We are working for many years in the aviation industry. Starting from primary and secondary flight controls up to intelligent actuators and cabin management systems. As different as the projects have been, we recognize common requests:
Separation of Applications - With the separation of applications, we target in detail the separation of safety criticality levels.
Guarantee of Runtime Behavior - During the guarantee of runtime, we target in parallel the deterministic system timing behavior.
Minimize Idle Times - The unused guaranteed time of an application is usable by the next application or core application
Working on a research project of Integrated Modular Avionics (IMA), we have contact with the operating system standard: ARINC653. This standard describes such a separation of applications. As the ARINC653 operating system standard is focused on extremely large systems, we see the benefits on smaller microcontrollers as well. In consequence, we have created the Partitioning System.
The figure shows a simple setup with three different applications (called partitions). Each partition is an own image and is independent of each other partition. The guaranteed runtime is configurable in phase tables during system design.
In contrast to the Flexible Safety RTOS where we monitor the temporal domain, the Partitioning System will control the temporal domain.
Each application is developed independently of other applications.
Bare metal application
Application with included RTOS
Integration of any RTOS is possible
System core extension allowed
Specify the guaranteed timing of applications during system design.
Unlimited number of timings
Switch timings during runtime
Monitor runtime of applications
For exchanging data, the system provides inter-partition communication.
Queues between applications
The system core extension can use this communication, too
Each endpoint gets a unique identifier
The open architecture allows you to expand the core system with so-called Service Calls (SC).
Unlimited number of user SCs
SCs are interruptible by default
Non-interruptible SCs possible
As this system is used in aerospace systems, there are very limited benefits from pre-certification. Therefore, we decide to take the guided project certification approach.
The system is used for the separation of multiple design assurance levels (DAL).
Multiple DALs on a single device
Reuse your maintenance partitions
Co-development of critical and non-critical partitions
You get prepared artifacts for certification according to DO-178C.
Artifacts for DO-178C up to DAL-A
Embedded Office guidance and assistance during assessment
The Partitioning System is ported to many architectures. The certification in a project depends on the CPU core of the processor and the cross-compiler environment. For some CPU core & compiler combinations, the document set is available. In addition to the listed chip vendor device families, all devices with the following Arm CPU Cores are supported:
Cortex-A8, A9 Microprocessors
Let's talk about your upcoming challenges. We are happy to discuss with you the potential use of the Partitioning System and possible software architectures.