Avionics The Elusive 64-Bit RTOS for ED-12C/DO-178C DAL A Avionics

Related Vendors

Green Hills Software GmbH

GGB Heilbronn GmbH

Fastems Systems GmbH

64-bit real-time operating systems remain rare in safety-critical avionics, but emerging certified solutions are beginning to unlock their performance and memory advantages under the stringent ED-12C/DO-178C DAL A standard.

Most software engineers take 64-bit architectures and operating systems for granted. Unix-style 64-bit operating systems have been around since 1993 with DEC Tru64 UNIX running on DEC Alpha CPU, and Windows XP 64-Bit Edition was released in 2001. Even real-time operating systems (RTOSs) have long had 64-bit support, starting with Green Hills INTEGRITY® RTOS running on DEC Alpha in 1999.

One of the few remaining domains where 64-bit operating systems are rare is safety-critical avionics. The primary software standard used by certification authorities, such as the EASA, FAA, and Transport Canada, is ED-12C/DO-178C "Software Considerations in Airborne Systems and Equipment Certification," published by EUROCAE and RTCA.

Full 64-bit support for ED-12C/DO-178C is challenging due to the high level of integrity and availability required by the standard, particularly at the highest design assurance level, namely DAL A. For example, DAL A requires bidirectional traceability, where every line of code can be traced back to a low-level software requirement, every low-level software requirement is part of satisfying a high-level software requirement, and every high-level software requirement is part of satisfying a system-level requirement. While most safety-critical RTOS suppliers claim to have 64-bit support for their products targeted at ED-12C/DO-178C up to DAL A, the proof only comes when a system actually gets certified using the RTOS.

Why does 64-bit support matter for DAL A avionics applications? The main advantages revolve around larger addressable memory and higher performance, including:

• Addressable memory beyond 4GB (or beyond 3GB depending on how much the operating system reserves for its use or for I/O space.
• Ability to run 64-bit virtual machines (VMs), which will also require larger addressable memory.
• Better performance resulting from more registers, wider registers, and wider data paths for compute-intensive workloads. For example, encoders, decoders, encryption, and video processing can benefit greatly from 64-bit registers and memory access.
• Support for more instruction set architectures (ISA), such as AVX and SHA extensions.
• Support for 64-bit integers, which is needed for accurate long-term timekeeping in avionics and space applications and greatly speeds encryption and secure boot algorithms.
• Some applications only run on 64-bit architectures or are optimised for 64-bit operations, including some AI/ML applications.

Of course, there are situations where a 32-bit operating system is preferable, but those are generally limited to running on a 32-bit CPU, being very memory constrained, or needing to support legacy 16-bit applications. But just because you have one or more avionics applications that need to run at DAL A doesn’t mean you have to endure a 32-bit operating system.

One RTOS that does have a DAL A certification for a 64-bit RTOS is the INTEGRITY-178 tuMP™ RTOS from Green Hills Software. That certification is on 64-bit Arm® cores, and 64-bit certification packages are underway for both Intel® and Power Architectures.

Requiring DAL A also doesn’t mean you need to accept running on a just single core of a multicore processor, which is still the case for most safety-critical avionics. But that is a topic for another day.