Nearly every piece of technology that airline passengers use in their daily lives enjoys the performance benefits provided by multi-core processors (MCPs). Phones, tablets and computers derive enhanced efficiency by combining multiple central processing unit (CPU) cores, which can share tasks and resources such as cache memory, into one physical unit.
But avionics do not, continuing to rely on single-core processors (SCPs) even as the rest of the industry has moved on to MCPs. “These days in commercial aviation, everything is multi-core outside of avionics,” said Alex Wilson, director of Aerospace & Defense Solutions with Wind River.
Single-core processing remains stubbornly perched atop the avionics world because of the complexities involved with MCP certification.
While FAA and EASA have not yet published official policy regarding the use of MCPs in avionics, the FAA’s Certification Authorities Software Team provided the industry with a guide to certifying authorities’ thinking when it released the CAST-32A Position Paper in 2016. The paper outlines regulators’ main concerns for MCPs reaching the safety, performance and integrity standards of DO-178C, through which certification authorities approve commercial software-based aerospace systems.
The key challenge for MCP certification is providing evidence of predictable behavior between its interconnected subcomponents. According to Dave Radack, associate director – Software Engineering for Collins Aerospace, earning certification on a multi-core system requires analysis of the hardware and software through a systems integration perspective focused on how the interconnected components work together.
“It takes a disciplined, coordinated effort to put together a determinism story for something as complex as a multi-core system,” said Radack.
Mission-critical applications can potentially be impacted if software running on one core affects the performance of software running on another core. Known as “interference,” such impacts can arise through a wide range of possible interference channels, such as cores competing for shared resources. Potential time delays caused by interference are a risk deemed unacceptable in an industry that demands precision and redundancy.
The effects of cross-core interference are a key consideration that avionics manufacturers will need to understand in order to demonstrate the safety of their multicore systems, says Daniel Wright, Rapita Systems technical marketing executive. The accumulated evidence of the mitigation of interference channels needs then to be structured and presented to the certification authority to achieve certification. This requires powerful tools for the execution of timing tests, and robust processes to ensure the compliance with safety standards, such as DO-178C.
Despite these challenges, “the transition into using multi-core systems is inevitable,” says Wright. Rapita provides testing tools like its RapiDaemon technology that simulate maximum interference conditions – conditions that avionics manufacturers will need to show persuasive evidence of being able to identify and control.
Though Wright says their first multi-core certification is still likely 12-24 months way, he’s confident for several reasons that widespread integration of MCPs into commercial avionics is coming sooner rather than later.
For one, the industry’s never-ending quest to squeeze more power into less space. As operators demand functionality that keeps pace with modern innovations, the size, weight and power (SWaP) advantages offered by MCPs are one of the few avenues through which more power can be delivered without adding more weight. “It’s becoming difficult to meet demands for more functionality in your software when it’s on a single-core platform,” notes Wright.
The growing need to execute higher levels of functionality goes hand-in-hand with the increasing affordability of products capable of doing so, says Gregory Sikkens, director, Safety Critical Solutions for CoreAVI, which designs safety-critical graphic and video drivers.
“Today’s system-on chip-devices – which can have multiple processors and graphics processing units (GPUs) within one chip – offer high levels of computing and graphics performance for a reasonable cost,” said Sikkens.
There are also supply chain concerns. The inevitable result of lagging behind global design trends is facing a constricting market for what has become outdated technology. Single-core processors are an increasingly limited product offering little to no upside outside of safety-critical industries; the avionics industry will have no choice but to adapt as the market shifts.
“It’s going to be increasingly hard to get hold of single-core processors,” said Nick Bowles, marketing manager for Rapita Systems. “They’re only really produced for niche industries like aerospace, so their long-term availability is already in question.”
Less immediately urgent but equally vital to aviation’s future growth, MCPs are also a key to unlocking the much-hyped aviation breakthroughs of this era, including autonomous flight. Luuk van Dijk, co-founder and CEO of Switzerland-based Daedalean, describes the industry’s reliance on single-core processing as a roadblock to the development of next generation technologies.
“It’s a matter of processing limitations – it’s completely impossible to perform these functions [using single-core processors],” said van Dijk, whose company is developing autonomous piloting software systems for civil aircraft and future urban air mobility platforms.
The road ahead for MCPs in avionics involves answering complex questions to the satisfaction of regulators – a process with no precise timetable. But the unavoidable performance benefits will be a strong motivating factor to find those answers soon, says Lucas Fryzek, field application engineer at CoreAVI.
“If you look at the global industry outside of the safety-critical domains, all of the major performance gains we’re seeing come from adopting multi-core technology,” said Fryzek. “For industries with safety-critical requirements to catch up, they’ll need to have a plan for properly supporting multi-core integration.”
Certification Challenges
The rigors of the certification process are the primary reason why, despite its increasingly glaring technical limitations, single-core persists as the go-to option for commercial avionics.
“You have to prove to the certification authority that you can successfully run a Design Assurance Level (DAL) A application at the highest level next to a DAL B or C,” said Wilson. “Achieving that on a single-core system means time-slicing the CPU by giving each application time to run – reducing your performance impact to stay safe. Multi-core gives you real advantages because you’re able to give these functions a full core to use.”
But those same advantages come with liabilities. Wilson points out the necessity to prove to regulators that, for example, a non-safety application crashing won’t affect a safety-critical application. This has the effect of making testing a much more difficult and time-consuming process – particularly when every multi-core device has different architecture.
Measuring software timing behavior using single-core processors is relatively straightforward, says Wright, because you can clearly identify a deterministic worst case execution time for that software.
However, for a multi-core system, “It’s an incredibly complex multi-factorial endeavor,” Wright explained. “You have to consider hardware components and interconnects all impacted by different architecture, systems and partitioning mechanisms you have.”
The sheer number of potential causes for interference makes identifying them the longest task in the multi-core testing process, notes Radack. Interference can be found between cores, between cores and peripherals, between the arrangement of the processors, even between two different peripherals – which may be talking to each other and using resources that safety-critical software could also be using, causing interference without ever directly talking to those applications.
“You’re looking for any place where a given resource could be shared across multiple entities and then you need to look at the mechanism and the use case,” said Radack. “Is it a one-time shot or are there continually going to be collisions over shared resources?”
Another challenge is finding the right approach to mitigating interference, which Richard Jaenicke, director of Marketing at Green Hills Software, warns can drive tenfold growth in worse-case execution time, depending on the number of cores. To make the investment worthwhile, you must reduce interference without dramatically impacting the multi-core utilization that enables superior results.
“In order to get the performance and consolidation benefits of multi-core processors, you need to get high utilization of the cores,” said Jaenicke. “The problem is that most attempts to mitigate multicore interference cause vast underutilization of the processor cores. An extreme example is holding all cores but one idle to ensure no interference from the other cores.”
Future Opportunities
What do aircraft operators ultimately gain from concerted efforts by vendors and regulators to clear certification hurdles? The answer includes both short-term financial benefits and a long-term role as one of the linchpins for the industry’s technological evolution.
“Multi-core processing allows operators to include more processing capability into units of any type for less size, weight and power consumption, and ultimately less cost,” said Radack. “Installing additional components means adding weight from wires and mounting tray. If you can get that processing power without additional units, it translates into significant fuel savings over time.”
Rick Hearn, senior product manager with Curtiss-Wright Defense Solutions, says MCPs allow operators to absorb numerous applications that used to run in systems across the aircraft into a single unit.
“They also allow you to have different certification levels for all those different functions spread across multiple cores,” added Hearn, whose company provides safety-critical hardware for the defense and commercial markets.
There are also tangible safety gains, according to Hearn. When information is getting to pilots faster and clearer, “[it] decreases the effort that the pilot has to put into flying the aircraft, lessens the workload, and ultimately creates an overall safer working environment,” said Hearn.
MCP-derived performance will ultimately be necessary to continue using the increasingly complex functionality available to pilots. For example, MCPs can drive sensor fusion algorithms for operating in degraded visual environments. Figuring out certification issues is “extremely critical” to being able to keep up with these kinds of technological advances, according to Radack.
“All of these emerging technologies that we’re looking at leveraging into avionics – machine learning, A.I., advanced visual systems – come at the price of processing needs,” said Radack. “To perform these advanced features in a world where timely performance must be guaranteed, you need the processing capabilities to run through all those algorithms quickly. That goes well beyond what our fielded aviation systems deploy today using single-core processors.”
For an aerospace industry peering at a future in which transportation is transformed by the confluence of physical and digital breakthroughs, multi-core processing has become a key component of efforts to bring the next generation of cutting edge technology to life.
“Most next-gen technologies will require multi-core processing as well as other processor enhancements such as A.I.-specific instruction set extensions,” said Jaenicke with Green Hills Software, which provides real-time operating systems and embedded development solutions.
Jaenicke notes that most types of A.I., such as machine learning and deep learning, are still very far from being accepted in safety-critical avionics. DO-178C certification with multi-core processing has taken more than a decade, and he expects full implementation of A.I. to take even longer.
“That said, A.I. can be applied now to non-safety-critical applications such as fuel consumption optimization, analyzing engine data for predictive maintenance, and strategic weather planning,” said Jaenicke
MCPs play a critical role in Daedalean’s efforts in the autonomous flying sector. To process visuals alone requires a 5-12 megapixel digital camera feeding the A.I. 20-30 frames per second – demanding up to 6 gigabits per second, which van Dijk says he could never do with SCPs.
“We want to use modern computer vision and deep learning techniques that involve neural networks, so that I can show an image and it will draw a box around the runway or airplane,” said van Dijk. “We have a large amount of simultaneous operations, and we need multiple processors to do it.”
He forecasts a future in which advanced avionics can enable aircraft operators to reduce the role of what is, statistically and increasingly in comparison to technology, the weakest link in the aviation process: the human component.
“Right now, our aviation system in IFR relies on two humans communicating over voice link, a system already operating at capacity,” said van Dijk. “To make denser use of the airspace, including urban air mobility and eVTOL, you will need to eliminate the human as the performance bottleneck. That is impossible without multi-core processing power.”
The certification challenges are not trivial, says van Dijk, but he says misconceptions about MCPs being difficult to understand are overwrought. Wilson agrees, saying that the industry generally knows where multi-core processors stand in the safety certification process, and there is widespread agreement that they will ultimately become the norm. “What really excites me is A.I. – adding it to avionics is such a complete unknown because it’s so different to the ways we’ve developed software before,” he said.
He says that the increasing attention it’s receiving within the industry represents a promising sign that intellectual and financial resources are being put toward the question.
“You’re seeing more and more people at conferences discuss how they’d certify A.I. on an aircraft,” he said. “I doubt regulators have the same opinion right now, but I think it’s got to come at some stage.”