Paul Parkinson

How to build a nuclear submarine

Those of you who have read my earlier blogs ('Astute optronic mast case study', 'Astute Submarine') will be aware that I am fascinated by submarines.

So, I was really pleased to see that the BBC have produced a documentary 'How to Build a Nuclear Submarine', which was broadcast on BBC2 in the UK on Sunday evening, and followed the progress of the design and construction of one of the world's most complex and technologically advanced machines (see Royal Navy website for details).

In case you missed it, the programme will be shown again on BBC2 at 11.20pm on Tuesday, and the programme is also available for Internet download via BBC iPlayer until 18th July (If you want a quick preview, there's a short clip on the BBC News website).

If you watch the end credits closely, you'll see real sensor imagery from Astute's VxWorks-powered optronic mast at a classified location (with dolphins)...

EGNOS Satellite Navigation System Safety Certification

In case you missed it, yesterday Wind River announced that VxWorks has been selected for the European Geostationary Navigation Overlay Service (EGNOS), and has been chosen to run the Integrity Processing Facility (IPF) check set.

The IPF, developed and delivered by Logica, is the crucial element that validates the information broadcast by the satellites to safety-critical users such as aircraft in flight or ships navigating through narrow channels. This is essential, because satellite navigation systems alone do not provide sufficient positional accuracy to be used in safety-critical applications.

The IPF is really good example of a critical system which needs to consistently provide hard real-time performance and total reliability, and this posed some interesting challenges for development and safety certification to the joint avionics software safety standards RTCA DO-178B and EUROCAE ED-12B at Level B.

Logica and the European Space Agency (ESA) have kindly allowed us to produce a case study which discusses the development and certification challenges and how they were successfully overcome, and this has just been published on the Electronics Weekly website. (Update: the case study can now also be downloaded in PDF from the Wind River website)

I hope you'll find this interesting, and the next time you are on a European flight on a landing approach in very poor visibility conditions, you'll know how VxWorks is helping to guide the aircraft to a safe landing.

Case study: Ultra Datel safety-critical avionics upgrade using COTS

I recently had the privilege of working with one of our partners, LDRA, and one of our customers, Ultra Datel, on writing a case study of their experiences of a mid-life upgrade of an existing avionics system.

What caught my attention was the fact that the existing system was uncertified, and the upgrade involved migrating the existing system to a commercial-off-the-shelf (COTS) and undertaking DO-178B Level B safety certification.

As a result, the project faced a number of development challenges because the pre-existing software and device drivers were not developed with safety certification in mind, and the code needed to be re-engineered and modified to meet safety certification requirements.

In the case study, we discuss the following development challenges and how they were overcome using the LDRA Tool Suite during the development of the safety-critical VxWorks application running on a GE Intelligent Platforms ruggedised PowerPC platform:

1. Porting to the VxWorks DO-178B safety-critical subset
2. Reduction of high cyclomatic complexity
3. Programming language subset compliance
4. Code coverage to meet DO-178B Level B objectives

The case study has now been published on the Wind River website on the Aerospace & Defence customers page (and the PDF file can be accessed directly here).

First flight of the Boeing 787

Today, the Boeing 787 Dreamliner made its first flight from Everett, Washington. One of our Wind River colleagues, Chip Downing, was able to attend this historic event in person, and shot the following video:

This is the culmination of years of development of a completely new aircraft which uses many state-of-the-art technologies to significantly improve efficiency, operating range and passenger comfort.

For instance, the 787 employs an Integrated Modular Avionics (IMA) architecture using VxWorks 653, Wind River's world-class ARINC 653 compliant RTOS. This approach which drastically reduces the amount of space, weight and power (SWaP) required for the aircraft's on-board avionics systems. The reduction in weight of avionics systems and cabling results in a reduced fuel load requirement, or increased range for the same fuel load, and of course reduced CO₂ emissions. Similarly, the reduction in the space required for the avionics systems can increase the space available for passengers, luggage and cargo.

(If you want to know more about the 787 development and DO-178B safety certification approach, read Alex Wilson's recent blog, and for details of VxWorks 653, there's a white paper available for download here).

In addition, the composite fuselage not only helps to make the aircraft lighter (improving fuel consumption further), but also enables higher cabin pressures to be used, which will result in passengers feeling more relaxed and less fatigued. When coupled with the advanced air-conditioning systems and state-of-the-art Rolls-Royce Trent 1000 jet engines and noise-reductions technologies, this provides the promise of greater passenger comfort on long haul flights.

This is of course, just the start, as the 787 will continue to evolve through its operational lifetime, just as the 747 has done over the last forty years. So, I wonder what other technologies will appear in the future?

In the meantime, I'm looking forward to seeing the 787 grace the skies above the Farnborough Air Show and taking a flight on one with British Airways in the near future. Congratulations, Boeing!

A&D Regional Conferences

I've recently finished updating presentations on The Essentials of Multicore Software and Challenges of Security Software Development for our forthcoming Aerospace & Defence Conferences which we are holding across Europe in November.

It's been interesting to think about how multicore can be used in technology refreshes and applied to new programmes. I'm looking forward to discussing these issues with customers, as well as understanding their security requirements, particularly as the need for interoperability continues to grow. We also recently demonstrated some of the capabilities to meet these security requirements in a cross-domain system and Gigabit Ethernet demo running on VxWorks MILS at MILCOM in the US, and the videos are available on YouTube.

If you've not received an invitation to one of the European conferences yet or had a chance to register, why not visit our conference portal? I hope to see you there.

Ada & C mixed language development

Last week, I downloaded AdaCore's GNAT Pro 6.2.2 and the latest GNATbench 2.3.1 release (which was announced yesterday), as I wanted to port an Ada & C mixed-language application to VxWorks 6.7.

I wanted to do this to show a customer how they can develop new Ada applications (as well as reusing existing intellectual property) and integrate them with network protocol stacks, graphics libraries and other middleware which are often implemented in C or C++.

Whilst the Ada 95 and Ada 2005 language standards provide inter-language compatibility with C and C++ respectively, close integration between the development tools is needed in order to really exploit these capabilities fully, for example being able to debug communication modules and/or tasks implemented in different languages.

My mixed language application consists of two VxWorks tasks (written in C), and two Ada tasks. One of the VxWorks tasks sends messages to an Ada task via a VxWorks message queue, and I wanted to step through the sending and receiving of the messages in a debugger to confirm that individual messages were sent and received correctly. This would not be a very user-friendly activity if I had to use two different debuggers to debug the Ada and C code separately. In addition, I also wanted to check that the inter-language calls that I had made (C function calling an Ada procedure and vice versa) had passed parameters using the correct language types and the data values were interpreted correctly.

Workbench provides an open and extensible framework based on Eclipse, so this has enabled AdaCore to integrate capabilities of GNAT Pro seamlessly through the GNATbench plugin. This enabled me to develop and run my mixed language application in Workbench. I was able concurrently debug multiple tasks in mixed languages (see below), and set task specific breakpoints on the Ada and C tasks individually and step over the calls to msgQSend() and msgQReceive() respectively, and confirm that the messages were passed correctly; and I was able to walk up and down the stackframes in the Workbench Debug View and confirm that parameters had been passed correctly between C function and Ada procedure and vice versa.

I also used Workbench's analysis tools System Viewer, Memory Analyser and Performance Profiler to verify the behaviour of Ada & C tasks at system level, and monitor memory & CPU utilisation of each of the Ada procedures and C functions in the mixed language application.

Even after many years working with these technologies, I am still excited by advances in capabilities which make the complex tasks of embedded software development easier. I just wish I was able to spend more time in Workbench and less time in PowerPoint!

Tornado GR4 goes extreme

In case you missed the news, our partner McObject has just announced that BAE SYSTEMS has selected the eXtremeDB running on VxWorks for the Tornado Advanced Radar Display Information System (TARDIS)  on the Tornado GR4 military jet.

This avionics upgrade further extends the capabilities of TARDIS (which I discussed in a previous blog, and also in a customer case study (PDF)), by using the McObject eXtremeDB embedded database to manage tactical information such as aircraft, ship, and vehicle positions provided from real-time sources and overlay it onto a digital map and radar display.

It's interesting to see how using in-memory database instead of a traditional file system provides greater flexibility for data access and interrogation which can be exploited by the end application.

Airbus A330 MRTT refuelling progress

I was pleased to read in today's news (Aerospace Testing International) that the Airbus A330 Multi-Role Tanker Transport (MRTT) has completed more flight testing milestones, including extended testing of its refuelling systems.

The A330 MRTT is an interesting design, as it has a centreline refuelling boom and two underwing refuelling pods, and although these perform similar functions, the electronic systems have quite different operating environments, which is reflected in their system architecture. The refuelling boom runs VxWorks 653 on an Integrated Modular Avionics (IMA) platform, whereas the underwing refuelling pods run VxWorks Cert on a federated avionics architecture in the harsh under wing environment, which can experience extremes of temperature. This is an excellent case of how a hybrid architecture can be used to achieve diverse mission requirements.

There's a photo of the view of the underwing refueling pods in the news story, and there's also a great photo of an A330 MRTT being refueled by a French Air Force tanker on the EADS website (click on the image to view a larger version).

The A330 MRT will enter service Royal Australian Air Force (RAAF) in the near future, and I am looking forward to see them enter service with the UK Royal Air Force (RAF).

South African A&D Seminars

Tomorrow, I will be traveling to South Africa to present at the Wind River Aerospace & Defence Seminars which will be held in Pretoria and Cape Town next week. 

I'm really looking forward to the events, as we will be covering some interesting topics including the latest trends in Aerospace & Defence, including Safety and Security. This will also be the my first opportunity to present some new Wind River A&D customer case studies, which I hope the audiences will find interesting and informative. In the afternoons, we'll be providing some technical deep-dive sessions on Multicore, Virtualization and Hypervisor technologies, VxWorks 6.6 safety certification, and Wind River Linux. So it's a pretty packed agenda.

I'm also looking forward to seeing the scenery again which is stunning, particularly around Cape Town and Stellenbosch. Thunder City, on the outskirts of Cape Town, has three operational English Electric Lightnings, which is my all-time favourite military fast jet. It would provide the ideal way to see Table Mountain and The Cape in real style, but unfortunately, that's not part of the seminar programme. (For some interesting facts and anecdotes on the Lightning, the Wikipeda entry is well worth reading!).

Security and cyber warfare

One of the Christmas presents I received was the book The Edge of Madness by Michael Dobbs. It's a novel about cyber warfare and is set in the present day. Despite mixed reviews of the book in the media (Daily Telegraph, Guardian), I found it to be a gripping read, and finished it over two evenings.

The reason why it held my attention was because of its central theme: the imminent threat of cyber warfare against a nation through co-ordinated attacks against critical national infrastructure (banking, commerce, energy,  telecommunications, etc.) bypassing national defence forces. Although we have yet to witness an offensive on this scale, there have been several instances of international cyber warfare in recent years, so perhaps these can only escalate in the future?

As I read the book, I was trying to distinguish between those scenarios which were accurate and/or technically feasible, and those where the author may have used artistic license. However, when I did a bit of research afterwards, I found that I had some misconceptions. For example, I thought that the scenario of a nuclear power station's control systems being accessible from the Internet was far-fetched, as I expected that it would operate on a completely isolated network for security reasons, but Google found at least one instance where this has actually happened ('Slammer worm crashed Ohio nuke plant network', Securityfocus.com).

It would be easy to dismiss this particular instance as a bad (and hopefully not very representative) example, but this would be missing the point. Even if nuclear power station control systems could/should operate in a completely isolated network, there are many other classes of systems that are part of the critical national infrastructure which will not have this option. These systems need to employ secure computing platforms and communication systems. 

This area is of particular interest to me, as this year I will be spending a significant proportion of my time focusing on Information Security (InfoSec). This is not just for Aerospace & Defence customers but also for security-critical applications in other vertical markets. Over the last two weeks, I've had the opportunity to get hands-on experience with VxWorks MILS, and I'm looking forward to gaining more experience in the coming year. I'm also getting up to speed with the Common Criteria, but I wish it was as riveting a read as the novel...