Академический Документы
Профессиональный Документы
Культура Документы
Introduction Introduction
More functionalities, more connectivity,…, in less Federated vs IMA (Integrated Modular Avionics)
space, weight, and power (SWaP)
Similarly to the automotive industry, the avionic
industry is moving from a federated approach to
an integration of multiple software systems on the
same processing unit.
Introduction Introduction
1
Introduction Introduction
Federated IMA
PROs PROs
SWaP CONs
Safety-critical control systems (potentially with Large configuration data: 40000+ configuration entries
different criticality levels);
Integrated platform with multiple OSes Development cycles are shorter and shorter…
2
IMA and ARINC 653 IMA and ARINC 653
ARINC 653 OS and applications are typically DO-178B levels (in decreasing criticality order)
certified for DO-178B;
Catastrophic – Failure may cause a crash. Error
DO-178B is a document dealing with the safety of or loss of critical function required to safely fly
software used in certain airborne systems. and land aircraft.
Different partitions can be certified to different Hazardous – Failure has a large negative impact
DO-178B levels. on safety or performance, or reduces the ability of
the crew to operate the aircraft due to physical
distress or a higher workload, or causes serious
or fatal injuries among the passengers.
3
ARINC 653 Services ARINC 653 Services
The ARINC 653 APEX API provides of services to Process management
the applications. A partition comprises one or more processes;
All the resources used by a partition have to be defined at Ready – able to be executed;
system configuration time, and created and defined in the Running – currently executing.
initialization phase of the partition.
Periodicity specification.
4
ARINC 653 Services ARINC 653 Services
Health monitoring Health monitoring – Example of error handling
Reporting and monitoring errors and exceptions; I. Log the error;
The error handling is the highest priority process and it is II. Stop or restart the failed process;
invoked whenever a fault takes place;
III. Eventually stop or restart the entire partition;
Error handlers must be defined to manage an error, defining
how a partition should respond. IV. Invoke the registered handler for the specific error code
5
ARINC 653 OS ARINC 653 OS
The partitions are divided into two categories,
application partition and system partition.
The application partitions execute avionic
applications and interact with the environment by
means of the APEX interface.
The system partitions are optional and their main
role is to provide services not available in APEX,
such as device drivers or fault management,
actually bypassing the APEX interface.
time
Major Cycle
(2,11)
FP (1,7)
priority
(5,14)
(5,50)
time
Major Cycle
6
ARINC 653 OS Certification Issues
Example – 2 partitions with 4, 2 To certify an ARINC 653 system to DO-178B:
Write human-readable requirements;
(1,8)
Write and run tests to prove the requirements are
priority
deadline miss deadline miss
(2,11) met
(1,7)
How to certify the configuration data?
priority
(5,14) …
(5,50) There are tools to check whether the configuration
matches the requirements
Thank you!
Alessandro Biondi
alessandro.biondi@sssup.it