EASA and FAA to Issue Further Guidance on Multicore Certification This Year

By Frank Wolfe

The European Aviation Safety Agency (EASA) and the Federal Aviation Administration (FAA) are to issue further guidance on the certification of airborne systems with avionics multicore processors this year, according to EASA.

Such guidance, to be put out as a joint EASA Acceptable Means of Compliance (AMC) and FAA Advisory Circular (AC), follows other counsel issued in recent years, including a EASA generic Certification Review Item Multicore Processor (CRI MCP) that applies to projects where two or more cores are activated. The CAST-32A position paper published in 2016 by a group of civil aviation regulatory officials from Asia, Europe, North and South America known as the Certification Authorities Software Team (CAST), has also provided guidance on how companies can earn certification for avionics that feature multicore processing.

However, the guidance to be published later this year will provide insight from EASA and FAA on industry advancements that have addressed challenges to certifying multicore systems outlined by CAST-32A.

"EASA is working together with the FAA on an adaptation of the multicore generic CRI into a common AMC/AC material (AMC 20-193), that aims to be published and available on the EASA website, later this year," EASA wrote in a Feb. 21st email to Avionics International.

Heightened aircraft performance requirements and the dearth of single core processors have led to the demand for MCPs, but gauging how many avionics MCPs are certified and in use is a hard task.

Neither EASA nor the FAA could or would specify which airborne systems carry MCPs, nor how many MCPs are certified and in use. The agencies said that the release of such data is either unavailable or would infringe on business proprietary related information.

"EASA has certified aircraft with some installed systems or equipment containing multicore processors," EASA wrote in its email to Avionics. "From the very first usage of multicore processor in a product (aircraft or engine), EASA has issued a Certification Review Item (CRI) that evolved to a generic CRI MCP. This CRI addresses the specific challenges of usage of multicore processors in a safety critical application, and is raised on each certification program where a multicore device is used."

"Currently most industry stakeholders using multicore processors choose to enable a limited number of cores, though the device would contain more," EASA said. "Advanced capabilities like dynamic allocation are not usually used, and there is a high caution on the management of interferences between shared resources as emphasized by the EASA CRI."

EASA declined to release the generic CRI MCP. "CRIs are confidential, as they refer to a specific project and therefore cannot be shared," EASA wrote in its email to Avionics. "For the same reason, we cannot confirm exactly when the generic MCP CRI applying to two or more cores was generated, as this could indicate which project led to this."

In January, Mercury Systems, Inc. unveiled its CIOE-1390 multi-core processor module for helicopters and urban air mobility vehicles (Mercury Systems, Inc. Photo)

This is a multifunction cockpit display developed by Collins Aerospace, the MFD-4068 multicore platform display running VxWorks 653 on a T2080 processor. This display is currently in the final certification review stage by the FAA. Photo: Collins Aerospace

The FAA wrote in an email to Avionics that "airborne systems and equipment containing multicore processors have already been approved in multiple applications."

"The FAA and EASA have a harmonized position to address these areas," according to the FAA. "Since January 2016, the organizations have been applying this position using project-specific issue papers."

The Multi-Core for Avionics (MCFA) working group, founded in 2008 by NXP, an Eindhoven, Netherlands-based semiconductor company, has been key in advancing the use of MCPs for DAL A-certified avionics. MCFA includes "System on a Chip" (SoC) designers, ecosystem software partners, and avionics system developers working to migrate avionics from federated architectures built on single core processors to integrated modular architectures using multicore systems on chips.

In January, Mercury Systems, Inc. unveiled its EnsembleSeries^™ CIOE-1390 module for helicopters and urban air mobility vehicles. The company said that the CIOE-1390 is "the industry’s first commercially-available compute module with Intel^® Atom^® multicore processors and embedded BuiltSAFE^™ technology for flight safety certification."

“The FAA and EASA have never done a multicore certification with an Intel processor,” Ike Song, vice president of Mercury's Mission Systems group, told Avionics International in a phone interview. “It’s just a matter of comfort level. I think it will get easier going forward. There has been and will be a lot of oversight, given what happened with the 737 MAX.”

In addition to the commercial, civil and urban air mobility markets, marquee military programs, such as the Lockheed Martin F-35 Lightning II, are eyeing MCPs.

Last December, San Jose-based Lynx Software Technologies said that the F-35 program office had chosen the company's LYNX MOSA.ic framework to help upgrade the F-35's mission system avionics under the F-35 program's Technology Refresh 3 effort. Will Keegan, the chief technology officer of Lynx Software Technologies, said that the LYNX MOSA.ic framework "lowers the cost, effort and risk of multicore certification compared with traditional SMP RTOS [Symmetric Multi-Processing Real-Time Operating System] approaches."

L3Harris has been developing a new, F-35 Integrated Core Processor (ICP), which is to go aboard F-35s starting with Lot 15 in 2023. Lockheed Martin built the legacy ICP at a facility in Eagan, Minn. which closed in 2012. Avionics work done there has moved to the company's Rotary and Mission Systems (RMS) division in Owego, N.Y.

The new, L3Harris ICP "is based on advanced open systems architecture and COTS technology, which pave the way for system upgrades to the F-35 well into the future," Bryant Henson, president of L3Harris Space and Airborne Systems' mission avionics sector, wrote in an email to Avionics. "Much of the F-35’s sensor and ISR capabilities will be made possible by the ICP. The new processor will increase by 25-times the collection of data from the aircraft’s sophisticated sensor suite to identify enemy radar and EW [electronic warfare] emissions that will provide the pilot with 360-degree situational awareness of threats and then prioritize and recommend to the pilot how to counter or negate the threat."

_{Privacy Policy}