Bill Graham

Updates to our VxWorks MILS platform, including a new High Assurance Network Stack

This week we announced the latest update to our VxWorks MILS Platform, (for Multiple Independent Levels of Security) which includes a new High Assurance Network Stack (HANS) and guest OS support for Wind River Linux. In a previous post I discussed the growing importance of security in embedded systems. However, in so-called high assurance environments used by military and government organizations, security is an absolute requirement.

Our VxWorks MILS product provides highly secure partitioning of a system into high, medium and low assurance virtual systems (or boards) that can be high, medium, or low assurance, as needed by the customer's application (hence the "multiple" and "independent levels" in Multiple Independent Levels of Security). VxWorks MILS has been developed in accordance with the U.S. Government Protection Profile for Separation Kernels in Environments Requiring High Robustness, version 1.03 (SKPP) and is officially listed by NIAP (National Information Assurance Partnership) as being in evaluation to EAL 6+/NSA High Robustness under the CCEVS. Until the advent of a software MILS architecture technology, supporting multiple levels of security was done with duplicated hardware - separate physical systems that provided the "partitioning" required. With the MILS software architecture, it is now possible to consolidate various systems with different security requirements onto one common hardware platform. The reductions in SWAP - size, weight and power advantages - are huge, as are the reductions in security evaluation costs. The following diagram shows a possible VxWorks MILS architecture:

 

Previous versions of VxWorks MILS already provided VxWorks Guest OS support, so the addition of adding Wind River Linux expands the available operating system choices.

The High Assurance Network Stack that is part of our latest VxWorks MILS update which provides secure network connectivity for the high assurance partitions via the existing network connection on the device. The High Assurance Network Stack lets applications of different security domains share a common physical network connection. This is done by handling the physical and low-level interface to the network within a high assurance partition and relaying data to medium and lower assurance target partitions, which contain the protocol network stacks. Secure and insecure Data from different domains can be discriminated and kept separate in the network data by using a discriminator, such as a IEEE 802.1Q VLAN tags as described in IEEE 802.1Q. The following diagram illustrates the HANS High Assurance Network Stack architecture in VxWorks MILS:

Clearly, more guest OS choices for VxWorks MILS provides a mechanism to reuse existing applications and leverage existing in-house development resources. Adding Wind River Linux allows a huge variety of custom and off-the-shelf applications to be run, at a medium and low assurance level environment. The addition of the High Assurance Networks Stack is critical not only for providing secure connectivity, but for enabling Cross Domain Solutions (CDS). CDS is a large topic on its own, but in a nutshell provides the ability to access or transfer information between two or more security domains (CNSSI 4009). A key to making CDS a reality is secure partitioning and network separation provided in by VxWorks MILS.

VxWorks in Education: University of São Paulo, Brazil - Part 3

In the third and final part of my interview with Professor Glauco Caurin we discuss multicore and virtualization and why they are working with us on their research projects.

Q: Are your students learning about multi-core processors  and programming? What about multi-OS systems including virtualization, i.e.  systems that have more than one OS on a single processor?

We are not teaching our students yet about the programming of multicore processors. But we have experience in the past with multiprocessing systems programming using X-METH.

It is in my medium-to-long term plan to insert multicore programming into our courses. It also depends on the time we take to have enough students that are skilled with the "basics".

Q: Are you  starting to use or design with multicore processors in your projects? Do you  think multicore and multi-OS systems are an important part of the  curriculum?

Regarding virtualization, we did some initial tests (not in real time) using virtualization and different OS for Human Machine Interaction. I am really impressed with this possibilities,

 I am really interessted in the future applications of this promising technology.

Q: Prof. Caurin, why do you choose Wind River as a partner in your courses and projects? What are some of the characteristics you were looking for in our software?

As I described, we have been working with RTOS since the 90’s especially with systems that were proposed in academic context at ETH (Swiss Federal Institute of Technology) like XMETH, XOberon, JBed and so on. We have also developed our own open source version of a Linux patch for Real Time applications here in Brazil. But my concern with the students and the research projects were related to their continuity [of software, OS, tools]. How is it possible to convince a new student to use a specific IDE? And further how could we take advantage of the work done previously. 

Every problem detected was solved with a new RTOS version [in-house developed]. Not rarely, the new version had commands and characteristics that were incompatible with the previous versions. Additionally, each new PhD student wanted to test a different open source RTOS, or even worse, some were suggesting they could make a better OS. 

As a consequence we were always starting from zero with every new robot project. 

Good results were achieved using Wind River Products and Tools, so we decided to focus on this software, and since then all the classes, students and researchers are invited to use them as a standard. We increase the information exchange between the students and our productivity. The availability of manuals and documentation was a strong point in our decision. I believe now we are able to propose and conduct a larger number of research projects in parallel.

Q: Do you plan to continue to use Wind River Products for teaching and research? Are there any interesting future projects or ideas you can share? 

Yes we are strongly investing in training human resources that will work in the next 5 years at our Lab. We are very excited with the possibility of new partnerships with different Universities in the USA. For example, the new project that we are starting together with the Newman Laboratory for Biomechanics and Human Rehabilitation at MIT. They have a lot of experience combining robot assistance and video games to motivate and improve stroke patients rehabilitation process. 

- end of interview - 

As you can see, there are some impressive things going on in the engineering program at USP! I wish to thank Professor Caurin for taking the time for this interview and for taking full advantage of our Wind River University program. If you have some exciting teaching and research going on with Wind River products let me know. If you are interested in using Wind River products in the class room and lab, take a look at our Wind River University Program.

VxWorks in Education: University of São Paulo, Brazil - Part 2

In part two of my interview with Professor Glauco Caurin, we talk about some the research projects that they working on and how they are using VxWorks and other Wind River products:

Q: Tell us about the research projects you have make use of Wind River Products. Can you give us more detail on the Kanguera, the five fingers robot hand? Which of our software are you using? Where is it used and why?

We are using VxWorks now for some years with different platforms. More then 8 years ago we started the first research projects with the hardware funded by FAPESP using VxWorks donated by Wind River as the RTOS. The projects were related to the development of robot grippers and hands. At that time we were using Tornado as IDE. Today our  goals in this area  are still the same: to create technologies for remotely operated maintenance in the deep sea supporting oil exploration. Most of the Brazilian oil reserves are more than a kilometer below the sea level. The recent accidents in the Gulf of Mexico [and the need for robotic assistance] reinforce the importance of our ideas. 

At dangerous and difficult places robots are very strategic technologies. Now we are developing the fourth generation of our robot hands. The new Kanguera robot hand (image below) will have a more robust mechanical system and also a higher number of sensors, including tactile capacity. Currently we are using Wind River Workbench as the IDE and VxWorks 6.7 [as the RTOS]. 

We are trying to establish a single platform for the development of the different robotic projects we have. We are very impressed with Workbench. A single platform that can be used from on-chip debugging level, passing through the BSP development, device drivers and reaching the application software.

We are also giving priority to the CAN communication protocol that will favor our communication with other Lab partners like Maxon Motors in Switzerland with their position controllers and servomotors.

 

Q: This project SENA, sounds very interesting. This is in conjunction with FIAT Brazil, what else can you tell us about it? How is Wind River software being used and where?

FIAT also uses the CAN bus protocol for communication of the Stilo model that was donated to our Lab. In this sense we are trying to use our knowledge to read the existing sensors in the car by combining their data with the additional information from the laser scanners and finally generating the desired actions with the actuators. For this project the students are working on the development of device drivers for the CAN protocol.

In this project we are considering the possibility of developing home made BSP for the computers that were donated by Beckhoff (also a project sponsor). Today this hardware does not run VxWorks.

At FIAT they are also using National Instruments LabView and CompactRIO for car electronic subsystems tests together with a platform called Veristand for HIL. All these components are running on VxWorks. We are working together trying to increase test frequency limits via direct access to VWorks. That is my contribuition to the project. The SENA Project is leaded by my colleague Prof. Marcelo Becker who is our mobile robotics specialist at the Mechatronic Lab.

 

Q: What can you tell us about the lower limb exoskeleton project? Again, how is Wind River software being used and where?

The lower limb exoskeleton project (pictured below) aims to develop a robotic device to promote assistance and/or rehabilitation for disabled people, focusing on patients who have suffered a stroke. Actually, the apparatus consists of an orthesis for the lower limbs - an external mechanism the patient can wear - whose mechanical joints can be moved by electrical motors. The control of the robotic system can be configured in such a way the patient can be assisted (no rehabilitation is performed in this case) or he/she is asked to execute a given movement with some constrains imposed by the robot, a typical task of a rehabilitation procedure. The robot aided rehabilitation framework also includes the use of computational games to motivate the user during the rehabilitation session.

The Wind River software is being used to access all signals generated by the exoskeleton sensors (encoders, gyros, force sensors, etc.) and to control the electrical motors to the desired positions, specified by a high level command which considers the walking stability and the patient intention. The hardware platform is a GE/Fanuc CV1 PowerPC, with analog and digital I/Os and quadrature encoder modules.

It is important to mention that lower limb exoskeleton Project is lead by my colleague  Prof. Adriano Siqueira who is our control specialist at the Mechatronic Lab.

 

...to be continued in Part 3

What else is new in Tilcon Graphics Suite version 5.8?

Although adding OpenGL 3D support was an important part of the recent Tilcon 5.8 update, there's other things to talk about in the new release. It adds other new capabilities such as increased hardware, driver and target OS support, and image rotation capabilities.This is also the first release of the Tilcon Graphics Suite to include source code for customers wanting to tune the Tilcon GUI engine configuration and build.

Tilcon Graphics Suite 5.8 now includes the Wind River Media Library (a.k.a. WindML) which is a graphics and audio framework that provides a high degree of architectural and hardware independence for application code. WindML provides interfaces to (including Tilcon GUI engine) on VxWorks, X.Org, OpenGL (including accelerated 3D support from our partner Presagis) and 2D UGL APIs plus various input devices such as touch screens, pointers and keyboards. WindML provides a common interface for graphics display drivers and acts as the abstraction layer form application to hardware devices. The advantage of this for Tilcon customers is the wide range of available graphics drivers for VxWorks and X.org and the abstraction provided means Tilcon apps don't need modification when switching hardware. Future driver support is simplified due to the WindML abstraction layer and the common driver architecture.

This release reintroduces runtime support for Microsoft Windows CE and XP and continues our support for Wind River Linux and other Linux distributions. Tilcon 5.8 is available for Power Architecture, ARM and Intel Architecture (including Atom) devices. For this release we have introduced support for the following reference platforms:Texas Instruments OMAP 3530, Freescale i.MX 31 Lite and MPC5121e, Portwell Nano, and Intel Navy Pier

Image rotation capabilities are new for version 5.8 and spport 360-degree rotation for raster images using APIs or the Tilcon Interface Design Tool.

Here's another video showing a series of example UIs designed with Tilcon and running on the Tilcon GUI engine:

VxWorks helping to bring LTE Down Under

Our customer, Huawei, recently announced they have been chosen to deploy Australia's first LTE network. This is great news because Huawei's LTE base stations are built using VxWorks - the VxWorks Platform for Networking Equipment to be exact. It's also great news because we are starting to see the fruits of our customers' efforts come to reality and it stands as a validation of our investment in next generation networks. Moreover, this is the latest in a set of successes we've had with VxWorks in the networking space.

In particular the technology investments we've made such as mobile IP, multicore and packet processing offload acceleration. What is also encouraging is that Huawei is standardizing on our solutions across product lines sich as core network, GSM, optical and access products. In fact, we did a nice customer success story on this recently.

So, what role does Wind River play in the next generation of LTE devices? Our multicore and virtualization technology is allowing network manufacturers to leverage the new horsepower available from 4,8, 16 and even 32 core processors. Our advanced networking technology (ANT) provides support for offload acceleration such as packet forwarding, deep packet inspection and encryption. Our mobile IP support is providing off-the-shelf protocol support needed for LTE and WiMAX networks. Along with our tools and services, we are providing a powerful platform that networking infrastructure companies need to handle the huge data rates required for next generation networks.

VxWorks flying high at Avionics Europe

Today at the Avionics Europe conference in Amsterdam, Wind River has announced some interesting news  that highlights our success in avionics with the VxWorks product line. We announced a major update to our VxWorks 653 platform which I'll go into more detail in an upcoming post but the highlights include support for Intel Architecture and Power Architecture e600 support, new power-safe file systems support and additional protocols in the networking stack. VxWorks 653 complies with the ARINC 653 specification and is safety certifiable to DO-178B level A.

Our VxWorks 653 platform has been doing really well in the market and I think the key reason for this is that it is a compelling, commercial off the shelf (COTS)  solution for Integrated Modular Avionics (IMA) that provides more than just an ARINC 653 scheduler. By this I mean there is a comprehensive set of OS, tools, BSPs, comprehensive certification evidence and services to support the product development. Our recent success with the Boeing 787 Dreamliner program is a case in point. The success of leveraging VxWorks 653 in the cockpit IMA solution saved significant time and effort during development, testing and certification.

Of equal importance with this release is the support from two very strong partners in the aerospace and defense market, GE Intelligent Platforms and Curtiss Wright Controls. In this new release of VxWorks 653, we are providing BSPs for two key COTS boards; from GE Intelligent Platforms, the V7768 board based on an Intel Core 2 Duo processor. From Curtiss-Wright Controls we are providing a BSP for the VPX6-185 which is based on the Power Architecture e600 core (a Freescale 8641D). BSPs for COTS boards are a key project accelerator for customers - they can pick pre-integrated COTS hardware and software and have a head start with a runtime and tools platform that's ready to go, literally out of the box.

Validating integrations is an important aspect of working with our partners and creating a seamless solutions for our customers. We also announced our partner validation program at Avionics Europe this week. This program provides our partners the ability to build and verify their own integrations with Wind River solutions. This program effectively increases the number of companies and people working on joint integrated solutions. Wind River will, of course, ensure quality is maintained but the benefit to the customer is more choice than ever for COTS solutions in the aerospace and defense market.

In keeping with this news I should also mention that we also recently updated our VxWorks DO-178B platform in January. This platform offers a certifiable safety critical platform based on the VxWorks OS more suited to federated (physically separate units) avionics systems.

The ultimate head start

I was very excited on hearing about Intel's acquisition of Virtutech and subsequent announcement that Simics was going to be part of our product line. Why? Because Simics gives you access to hardware platforms before they're even made (including multicore platforms.) In my experience, access to hardware platforms and having enough for everyone is a constant concern during development. Many developers are targeting their new product for new hardware platforms that are still in development and hoping for the stars to align so their software and the hardware platform delivery dates align. Now, if you are on this bleeding edge of technology what can you do to ensure success?

Clearly, if the hardware doesn't exist you need to proceed regardless and you can develop the application software to certain extent but their comes a point where you need to start integrating and testing the system. This is were Simics comes in, letting you build a virtual hardware platform when the hardware doesn't exist or there isn't enough to go around. What's also exciting is the ability to simulate systems at the processor, board and system level (e.g. boards in a chassis.) This virtual platform simulates the hardware very accurately to the point, for example, where the same VxWorks BSP can be used for hardware or virtual platform. This platform can therefore run VxWorks, middleware and applications plus with our tools just like any other target platform.

A virtual platform means your project can proceed full speed to meet time to market windows that are so tight in today's market. More importantly though, are the other advantages of the virtual platform such as the ability to do advanced debugging, check points and restores, real external connections to other systems, and fault injections. Plus, everyone on the team can use this virtual platform, something that is impossible with the typically short supply of prototype boards (if you have hardware at all). Once the hardware comes in you can quickly move to the real hardware platform and deliver your product. Avoiding that last minute integration "Big Bang" saves time, money and improves quality. More and earlier access to the target platform plus advantages of a virtual software-based platform equals the utlimate head start.

Busting the Myths around VxWorks #6: Safety

Software safety is related to many factors but I think the impression that an operating system is unreliable conjures up the perception it is unsafe as well. I’ve spent time in other posts dispelling myths surrounding VxWorks reliability. Rather than repeat myself I’ll point to my previous post on reliability – the points made there, apply here too. The proof point for the safety of VxWorks lies in the success of our customers.

VxWorks supports three of the most important and stringent safety standards in the world. Firstly for the commercial and military avionics market we have VxWorks ARINC 653 and VxWorks DO-178B. Both of these products are certifiable for commercial aviation, which is has the strictest safety standards for software and hardware. Interestingly, the technology in these products can be used for safety critical devices whether they need officially certification. Example would be industrial control and medical devices. In addition, we have the VxWorks IEC61508 platform for industrial and medical systems – the key certification for safety in these markets. In products where safety is a concern, VxWorks is usually a first choice. 

Busting the Myths Around VxWorks #5: Security

In reality this isn’t a myth, it’s more of an awareness problem. Our solution for the need for high robustness systems is the VxWorks MILS product. VxWorks MILS is designed to provide Multiple independent Levels of Security (MLS), a security concept that ensures that complete separation is provided between secure and non-secure portions of a system (and that it is impossible to subvert this to gain access to the classified partition in the system from the non-secure). 

We have designed the MILS product to conform to the separation kernel protection profile as defined by the Common Criteria (aka ISO 15408) and is currently undergoing official certification to Evaluation Assurance Level (EAL) 6+. Now I appreciate this appears like a lot of buzzwords but customers looking to build high robustness secure systems will understand the need for this type of product. 

Now why is VxWorks MILS (and MLS) important technology? It reduces costs. Rather than have redundant hardware to provide physical separation of classified and non-classified information, MILS provides a way to do this on one device. It also reduces the burden in the field (or battlefield) to allow operators to have just one device that does secure and non-secure communication rather than many. Our VP for Product Strategy and Marketing for VxWorks, Marc Brown, recently did an interview with Military Embedded Systems Magazine on this very topic.

Busting the Myths around VxWorks #4: VxWorks reliability

I don’t think we are promoting the reliability of our products well enough. In particular, a key attribute and value of VxWorks is its reliability. Being a newcomer to Wind River my colleagues here were surprised to hear that the reliability of VxWorks would have been called into question. Being on the inside, of course, I am now aware of the various proof points regarding VxWorks’ reliability:

• VxWorks has been built into over a billion devices.  VxWorks has been in more devices than any other RTOS and been on the market for more than 20 years.  Assuming linear growth and at least 25% of these devices are still on the market, VxWorks has over 2 Trillion (2x1012) hours in operation (that is 250 million years!)
• VxWorks is available in certified versions for FAA DO-178B, ARINC 653 and IEC 61508. These are very strict standards for safety critical systems. Unreliable is not an option.
• VxWorks is running in avionics for commercial aviation today. These products must be certified to FAA  DO-178B level A, likely the most stringent safety standard in the world.
• The engineering process used at Wind River for safety certified and non-certified products are similar. We take reliability of our RTOS very seriously.
• Non-certified versions VxWorks are used in mission critical systems from industrial control and robotics to networking infrastructure. Failure in these systems have financial and safety repercussions.
• The core API is shared amongst the certified and non-certified versions of the OS. Customers can adopts safety certified versions if they need to when the regulation environment for their product changes.
• VxWorks provides the services needed to make systems reliable including memory protection and we also have development tools to debug the system and test software to assist the testing effort. 

I think these proof points boil down to that fact the longevity of the product and its proven use in various markets, reliability is an absolute requirement for this success.