| In the past, Safety Critical software systems with multiple levels of safety criticality have been deployed on federated systems, where each function executes on a dedicated processor. The need to lower maintenance costs and reduce the size/weight/power of older embedded computer systems, combined with the availability of modern processor technology, has created the demand for a commercial run-time system that permits multiple programs at different safety levels to execute on a single processor. In addition, the run-time system must be certifiable to a level of criticality as high or higher than that of any program running on the processor. The cost to test and certify safety critical software is directly proportional to the level of safety criticality. The higher the safety level, the more complex and expensive the certification process. The most economical and architecturally ideal single processor solution is to certify only those programs that operate at the highest level of safety criticality to the highest level of certification. The programs or functions that operate at lower levels of criticality would then be certified to lower levels of safety. This method is valid as long as the run-time system guarantees that any failure resulting from a defect in a program operating at a lower safety level CAN NOT, under any circumstance, disrupt the operation of the higher safety level functions. The run-time system must guarantee protection in both the space and time domains. In other words, a commercial real-time operating system must be securely partitioned so that it provides both memory protection and real-time scheduling protection. |
|
|||||||||||||||||||
 |
||||||||||||||||||||
|
INTEGRITY-178B
is an
ARINC-653-1 compliant, securely
partitioned real time operating
system that targets demanding safety
critical applications containing
multiple programs with different
levels of safety criticality, all
executing on a single processor.
INTEGRITY-178B has been engineered
from the ground up to provide
security and determinism. As a
result it guarantees protection
across both the time and space
domains. The kernel's design guarantees bounded computation times by eliminating features such as dynamic memory allocation. Underlying hardware mechanisms are used to provide full system memory protection for all components, including user applications, device drivers, and inter-partition communications. Clocks and timers are protected with access permissions and implemented entirely in software. Its memory-protection and error-handling features provide a secure system with built-in fault isolation and tolerance. At the lowest level, the kernel is protected from malicious access through its object-oriented design and access verification. Traditional kernel access problems such as invalid kernel addresses and invalid system call parameters are eliminated by the kernel's secure design. INTEGRITY-178B's unique approach to resource management, which includes processor utilization and memory management, provides guaranteed resource availability for multiple safety-critical programs on a single processor operating at different safety levels. |
|||||||||||||||||||
|
With its securely partitioned
design, deterministic behavior,
real-time responsiveness and small
footprint, INTEGRITY-178B offers a
universal run-time environment that
is capable of executing a variety of
avionics and flight control
functionality operating at different
safety and security levels. INTEGRITY-178B's ARINC-653-1-Application/EXecutive (APEX) interface provides a recognized standard interface between the operating system of an avionics computer resource (ACR) and the application software. It's ability to fully support ARINC-653-1 while complying with DO-178B Level A provides a COTS baseline avionics operating environment that meets standards already adopted and accepted by the commercial avionics industry for Integrated Modular Avionics. |
|||||||||||||||||||
INTEGRITY-178B reduces the time
to introduce new functionality into
existing systems. Through secure
partitioning in both time and space,
minimal regression testing is
required for a system's preexisting
components. Testing is often the
most expensive activity of any
certification effort. This reduction
of effort translates into large cost
savings and decreased time to
market. For systems without secure
partitioning, regression
tests/analysis must be performed to
guarantee schedulability, as well as
ensuring no data access violations,
by the new functionality. As a
result, both performance and
functional tests are required.
|
||||||||||||||||||||
Securely
partitioned real-time
operating system
same state