The Evolving Use of Multicore Processors in Avionics

Power, reliability and real-time computing capabilities are just some of the advantages of using multicore processors. But, careful consideration of safety and certification standards is needed since rigorous testing and validation for critical systems is required by regulation. Our two-part story on the multicore evolution looks at the challenges and benefits of using multicore processors in avionics.

Multicore processors afford some advantages versus single core processors in avionics systems and multicore processors are becoming more common in avionics equipment. In this first of a two-part story on multicore processors in avionics we reached out to industry experts to establish a comparison of multicore versus single core processors, the state of things as to the use of multicore processors in avionics, the difficulties in certification and some solutions available to date.

Multicore vs. Single Core Processors

During the early history of microprocessors, performance improvements and efficiency gains were achieved by continuously increasing the clock speeds of central processing units (CPU), affirms Mike Pyne, senior director of strategic accounts and solutions architect at CoreAVI. “Early processors ran at clock speeds of 10 megahertz compared to today’s processors that run at speeds up to 3 gigahertz. At some point, in the late 1990s it became clear that there were transistor technology limitations associated with ever increasing clock speeds,” he said.

Mike Pyne, CoreAVI

To continue to provide increased performance, multicore processor (MCP) architectures were developed, Pyne observes. “Today, multicore processors can be found in just about every avionics system including mission computers, flight control systems, smart displays, air data processors, navigation gear and of course entertainment hubs,” he affirmed.

Gregory Sikkens, Curtiss-Wright Defence Solutions

Gregory Sikkens, safety critical senior product manager at Curtiss-Wright Defence Solutions, affirms that MCPs are a convenient way to improve performance where an efficient core can be replicated in a System on Chip (SoC). “Not only is this approach convenient, but MCPs can also save space, power, cost and provide an effective solution for integrated modular avionics (IMA) architectures. Today, it is rare to see a true single core processor in new systems as the majority of commercial-off-the-shelf (COTS) devices that avionics equipment depend on typically include more than one processor core,” he said. “For many years, it was the case that all but one core would be disabled on avionics equipment to avoid having to deal with the complications that multicore processors introduced when demonstrating compliance with applicable airworthiness regulations.”

Yemaya Bordain, Daedalean

According to Yemaya Bordain, Daedalean’s president of Americas, the advantages of using multicore processors (MCP) in avionics are the same as for non-avionics applications: higher performance, lower power consumption and improved efficiency. “Some secondary benefits also include their scalability and their ability to execute multiple workloads concurrently. The difference with avionics is our focus on size, weight and power consumption (SWaP), as well as heat dissipation, which is a direct consequence of power consumption and, crucially, certification,” she said.

Roberto Valla, EMEA

According to Roberto Valla, EMEA aerospace and defense head of sales at Wind River, their greater performance allows MCPs to execute multiple tasks simultaneously, which can enable parallel processing of data leading to improved overall performance. “This is particularly important in avionics, where real-time data processing is critical. Another advantage is the increased flexibility and future growth provisioning. MCPs can be configured to support a variety of applications and can provide spare capacity for future growth, making them more flexible than single-core processors and avoiding costly hardware upgrades,” she said. “The increased performance of MCPs can enable multiple applications which previously ran on individual avionics line replaceable units (LRU) to be consolidated onto a common processing LRU using an MCP, reducing requirements for space, weight, power and cabling.”

Andrea Beer, Rapita Systems

Use in Avionics

The use of MCPs in avionics equipment is trending positive, but it is not yet widespread. For safety-critical applications, MCPs were not until recently available as certifiable components and, for higher safety-criticality, such as design assurance level A (DAL-A) flight control systems, few multicore-based systems are yet available, observed Bordain. “For machine-learned systems running neural networks such as those we use, there are no processors currently certifiable that will satisfy our requirements,” she said. “In a white paper we recently co-authored with Intel, we propose a reference design based on the 11th Gen Intel Core i7 and Intel Agilex F-Series FPGA for machine learning applications. This architecture satisfies all requirements for future certifiable machine-learned avionics systems requiring high-performance computing at low SWaP.”

Multicore processors (MCPs) are increasingly being used within avionics systems, they offer increased performance compared to single core processors and allow more functionality to be included within hardware, points out Andrea Beer, marketing manager at Rapita Systems. “They can also contain other embedded functions such as memory management and embedded security, reducing the chip count for a system,” she said. “However, there are numerous implementation and certification issues that are not present in single-core processor implementations and, in addition, the use of single-core processors in so few other industries also raises concerns amongst avionics suppliers over their future supply.”

Over the last couple of years, there have been some successful multicore certifications, with more in development, Sikkens highlights. “In the defence space, most avionics equipment is turning to multicore processing-based solutions as avionics increasingly requires the performance level provided by multicore COTS SoC devices. Overall, multicore architectures are becoming more and more common as understanding increases,” he affirmed. “Also, the availability of tools for multicore processors is also increasing, providing a mechanism to demonstrate that multicore interface channels can account for worst case execution time (WCET) analysis as well as other objectives. I believe that the move to multicore processing in avionics is inevitable.”

The adoption of MCPs is increasing, partly due to the diminishing availability of single core processors, but also because of the increased performance requirements of some modern applications, including those involving artificial intelligence (AI) and machine learning (ML), according to Valla. “MCPs also provide greater processing power and enable consolidation of applications. MCPs are being increasingly used in avionics applications such as primary flight displays (PFD), mission systems, communication systems, and sensor suites, among others,” he said. “Of course, it is important to note that the use of MCPs in safety-related avionics applications is subject to strict safety certification requirements, and their use must undergo rigorous verification to ensure that they meet the required safety and reliability standards.”

Certification Difficulties

The architecture for single core processors is relatively straightforward and the process rigor and certification requirements for qualifying these systems for use in aircraft is very mature, according to Pyne. “MCPs on the other hand introduce a much greater potential for resource conflict which complicates the goal of determinism which is key to endorsing a system for safe flight operations. The European Union Aviation Safety Agency (EASA) and the US Federal Aviation Administration (FAA) have released separate guidelines for the use of MCPs in safety critical applications (i.e., EASA Certification Review and CAST-32A),” he said. “These agencies are now working in concert to finalize these requirements in more formal use of MCPs in avionics applications and address component roles (processor architecture, operating system, drivers, etc.) along with approaches to modelling and testing such systems.”

The main obstacle in certifying avionics equipment with MCPs is ensuring that the system still operates in a deterministic way considering that processes running on each core will be accessing common resources, according to Bordain. “Sharing is always more difficult than keeping things strictly separated. Interference between processors competing for the same resources such as cache, memory, and through shared interconnects, can make it difficult to prove determinism of the system under all circumstances. Some avionics designs utilizing MCPs go so far as to disable all but one core to prevent interference,” she said.

According to Sikkens, at a high level, the obstacle for certification of multicore-based avionics is the need for a deeper understanding of multiple interconnected device details, as well as how software makes use of the hardware. “These requirements add development activities and lifecycle data to the avionics equipment development project,” he said. “MCPs can complicate application implementation and require, for example, an understanding and planning for data-sharing between threads, and the use of shared resources, such as interconnect fabrics and the synchronizing of concurrent operations, just to list a few of the associated challenges.”

Whilst MCPs offer a great deal of advantages, their behavior is harder to verify due to the presence of interference channels, explains Beer. “Interference channels can be caused by a variety of factors, including contention over shared hardware resources. This interference can have a significant effect on timing behaviour, raising critical safety concerns,” she said. “Validating the timing requirements of multicore systems offers new challenges. As traditional worst-case execution time analysis methods do not take interference effects into account, new methods, such as Rapita’s Multicore Timing Analysis Solution have been developed.”

Solutions

While program execution running within a multiple cores enclave is similar to a single core, complications arise when going to an external cores enclave where transfers across the shared internal fabric to shared memory interfaces and interference can occur from each of the cores, observes Sikkens.

“These interference channels can impact performance and can complicate the determination and demonstration of WCET. Also, it can be a challenge to obtain details of the internal fabric to model a WCET determination,” he affirmed. “To help address this challenge, collaboration was formed between avionics equipment suppliers and COTS SoC suppliers, called MultiCore For Avionics (MCFA), which is an ad hoc group that establishes a unified voice of avionics equipment vendors for COTS SoC suppliers that provides guidance for the COTS SoC supplier in preparing common design data artifacts for multicore processor SoCs and assists suppliers in demonstrating compliance with airworthiness regulations.”

There are inherently more possible pathways for interference in MCPs in comparison to single core processors, according to Bordain. “This feature makes it difficult for the software, such as a Real-Time Operating System (RTOS), to control the behavior of the MCP and bound the worst-case execution time (WCET) of tasks being executed,” she said. “These pathways must all be understood, controlled, tested, and validated; therefore, the system design itself should include considerations of interference as well as which features of the MCP are needed for the application. Many MCPs have features embedded to manage resources, such as Intel’s Cache Allocation Technology as part of its Resource Director Technology Framework. We expect this year to see the first product with Daedalean technology certified. Developed out of a partnership between Daedalean and Avidyne Corporation, the Avidyne PilotEye Visual System uses the Intel Core i7 processor, which has four cores.”

Intel’s 11th gen Core i7 processor offers an advantage for aerospace suppliers since Intel has introduced the Airworthiness Evidence Package (Intel AEP), said Bordain. “It provides aircraft-embedded manufacturers with processor artifacts and the tools to analyze and mitigate non-deterministic and unintended behavior to support DO-254 certification up to DAL-A,” she added. “Initially, information was provided in 2016 by the Certification Authorities Software Team in its CAST-32A paper and later that was officially adopted by EASA as an Acceptable Means of Compliance in AMC 20-193. Both regulators recognize the advantages of MCPs and the need to steward their introduction into avionics systems.”