Paul Parkinson

Avionics 2012 report

I've just got back from the Avionics Europe 2012 conference and exhibition which was held in Munich.

The theme of this year's conference was 'Common Sky: Operating in One Air Space' focussing on the growth in air traffic across Europe, the challenges arising for air traffic management and navigation, and the development of SESAR air traffic management technologies.

I was keen to hear to how changes to the high-level policies would drive regulatory changes and drive technology requirements.

I didn't have to wait very long, as in his keynote speech, Brigadier General Hans-Georg Schmidt (Vice Commander of 1st German Air Division, and Chairman of the Military Air Traffic Management Board of EUROCONTROL) discussed the implications of the integration of unmanned systems (UAVs, UCAVs) into non-segregated airspace. He discussed the need for unmanned systems to be "sufficiently safe as not to reduce the overal safety of airspace", and said that unmanned systems "must be proven to be safe before their introduction into this environment".  (The keynote speech is discussed in more detail by John Keller, conference chairman, in this blog post).

This subject of UAV safety certification was covered in more technical detail by Richard Seitz of Cassidian in his presentation on 'UAV Computing'. He discussed the differences between flight software on piloted aircraft (which leaves the ultimate decision to the pilot) and flight software in unmanned systems which becomes safety-critical in the case of datalink loss,  and the need for RTCA DO-178B / EUROCAE ED-12B safety certification of UAV flight software. 

It was encouraging to see the subject of UAV safety and the need for software certification being acknowledged, as this was a topic which I had also raised in my conference paper  in the context of combined safety and security requirements for unmanned systems (for details see my previous blog).

The other recurring theme at the conference which caught my attention both in the conference and in the exhibition, was the technology disruption of multicore processor architectures, which provides some exciting opportunities for reducing the size, weight and power (SWaP) of avionics systems, but also presents new challenges for hardware and software safety certification. However, there's now significant momentum in the research into these areas, and the experience gained should lead to regulatory guidance and adoption in the near future.

So overall it was an interesting and enjoyable conference, not least for the fine Bavarian hospitality!

Safety-Critical Systems Symposium 2011

I'm looking forward to the 19th annual Safety-Critical Systems Symposium which is being held in held in the UK next week.

The conference programme covers a range of subjects including safety cases, testing of safety-critical systems, updates to safety standards, and technologies. On the Thursday afternoon, I will be presenting a paper 'Safety, Security and Multicore'.

Wind River will be participating in the exhibition which is being held on the Wednesday, and we will have a live demo of VxWorks MILS 2.0 running on the stand. So why not pop by to discuss your safety & security requirements?

Multicore called up for active service

There's an interesting editorial column 'Multicore Processing Becomes the New Mainstream' in the latest edition of COTS Journal. Jeff Child discusses how multicore processors, after becoming all pervasive in the desktop and server market, are now becoming the norm for embedded aerospace and defence systems. He also shares some insights into why the transition to multicore is necessary, and provides an example of the deployment of multicore in the Aegis Modernization Program (Congressional Research Service report on FAS website: PDF).

Rather tantalizingly, Jeff only mentions software architectures in his final paragraph (maybe that's a subject for a future editorial), where he contrasts the use of Symmetric Multiprocessing (SMP) on multicore devices with tiled processors (which can be massively parallel architectures). 

As a software engineer, I think this is where things start to get really interesting, and there are actually quite a number of different possible permutations on homogeneous multicore architectures when you include visualization using a hypervisor into the overall software architecture. This can support a system with separate instances of an operating system or runtime per core, known as asymmetric multiprocessing (AMP); or a single instance of an operating system running across multiple cores, known as symmetric multiprocessing (SMP), or even a combination of both.

Customers often ask me 'Which is better, AMP or SMP?', and my answer is 'It depends'. It depends on the nature of their application, the degree of parallelism within it which determines the scalability across cores; it depends on the I/O architecture and throughput requirements and more besides. But by analyzing the system requirements in detail, these can be mapped to a suitable implementation which may comprise AMP, SMP or both. Bill Graham discusses how this complexity can be simplified into a number of key uses cases in this recent blog.

Back to the COTS Journal editorial, Jeff also mentions that tiled processors (and massively parallel architectures in general) present a programming challenge due to the complexity involved. This subject was also recently discussed in some technical depth by Mark Hermeling in a recent blog 'A sea of cores, now what?'.

A Decade at Wind River

On Wednesday, it will be exactly ten years since I joined Wind River.

I was thinking about this on my flight to San Francisco on Saturday, and as well as wondering how I long I've spent watching the VxWorks boot loader counting down to zero on the serial console over the years, I was also reminiscing about my early days with the company.

In many ways, it doesn't feel like a decade (as they say: time flies when you're having fun). This is the longest that I've worked for a company, and I was thinking about what it is that keeps me so interested and motivated in my job.

It's hard to put into words, but I have to admit that I really enjoy being at the cutting edge, observing the continual technological advances, not just for technologies' sake (although I admit to being a technophile), but in order to work out these can be applied to real world applications to meet customer requirements and solve their problems.

I started at Wind River in 2000, just before the dot com boom turned into the dot com crash, which many people would rather forget, but this was still a significant point when Internet connectivity was starting to spread from the Enterprise arena into the outside world. In my own area of specialization, Aerospace & Defense, IP-based networking was only just starting to replace stove pipe systems, but the adoption of commercial-off-the-shelf (COTS) technologies was fragmented and interoperability hindered by a lack of standardization. This made presented an unwanted challenge of developing a solutions stack for programmes.

Ten years on, I'm not so naive as to claim that things are now perfect, but the widespread adoption of open standards and open architectures in recent years is providing programmes with a range of interoperable implementation options, increasing choice and flexibility, and also resulting in lower risk for long term support and managed obsolescence.

I've also noticed that embedded devices have become a lot smarter in the last decade, passive remotely controlled devices are now being superseded by intelligent semi-autonomous and even fully-autonomous systems which are capable of flying UAVs and even aircraft without a pilot (see previous blog: Airborne Control of UAV Swarms). A lot of this has only become possible due to the massive increase in processor performance in relation to power dissipation (especially in airborne systems, and with the advent of multicore processors this provides even greater potential for exploitation). I wonder whether in ten years time we will have seen the introduction of autonomous commercial aircraft, maybe for cargo initially?

The Internet has become all-pervasive, and we now rely on IP-based networking for everything from communication between desktop computers, multimedia broadcast, through to critical national infrastructure. This presents new challenges in terms of increased cybersecurity threat due to the inter-connectivity of networks and some of the IPv4 protocols were not designed with security in mind. However, the deployment of IPv6 and the on-going developments of processor hardware virtualisation support and provably secure implementations of the Multiple Independent Levels of Security (MILS) will provide the foundations for secure robust systems which can mitigate this threat and more besides.

A decade on, the future still looks exciting.

A&D Regional Conferences

I've recently finished updating presentations on The Essentials of Multicore Software and Challenges of Security Software Development for our forthcoming Aerospace & Defence Conferences which we are holding across Europe in November.

It's been interesting to think about how multicore can be used in technology refreshes and applied to new programmes. I'm looking forward to discussing these issues with customers, as well as understanding their security requirements, particularly as the need for interoperability continues to grow. We also recently demonstrated some of the capabilities to meet these security requirements in a cross-domain system and Gigabit Ethernet demo running on VxWorks MILS at MILCOM in the US, and the videos are available on YouTube.

If you've not received an invitation to one of the European conferences yet or had a chance to register, why not visit our conference portal? I hope to see you there.

Is safety-critical ready for multi-core?

You may feel that you're experiencing déjà vu reading this blog, but the title 'Is safety-critical ready for multi-core?' is different to an earlier blog, which was 'Is multi-core ready for safety-critical?'.

In the earlier blog, I discussed some recent developments in multi-core processors in the context of their suitability for use in safety-critical systems. In this blog, I want to discuss how a particular type of safety-critical system could exploit the capabilities of multi-core devices. However, before I dive into the details, I should really outline the different types of safety-critical systems (at least in the simple categories which I like to use). These are broadly as follows:

• Type 1: Single application, safety critical
• Type 2: Multiple applications, single level of safety-criticality
• Type 3: Multiple applications, multiple levels of safety-criticality

Type 1 is very common in industrial automation, transportation, defence, and of course aerospace (where it is known as safety-critical federated avionics). This is readily supported by a safety-critical COTS RTOS implementation, such as VxWorks/Cert (subset of 5.4) or the forthcoming safety-critical implementation of VxWorks 6.x.

Type 2 is really a variation on Type 1, but the certification requirements are the same, everything is safety-certified to the same level. In aerospace, this is one instance of Integrated Modular Avionics (IMA).

Type 3 is where things become more interesting, and can apply to a range of different types of applications. In aerospace, this is another instance of IMA, but the different levels of safety criticality (e.g. RTCA DO-178B Level A and Level D) either require that the whole systems is certified to the level of the most critical application (which can be very expensive), or by implementing robust separation of applications.

The ARINC 653 software model provides robust separation through temporal and spatial partitioning, which is implemented in the VxWorks 653 RTOS running on a single processor core.  This architecture is well suited to systems which exhibit cyclic/periodic behaviour and/or perform synchronous I/O, e.g. flight control systems, but there are other types of applications which do not exhibit cyclic/periodic behaviour and/or perform a lot of asynchronous I/O, and may not fit well with the ARINC 653 timeslot scheduling model. These applications sensors such as radar warning receivers and electronic countermeasures (wikipedia) on military fast jets.

The NATO ASAAC IMA model might provide an alternative approach for these these types of application, but this does not have widespread commercial support yet. However, the advent of multi-core introduces another possibility - a system comprising two applications with different-levels of safety-criticality, but running one on a separate instance of a priority-based pre-emptive scheduling kernel on each of the processor cores within a dual-core device - known as  Asymmetric Multi-Processing or AMP (Wind River).

This could potentially be implemented by running the safety-critical subset of VxWorks 6.x on each core in AMP mode.  The VxWorks 6.x multi-core Board Support Package (BSP) would of course need to set up the memory map and I/O devices correctly to avoid coupling (FAA, MS-Word), and any inter-core communication mechanism would need to be robust (i.e. faulty messages from Level D processor core could not impact the operation of the Level A processor core). 

This approach would provide the immediate response required by the sensor applications, and also robust partitioning. In short, the best of both worlds. You could also view this as shrinking the form factor of a traditional dual-processor VME or CompactPCI system onto a single piece of silicon.

Now, when can I get hold of a Freescale PowerPC MPC8641D or Intel Core Duo board to try this out?

Is multi-core ready for safety-critical?

I recently attended the Military & Aerospace Electronics conference in the UK, at which a number of technical presentations were given on new technologies relevant to this sector, including an excellent one by Gordon Hunt of RTI on the Data Distribution Standard (which probably deserves a blog entry in its own right). However, the presentation which I want to comment on here is 'COTS VME processing: 4-way SMP Intel vs. Quad Distributed PowerPC' given by Richard Jaenicke, Director of Technology Integration at Mercury Computer Systems.

Richard gave a considered overview of the different types of multiprocessor architectures and their suitability to different types of application. He then went on to discuss the relative merits of a number of multi-core devices, and their suitability for deployment in the various multiprocessing architectures. This included insights into the performance speed-up of the multi-core Intel Core Duo over single-core Pentium architectures, and why the Dual-Core Intel Xeon is more suitable for 4-way symmetric multiprocessing (SMP) architectures. He also went on to discuss the Freescale PowerPC MPC8641D dual-core processor (Freescale: architecture diagram), and how this can be used in a number of different SMP and distributed shared memory architectures. I was struck by two things: firstly, that the most suitable processor choice really is dependent on the overall system requirements (i.e. it's a question of different horses for different courses); secondly, that Richard had given a very interesting and informative presentation without even talking about Mercury's products (note to self: must make technical seminar presentations more interesting in future).

This was a very useful and timely backgrounder, as I've noticed an increase in interest in using  multi-core devices for A&D applications recently. The benefits of multi-core are becoming well-known: increased performance, higher processing densities, reduced physical footprint (things which have been key factors in the development Integrated Modular Avionics architectures, coincidentally), so I am interested in how multi-core could be exploited in a diverse range of A&D applications, not just avionics.

Since the event, I've been thinking about how software platforms might be implemented on top of these multi-core and multiprocessor architectures. Tomas Evensen recently discussed Intel multi-core support, and Maarten Koning has also considered fault-propagation in multi-core devices, but what really interests me is the suitability of multi-core devices for safety-critical systems. The type of software platform which can be supported seems to be dependent on the level of flexibility of the multi-core architecture, and whether the cores can be configured to operate in an independent manner, or whether there is coupling and/or dependencies between the cores as there are obvious ramifications in a safety-critical environment.

The next question which springs to my mind is: What types of safety-critical software platforms could be supported on multi-core architectures?