Aerospace & Defense

Northrop Grumman X-47B UCAS-D Running on Wind River VxWorks Catapults from Aircraft Carrier

By Chip Downing

Today, the Northrop Grumman X-47B unmanned aircraft achieved a successful catapult launch from the deck of the USS George H.W. Bush carrier, the first of its kind in aviation history.  This marks a very proud day for Wind River knowing that our VxWorks real-time operating system is a key technology for this aircraft, developed as part of the Navy’s Unmanned Combat Air System Carrier Demonstration (UCAS-D) program.

Northrop Grumman's X-47B is a tailless, strike fighter-sized unmanned aircraft currently under development for carrier operations. VxWorks serves as the foundation for the Common Core System, the backbone of UCAS-D computers, networks, and interfacing electronics on the X-47B. Built on VxWorks, Northrop Grumman engineers were able to rapidly create, deploy and maintain the safety-critical control system. 

This is a significant achievement following a series of proof of concept demonstrations to assess the viability of an unmanned system's operation aboard a carrier.  The video of the X-47B doing its first carrier launch can be seen here.

This started with the first flight in July 2012 at Pax River Naval Air Station, after several flights it then performed the first land based catapult launch in November 2012, and performed its first arrested landing in May this year. As well as flight testing, the X-47B performed sea trials and performed a series of tests, included taxiing the X-47B on the flight deck, maneuvering the aircraft up to the ship's catapults, taxiing the aircraft over the ship's arresting cables, conducting fuelling operations and mixing the X-47B with other manned naval operations.  And now this historic catapult launch milestone can be added to the list.

Congratulations to the U.S. Navy and Northrop Grumman!

 

For additional information from Wind River, visit us on Facebook. 

Securing Critical Infrastructure with MILS

By Paul Chen

On February 12, the White House released the Presidential Policy Directive 21 (PPD-21), Critical Infrastructure Security and Resilience. The DHS website describes PPD-21 as “advancing a national policy to strengthen and maintain secure, functioning, and resilient critical infrastructure.” Sixteen different critical infrastructure sectors are identified, including: Chemical, Communications, Energy, Financial Services, Healthcare and Public Health, Food and Agriculture, Nuclear Reactors, Transportation, and Water and Wastewater Systems.

On the same day PPD-21 was released, President Obama also signed Executive Order 13636 for “Improving Critical Infrastructure Cybersecurity.” The Executive Order directs NIST (National Institute of Standards and Technology) to develop a framework for “reducing cyber risks to critical infrastructure,” for which they have issued an RFI and plan a workshop in late May.

And on March 26, the BSI (Bundesamt für Sicherheit in der Informationstechnik, the German Federal Office for Information Security) published the Protection Profile for the Gateway of a Smart Metering System. Such devices will securely collect, process, and store information from smart meters, adding security to smart electricity distribution grids. The protection profile notes that the threat from a remote cyberattack is much higher than that from a local physical attack, since the attacker in network has the potential to compromise not just one, but many components of the infrastructure, or even the corresponding grid.

These developments highlight the focus on improving critical infrastructure security as attacks from cyber-terrorism have increased over the last decade and, alarmingly, in the past year on power, water, and nuclear systems. A recent report states that, indeed, most cyber-attacks now target critical infrastructure, moving “away from hacking and financially motivated crime” to attacks to “deny, disrupt, and destroy” service. For most of us, even the most destructive cyber-attacks like Stuxnet are fairly remote and don’t impact us; but if critical infrastructure services are denied, disrupted, or destroyed, cyber-attacks could become devastatingly personal.

Critical infrastructure systems often use distributed control systems (DCS), industrial control systems (ICS), and supervisory control and data acquisition (SCADA) systems for process monitoring and control. Usually networked and often connected to the public Internet, these DCS, ICS, and SCADA systems are potentially vulnerable to cyber-attacks. Developing more secure DCS, ICS, SCADA systems, and other components of critical infrastructure using the MILS (Multiple Independent Levels of Security) architecture can help improve the overall security of such infrastructure: I explain how below.

The MILS architecture enables security architects to configure the system following the principle of least privilege, which requires that each system component be granted access only to the resources needed to complete its functions. This enables the development of devices and systems that are more resilient against attacks, and better at mitigating potential damage from defective or malicious software. Also, the MILS architecture uses a separation kernel to provide time and space partitioning, information flow control, and fault containment. By providing these capabilities, security-critical components (such as a data guard or process controller) can be separated and protected from less secure components (such as an Internet gateway or network interface) when these components run on the same hardware platform to reduce size, weight, and power (SWaP) requirements. And by reducing SWaP, MILS allows devices and systems to be more cost effective to develop, deploy, operate, and maintain.

Underscoring Wind River’s commitment to delivering trusted systems with built-in security capabilities, we have just launched VxWorks MILS Platform 3.0, which implements the MILS architecture with a secure, hypervisor-based separation kernel compliant to the U.S. Government Protection Profile for Separation Kernels in Environments Requiring High Robustness (SKPP), version 1.03. Although NIAP has sunset the SKPP as the basis of a component-level certification process, NSA continues to recommend the use of separation kernels for security-critical systems, making VxWorks MILS Platform an appropriate choice for use in critical infrastructure sub-systems. And to support a wide range of potential evaluation activities, VxWorks MILS Platform provides a complete set of artifacts to support a system-level evaluation process, based on the internationally recognized Common Criteria.

VxWorks MILS Platform 3.0 is an ideal foundation for building secure, cost-effective, and evaluatable DCS, ICS, SCADA, and other security-critical systems. And it’s available today to help secure national critical infrastructure.

 

For additional information from Wind River, visit us on Facebook. 

Avionics Europe 2013 Conference

By Paul Parkinson

Last week I attended the Avionics Europe 2013 conference, which was held in Munich for the last time perhaps (as it is moving to Abu Dhabi in 2014).

The theme of this year's conference was 'Tackling the Challenges in Avionics: Single Sky Many Platforms,' which continued to focus on the growth in air traffic across Europe and challenges arising for air traffic management and navigation. However, rather than continuing to focus on the regulatory challenges as in 2012 (which I have discussed previously), there was a shift in emphasis towards the implementation of technologies such as SESAR.

One of the keynote speakers, Captain Sascha Unterbarnscheidt, A320 Captain and Director Operations Support, Lufthansa Germany made some very interesting observations in his address 'Single European Sky - Delivery to Daily Operations.' In particular, how the fragmented European air space (compared to the United States), led to ATM inefficiencies in 2011 resulting in 17.9m minutes of ATM delays, 8.1m tonnes of wasted CO2, and increased costs of around 5billion Euros (with the effect on passengers of delayed flights, longer flight times, wasted fuel and increased noise). He then went on to explain how the increased levels of automation and productivity through SESAR would result in increased capacity, reduced costs and lower accident rates.

The impact and benefits of SESAR were also discussed in a number of other presentations at the conference, but the one which really caught my attention was the one which proposed changing the ATM model from peer-to-peer communication over proprietary network infrastructure, to making all airborne and ground-based information available to all users on (publicly-accessible) IP-based networks. I was alarmed at the obvious security implications of this approach, but the potential cyber security threats and their mitigation weren't even mentioned during the presentation. When networking critical infrastructure systems together, security must be considered from the outset rather than as an afterthought!

I also presented a conference paper, 'Use of ARINC 653 and ARINC 661 in Developing a Touch Screen Avionics Display,' which I had co-authored with David Randall of Presagis. This included a discussion on the requirements of the upgrade of a cockpit avionics display for a military rotary-wing platform, and the use of standards-based architectures including ARINC 653 and ARINC 661 with COTS hardware platforms. The paper also presented the experience gained by the use of these technologies on a European military helicopter programme, including the benefits in overcoming hardware obsolescence and the contributions towards reductions in operational and through-life costs.

If you weren't able to attend the conference, we will make the paper available on the Wind River website soon.

For additional information from Wind River, visit us on Facebook.

The Advent of Multi-core MILS

By Paul Parkinson

It has been a rather long time since my previous blog post. I intended to post a blog before the holidays regarding our partner Curtiss-Wright's announcement about VxWorks MILS support on the VPX6-187, but I simply ran out of time! So here it is as my first blog post of 2013.

The Curtiss-Wright new release was actually quite a game changer. To the casual reader, it may just appear to be about the release of another board support package (BSP) on a leading-edge COTS processor card, but the fact that this BSP supports multi-core for a MILS architecture is what makes this announcement so significant.

When the MILS software architecture was proposed in 1984 by the computer scientist Dr. John Rushby, microprocessors at the time were inherently single-core, and computing performance advances were being driven by clock speed increases and die size, at a rate following Moore's Law.

Over the last decade, single-core processors with robust MMU partitioning have become sufficiently performant to enable viable MILS separation kernels (SK). In recent years, Wind River has implemented VxWorks MILS on single-core processor architectures (PowerPC MPC8548), and on multi-core processors, but only running on a single core (dual-core PowerPC MPC8641D, quad-core Intel Core i7).

However, with the VxWorks MILS Platform, Multicore Edition, the VxWorks MILS separation kernel now runs on all eight cores of the Freescale QoriQ P4080 processor concurrently. Yes that's right, I am talking about (MILS & multi-core) rather than (MILS XOR multi-core). This enables the integration of many MILS solutions on a single processor, creating reduced size, weight and power (SWaP) benefits - even high assurance security-critical systems have tough performance requirements.

The advent of multi-core processor architectures over the last few years has had a dramatic and disruptive effect on the embedded market. This has provided significant benefits in terms of reducing size, weight and power (SWaP), but has also presented some interesting challenges for safe and secure application domains.

For example, the global aerospace market has very mature processes for DO-178B safety-certification on single core processors. Similarly, the security community is approaching maturity for Common Criteria security evaluation on single core processors. But both segments are challenged when driving multicore systems through their respective processes.

There has also been an emerging trend in recent years of individual systems needing to meet both safety-certification and security evaluation, and now with the emergence of multi-core, this presents some new regulatory challenges, but the benefits will be worth the effort.

This convergence is discussed in more detail in the white paper 'Safety, Security and Multicore' which is available for download from the Wind River website.

For additional information from Wind River, visit us on Facebook.

The New FACE of Avionics

By Chip Downing

Earlier this year, Wind River announced its support of the Future Airborne Capability Environment (FACE) technical standard, which hopes to resolve two fundamental problems with military procurements.

First, current aviation systems are typically developed for a unique set of requirements by a single vendor for a single aircraft, resulting in limited portability of software components, increased costs, and creating barriers to competition within and across airborne systems.

Second, the military aviation community has not created standardized architectural and software interface standards to sufficiently enable portability of software components across DoD aviation systems.  Commercial aerospace suppliers have standardized on open common core platforms based upon ARINC 653, which is a standard API for integrated modular avionics (IMA), but this has simply not occurred in military avionics systems.

The FACE technical standard will create an open, modular, multi-vendor software environment enabling portability and reuse of software components across multiple programs and platforms.  Combining this technical standard with a the FACE Business Guide will expand the selection options for military software components, reduce up-front procurement costs, reduce system integration cost and risk, and reduce upgrade and technical refresh costs.

To read the full blog post visit Military Embedded Systems

Identifying Backdoors in Production-Ready Code

By Ido Sarig

The security world is abuzz with news about a “backdoor” - undocumented  access to its programmatic interface -  found in a popular FPGA manufactured in China and used in US military applications.

Whether you are concerned that this is a deliberate Chinese plot to attack Western militaries, or relieved to hear that this is just a "common" backdoor, put in for debugging purposes, you should take note of the following:

"Backdoors are a common problem in software. About 20% of home routers have a backdoor in them, and 50% of industrial control computers have a backdoor. The cause of these backdoors isn't malicious, but a byproduct of software complexity. Systems need to be debugged before being shipped to customers. Therefore, the software contains debuggers. Often, programmers forget to disable the debugger backdoors before shipping.” 

Sometimes, this is not an inadvertent omission. Developers may deliberately leave “test APIs” in the code, thinking it may be useful in the future, for diagnostics, should a problem surface at a customer site.

One of the key benefits of an automated software testing solution is its ability to easily identify such debug APIs and backdoors that are inadvertently (or worse – deliberately!) left in production code.  For example, Wind River Test Management can analyze uninstrumented, production-ready binaries – the same code you will be shipping to your end users after all the “debug only” APIs should have been removed – and provide you with detailed reports on the coverage achieved by your entire test suite running against that binary image. If there are any “debug-only” APIs in the code, they will typically not be touched by any of your  test cases, since they have no requirements associated with them and hence no test cases to validate those requirements. They will be quickly highlighted by Wind River Test Management’s reports.

Additionally, using Wind River Test Diagnostics (a system that links product development teams in an intelligent, collaborative workflow so they can efficiently validate embedded devices and rapidly resolve issues) you do away with the need to leave such backdoors in the code for diagnostic purposes in the first place. Utilizing our patented Sensorpoint technology, Wind River Test Diagnostics can dynamically add diagnostic code  to a running, uninstrumented binary, delivering you with all the needed diagnostic information without the security risk of a backdoor.

The good news is that when issues like this arise, it gets the conversation started, and it is a very important conversation to be having.  I’d be interested know what you’re hearing.

 

For additional information from Wind River, visit us on Facebook.

Securing Android for the Battle Space

By Tim Skutt

Armed conflict has radically changed.  Remotely operated unmanned vehicles and cyber warfare highlight this change.  Combatants can launch an attack anywhere from a few hundred meters away to half a world away with the same devastating results.  One of the fascinating – and scary – parts of this change is that the trigger firing the weapon has become the Enter key on a keyboard or a finger press on a touchscreen.

Essentially, the geography of the battlefield now includes the mobile devices we carry – whether we carry them into the physical front lines being fought with kinetic weapons, or the virtual front lines that extend to our corporate or even home offices. 

Global defense organizations recognize the value of commercial smart phone and tablet capability for deployment to soldiers in the battlefield, wherever that battlefield may be. The challenge of securing the commercial capability and mobile platform for warfighter use requires end-to-end system threat assessment and incorporating embedded device strategies to minimize cyber-attacks and maintain mission-critical communications.

Protecting mobile system services from disruption, corruption, espionage, and unplanned behavior becomes exponentially important to drive successful missions and preserve lives. Battle readiness for Android platforms for deployment in theater requires device developers to take a more holistic approach to device security—one that considers security issues at every layer of the technology stack—from silicon to virtualization to the operating system, the network and communication stacks, and the application layer.

Securing mobile ad-hoc tactical edge devices, as well as mobile devices on commercial networks, requires leveraging advancements in trusted silicon capability, extending certified secure operating system features to Android, and layering in application level white listing functionality into the secure embedded system fabric.

To address the unique challenges of bringing commercial mobile device capability into the battle space and the key considerations in delivering these platforms into secure net-centric mobility solutions, a holistic approach is highly valuable.  This includes threat and risk assessment, technology solutions that counter those threats (and still deliver the benefits of commercial mobile platforms), and testing and verification frameworks that enable secure devices to be quickly verified and approved.  A holistic approach will support mobile devices and services in the battlefield of today and tomorrow.

I recently presented on this topic at the Systems & Software Technology Conference in Salt Lake City, Utah, a Defense-focused event which provides information and training on systems and software engineering issues and technologies, and can tell you first hand that it is a discussion that is top of mind for many.  I believe the combination of Wind River’s Android expertise with our extensive background and technologies for the defense space puts Wind River in a unique position to address the challenges and key considerations in securing Android for the battle space.

 

For additional information from Wind River, visit us on Facebook.

What is the Real Impact of DO-178C and ED-12C?

By Joe Wlad

DO-178C and ED-12C are now released.  What does this mean for Wind River and its customers?

Now that RCTA DO-178 and its European equivalent, EUROCAE ED-12, have been updated after nearly twenty years, many are wondering, what is the impact to Wind River and our customers?  We’ve provided our customers with products and services based on DO-178B and ED-12B guidelines for over 10 years and have deployed certified VxWorks solutions on over 250 aircraft programs.  With the arrival of DO-178C and ED-12C it’s really business as usual for Wind River and we will incrementally adopt the standard in our future certification evidence offerings. Yes, the new release of DO-178 and ED-12 compel many to ask questions about how we comply, what our roadmap for approval is, and how we plan to support our customers now and in the future.

Here’s a short summary of what has changed and what we can expect in the near future:

1. First and foremost, DO-178C/ED-12C has backward compatibility with DO-178B/ED-12B. They both have the same set of objectives and software levels. Wind River and Verocel have always applied rigorous interpretations of DO-178B and ED-12B to our existing certification evidence that won’t make us vulnerable to any revised guidance called out by DO-178C and ED-12C.  So our DO-178B and ED-12B certification evidence today is fully compatible with DO-178C and ED-12C.   What has changed is that the certification authorities have adopted guidelines for alternative technologies (such as object oriented design) and alternative processes (model-based development and formal methods) which were previously published in other guidance material. The guidelines for these technologies are now published in four other RTCA and EUROCAE documents called:

• DO-330/ ED-215, Software Tool Qualification Considerations
• DO-331/ED-216, Model-Based Development and Verification Supplement to DO-178C and DO-278A
• DO-332/ED-217, Object-Oriented Technology and Related Techniques Supplement to DO-178C and DO-278A
• DO-333/ED-218, Formal Methods Supplement to DO-178C and DO-278A

2. The one significant change for Wind River in our DO-178C and ED-12C certification evidence is that all requirements for verification tools, such as code coverage tools, and development tools, such as code generators, are moved into formal RTCA document, DO-330 (EUROCAE ED-215).

All of our core DO-178B/ED-12B certification evidence that we provide today in VxWorks Cert and VxWorks 653 meet the requirements of DO-178C and ED-12C today. Our certification evidence includes verification tools (such as our debug agent and test harness) and development tools such as our XML compiler.  As we create our next generation of certification evidence we will enhance it to demonstrate compliance to DO-330/ED-215 and DO-332/ED-216.  Our first evidence based on this new format will be VxWorks Cert 6.6.4 that will be released later this year.  

3. Since most developers use some tools for verification of their software, future developers will need to demonstrate compliance with DO-330, even if they are using a previously qualified verification tool such as a coverage analyzer. DO-330 now defines five qualification levels for tools (TQL-1 through TQL-5) and objectives for each level depending on the software level of verification. The total number of objectives in DO-330 exceeds the number of DO-178B objectives in some cases. This means that developers who previously qualified tools using Tool Operational Requirements and Tool Qualification Documents will also need to produce other documents required by DO-330 and show a compliance matrix to the applicable objectives and then have these data items approved by the certification authority. In short, qualification of tools has become a much more formal process in DO-330 than it was with DO-178B.

4. While the core DO-178C/ED-12C document was not changed substantially, there are changes to the guidance that may impact how some companies demonstrate compliance. For example, it is expected that developers will create low-level requirements that can be explicitly tested and it may no longer be permissible to test only high level requirements and demonstrate source code coverage. Moreover, one would also need to create robustness requirements which would also have to be tested. In these cases, special tools may be required to stimulate these conditions. Wind River’s Test Management tools and Simics tools could be employed to assist in robustness verification. Other areas of DO-178C/ED-12B which may require new attention involve requirements for backward and forward traceability, parameter data verification (akin to MCDC for Level A) and clarifications on independence.

5. Some developers who use object oriented design will have to demonstrate compliance to DO-332 and others who chose to use model-based development or formal methods of verification will have to use DO-331 and DO-333, respectively.

6. The adoption of DO-178C/ED-12C by our customer base will occur over a period of years.   The FAA must first publish a revision to AC 20-115B, recognizing DO-178C, then the FAA would need to update the scores of Technical Standard Orders (TSOs) that currently call out DO-178B.  In the meantime, many avionics developers will make minor revisions to already-certified products and the easiest way to do that is to grandfather in the use of DO-178B. We expect that DO-178C will be first adopted on new projects after the FAA updates AC 20-115 and the applicable Technical Standard Orders, which we predict will occur later in 2012.

How the release of DO-178C/ED-12C and its supplements impacts you depends upon what technologies you use and what development processes you use. You can trust that Wind River is well prepared to embrace DO-178C/ED-12C and this is a wonderful opportunity to engage Wind River Services to assist you with a formal program modernization effort which requires compliance to DO-178C/ED-12C.

 

For additional information from Wind River, visit http://www.facebook.com/WindRiverSystems.  

Avionics Europe 2012 Report

By Paul Parkinson

I've just got back from the Avionics Europe 2012 conference and exhibition which was held in Munich.

The theme of this year's conference was 'Common Sky: Operating in One Air Space' focussing on the growth in air traffic across Europe, the challenges arising for air traffic management and navigation, and the development of SESAR air traffic management technologies.

I was keen to hear to how changes to the high-level policies would drive regulatory changes and drive technology requirements.

I didn't have to wait very long, as in his keynote speech, Brigadier General Hans-Georg Schmidt (Vice Commander of 1st German Air Division, and Chairman of the Military Air Traffic Management Board of EUROCONTROL) discussed the implications of the integration of unmanned systems (UAVs, UCAVs) into non-segregated airspace. He discussed the need for unmanned systems to be "sufficiently safe as not to reduce the overal safety of airspace," and said that unmanned systems "must be proven to be safe before their introduction into this environment." (The keynote speech is discussed in more detail by John Keller, conference chairman, in this blog post).

This subject of UAV safety certification was covered in more technical detail by Richard Seitz of Cassidian in his presentation on 'UAV Computing'. He discussed the differences between flight software on piloted aircraft (which leaves the ultimate decision to the pilot) and flight software in unmanned systems which becomes safety-critical in the case of datalink loss,  and the need for RTCA DO-178B / EUROCAE ED-12B safety certification of UAV flight software. 

It was encouraging to see the subject of UAV safety and the need for software certification being acknowledged, as this was a topic which I had also raised in my conference paper  in the context of combined safety and security requirements for unmanned systems (for details see my previous blog).

The other recurring theme at the conference which caught my attention both in the conference and in the exhibition, was the technology disruption of multicore processor architectures, which provides some exciting opportunities for reducing the size, weight and power (SWaP) of avionics systems, but also presents new challenges for hardware and software safety certification. However, there's now significant momentum in the research into these areas, and the experience gained should lead to regulatory guidance and adoption in the near future.

So overall it was an interesting and enjoyable conference, not least for the fine Bavarian hospitality!

Avionics 2012 conference

By Paul Parkinson

It's been a long time since my previous blog, as unfortunately I've been engrossed in a number of projects!

However, I have just got time to mention that I'm really looking forward to the Avionics Europe conference in Munich on 21-22 March. The conference programme is pretty packed, covering cockpit avionics and technologies for civil and military aircraft; and aircraft, spacecraft and UAV sensor payloads, diagnostics and certification.

I will be presenting a paper on "A Secure Virtualisation Approach to Support Multi-Level Secure Systems, Software Reuse and Incremental Certification" in the Embedded Software session on Wednesday afternoon.

The paper addresses how secure virtualisation approaches can be used to implement a system architecture to securely partition applications and data of different security domains on the same system (such as national Secret and NATO Secret data), whilst enabling the reuse of previously developed software applications and existing intellectual property in an open standards-based communications environment. The paper also includes a discussion on the requirements for supporting incremental safety-certification under RTCA DO-178C / EUROCAE ED-12C and Common Criteria security evaluation at high evaluation assurance levels, and the implementation architecture to support a role-based development process.

Wind River will also be exhibiting at the conference, so why not drop by our stand for a chat and to see a cool avionics display demo?