Aerospace & Defense

Case study: Ultra Datel safety-critical avionics upgrade using COTS

By Paul Parkinson

I recently had the privilege of working with one of our partners, LDRA, and one of our customers, Ultra Datel, on writing a case study of their experiences of a mid-life upgrade of an existing avionics system.

What caught my attention was the fact that the existing system was uncertified, and the upgrade involved migrating the existing system to a commercial-off-the-shelf (COTS) and undertaking DO-178B Level B safety certification.

As a result, the project faced a number of development challenges because the pre-existing software and device drivers were not developed with safety certification in mind, and the code needed to be re-engineered and modified to meet safety certification requirements.

In the case study, we discuss the following development challenges and how they were overcome using the LDRA Tool Suite during the development of the safety-critical VxWorks application running on a GE Intelligent Platforms ruggedised PowerPC platform:

1. Porting to the VxWorks DO-178B safety-critical subset
2. Reduction of high cyclomatic complexity
3. Programming language subset compliance
4. Code coverage to meet DO-178B Level B objectives

The case study has now been published on the Wind River website on the Aerospace & Defence customers page (and the PDF file can be accessed directly here).

Quit Bugging Me: Cell Death.

By Mike Deliman

You're working from home.  You trigger a remote transfer - a single update file is sent via a standard transfer protocol.  Part way through the file transfer, the cell phone goes down - actually - all the phones connected to that cell concentrator... go down.  This would be a bad thing to happen.  It actually did happen in a laboratory environment.

In the lab, efforts to repeat the problem fail - until that same exact file is transfered.  Transferring other files works without a problem.  The thought becomes "perhaps there are characters embedded in the data stream that affect the software somehow - like XON/XOFF, Perhaps the software is somehow processing the data as it comes through?"

The contents of the file are now suspect, as well as the OS - perhaps reacting to the contents of the file.  Somehow, transferring -this file- causes resets, you can make the file a bit shorter, longer, change it's name, and it still resets the system. You start digging through the file itself.

In this case, in the file, you notice a particularly long field of repeating characters.  It doesn't mean anything until some time later.  One of the technicians relates a story - in his old office they used to have a nice Frame Relay connection to the outside world,  It was mostly reliable.  But... transferring certain files always lead to a need to reboot the modem.  You could transfer those -same- file if they were compressed. It was later found that in the uncompressed image there was a large bitmap, the bitmap - if edited - contained a huge field of "BBBBBB" capital B's.  The Modem was designed in such a way that if there were problems, you could send it a special key to make it shut down.  That special key?  A long string of "B"'s....

Is it possible that something in the data stream itself is triggering the problem?

After experimenting you find that there is indeed a long pattern in this file, and sending this pattern through the file transfer protocol causes the new Cell Base to crash.  Now you have a mystery - why does this exact pattern always cause the Cell Base to crash?  The software is still not yet clear, but now that we know it's something to do with the use of this one high-speed serial channel, we start debugging.

Eventually we start adding signal traces from the hardware.  It's found that while transferring the magic pattern, the PowerFail line on the Power Supply triggers, and the system resets due to the power alarm.  The only problem with this automatic system is... the power bus was just fine.

This brings the question:  how can transferring a specific pattern of bytes cause an incorrect power fail "reset" signal?  These functions aren't even related in any way!!

Digging into the hardware design now, you find that the high-speed serial I/O is laid-out along side some of the power sense circuitry.  It was just a fluke of the design.  Transferring enough data - with the right electrical patterns - across the high-speed serial actually caused a power-supply sense circuit to anomalously trigger, resetting the entire system.  There's some level of electromagnetic bleed-over, just enough that the right pattern repeating long enough induces the sensing circuit to believe it needs to reset the whole board - which it does.

The fix at this point becomes almost trivial.  The logic analyzer shows an extremely short transient captured by the sensing circuit.  This circuit is built / designed with programmable logic.  The fix is to program the logic to screen-out short transients and look for longer "real" signals.  In this way, the hardware doesn't need to be laid-out again and re-manufactured, an expensive option that would also delay the project.

[Thank you to A.G. for the story!]

In the Shadows of Giants

By Mike Deliman

When I was a child, the Apollos were flying, and the whole world was all about Mankind taking those first steps on Lunar soil. I remember my parents had this record, I think it came from a Time magazine. It was a little flimsy thing, noisy, and all it really was, was a speech. For whatever reason, that particular speech really impressed me. One part always comes to mind when I think of that speech, when I think of words of motivation.

 There is no strife, no prejudice, no national conflict in outer space as yet. Its hazards are hostile to us all. Its conquest deserves the best of all mankind, and its opportunity for peaceful cooperation many never come again. But why, some say, the moon? Why choose this as our goal? And they may well ask why climb the highest mountain? Why, 35 years ago, fly the Atlantic? Why does Rice play Texas?

We choose to go to the moon. We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard, because that goal will serve to organize and measure the best of our energies and skills, because that challenge is one that we are willing to accept, one we are unwilling to postpone, and one which we intend to win, and the others, too.

To me it's this last sentence. "We choose to go to the moon" not because we want to make the history books, not for personal glory, not just to say "we've been there and left our mark", but for the bigger reasons, for knowledge and wisdom, to push the edge of mankind's envelope higher, farther, faster, for the betterment of mankind. It's a mission of the greater good, driven by something more pure than a desire for more profits or a better corporate bottom line. It's of the stuff of nobility. It's like sailing off the edge of the map to prove the world is round. "Here thar be monsters."

It is nearly impossible for me to imagine what it must have been like to be part of those early space projects. We had no clue what we were getting into. The engineers, machinists, and assembly crews knew, though, that every step required their best efforts. The machines they were designing and building had to work, or the result would be pure disaster, the heroes of a nation, of generations, riding the top of a column of flame.

What a tremendous honor, and incredible responsibility, it must have been, then, to be a part of those teams. To be one whose work, as a small part of a huge team, is representing the best of humankind's intentions, and achievements. A single work marking a turning point in Man's journey, the point where he ceased to be a citizen of just a planet, and joined the cosmos, perhaps the greatest turning point up to that time, in history. Forging dreams, wrought into reality, to become the foundry of a new generation of achievement. From these projects were born rockets into space, satellites, and Astronauts.

During this era the Apollo engineers, test pilots, and astronauts did something no other generation did before or since: they left footprints on the Moon.

The Ares program represents a bold step into a new era of exploration and discovery. I am very proud of our engineers, test pilots, and astronauts who will leave the next footprints, and eventually build our first long-term encampments, on the Moon.

It is an honor to be a part of the Ares program.

First flight of the Boeing 787

By Paul Parkinson

Today, the Boeing 787 Dreamliner made its first flight from Everett, Washington. One of our Wind River colleagues, Chip Downing, was able to attend this historic event in person, and shot the following video:

This is the culmination of years of development of a completely new aircraft which uses many state-of-the-art technologies to significantly improve efficiency, operating range and passenger comfort.

For instance, the 787 employs an Integrated Modular Avionics (IMA) architecture using VxWorks 653, Wind River's world-class ARINC 653 compliant RTOS. This approach which drastically reduces the amount of space, weight and power (SWaP) required for the aircraft's on-board avionics systems. The reduction in weight of avionics systems and cabling results in a reduced fuel load requirement, or increased range for the same fuel load, and of course reduced CO₂ emissions. Similarly, the reduction in the space required for the avionics systems can increase the space available for passengers, luggage and cargo.

(If you want to know more about the 787 development and DO-178B safety certification approach, read Alex Wilson's recent blog, and for details of VxWorks 653, there's a white paper available for download here).

In addition, the composite fuselage not only helps to make the aircraft lighter (improving fuel consumption further), but also enables higher cabin pressures to be used, which will result in passengers feeling more relaxed and less fatigued. When coupled with the advanced air-conditioning systems and state-of-the-art Rolls-Royce Trent 1000 jet engines and noise-reductions technologies, this provides the promise of greater passenger comfort on long haul flights.

This is of course, just the start, as the 787 will continue to evolve through its operational lifetime, just as the 747 has done over the last forty years. So, I wonder what other technologies will appear in the future?

In the meantime, I'm looking forward to seeing the 787 grace the skies above the Farnborough Air Show and taking a flight on one with British Airways in the near future. Congratulations, Boeing!

Airbus A400M and Boeing 787 Dreamliner first flight

By Alex Wilson

Wow!

What a week for our customers in Europe and USA! Last week saw the first flight of the Airbus A400M Military Transport and today the Boeing 787 Dreamliner took to the skies!

Congratulations go out to Airbus, Boeing and all of their worldwide suppliers!

Our man on the ground at Paine Field, Everett is Chip Downing, Director of A&D Business Development and he managed to send us this excellent video of the event!

It will be interesting to follow these two aircraft as they go through their respective flight testing and enter service!

On the Avionics side, the 787 Dreamliner is the result of collaboration between Boeing and its suppliers to integrate multiple applications at different safety levels on the Common Core System. This strategy of avionics development follows the RTCA DO-297 role based development concept, allowing each application developer to work independently of each other and provide the necessary safeguards for the systems integrator to bring this all together in the final configuration for this historic first flight.

The independence of each application is fundamental to allowing them to be designed, developed , and tested in isolation. DO-297 provides guidelines for each role in building the safety case for the aircraft, and by having these independent “components” the applications can be tested in isolation before being tested as part of the final system. This save a considerable amount of time and effort in software testing terms and provides a solid foundation for the final system integration tests.

As part of the work to develop the 787 Dreamliner, Wind River worked with the team to expand and develop the ARINC 653 XML schema. The schema was originally provided as an example of how you might use XML for ARINC 653 systems configuration, but had a lot of missing links and cross-referenced information that made it all but impossible to use on a large scale systems such as the 787. The modified XML schema is now being adopted as part of Supplement 3 to ARINC 653 Part 1, in order for the benefits it provides to be shared in the Avionics community on future projects – this is what open standards are all about!

The backbone of the Common Core System is Wind River’s VxWorks 653 Platform. This includes the VxWorks 653 RTOS provides the fundamental components needed to build such a system based on the ARINC 653 standard. Wind River launched the safety critical version of VxWorks in 1999 for federated avionics, and followed on with VxWorks 653 in 2003 for Integrated Modular Avionics. As a COTS Software supplier to many industries, we wanted to develop the DO-178B Level A certification evidence for VxWorks 653 as a COTS solution, so that our customers could benefit from not having to re-certify the OS every time it was used. We came up with a unique hyperlinked DVD with our partners Verocel that allows customers to have a copy of all the safety related material in a fully traceable format that helps them to build the systems safety case. Included in this material are not only all of the safety related documents that need to be provided to the authority (such as PSAC, SAS etc) but also the software development folded, including all VxWorks 653 source code, test code and test coverage results.

Previous Press Releases from Wind River for these aircraft include:

2004 : Smiths Aerospace Selects Wind River for Use in Boeing 7E7 Common Core System

2006 : Wind River to Support Development of Military Communications Device by EADS CASA for Airbus A400M and MRTT Tanker

2006 : Wind River Platform for Safety Critical Devices To Power Indra Sistemas Aircraft Identification Project for A400M Military Aircraft

2006 : Innovative Design and Safety-Critical Software Enable Refuelling Wing Pod