Avionics Architectures: Mechanisms, and Assurance

AbstractAutomated aircraft control has traditionally been divided into distinct "func-tions" that are implemented separately (e.g., autopilot, autothrottle, flight manage-ment); each function has its own fault-tolerant computer system, and dependenciesamong different functions are generally limited to the exchange of sensor and con-trol data. A by-product of this "federated" architecture is that faults are stronglycontained within the computer system of the function where they occur and cannotreadily propagate to affect the operation of other functions.More modern avionics architectures contemplate supporting multiple functionson a single, shared, fault-tolerant computer system where natural fault containmentboundaries are less sharply defined. Partitioning uses appropriate hardware andsoftware mechanisms to restore strong fault containment to such integrated archi-tectures.This report examines the requirements for partitioning, mechanisms for theirrealization, and issues in providing assurance for partitioning. Because partitioningshares some concerns with computer security, security models are reviewed andcompared with the concerns of partitioning.iii