countries by providing international mutual recognition of evaluated products.

To accelerate the Common Criteria evaluation, the product can be developed according to the approved Protection Profile (PP) to ensure that it meets the accepted security requirements for that class of product. A Protection Profile is a document that defines the combination of threats, security objectives, assumptions, security functional requirements (SFRs), security assurance requirements (SARs) and rationales for a specific security target (ST). The PP is used to substantiate vendors' claims of a given family of information system products. The PP for a particular device typically specifies the Evaluation Assurance Level (EAL), a number 1 through 7, indicating the depth and rigour of the security evaluation, usually in the form of supporting documentation and testing, that a product meets the security requirements specified in the PP. In the United Kingdom, CESG supports Common Criteria evaluation and the use of PPs; in the United States, the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA) have agreed to cooperate on the development of validated US government PPs.

Common Criteria testing and evaluation can be quite expensive, and adds significant risk to any programme. To help eliminate much of this risk, Wind River has taken this approach for the development of Wind River Linux Secure, a commercial-off-the-shelf (COTS) product which has been certified by NIAP under the US Common Criteria Evaluation Scheme to Evaluation Assurance Level (EAL) 4+ (EAL4 being the highest level which is mutually recognised internationally under the Common Criteria Recognition Arrangement, and "+" referring to the evaluation being augmented with the Security Assurance Requirement ALC_FLR.3, the highest level of systematic flaw remediation).

Wind River Linux Secure was evaluated against the US Government Protection Profile for General Purpose Operating Systems in a Networked Environment (US GP-OSPP). This is a new protection profile which was published by the US National Security Agency's Information Assurance Directorate in August 2010, and supersedes the earlier Role-Based Access Control Protection Profile (RBAC) which was 'sunsetted' from 1st September 2011.

With this COTS GP-OSPP foundation, we expect that evaluating Linux products under similar PPs, like the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI) General Purpose Operating System Protection Profile (BSI GP-OSPP) can also be undertaken. The BSI OSPP is also published on the Common Criteria portal, and defines the specific requirements for the German security market. Although there are two separate general-purpose operating system protection profiles, with some specific differences in Security Functional Requirements, there is a lot of commonality, and Wind River’s experience in evaluating a full-featured Linux distribution from kernel.org removes considerable risk from other programmes requiring Common Criteria certification using the US GP-OSPP, BSI GP-OSPP, or other evaluation scheme.

Embedded Virtualization to Underpin Next Generation Network-Centric Operations

By Chip Downing

“Embedded virtualization” is a technology that is rapidly proliferating in global defense systems that deliver critical data to warfighters.  Embedded virtualization is typically instantiated in small layer of software called a hypervisor that controls all activities and functions on a microprocessor deployed in a military control and communications equipment.

These hypervisors can be foundations for hosting a wide range of complex, dynamic applications for network-centric operations (NCO), electronic warfare (EW) and spectrum planning/electronic warfare battle management (EWBM) systems. Hypervisors enable the migration of existing capabilities from legacy NCO programs onto next generation platforms, enabling wider integration and preserving program investment.  

Embedded virtualization with hypervisors is a proven means to consolidate multiple applications from a diverse supplier base onto a single chip or an array of processors. Hypervisors can be implemented on a wide variety of current military microprocessors and are communications link agnostic.

An embedded virtualization foundation based upon a robust hypervisor enables adaptive growth in capacity and spectrum to address the individual needs of each service, agency, or coalition partner constituency.  Without a virtualization foundation, developing new NCO planning or management platforms from the ground up is costly and would take years to define, get under contract, develop, and deploy.

To conceptualize a hypervisor, think of an iPhone or an Android device. An Android device allows multiple applications from multiple developers to run independently on a single smartphone device. Users can individualize their Android phones by selecting apps that meet their individual needs, and downloading these capabilities on demand as required.

An embedded hypervisor creates this same type of iPhone or Android application enablement, but in a wider, more open, and universal context.  Today there are flexible commercial off-the-shelf (COTS) hypervisors that can support simultaneous secure communications applications from different sources and suppliers using multiple operating systems, such as Windows, Linux, and Android on a shared compute device.  Like Android devices, these foundations can simultaneously support GSM, 3G, 4G, and other cellular links, along with a wide range of military communication channels and software defined radio (SDR) waveforms.   

Wind River embedded virtualization solutions are based upon open, global industry standards.  Unlike consumer and IT solutions, Wind River virtualization solutions optimize the physical silicon environment, with focused multi-core utilization, real-time performance and system robustness, enabling deployment of hypervisor-based critical infrastructure and control systems, with full support of demanding safety and security certifications at their highest levels, including Common Criteria EAL6+ and FAA DO-178B Level A.

These Wind River embedded virtualization solutions are operational today in more than 200 critical aerospace and defense programs worldwide and robustly consolidate a wide range of critical applications from global aerospace and defense suppliers.

For example, one Wind River virtualization solution, VxWorks 653, has achieved Federal Aviation Administration (FAA) RTCA DO-178B Level A for use on commercial jetliners, and is now used on the Boeing 787, P-8 MMA, and more than 40 other aircraft.  On the 787, Wind River’s virtualization foundation enabled Boeing to eliminate more than 100 line replaceable units (LRUs) and integrate applications from more than 15 different suppliers on a single compute platform, substantially compressing size, weight and power (SWaP) while reducing certification cost and risk.

Other Wind River customers are using Wind River virtualization platforms as a foundation for deploying multi-level security (MLS) applications on a single device.   This integration and separation of multiple security domains removes the multiple layers of dedicated, single-domain legacy hardware environments that makes multiple service, agency, and collation partner operations both expensive and unwieldy.

Wind River virtualization solutions have complete, open-standards-based toolsets for development, and support the robust insertion of new applications while minimizing the need for end-to-end platform testing.  These solutions support the Modular Open Systems Approach (MOSA) and have COTS strategies for insertion into high-security-critical (National Security Agency / Common Criteria) and safety critical (FAA RTCA DO-178B) environments.

Use of Wind River embedded virtualization platforms enable:

• The utilization of legacy program and system investments on new platforms
• Multiple defense supplier, multiple operating system integration
• The protection of future investments, rapidly moving to newer processors and environments
• Optimization of hardware platforms, consolidating multiple legacy systems / domains into one
• Improving operational security, safety, mobility, and real-time performance in smaller devices

More information on Wind River virtualization solutions can be found at:

Wind River Hypervisor: http://windriver.com/products/hypervisor/

Wind River VxWorks 653: http://www.windriver.com/products/platforms/safety_critical_arinc_653/

Wind River VxWorks MILS: http://www.windriver.com/products/platforms/vxworks-mils/

Unmanned Systems No Longer Require Human, or Canine, Participation

By Joe Wlad

Forty-plus years ago, when automatic pilots were first used to perform automatic landings of large aircraft, there was a joke that was circulated among pilots everywhere. Future aircraft would be manned only by a single pilot and a dog. The pilot’s job would be to feed the dog. The dog’s job would be to bite the pilot if she or he touched anything. Today, we’ve advanced well beyond that presageful joke, and airborne systems can now operate autonomously without human, or canine, participation.

One key event taking place this week, that Wind River is exhibiting at, is the Association for Unmanned Vehicle Systems International (AUVSI) North America, which showcases the latest trends and technologies in unmanned systems. This event consistently attracts a lot of attention and participation. In fact, this year’s show in Washington, DC is likely to have record participation, which is indicative of the trends we’re seeing in automated and unmanned systems designs.

Ever since hobbyists have demonstrated the ability to control model-sized aircraft using radio signals, engineers conceived of controlling larger-scale unmanned aircraft for both military and civilian purposes. A number of the research efforts for unmanned aircraft over the past two decades have now evolved into larger rate production, and in some cases, deployment in the Iraq and Afghanistan war zones. While this is a tribute to the engineers and architects of these designs, one negative consequence of this success is that we now have many unmanned systems that cannot easily coexist with manned aircraft because lack of standards and regulatory requirements for unmanned vehicles. Moreover, the systems in use today are not interoperable. In other words, each unmanned air vehicle is tied to a unique ground station which increases the cost of design and certification.

If you are wondering what rules govern the operation of unmanned vehicles in US National Airspace, the FAA has published operational air traffic policies in the form of a Notice, JO 7210.766 Unmanned Aircraft Operations in the National Airspace System. This document is intended for use by FAA personnel responsible for air traffic operations. Among many other things, this notice identifies some of the requirements unmanned vehicles must meet that share National Airspace with commercial and private aircraft. Since unmanned systems don’t usually comply with standard safety or airworthiness requirements, operators of unmanned air vehicles must obtain a Certification of Authorization (COA) from the FAA which will give the operator restricted permission to operate the unmanned aircraft. Typically, the restrictions include operation in non-populated areas, restricted or positive-control airspace and/or warning areas. Additionally, the operator must convince the FAA that the vehicle can be operated safely under all conditions including lost communication provisions and system failures. Each COA is specifically authorized by the FAA and requires a lot of effort on the part of both the applicant and the FAA.

The Department of Defense (DoD) and the FAA envision integrating use of unmanned aircraft in a more standard fashion so that systems can be certified at lower cost and become more interoperable. One unique characteristic about unmanned systems is that safety properties must be addressed for both the air vehicle and the ground control system. The Office of the Secretary of Defense (OSD) in the DoD has chartered a working group (WG) called the Unmanned Control Systems, Control Segment, or UCS. The goals of the UCSWG are to define standard, reusable, interoperable ground stations that can support a variety of unmanned aircraft. The UCSWG does this by defining the properties of a platform independent model (using a model-driven architecture) whereby services such as mission control, vehicle control, communication, etc, can be added to support each vehicle without modification to the underlying platform.  The UCS standard will have various interfaces based on a NATO standard, called STANAG 4586, which is specifically designed for UAV interface systems.  The current UCS efforts, called architecture 2.1, are planned to be complete by the end of 2011 but additional efforts are likely to continue beyond 2011.

Special attention has been given to the safety and security aspects of UCS and Wind River is playing a big role in helping to define the safety requirements for UCS. The working group has included standards and guidance from NATO, DoD and the FAA such as:

• NATO STANAG 4671: UAV Systems Airworthiness Requirements
• RTCA DO-178B: Software Considerations in Airborne Systems and Equipment Certification
• DIACAP: DoD IA Certification and Accreditation Process
• CNSSI 1253: Security Categorization and Control Selection for National Security Systems
• MIL-STD-882D: System Safety
• MIL-HDBK-516B: Airworthiness Certification Criteria

At its foundation, the UCS2.1 platform-independent model architecture is defined as a partitioned platform where separation is provided by a time/space partitioned operating system which supports open standards such as ARINC 653 or POSIX, cross-domain services for high assurance and mixed levels of safety criticalities. Additional layers of functionality such as configuration in accordance with RTCA/DO-297, middleware such as DDS or cryptographic services are also defined in UCS 2.1. Wind River’s VxWorks MILS platform, VxWorks 653 platform and Wind River Linux Secure and the Wind River Hypervisor all support the tenets of UCS 2.1, depending upon how a Platform Specific Model (PSM) is defined. Information assurance requirements could be either medium assurance cross domain communication or high assurance cross-domain communication depending upon mission requirements.

In the coming weeks, I’ll provide more information on the safety requirements and certification processes for UCS. Until then, you can learn more about UCS and the evolution of the architecture at: http://www.ucsarchitecture.org/page/home