1. Certification Mac Mollison

2. Who mandates certification? l FAA (Federal Aviation Administration) »Standards DO178B, DO297 l DoD (Department of Defense) »Mandates a security validation program incorporating many standards l NSA (National Security Agency) »Certifies crypto software and devices

3. DO 178-B l Sets lots of “software engineering” rules »E.g., documenting the design/development process »We won’t discuss this further here l Gives criticality levels for software »The only part that has interesting implications for us, to my knowledge »See next slide

4. DO 178-B Criticality Levels l A: Catastrophic l B: Hazardous l C: Major l D: Minor l E: No Effect

5. Implications of DO 178-B 1. Increasing WCET pessimism with increasing criticality level »Our group has written papers on how to deal with this “intelligently” 2. Need to use Level-A RTOS that forces independence between software of different levels »Defined by ARINC 653 API standard

6. ARINC 653 l Defines API for time-space partitioning »See next slide l Multiple RTOSs are ARINC 653 compliant »Wind River VxWorks 653 »Etc.

7. Time-Space Partitioning l Partitions are basically “containers” that are statically scheduled.

8. DO 297 l Standard for integrated modular avionics (IMA) l Satisfied by using an ARINC 653 OS l Isn’t talked about much and we won’t discuss it further now

9. Security l Must use “secure” RTOS, hardware, etc. when working with classified information »Classified = confidential, secret, top secret/SAR l Typically, when multiple security levels co- exist in one system, time-space partitioning is used »E.g. VxWorks MILS: Like VxWorks 653, but fewer LOC l More details in security segment of course