Search

In order to reduce the failure rate of Integrated Modular Avionics (IMA) partition software, due to the reliability block diagram (RBD) method, fault tree analysis (FTA) method and GO method cannot describe the state transition process of partition software, according to the ARINC 653 standard and the actual running status of the partition software, this paper determines the state machine and conversion delay of the partition software, and establishes the stochastic Petri nets (SPN) reliability quantitative model of the partition software. By proving that each transition in the SPN model of the partition software approximately obeying exponential distribution, and according to the reachable state tree of the SPN isomorphic to a homogeneous Markov chain (MC), the steady-state probability of the partition software in the fault state is calculated to be $5.2778^\ast 10^{-9}$ by using MC stochastic process theory. The factors affecting the reliability of the partition software are obtained, and the sensitivity of each factor to the model is studied. Finally, the relevant conclusions are drawn to provide guidance for improving the reliability of partition software.

The ARINC-653 standard defines temporal partitioning that enables multiple avionics applications to execute independently from each other without interference in terms of CPU resources. Though partitioning has been mainly discussed from the viewpoint of manned aircraft, it can also efficiently integrate multiple applications on civilian Unmanned Aerial Vehicles (UAVs) that have even severer limitations on size, weight, power, and cost. In order to employ ARINC-653 temporal partitioning to civilian UAVs, its implementation must be flexible enough to be applied to diverse run-time software environments and computing hardware platforms. In this paper, we suggest a portable and configurable implementation of ARINC-653 for small-sized civilian UAVs aiming for low cost, easy development, and easy extension. Our implementation provides the Operating System (OS) abstraction layer that defines the essential OS-level features and the OS-independent interfaces to the upper layer that actually implements the ARINC-653 standard. Our implementation is also modularized so that the policies of resource management in CPU scheduling and memory allocation can be easily extended and selectively configured. In addition, we implement the advanced resource management schemes to promote the benefits of multi-core processors that are already widely deployed in Commercial Off-The-Shelf (COTS) systems. We show that our ARINC-653 implementation is portable across different OS, such as Linux and RTEMS, reusing the most of source codes thanks to the layered and modular design. We also analyze the overheads of the ARINC-653 APEX interfaces and multi-core scheduling. Moreover, we conduct a case study for a small-sized quad-copter.

Aiming at the shortcomings of standardized design and early verification of integrated modular avionics systems, this paper proposes a non-functional attribute modeling and verification method for integrated modular avionics system. We extract an architecture-centric design process for integrated modular avionics system, propose automatic transformation from SysML-based functional models to AADL-based architecture models, design AADL-Hazard sub-language, put forward AADL-based scheduling analysis for ARINC 653 system and safety analysis based on FMECA. Finally, aviation air compressor control system is chosen as a case to verify the correctness and feasibility of the method proposed in this paper. The method in this paper improves the AADL’s ability to model and verify for integrated modular avionics system, help engineersuse standardized design, multi-dimensional analysis methods in the early stage of the product, and reduces later product rework.

Integrated Modular Avionics (IMA) has become the mainstream in avionics system because of its advanced design and excellent performance. However, the disadvantage of the high price, not published source code and limited resource problems makes the development and verification of avionics software more and more complicated. It is of great significance to provide a software testing environment on the general operating system in avionics software development and system integration. In this paper, a virtual ARINC 653 system simulation platform is designed and built by using virtual experiment technology. The platform contains partition management, communication management and health monitoring management, and effectively solves the limited test resources of avionics system. Experimental results show that the performance of the proposed platform is excellent, and meets the real-time requirements of applications.

JetOS is a prospective onboard real-time operating system (RTOS). Nowadays GosNIIAS develops JetOS in the scope of the research and development project. One of the most important tasks during JetOS development is to create the DO-178C certification kit, which will allow JetOS to be used for development and modification of avionics for civil aircraft. Today there is no operating system certified in accordance with DO-178C in Russia, therefore the JetOS creation is the matter of current importance. Using DO-178C requires the developer to have very strict development processes. The arrangement of processes that satisfy the DO-178C requirements is a very responsible and demanding task because of high expectations in the fields of safety and security. JetOS is being developed primarily for onboard equipment based on the integrated modular avionics (IMA). One of the key features of IMA is the ability to execute several functional applications on one target onboard module. The obvious consequence of this feature is a necessity to have a time and resource partitioning of applications. In avionics field application partition along with a host of other features is defined in ARINC 653 international standard, so its support is the significant requirement for JetOS. ARINC 653 defines application programming interface (API) and modes of operation for onboard functional software. JetOS supports the up-to-date version of ARINC 653 (2015) with supplementary services. JetOS also supports the safety-critical graphical library - OpenGL SC; the special implementation of the OpenGL SC library is being developed along with JetOS itself. OpenGL SC services are used to draw two-dimensional and three-dimensional pictures by onboard functional software. JetOS is a certifiable modular cyber-safe real-time operating system, which is designed in order to support several hardware architectures and to be easily adopted for different hardware boards. The scope of the JetOS project also includes creation of the tools necessary for functional software development, especially aircraft systems.

Avionics systems are complex and time-critical systems that are progressively adopting more flexible (though equally robust) architectural designs. Although a number of current avionics systems follow federated architectures, the Integrated Modular Avionics (IMA) paradign is becoming the dominant style in the more modern developments. The reason is that the IMA concept promotes modular designs where applications with different levels of criticality can execute in an isolated manner in the same hardware. This approach complies with the requirements of cost, safety, and weight of the avionics systems. FACE standard (Future Airborne Capability Environment) defines the architectural baseline for easing integration in avionics systems, including the communication functions across distributed components. As specified in FACE, middleware will be integrated into avionics systems to ease development of portable components that can interoperate effectively. This paper describes the usage of publish-subscribe middleware (precisely, DDS – Data Distribution Service for real-time systems) into a fully distributed partitioned system. We describe, from a practical point of view, the integration of the middleware communication overhead into the hierarchical scheduling (as compliant with ARINC 653) to allow the usage of middleware in the partitions. We explain the design of a realiable communication setting, exemplified on a distributed monitoring application in a partitioned environment. The obtained implementation results show that, given the stable communication overhead of the middleware, it can be integrated in the time windows of partitions.

The framework is made to provide tools to develop the integrated modular avionics (IMA) applications, which could be launched on the target platform LynxOs-178 without modifying their source code. The framework usage helps students to form skills for developing modern modules of the avionics. In addition, students obtain deeper knowledge for the development of competencies in the field of technical creativity by using of the framework. The article describes the architecture and implementation of the Linux OS framework for ARINC653 compliant OS application development. The proposed approach reduces ARINC-653 application development costs and gives a unified tool to implement OS vendor independent code that meets specification. To achieve import substitution free and open-source Linux OS is used as an environment for developing IMA applications. The proposed framework is applicable for using as the tool to develop IMA applications and as the tool for development of the following competencies: the ability to master techniques of using software to solve practical problems, the ability to develop components of hardware and software systems and databases, using modern tools and programming techniques, the ability to match hardware and software tools in the information and automated systems, the readiness to apply the fundamentals of informatics and programming to designing, constructing and testing of software products, the readiness to apply basic methods and tools of software development, knowledge of various technologies of software development.

Recently, avionics systems have evolved into a time and space partitioning (TSP)-based integrated modular avionics (IMA) structure for integration into a single system from a variety of existing independently configured federated systems. The TSP-based IMA architecture is suitable for solving size, weight, and power problems in avionics systems. Partitioning real-time operating systems (RTOSs) to support TSP-based IMA have been researched, and the international aviation industry has established the ARINC 653 standard for a partitioning RTOS. The ARINC 653 standard has defined the health monitoring (HM) function for debugging. However, the HM of the ARINC 653 standard does not support monitoring and debugging functions, such as snapshot, cycle, and, redundancy monitor, which makes the system development hard. To this end, the purpose of this paper is to introduce a monitoring framework that supports high reliability and stability for RTOS and application software based on TSP structure used in avionics systems. The proposed monitoring framework is designed for Qplus-AIR, an RTOS based on the TSP structure that conforms to the ARINC 653 for aircraft systems. It is also applicable to other RTOSs based on TSP structure that does not conform to ARINC 653. It supports monitoring functions, such as snapshot, trigger, and cycle as well as various debugging functions. It also supports debugging and monitoring operations under the redundancy of avionics systems, and minimizes the intrusive effect, which is a disadvantage of the software-based debugging approach. These functionalities enable avionics system developers to monitor and measure the performance of TSP structure-based RTOS and application software in flight control system for unmanned aerial vehicles. Our evaluation results show that the proposed monitoring framework is suitable for monitoring and debugging of RTOS and application software based on TSP structure.

UID/CEC/04516/2019 TUBITAK/ 0008/2014 2018/2019(Proc. DAAD 441.00) In the domain of avionics, we can find intricate software product lines constrained by both aircraft’s hardware and conformance to strict standards. Existing general-purpose languages are complicated, as they do not hide unnecessary low level-details. This situation potentially leads to a lengthy process in the specification phase and the loss of control over the quality of the specification itself and possibly resulting in the generation of inconsistent products. In Software development for avionics systems, the pressure of time-to-market is high. Additionally, the long time taken for systems certification of this sort of critical system pushes for the development of solutions that support specifications correct by construction. With that kind of solutions, we can release the burden of the software developer by positively constraining the configuration of the products. In this paper, we put into practice an in-house solution that implements the concept of Product Lines of Domain Specific Languages (DSLs). The solution allows generating dedicated DSLs for each sub-family/configuration in Modular avionics departing from the model of a given aircraft. authorsversion published

Petri nets are graphical and mathematical tools that are applicable to many systems for modeling, simulation, and analysis. With the emergence of the concept of partitioning in time and space domains proposed in avionics application standard software interface (ARINC 653), it has become difficult to analyze time–space coupling hazards resulting from resource partitioning using classical or advanced Petri nets. In this paper, we propose a time–space coupling safety constraint and an improved timed colored Petri net with imposed time–space coupling safety constraints (TCCP-NET) to fill this requirement gap. Time–space coupling hazard analysis is conducted in three steps: specification modeling, simulation execution, and results analysis. A TCCP-NET is employed to model and analyze integrated modular avionics (IMA), a real-time, safety-critical system. The analysis results are used to verify whether there exist time–space coupling hazards at runtime. The method we propose demonstrates superior modeling of safety-critical real-time systems as it can specify resource allocations in both time and space domains. TCCP-NETs can effectively detect underlying time–space coupling hazards.

Unmanned autonomous systems (UAS) avionics call for advanced computing system architectures fulfilling strict size, weight and power consumption (SWaP) requisites, decreasing the vehicle cost and ensuring the safety and timeliness of the system. The AIR (ARINC 653 in Space Real-Time Operating System) architecture defines a partitioned environment for the development and execution of aerospace applications, following the notion of time and space partitioning (TSP), preserving application timing and safety requisites. The plan for a UAS mission may vary with the passage of time, according to its mode/phase of operation, and the vehicle may be exposed to unpredictable (environmental) events and failures, calling for the advanced adaptability and reconfigurability features included in the AIR architecture. This paper explores the potential of non-intrusive runtime verification (RV) mechanisms, currently being included in AIR, to improve system safety and to decrease the computational cost of timeliness adaptability and of the corresponding overhead on the system.

Modern airliners such as Airbus A320, Boeing 787, and Russian MS-21 use so called Integrated Modular Avionics (IMA) architecture for airborne systems. This architecture is based on interconnection of devices and on-board computers by means of uniform real-time network. It allows significant reduction of cable usage, thus leading to reducing of takeoff weight of and airplane. IMA separates functions of collecting information (sensors), action (actuators), and avionics logic implemented by applied avionics software in on-board computers. International standard ARINC 653 defines constraints on the underlying real-time operation system and programming interfaces between operating system and associated applications. The standard regulates space and time partitioning of applied IMA-related tasks. Most existing operating systems with ARINC 653 support are commercial and proprietary software. In this paper, we present JetOS, an open source real-time operating system with complete support of ARINC 653 part 1 rev 3. JetOS originates from the open source project POK, created by French researchers. At that time POK was the only one open source OS with at least partial support for ARINC 653. Despite this, POK was not feasible for practical usage: POK failed to meet a number of fundamental requirements and was executable in emulator only. During JetOS development POK code was significantly redesigned. The paper discusses disadvantages of POK and shows how we solved those problems and what changes we have made in POK kernel and individual subsystems. In particular we fully rewrote real-time scheduler, network stack and memory management. Also we have added some new features to the OS. One of the most important features is system partitions. System partition is a specialized application with extended capabilities, such as access to hardware (network card, PCI controller etc.) Introduction of system partitions allowed us moving large subsystems out of the kernel and limiting the kernel to the minimal functionality: context switching, scheduling and message pass. In particular, we have moved network subsystem to system partition. This moving reduces kernel size and potentially reduces probability on having bug in kernel and simplifies verification process.

Integrated Modular Avionics (IMA) architecture host multiple federated avionics applications into a single platform and provides benefits in terms of Size, Weight and Power (SWaP), nonetheless brings a high level of complexity to aircraft control systems. The thesis presents Model-Based System Engineering a novel, structured development methodology to cope efficiently with increased complexity due to IMA. Using ARCADIA methodology and the open source Capella tool, the developed methodology is implemented for a complete design cycle: starting with capturing requirements from the aircraft level to streamlining the development, integration of avionics application in an ARINC 653 platform. The proposed methodology provides effective traceability and management of specification artifacts from aircraft to system to item-level adhering to SAE ARP4754A guideline. Further, the thesis presents the capability of the MBSE framework to effectively address a few technological variants through the proposed methodology. To illustrate the efficiency of the methodology and MBSE approach an Environmental Control System (ECS) case study is presented. The case study focuses on implementing ECS in an IMA architecture using MBSE framework and proposed methodology. However, the derived methodology is also applicable to other systems. Further, the case study also presents a demonstration of integrating Cabin Pressure Control Sub-system (CPCS) into a real-time IMA platform for validation of MBSE approach. In addition, the thesis provides important insights in challenges and advantages of the MBSE process in contrast to the traditional paper-based specification process.

[EN] The development process of avionics system requiring a high level of safety is subjected to rigorous development and verification standards. In order to accelerate and facilitate this process, we present a testbed that uses a suite of methods and tools to comply with aerospace standards for certification. To illustrate the proposed methodology, we designed a Mission Management System for Remotely Piloted Aircraft Systems (RPAS) that was deployed on a particular run-time execution platform called XtratuM, an ARINC-653 compliant system developed in our research group. The paper discusses the system requirements, the software architecture, the key issues for porting designs to XtratuM, and how to automatize this process. Results show that the proposed testbed is a good platform for designing and qualifying avionics applications., This research has been financed by the Institute of Control Systems and Industrial Computing (Ai2), and by projects GVA AICO/2015/126 (Ayudas para Grupos de Investigacion Consolidables) and GVA ACIF/2016/197 (Ayudas para la contratacion de personal investigador en formacion de caracter predoctoral) of the Spanish Regional Government "Generalitat Valenciana".

IMA (Integrated Modular Avionics) approaches have been around for 30 years but vary widely in implementation and the extent of both hardware and software levels of unification. The IMA concept, which replaces numerous separate processors and line replaceable units (LRUs) with fewer, more centralized processing units, has led to significant weight reduction and maintenance savings in both military and commercial airborne platforms. The IMA concept for this definition originated in the United States with the F-22 Joint Integrated Avionics Working Group (JIAWG) 30 years ago and then migrated to business jets and commercial transports in the late 1990s. In the last 10 years, the mainstream IMA definition has incorporated time and space partitioned software environments based on the ARINC 653 standard. During this period, software complexity has exploded. The ARINC 653 extended IMA definition has enabled the development of common software infrastructure to enhance complex systems management and enable greater software reuse. In open literature, civil aviation has cornerstone IMA extended examples in the Airbus 380 and Boeing 787 Dream-liner platforms. This article provides a summary of IMA history, presents these new IMA challenges going forward, and summarizes research focus exploring advanced IMA solutions.

This chapter acquaints the reader with the real-time operating system (RTOS) and the associated avionics application software standard widely used in digital avionics systems. It addresses the following questions: Why use an avionics RTOS? What makes an avionics RTOS different from general computer RTOS? What are the basic concepts? and how do they work?. ARINC Specification 653 was written to define software modules at an abstract level and, in particular, define the interface boundary between the application software modules and the underlying computer operating system, also called the RTOS. The RTOS creates a uniform environment that allows software modules or applications to execute and provides a standard set of system services to schedule software execution, map memory areas, and, in some cases, partition memory accesses, perform input/output (I/O) operations, and handle errors or faults. The ARINC 653 software interface specification was developed for Integrated Modular Avionics systems and for federated equipment that may contain more than one partitioned function.

In this paper, we survey the works related to the system architecture of avionics and extract characteristics from the related works. On the basis of the investigation, we propose an integrated modular avionics (IMA) architecture that can be used for current avionic upgrades and future avionic developments based on the IMA Core system. To verify the feasibility of the proposed IMA architecture, we have developed the prototype of the IMA Core system that consists of both the common hardware module and the IMA software. It was verified that the developed prototype with the common hardware module contributes to the improvement of maintainability because it can save the time and expenses for the development and can reduce the number of types of hardware modules when compared with Federated architecture. It was also confirmed that the developed prototype can save not only overall system weight, size, and power consumption but also the number of hardware types because the IMA software can support the integrated processing where the single processing hardware module can process multiple software applications.

ARINC 653 specification has been introduced as a standardized interface definition of real-time operating system to simplify the development of Integrated Modular Avionics. The ARINC 653 provides a strict and robust time and space partitioning to guarantee the reliability of avionics by isolating the failures of the system. Configuration data for the time and space partitions in the ARINC 653 can be defined as the XML configuration file that can be accessed only by system OS. Unfortunately, it is quite tedious activity to confirm the integrity of partition scheduling and to check the syntax errors of XML during the integration tasks. In this paper, we present a software configuration tool that provides generating the configuration data and verifying the integrity of partitioning based on XML Scheme of the ARINC 653 standard.

ARINC 653 Specification defines a standardized interface of real-time operating systems and an Application Executive (APEX) to develop the reliable applications for avionics based on Integrated Modular Avionics (IMA). The requirements of system platform based on ARINC 653 Standard are defined as configuration data and are integrated to the XML configuration file(s) in the real-time operating system. Unfortunately, existing configuration tools for integrating requirements do not provide checking the syntax errors of XML and verifying the integrity of input data for partitioning. This paper presents a configuration tool for ARINC 653 OS that consist of Wizard module which generates the basic configuration data for IMA based on XML Scheme of ARINC 653 Standard, XML and Partition Editor for the partitioning system of IMA, and Verification module which checks the integrity of input data and XML syntax with its visualization.

Most current generation avionics systems are based on a federated architecture, where an electronic device runs a single software module or application that collaborates with other devices through a network. This architecture makes the software development process very simple, but the hardware system becomes very complicated and it is difficult to resolve issues of size, weight, and power efficiently. An integrated architecture can address the size, weight, and power issues and provide better software reusability, testability, and reliability by means of partitioning. Partitioning provides a framework that can transparently integrate several real-time applications on the same computing device, allowing the isolation of the execution environment in terms of resources and faults. Several studies on partitioning software platforms have been reported; however, to the best of our knowledge, extensive comparison and analysis of design and implementation alternatives have not been conducted owing to the extreme complexity of their implementation and measurement. In this paper, we present three design alternatives for partitioning at the user, kernel, and virtual machine monitor levels, which are compared quantitatively. In particular, we target the worldwide standard software platform for avionics systems, that is, Aeronautical Radio, Incorporated Specification 653 ARINC 653. Overall, our study provides valuable design references and demonstrates the characteristics of design alternatives. Copyright © 2013 John Wiley & Sons, Ltd.

Traditionally automated systems in aircraft were realised using well defined functions that are implemented as federated functional units. Each functional units possesses its own resources with fault containment compared to multiple functions in single processing node. Integrated architectures are structured over the avionics cabinets or processing cabinets which house the hardware modules and software application partitions along with system software. These integrated modular avionics (IMA) applications supports distributed multiprocessor architecture. Both time and memory is shared among multiple avionics functionalities across the same platform with good protection mechanisms provided by ARINC 653. ARINC 653 is an additional layer of protection being embedded as part of real time operating systems supporting the partitioning protections using well defined application executive, and application programming interfaces (API). IMA uses set of partitions, which are scheduled across a major frame M consisting set of partitions P tn and each partition having set of task/process τ n /P sn . The number of partitions and number of processes in each partition is a trade-off between the real time requirements and the resource. The paper also presents in brief, the API functionalities, its components, implementation, required interfaces, restrictions based on criticality of the avionics application. Error detection, control mechanisms for data integrity and validity for reconfiguration is also addressed. The experimental and simulation studies related to the API utilization as part of case study is addressed with four partitioned case study demonstrating the normal and failure scenario.

International audience; The adoption of Integrated Modular Avionics (IMA) architecture is a technological trend in the avionics industry due to its capability of supporting space and temporal partitioning, which is mandatory for systems with mixed criticality. However, combining partition allocation and schedule design for applications sharing hardware, software, and communication resources of the same computing platform while assuring temporal behavior is a complex task that requires adequate tools for system design and integration. This paper presents the main features of a model that has been developed for simultaneous partition allocation and schedule design, which allows for automatic adjustment of both applications distribution over the partitions and scheduling parameters toward performance optimization. In the proposed model, all the variables are integer and all constraints are formulated via linear equalities and inequalities. Therefore, this problem can be efficiently solved by many existing mixed integer linear programming algorithms. A set of timing constraints at both partition and task levels are established, and different optimization objective functions are provided. The results of a case study show that, if a solution exists, the proposed model can achieve a global optimum while guaranteeing that all the constraints are met.

The coming decade will see an unprecedented air traffic growth and the installation of more avionic systems onboard aircrafts, in response to new services, safety and reliability requirements. The latter has triggered the evolution of avionic architecture towards the next generation Integrated Modular Avionics (IMA), due to space constraints under the Federated architecture. Furthermore, newer avionic systems and communication requirements will exasperate data capacity demands in the already constrained spectrum. Therefore, the spectral efficiency of existing avionic communication systems must be improved or new high data capacity communications technologies must be identified that can coexist with other avionic radios in the saturated aeronautical bands. In this paper, the efficiency improvements to avionic communication waveforms and the IMA architecture are addressed. In particular, a new modulation technique is proposed for avionic waveform and is evaluated for aeronautic communication channels. Also, a concept for a more efficient architecture is proposed and discussed within the IMA second generation (IMA 2G) that integrates the communication, navigation and surveillance radios together with other avionic applications into an ARINC 653 standard, which supports a partitioned Operating System. This includes the integration of the avionic waveforms to run within an independent IMA partition. Optimization of applications in the overall IMA system framework will reduce the number of avionics hardware (IMA Modules). Reducing the number of avionics hardware, coupled with flexible or reconfigurable hardware, will result in reduced cabling and associated connectors, thus contributing to the reduction in the overall weight of the aircraft. This will consequently boost fuel efficiency from an avionics perspective.

International audience; Integrated modular Avionics (IMA or ARINC 651), as it is currently implemented in large aircrafts, uses a limited number of complex processors interconnected through a communication network (AFDX or ARINC 664). The allocation of avionics applications is done according a communicating partitions model (APEX or ARINC 653) needed for guaranteeing robust partitioning when sharing processors (TDMA like schedule) and communication network (APEX channel). On smaller aircrafts (such as helicopters) the objective (due to room and weight constraints) is to use les complex processors and consequently to increase their number. Implementing such a distributed IMA architecture leads to a global (more complex) integration problem, which is twofold. Allocation and scheduling of partitions on each shared processor as well as end-to-end communication delays among distributed partitions must be compatible in order to guarantee timing requirements of distributed avionics applications. This paper points out the complexity of composing the two aspects of this integration problem on different possible target architectures.

The systematic solutions to a berth allocation problem (BAP) at container terminals have been scarce owing to their high complexity and strong randomness. This paper extends the past research on modeling of container terminal logistics systems (CTLS) with computational thinking. We introduce and integrate the task scheduling architecture and mechanism in real-time operating system (RTOS) into BAP, and propose a partition berth allocation scheduler based on resource utilization and load balancing. Subsequently, we establish the fundamental principles of scheduler with the computing perspective and decision framework of ARINC 653, which is a design philosophy of RTOS for integrated modular avionics. Finally, the approach is demonstrated by investigating the stress testing of a typical container terminal logistics service case in contrast with the average random berth assignment algorithm based on the comprehensive computational experiments.

Atomicity races in ARINC 653 applications are a kind of concurrency bugs which causes nondeterministic behaviors by parallel processes. This paper presents a tool, called AR653, to dynamically detect atomicity races. The tool monitors only synchronization operations and access to shared resources, and analyzes the relation of synchronizations to report atomicity races through a locking discipline of semaphores. We compared the accuracy of AR653 with CodeSonar using synthetic programs on a simulation system for integrated modular avionics. The empirical results show that our tool correctly reports atomicity races, while CodeSonar only locates atomicity races in cases of using shared variables.

ARINC 653 specification has been introduced as a standardized interface of real-time operating system and an application executive (APEX) to simplify the development of integrated modular avionics (IMA). The ARINC 653 provides a strict and robust time and space partitioning to guarantee the reliability of avionics by isolating the failures of the system. Configuration data for the time and space partitions in the ARINC 653 can be defined as the XML configuration file that can be accessed only by system OS. It is well known that the integrity of partition scheduling is quite tedious activity to check the syntax errors of XML during the integration tasks. Moreover, existing configuration tools for integrating requirements provide limited functions to configure the partitions for host OS or do not provide Health Monitor for faults in each partition. This paper presents improved software configuration tool that provides the state of connections among partitions, the usage of partition memories, and faults and responding actions for Health Monitoring based on the XML scheme of the ARINC 653 standard.

The ARINC 653 specification defines standardized interfaces between a partitioning Real-Time Operating System (RTOS) and application programs that implement the safety-critical and avionics systems. ARINC 653 requires spatial and temporal isolation between independent executing avionics applications, a.k.a. partitions. Temporal partitioning ensures that each partition is executed by the processor only within its predefined execution interval. ARINC 653 Part 3 Conformity Test Specification specifies test procedures for validation of ARINC 653 Part 1 (Required Services Specification). However, this specification does not define any procedure on how to verify the temporal partitioning. This paper describes a validation framework to measure partition jitter at runtime and verify whether a partition ever exceeds its predefined execution time. We define test cases that can quite likely cause temporal violation and by using this framework with the test cases, we experimentally verify temporal partitioning on an ARINC 653 compliant COTS RTOS.

Integrated modular avionics (IMA) is an electronic system consists of a set of processing modules and controller with standard formats, which is controlled by a real-time computer network. In an ARINC 653-based IMA system time and space should be strictly partitioned, which increases difficulty of software designing and testing. Currently, IMA software is tested and verified based on some technical specifications and settled hardware configurations, which no longer meets the fast growing demands of airborne software, as software testing depends on not only the software itself, but also the whole IMA system, including configurations and complexity. This paper introduces an IMA software testing method as well as a general IMA simulation platform, based on CPCI bus and Wind River's VxWorks653 real-time operating system. This method aims at solving unpredictable distortions caused by time and space partitioning, through testing the IMA platform networks (Communications within the partition, Communication between different partitions of one module and Communication between different modules) and through testing the IMA hardware configurations like AFDX communications rather than software itself. In this paper, the integrated surveillance system (ISS) is tested and verified as an example. This method and simulation platform shows a different way to design, simulate, test and validate IMA software, which has an important influence on the reliability and safety of the IMA system.

Off-the-shelf software is now a part of avionics design. But how do you stop third-party code from upsetting other parts of the system? Standards call for it to be boxed off. The avionics industry has witnessed a major shift toward integrated modular avionics (IMA) in recent years, and IMA architectures and standards are still evolving as they gain industry acceptance. This presents significant challenges for standards organisations, OEMs and commercial vendors alike. However it is clear that standards-based architectures, such as ARINC 653, will provide greater flexibility and portability and enable existing federated applications to be reused in an IMA environment.

This paper presents a dynamic detector, called Race-653 that locates atomicity races in ARINC-653 applications using an on-the-fly analysis technique. Race-653 consists of 653-Monitor and 653-Detector modules. The 653-Monitor collects monitored information during an execution of the applications, such as processes, semaphores, and accesses for each shared resource. The 653-Detector reports atomicity races by checking violations of a synchronization discipline based on semaphore. We implemented the detector as a PIN tool using PIN binary instrumentation framework and evaluated accuracy of the tool on a simulation system for integrated modular avionics.

This paper presents a visualization tool that provides the overall information of process synchronization based on the event services in ARINC- 653 applications. The tool visualizes logical synchronization among processes and race conditions by the violations of synchronization order, such as the priority inversion, through analyzing the aspect of the process execution and the accesses to the shared resources of each partition considering event services. We evaluated our visualization tool using synthetic programs for ARINC-653 on a simulation system for integrated modular avionics.

Integrated Modular Avionics (IMA) enables incremental qualification by encapsulating avionics applications into software partitions (SWPs), as defined by the ARINC 653 standard. SWPs, when running on top of single-core processors, provide robust time partitioning as a means to isolate SWPs timing behavior from each other. However, when moving towards parallel execution in many-core processors, the simultaneous accesses to shared hardware and software resources influence the timing behavior of SWPs, defying the purpose of time partitioning to provide isolation among applications. In this paper, we extend the concept of SWP by introducing parallel software partitions (pSWP) specification that describes the behavior of SWPs required when running in a many-core to enable incremental qualification. pSWP are supported by a new hardware feature called guaranteed resource partition (GRP) that defines an execution environment in which SWPs run and that controls interferences in the accesses to shared hardware resources among SWPs such that time composability can be guaranteed.

Due to copyright restrictions, the access to the full text of this article is only available via subscription. The ARINC 653 specification not only provides a standard application programming interface for an RTOS, but also specifies how to validate an ARINC 653 based RTOS. ARINC 653 Part 3 Conformity Test Specification specifies test procedures for validation of ARINC 653 Part 1 (Required Services Specification). Existing ARINC 653 verification suites and packs do not provide platform-independency, maintainability gained by an open source framework, a reliable communication protocol, and automated testing principles at the same time. This paper introduces a brand new validation suite, GVT-A653 which is platform-independent and ensures conformance to ARINC 653 specification. The suite is based on TETware (trademark of OpenGroup) and builds upon Continuous Integration (CI) principles. It also brings flexibility by providing various protocols including Avionics Full-Duplex Switched Ethernet (AFDX) Network that provides deterministic communication required in avionics applications. TÜBİTAK

Development of the space industry has led to a diversity of specialized electronics-units implemented on space system. However, this provoked new problems such as increased system's complexity and the size. As a solution to the problem, the Integrated Modular Avionics (IMA) architecture and ARINC 653 standard have been suggested. This paper introduces a Linux-based memory efficient ARINC 653 partition scheduler, which employs fixed-priority preemptive scheduling algorithm for partitions scheduling. The implemented partition scheduler has small memory footprint for each partition and produces low partition switching overhead. The prototype was executed on a LEON4 processor, which is the European Space Agency (ESA) Next Generation Multicore Processor (NGMP) in the space sector. In evaluation, we analyzed execution trace, memory footprint and scheduling overhead.

The Integrated Modular Avionic (IMA) architecture has been proposed for the next-generation avionics systems. ARINC 653 is the standards for Application Programming Interfaces (APIs) of avionics software for IMA architecture [1]. There are a great many researches on design and implementation of ARINC 653. Though some of them including VxWorks recently show high potential of providing software platform for avionics systems, efficient partition management have not been considered much for a base operating system of ARINC 653. In this paper, we propose a kernel-level design to support partitioning and hierarchical real-time scheduling of ARINC 653 for VxWorks. We have assurance that our suggestion can provide a very valuable reference for raising the level of partition scheduling for ARINC 653 especially because of the integrity of the VxWorks kernel. We show that the overhead and jitter of the proposed design is significantly lower compared with legacy partition management algorithm-a user-level design.

The ARINC 629 civil aircraft avionic databus standard has been applied by Boeing in the development of the new 777 aircraft and is intended to provide general purpose data communications between avionic sub-systems in future civil IMA (Integrated Modular Avionics) architectures. The 629 standard describes two independent medium access level protocols for communications across a common, multiple access databus. These are known as the basic protocol and the combined protocol ; the main difference being the manner in which bus arbitration occurs. This paper describes the results of a study carried out at the University of York on behalf of British Aerospace, addressing the timing behaviour of the 629 databus under each of the two protocols. Estimates of worst-case end-to-end (application-to-application) message transmission delays are derived. These are expressed in terms of design-time bus configuration parameters (such as the bus minor-frame duration and the transmission windows assigned to individual terminals) and the potential delays introduced by the run-time executive, eg. an ARINC 653 (APEX) compliant kernel.

A key goal of the ARINC 653 (APEX) specification is the achievement of software re-use through provision of a standard operating environment for applications software. Reuse of software can be achieved in two ways: (i) by re-using operating systems, which provide common functions across the application spectrum, eg. health monitoring, process management, communications mechanisms; and (ii) by re-using the applications software which provides avionics applications functions. By provision of a standardised interface between applications and operating system, ARINC 653 facilitates both forms of re-use Operating systems are by nature tightly coupled to the underlying hardware platform, re-use of operating systems is therefore limited to modules employing the same hardware unless a new standard such as COEX (Core Executive Interface) can be tightly defined Applications software is often dependent on the actual aircraft implementation. Direct re-use of applications will not always be possible; however, by use of ARINC 653, it will be possible to re-use individual partitions of an application in other applications ARINC 653 is language-dependent and within languages such as Ada there is scope for functionally identical implementations which are syntactically different. Unless definitive language implementations of ARINC 653 are adhered to, language issues will become a major hurdle to re-use A large cost of avionics development (particularly software) is the cost of certification. Currently, avionics functions are certified at the ‘system’ level. In order to maximise the benefits of software re-use, means must be found to claim credit for previously-developed software components of a system. EUROCAE WG48 and RTCA SC182 are currently investigating this issue in their definition of an Avionics Computing Resource. It is hoped that these groups, working in co-operation with ARINC 653, will provide the means to achieve the benefits of re-use

Multicore processors are now considered as relevant candidates for the next generation of Integrated Modular Avionics (IMA) systems. One expected benefit of multicore introduction inside IMA platforms is an increase of the number of avionic applications hosted on a single platform. This can be achieved by deploying several ARINC 653 partitions simultaneously on different cores. However to be certifiable, such an architecture must fulfill many dependability requirements. In this paper we focus on the problem of Worst Case Execution Time (WCET) computation of embedded partitions under the Robust Partitioning constraint. Today's multicore processors internal features make those requirements fulfillment difficult to ensure on the platform for any set of hosted partitions. That comes from the difficulty to characterize with a satisfying confidence the processor behavior when several unknown applications use simultaneously shared hardware resources, such as the main memory. We present in this paper a generic software solution that constrains the use of shared resources to remain inside predefined usage domains for which the processor has a deterministic behavior. We illustrate this approach with a case study based on a COTS processor from the Freescale QorIQ series.

The objective of this paper is to illustrate the details of Line Replacement Unit (LRU)[1], Integrated Modular Avionics (IMA)[2] and development of real models of aircraft on Core Processor Input and Output Module (CPIOM) for the simulation activity. The real models development can be done by using ARINC-653 application software, which is real-time OS. The real models can be implemented using C language, and some scripts have also implemented to run the models. The RTOS running on CPIOM can perform real-time operations such as resource management, memory management etc.

ARINC 653 is currently one year from the completion of its first phase. Phase 1 is intended to meet the requirements of the most critical systems which require strictly deterministic periodic processing. The original hardware platform envisaged for software conforming to ARINC 653 was cabinet-based line replaceable modules communicating with each other over the ARINC 659 backplane databus. However, ARINC 653 conformant software must be compatible with other hardware configurations such as the proposed Avionics Computing Resource (RTCA SC-182) and LRMs with direct ARINC 629 connections and ARINC 429 based systems. This paper describes the challenges facing the ARINC 653 working group in defining a sufficiently rigorous specification of services without constraining the developer to a particular system architecture. The external communications mechanisms and configuration information necessary to realize the aims of portability and re-use are considered. The achievement of ‘time partitioning’ on a shared processor resource is discussed. The paper concludes with a discussion of future extensions to ARINC 653 to enable reconfiguration of applications both statically and dynamic- ally, and to accommodate aperiodic processes.

Recently partitioning and virtualization techniques for Integrated Modular Avionics (IMA) of aeronautics sector are proposed as the candidate architecture for safety-critical space applications. However, spacecraft software has subtle difference from aeronautic applications. Radiation particles in space environment cause various faults on the spacecraft computer. Requirement for autonomous operation with constrained resources is more stringent in space missions. Once it is launched, no way to refurbish the spacecraft without tremendous cost. These extra properties on top of those of regular aeronautic systems cause large software development cost in spacecraft projects. Summing up, spacecraft software should have real-time property, fault tolerance and efficient resource usage. In this paper, we introduce a hypervisor for spacecraft computer to improve reusability of inherited flight software from previous missions without redevelopment cycle. Fault tolerance is designed into the hypervisor to provide autonomous operation in space. We designed a prototype which is Type-II full virtualized hypervisor with kernel-level ARINC 653 partitioning on a dual-core LEON4-based flight computer for spacecraft. As the guest system, RTEMS-based flight software running on ERC32 flight computer is chosen because it has been used for many recent space missions and its flight software is likely to be reused when multicore LEON4 becomes widely available.

The Integrated Modular Avionics (IMA) architecture has been suggested to address the Size, Weight, and Power (SWaP) issues and provide better software consolidation and testability by means of partitioning. Though the IMA architecture is mainly discussed from the view point of large aircrafts or manned aerial vehicles, small Unmanned Aerial Vehicles (UAV) are one that indeed requires IMA to reduce SWaP. In this study, we design and implement UAV control and mission software over ARINC 653. Especially we utilize our Linux-based ARINC-653, which can provide abundant development tools, software libraries, and device drivers due to the nature of Linux. Our control and mission software include Operational Flight Program (OFP), Video Streaming Program (VSP), Ground Control Program (GCP), and Ground Monitoring Program (GMP). We test our programs in a HILS environment and show that these run correctly in terms of functionality and real-time requirements. Our study also suggests few extensions for process scheduling and inter-partition communication of ARINC 653.

We live in a world where computer-based electronics are utilized by consumers as part of their every day routines. The enormous size of this worldwide consumer electronic market ends up influencing the types and capabilities of microprocessors available for other lower-volume electronic markets, including commercial avionics. Customer demands for additional product features and improved response times are driving the development of microprocessor improvements that satisfy these demands. In response, some processor designers have integrated multiple processor cores into a single hardware component that permit multiple software applications and threads to execute concurrently. Commercial avionics products today are predominantly single-core. Whether consumer product demands for multi-core processors will significantly impact the availability of single-core processors is still yet to be seen. There is a discernible trend for new processor designs, including many “leading-edge”, to be multi-core. Certification considerations in the use of multi-core processors in commercial avionics are currently being studied and researched by a range of aircraft manufacturers, avionics suppliers, software suppliers, hardware vendors, and research organizations. This paper covers one such multi-core related software topic: Given an operating system running on a multi-core processor that satisfies an avionics product's certification considerations, what are the cascade affects on applications that utilize a software architecture and set of programming interfaces as defined in ARINC specification 653 [1], “Avionics Application Software Standard Interface”? This paper describes the considerations and potential impacts of utilizing multi-core processors in an ARINC 653 based software environment.

In 1996, ARINC 653 Part 1 (653p1) was published, which defines a standard Real-Time Operating System (RTOS) API called the APplication EXecutive (APEX). APEX defines mandatory RTOS services including the notions of time and space partitioning, and is targeted at large, complex Integrated Modular Avionics (IMA) systems. In 2012, ARINC 653 Part 4 (653p4) was developed, which defines a subset of 653p1 capabilities intended to address systems that do not require the size, complexity, or features of IMA systems. As such, 653p4 brings the benefit of 653p1-style standards compliance to more devices on aircraft, such as the majority of the Line Replaceable Units (LRUs) on next-generation aircraft. In this paper, we discuss ARINC 653p4 in contrast with 653p1.