Computer platform with additional configuration file, associated avionics electronic system

Abstract

Computer platform with additional configuration file, associated avionics electronic system. This computer platform is embedded on board an aircraft, runs a set of application partition(s), hosts an operating system and includes: + resources;+ a boot package including a kernel, at least one resource driver, a set of system partition(s) and at least one resource configuration table, each system partition including at least one operating system service, the table or tables being chosen from the group consisting of: a table of a first type containing configuration values ​​for hardware resources, a table of a second type containing configuration values ​​for resources usable by a respective set of partition(s), a table of a third type containing configuration values ​​for resources used by a respective partition, the first, second and third types being distinct from each other, one of the at least one table being of the first type; and + a boot automaton capable of being executed first following a power-up of the platform and configured to launch the boot package;The boot process checks if an additional configuration file is present in the storage memory, and launches, before the boot package, the additional configuration file including at least one resource configuration table of the first, second or third type, which is then used in place of a respective table of the same type from among the at least one table in the boot package.

Description

Title of the invention: Computer platform with additional configuration file, associated avionics electronic system

[0001] The present invention relates to a computer platform capable of running a set of application partition(s), each including an avionics software application, comprising resources and hosting an operating system.

[0002] The invention also relates to an avionics electronic system intended to be carried on board an aircraft, the avionics system comprising such a computer platform.

[0003] The invention relates to the field of configuring software applications, in particular avionics, loadable on a computer platform comprising resources, including a processor and at least one memory.

[0004] Such software applications, also called loadable software parts or LSPs, are generally configurable:

[0005] - either during the design phase (from the English "at design time"), by integrating it during their development generation of configuration values ​​adapted to the execution context of the respective software application;

[0006] - either during execution (from the English "at run time"), by retrieving this configuration configuration in a software or hardware memory area specifically designed for this purpose. It is then necessary to program these memory areas beforehand with the appropriate configuration parameters.

[0007] Such loadable avionics software applications typically conform to the ARINC 665 standard, also noted as A665, in its version A665-3 of 12 / 08 / 2005 and subsequent versions.

[0008] In the case of software applications configurable at design time, a computer platform capable of executing the set of application partition(s) is known. The platform comprises resources, including hardware resources, and hosts an operating system. The hardware resources include a processor, RAM, and storage memory. The computer platform also comprises, in the storage memory, a boot package including a kernel, at least one resource driver, a set of system partition(s), and a hardware resource configuration table. Each system partition includes at least one operating system service. The platform also includes a boot process capable of being executed first after the platform is powered on and configured to launch the boot package.

[0009] The advantage of configuring software applications during the design phase is to guarantee better control of the configuration taken into account, to avoid the need to add robustness to the configuration values, and to facilitate certification, in particular ETSO certification (European Technical Standard Ordered for software applications) by allowing the performance of the platform to be characterized precisely during design, without any possible variation related to a user context during execution.

[0010] However, changes in the execution context of software applications very often require the regeneration of new versions of software applications, incorporating the new configuration values.

[0011] The aim of the invention is therefore to propose a computer platform enabling the consideration of changes in the execution context of software applications.

[0012] For this purpose, the invention relates to a computer platform intended to be embedded on board an aircraft and capable of executing a set of application partition(s), the platform hosting an operating system and comprising resources including hardware resources including a processor, RAM and storage memory;

[0013] the computer platform further comprising in the storage memory:

[0014] + a boot package including a kernel, at least one resource driver, a a set of system partition(s) and at least one resource configuration table, each system partition including at least one operating system service, the table(s) being chosen from the group consisting of: a table of a first type containing configuration values ​​for hardware resources, a table of a second type containing configuration values ​​for resources usable by a respective set of partition(s), a table of a third type containing configuration values ​​for resources used by a respective partition, the first, second, and third types being distinct from one another, one of the at least one table being of the first type; and

[0015] + a startup automaton capable of being executed first following a power-up platform tension and configured to launch the boot packet;

[0016] the boot system being configured to check if an additional configuration file is present in storage memory, and then to launch the additional configuration file before the boot package,

[0017] the additional configuration file including at least one resource configuration table of a type chosen from the first, second and third types; each table in the additional configuration file then being used instead of a respective table of the same type from among the at least one table in the bootstrap package.

[0018] With the computer platform according to the invention, the additional file of confi Configuration including at least one resource configuration table facilitates the consideration of changes in the execution context of the software application(s) by allowing the addition of new configuration values ​​after the design of said software application(s).

[0019] In other words, the computer platform according to the invention makes it possible to configure software applications during the design phase, with the associated advantages, while also allowing the addition of new configuration values ​​after said design, thus remedying the aforementioned disadvantage.

[0020] Preferably, the boot machine is configured to launch the additional configuration file before the boot package if said additional file includes a table of the first type, i.e. containing configuration values ​​of hardware resources, and each configuration table of the additional configuration file then replaces the configuration table of the same type among at least one primary table.

[0021] Preferably, if the additional configuration file includes a hardware resource configuration table, i.e. a table of the first type, then the hardware resource configuration values ​​contained in said table each belong to value ranges for which the computer platform has been previously certified, which allows the benefit of the certification carried out to be retained, and thus avoids a new certification, or recertification.

[0022] Preferably, the additional configuration file consists of at least one configuration table, and the additional configuration file is then easier to generate and faster to load than a new version of the boot package modified to introduce the new configuration values.

[0023] According to other advantageous aspects of the invention, the computer platform comprises one or more of the following features, taken individually or in all technically possible combinations:

[0024] - if, during the verification of the presence of said additional configuration file, the storage memory does not contain an additional configuration file, so the boot automaton is configured to launch the boot package;

[0025] - The startup automaton is configured to launch the additional configuration file configuration only if at least one launch condition is met, each launch condition being chosen from the group consisting of: an authenticity check of the additional configuration file, and an integrity check of the additional configuration file;

[0026] the startup automaton being preferably configured to launch the additional configuration file only if all the launch conditions are met, including the authenticity check of the additional configuration file and the integrity check of the additional configuration file;

[0027] - the computer platform is capable of operating according to a mode of operation operation chosen at least from among a degraded mode where only the system partition(s) set is executable from among the system partition(s) and application partition(s) sets, and an operational mode where the system partition(s) and application partition(s) sets are each executable;

[0028] - at least one of the boot package and the additional configuration file contains a second-type resource configuration table for degraded mode, the second-type table for degraded mode containing resource configuration values ​​usable by the system partition(s);

[0029] - at least one of the boot package and the additional configuration file contains at least one third-type resource configuration table for degraded mode, each third-type table associated with a respective system partition for degraded mode containing the configuration values ​​of the resources used by said system partition in degraded mode;

[0030] - the boot package and the additional configuration file each include at plus a configuration table of the first type;

[0031] - if the additional configuration file includes a configuration table of the first type, then the hardware resource configuration values ​​contained in said table each belong to value ranges for which the IT platform has been previously certified;

[0032] - the boot package and / or the additional configuration file include several configuration tables of the second type and / or several configuration tables of the third type.

[0033] The invention also relates to an avionics electronic system intended to be installed on board an aircraft, the avionics system comprising:

[0034] - a computer platform capable of executing a set of partition(s) ap- plicative(s), the IT platform being as defined above;

[0035] - a secondary resource configuration table, the secondary table being of the second type, stored in storage memory, and containing resource configuration values ​​usable by the application partition(s); and

[0036] - the set of application partition(s), each application partition including a avionics software application and a tertiary resource configuration table, each tertiary table being of the third type and containing resource configuration values ​​used by the respective application partition, the set of application partition(s) being stored in storage memory.

[0037] According to other advantageous aspects of the invention, the avionics system comprises one or more of the following features, taken individually or in combination technically possible combinations:

[0038] - the avionics system includes, in the storage memory, at least one file additional configuration;

[0039] the avionics system preferably comprising several additional configuration files;

[0040] such as the additional configuration file including at least one configuration table, one of which is of the first type, and at least one other additional configuration file including at least one configuration table of a type chosen from the second and third types;

[0041] - the additional configuration file(s) include only at least one configuration table of a type chosen from the first, second and third types;

[0042] the additional configuration file(s) preferably consisting of at least one configuration table of a type chosen from the first, second, and third types; and

[0043] - the avionics system further includes a display screen and / or an interface man-machine.

[0044] These features and advantages of the invention will become clearer upon reading the following description, given solely by way of non-limiting example, and made with reference to the accompanying drawings, in which:

[0045] [Fig-1] [Fig.1] is a schematic representation of an aircraft equipped with a avionics electronic system comprising a set of application partitions and a computing platform capable of executing the application partitions, the platform having resources, including hardware resources including a processor, RAM and storage memory, and hosting an operating system; the platform further comprising a bootloader and a boot package including a kernel, a resource driver, a set of system partitions; the avionics system comprising primary, secondary and tertiary resource configuration tables, these tables being respectively of first, second and third types; the bootloader being configured to check whether at least one additional configuration file including at least one configuration table is present in storage memory and to launch the additional configuration file if so;at least one table from the additional configuration file is then used instead of at least one respective table of the same type;

[0046] [Fig.2] [Fig.2] is a view illustrating a first example of implementation of the invention, in operational mode of platform operation, where the avionics system includes a first additional configuration file including a configuration table of the first type, used then in place of the primary table;

[0047] [Fig.3] [Fig.3] is a view analogous to that of [Fig.2] in degraded mode of function- platform operation;

[0048] [Fig.4] [Fig.4] is a view illustrating a second example of implementation of the invention, in operational mode of operation, where the avionics system includes both the first additional configuration file including the configuration table of the first type and a second additional configuration file including a configuration table of the second type, each additional configuration file table then being used in place of a respective table of the same type initially stored in the avionics system;

[0049] [Fig.5] [Fig.5] is a view illustrating a third example of implementation of the invention, in operational mode of operation, where the avionics system includes both the second additional configuration file including this time a configuration table of the second type and a configuration table of the third type, and a third additional configuration file including a configuration table of the third type, each additional configuration file table then being used in place of a respective table of the same type initially stored in the avionics system;

[0050] [Fig.6] [Fig.6] is a view illustrating a fourth example of implementation of the invention, in degraded operating mode, where the avionics system includes the first additional configuration file including both the first type configuration table and second and third type configuration tables, used then in place of respective primary, secondary and tertiary tables;

[0051] [Fig.7] [Fig.7] is a view analogous to that of [Fig.6], in operational mode, in which the second and third type configuration tables included in the first additional configuration file are not used; and

[0052] [Fig.8] [Fig.8] is a flowchart representing a startup sequence of the avionics system of [Fig.1], with verification of the presence or absence of at least one additional configuration file.

[0053] In [Fig.1], an aircraft 5 is equipped with an avionics electronic system 10 comprising a set of application partitions 12 and a computer platform 15 capable of executing the set of application partitions 12.

[0054] Aircraft 5 is preferably an airplane. Alternatively, aircraft 5 is a helicopter, or even a drone remotely piloted by a pilot.

[0055] The computer platform 15 includes resources 18 and hosts an operating system 20. The computer platform 15 also includes a boot package 22, visible in [Fig.2] to 8, and a startup automaton 24 capable of being executed first following a power-up of the platform 15 and configured to launch the boot package 22.

[0056] Advantageously, the computer platform 15 also includes a first additional configuration file 26, visible in [Fig.2] to 8 and described in more detail thereafter.

[0057] Operating system 20, also called OS (from the English Operating System), is, for example, an operating system conforming to the ARINC 653 standard, or a POSIX operating system, or a hypervisor, or a middleware.

[0058] A person skilled in the art will then understand that the operating system 20 is understood in a broad sense and is, more generally, a set of at least one basic software 28, designed to offer services 29 of different types to each application partition 12 and / or system partition 30.

[0059] A service 29 is therefore a function of the base software usable by the application(s) and accessible by a call, also called a service call (of the OS) or a system call. An example of base software is an ARINC 653 or POSIX OS that provides such services. In the context of the invention, those skilled in the art will understand that it is the concept of a service call that is important, and not the service itself, offered by the base software.

[0060] The services 29 offered by the operating system 20 are known in themselves, and are for example input / output acquisition services, process management, communication protocol management, etc. The types of service are then input / output acquisition, process management, communication protocol management and timer management, in particular its triggering.

[0061] The avionics system 10 also includes a set of system partitions 30, each system partition 30 including at least one service 29 of the operating system 20.

[0062] The resources 18 of the platform 15 are physical, i.e. hardware, or logical elements suitable for being made available to the application partition(s) 12 and / or system partition(s) 30.

[0063] Resources 18 include hardware resources, in particular a processor 32 and memory resources 34, such as random access memory 35 and storage memory 36. The storage memory 36 is for example a programmable read-only memory, such as a PROM or FPROM (Programmable Read Only Memory or Field Programmable Read Only Memory).

[0064] In addition, the resources 18 include input and output type resources 38, also called IO resources (from the English Input Output), and graphics type resources 40, i.e. allowing a display of data.

[0065] In addition, resources 18 include avionics network-specific resources, not shown. Such resources are, for example, communication routers of an ARINC664 network, in particular ARINC664 Part 3 or ARINC664 Part 7.

[0066] The computer platform 15 is typically capable of operating according to an operating mode chosen at least from among a degraded mode, also noted PDL, where only the system partition(s) 30 is executable among the system partition(s) 30 and application partition(s) 12 sets, and an operational mode, also noted OPS, where the system partition(s) 30 and application partition(s) 12 sets are each executable.

[0067] The boot package 22 includes a kernel, at least one resource driver, a respective set of system partition(s) 30 and a primary resource configuration table 42, each system partition 30 including at least one operating system service 29 20, the primary table 42 being of a first type, denoted HWCT.

[0068] In addition, the avionics system 10 includes at least one secondary resource configuration table 44, stored in the storage memory 36, each secondary table 44 being of a second type, denoted MGCT, the second type MGCT being distinct from the first type HWCT.

[0069] Advantageously, the avionics system 10 comprises at least two distinct secondary tables 44, at least one designated 440 being intended for the computer platform 15 in operational mode, and at least the other designated 44P being intended for the computer platform in degraded operating mode. Each secondary resource configuration table 440 associated with the operational mode contains resource configuration values ​​usable by a respective set of application partition(s). Each secondary resource configuration table 44P associated with the degraded operating mode contains resource configuration values ​​usable by a respective set of system partition(s).

[0070] In addition, the avionics system 10 includes a set of system tertiary tables 46SO, 46P for resource configuration for the system partition(s) 30, stored in storage memory 36. Each system tertiary table 46SO, 46P is of a third type HACT. The third type HACT is distinct from both the first type HWCT and the second type MGCT. In the example in [Fig. 1], each system tertiary table 46SO, 46P is included within a respective partition 30.

[0071] Advantageously, the avionics system 10 includes a second-type resource configuration table (MGCT) for each of the operating modes, including degraded mode 44P and operational mode 440. The second-type table for degraded mode 44P consists of the resource configuration values ​​usable by the system partition(s) set 30. The second-type table for operational mode 440 consists of the resource configuration values ​​usable by the set of application partition(s) 12.

[0072] Advantageously, the avionics system 10 includes, for each system partition 30, a third-type HACT resource configuration table for each of the operating modes: PDL degraded mode and OPS operational mode. Each third-type table associated with a respective system partition 30 for the HACT_PDL degraded mode consists of the resource configuration values ​​used by said system partition 30 in PDL degraded mode. Each third-type table associated with a respective system partition 30 for the 46SO operational mode consists of the resource configuration values ​​used by said system partition 30 in OPS operational mode.

[0073] Each application partition 12 includes an avionics software application 50 and an application tertiary resource configuration table 46AO. Each application tertiary table 46AO is of the third type HACT and contains configuration values ​​for the resources used by the respective application partition 12. Each avionics software application 50 is intended to be executed by the platform 15, is therefore designed to make one or more calls to the operating system 20, and is also configured to use platform resources 18.

[0074] Each application partition 12 is capable of being executed only in operational mode (OPS), and is not executed in degraded mode (PDL). Each system partition 30 is capable of being executed in both operational mode (OPS) and degraded mode (PDL).

[0075] In addition, each application partition 12 also includes at least one library 52. ​​Each library 52 is a set of functions, classes, interfaces, or software modules that are grouped together for easier use by the respective avionics software application 50. The functions, classes, interfaces, or software modules of a respective library 52 relate, for example, to database management, file manipulation, graphics creation, or communication with other avionics software applications 50. When the software application 50 is executed, the library(ies) 52 of the corresponding application partition 12 are loaded into memory, and the elements they contain are then ready to be called from the application code 50.

[0076] Each application partition 12 typically comprises, and is preferably made up of, a single avionics software application 50 and one or more libraries 52 associated with this avionics software application.

[0077] In the example of [Fig. 1], the avionics system 10 comprises three application partitions 12, namely a first application partition 12A, a second application partition 12B, and a third application partition 12C. In this example, the The first application partition 12A contains a single library 52, and the second and third application partitions 12B, 12C each contain two libraries 52.

[0078] A first-type HWCT configuration table contains configuration values ​​for the hardware resources of the computing platform 15, and thus forms a hardware resource configuration table for the platform 15. The first-type HWCT configuration table typically includes the values ​​of the following quantities: processor operating frequency 32; number of processor core(s) 32; amount of RAM, i.e., RAM size 35; amount of cache memory, i.e., processor memory size 32; number of input / output operations among the resources 10 38; frequencies supported according to the ARINC 429 standard; value of the scaling coefficient (from the English prescalef) to be programmed for message timestamping, etc.

[0079] A second-type MGCT configuration table contains resource configuration values ​​usable by a respective set of partition(s), for example by the application partition(s) set(s) 12, or respectively by the system partition(s) set(s) 30.

[0080] Since the computer platform 15 is likely to be included in different avionics systems 10 and / or to be positioned in different positions on board the aircraft 5, the resources 18 usable by a respective set of partition(s) 12, 30 do not necessarily correspond to all the supportable resources of the platform 15. These usable resources generally correspond only to a portion of said resources 18, strictly smaller, i.e. more reduced, than the total of said resources 18, the values ​​of which are directly linked to the position of the computer platform 15 on board the aircraft 5.

[0081] The configuration table of the second type MGCT typically includes the values ​​of the following quantities: amount of processor time 32 usable by the respective set of partition(s) 12, 30; number of processor core(s) 32 usable by said set of partition(s) 12, 30; amount of RAM 35 usable by said set of partition(s) 12, 30; amount of cache memory usable by said set of partition(s) 12, 30; input / output identifier(s) usable by said set of partition(s) 12, 30; acceleration coefficients for cursor movement on touchscreens included in the graphics resources 40; threshold for triggering a partition sanction 12, 30 by a monitoring module of the IT platform 15. The partition sanction typically depends on an authorization associated or not with the partition 12, 30 subject of this sanction.When partition 12, 30 is a partition with authorization, for example with module-level rights, the partition sanction is a platform restart. 15. When partition 12, 30 is an unauthorized partition, for example without module-level rights, the partition sanction is a restart of the partition 12, 30 concerned.

[0082] A configuration table of the third type HACT contains resource configuration values ​​used by a respective partition 12, 30, for example by a respective application partition 12, or by a respective system partition 30.

[0083] Preferably, each third-type HACT configuration table for a respective application partition 12, as well as each third-type HACT configuration table for a respective system partition 30, must be compatible with the budgets of the second-type MGCT configuration table for the sets of application partition(s) 12 and system partition 30. In other words, the sum of the configuration values ​​contained in all the respective third-type HACT configuration tables must not exceed those contained in the corresponding second-type MGCT configuration table.

[0084] The configuration table of the third type HACT typically includes the values ​​of the following quantities: time window identifier(s) of the processor 32 used by the respective partition 12, 30; core identifier(s) of the processor 32 used by said partition 12, 30; identifier of a RAM area 35 used by said partition 12, 30; definition of communication port type objects (name, size, refresh rate ...) and identifier of the resource concerned among the inputs / outputs used by said partition 12, 30.

[0085] In the example of [Fig.1], the avionics system 10 is represented as a stack of layers Cl, C2, C3; namely a first layer Cl, also called the hardware layer; a second layer C2 above the first layer Cl, the second layer C2 also being called the operating layer, or OS layer; and a third layer C3, also called the partition layer, above the second layer C2.

[0086] The first layer C1 then comprises the resources 18. The second layer C2 comprises the operating system 20, the boot process 24, the primary table 42, and the secondary table 44P associated with the degraded operating mode. The third layer C3 comprises the application partition set 12, the system partition set 30, the secondary table 440 associated with the operational mode, and the system and application tertiary tables 46SO and 46AO, it being noted that the application tertiary tables 46AO are directly included in the application partitions 12.

[0087] A person skilled in the art will then observe that the computer platform 15 corresponds to the first and second layers Cl, C2 of the avionics system 10.

[0088] In the examples in Figures 2 to 7, the avionics system 10 is represented in terms of functional levels, with a first functional level NI corresponding to the elements likely to be launched first by the boot automaton 24, namely the boot package 22 and the first additional configuration file 26. The first functional level NI then includes the primary table(s) 42, the secondary table(s) 44P associated with the degraded operating mode, and the tertiary table(s) 46P associated with said degraded mode.

[0089] The avionics system 10 then includes a second functional level N2 typically including the secondary table 440 associated with the operational operating mode OPS, also called operational secondary table 440, and one or more tertiary system tables 46SO also associated with the operational mode OPS, as well as one or more auxiliary tables 58. The second functional level N2 is linked to the first functional level NI, the elements of the second functional level N2 being able to be called by a corresponding element of the first functional level NI.

[0090] The avionics system 10 then includes a third functional level N3, typically comprising the set of application partitions 12, as well as one or more system partitions 30. The tertiary application tables 46AO are then included in this third functional level N3, each being itself included in a corresponding application partition 12. The third functional level N3 is linked to the second functional level N2, as well as to the first functional level NI, the system partition 30 being, for example, executed in degraded mode, and then called directly by the boot package 22 or by the first additional configuration file 26. Each application partition 12 is typically called by a corresponding element of the second functional level N2, namely by the operational secondary table 440 or by a respective auxiliary table 58.

[0091] The avionics system 10 finally includes a fourth functional level N4 typically including one or more complementary software applications 56. The fourth functional level N4 is linked with the third functional level N3, each complementary application 56 being typically called by a respective application partition 12, in particular by the corresponding avionics software application 50.

[0092] According to the invention, the avionics system 10 is capable of comprising at least one additional configuration file from among the first additional configuration file 26, a second additional configuration file 60 and a third additional configuration file 62, each additional configuration file 26, 60, 62 including at least one resource configuration table of a type selected from the first type HWCT, the second type MGCT and the third type HACT. The first Additional configuration file 26 typically includes a first-type HWCT table, and optionally a second-type MGCT table for degraded operating mode and / or a third-type HACT table for said degraded mode. Second additional configuration file 60 includes a second-type MGCT configuration table and / or a third-type HACT configuration table. Third additional configuration file 62 typically includes a third-type HACT configuration table. Advantageously, each of the first, second, and third additional configuration files 26, 60, and 62 includes at least one configuration table of a type chosen from among the first-type HACT, second-type MGCT, and third-type HACT, and each of the first, second, and third additional configuration files 26, 60, and 62 preferably consists of said at least one configuration table of the aforementioned type.

[0093] Advantageously, the avionics system 10 includes, in the storage memory 36, at least one additional configuration file 26, 60, 62, and preferably several additional configuration files 26, 60, 62 from among the first 26, second 60 and third 62 additional configuration files.

[0094] The startup automaton 24 is configured to check if an additional configuration file 26, 60, 62 is present in the storage memory 36, and then to launch the additional configuration file 26, 60, 62, each table of the additional configuration file 26, 60, 62 being then used in place of a respective table of the same type among the primary table 42, secondary table 440, 44P, system tertiary table 46SO, 46P and application tertiary table 46AO.

[0095] A person skilled in the art will observe that if, when checking for the presence of said additional configuration file, the storage memory 36 does not contain any additional configuration file 26, 60, 62, then the boot machine 24 is configured to launch the boot package 22, in the absence of said additional configuration file 26, 60, 62.

[0096] Advantageously, if the additional configuration file 26 includes a table of the first type HWCT, then the boot automaton 24 is configured to launch the additional configuration file 26 before the boot package 22.

[0097] In addition, the startup automaton 24 is configured to launch the additional configuration file 26, 60, 62 only if at least one launch condition is met. Each launch condition is either an authenticity check of the additional configuration file or an integrity check of the additional configuration file.

[0098] According to this supplement, the startup automaton 24 is preferably configured to launch the additional configuration file 26, 60, 62 only if all the launch conditions are met, i.e., if the additional configuration file- Figure 26, 60, 62 is both authentic and honest.

[0099] Preferably, the boot package 22 and the first additional configuration file 26 each include at most one configuration table of the first type HWCT.

[0100] Advantageously, if the first additional configuration file 26 includes a configuration table of the first type HWCT then the hardware resource configuration values ​​contained in said table each belong to value ranges for which the computing platform 15 has been previously certified.

[0101] As an optional complement, the boot package 22 and / or the first additional configuration file 26 include several configuration tables of the second type MGCT and / or several configuration tables of the third type HACT.

[0102] Various examples of implementation of the invention will now be described with reference to figures 2 to 7.

[0103] In the example of [Fig. 2], the avionics system 10, and in particular the computer platform 15, includes the first additional configuration file 26, while not including any other additional configuration file. The boot package 22 includes the primary table 42, as well as the secondary table 44P and tertiary table 46P associated with the degraded operating mode PDL.

[0104] In this example in [Fig. 2], the first additional configuration file 26 contains only a configuration table of the first type HWCT, for example a new version of the primary table 42, the new version being denoted 42*. In this example, the first additional configuration file 26 does not contain a configuration table of the second type MGCT or the third type HACT.

[0105] When the first additional configuration file 26 is launched by the boot machine 24, the new version of the primary table 42* included in the first additional configuration file 26 is then used instead of the primary table 42 of the boot package 22. In other words, the primary table 42 of the boot package is then bypassed by the new version of the primary table 42* included in the first additional configuration file 26.

[0106] Generally, in the examples in Figures 2 to 7, each table bypassed by another table in an additional configuration file 26, 60, 62 respectively is crossed out by a cross 65. In the example in [Fig.2], the primary table 42 of the boot package is then crossed out by the cross 65.

[0107] This example from [Fig.2] corresponds to the OPS operating mode, and the secondary 44P and tertiary 46P tables associated with the PDL degraded mode are not used.

[0108] Generally, in the examples in Figures 2 to 7, the elements not used by the operating mode considered in the associated example are masked by an elliptical shape 70. In the example of [Fig. 2], the secondary 44P and tertiary tables 46P, are then masked by the elliptical shape 70.

[0109] In the example in [Fig.3], the avionics system 10, and in particular the computer platform 15, includes the same elements as in the example in [Fig.2], and the example in [Fig.3] differs from that in [Fig.2] in the mode of operation, this example corresponding to the degraded mode of operation PDL.

[0110] In the same way as in the example of [Fig.2], when the first additional configuration file 26 is launched by the boot machine 24 following the power-up of the computer platform 15, the new version of the primary table 42* included in the first additional file 26 is used instead of the primary table 42 of the boot package 22.

[0111] Unlike the example in [Fig. 2], the secondary 44P and tertiary 46P tables associated with the degraded operating mode are used this time, and the tables of the second MGCT and third HACT types implemented are those of the boot package 22. The first additional configuration file 26 includes only the new version of the primary 42* table of the first HWCT type and does not contain a configuration table of the second MGCT type or the third HACT type. In other words, among the tables included in the boot package 22, only the primary 42 table is bypassed and is represented with a cross through it 65, while the secondary 44P and tertiary 46P tables are used normally.

[0112] This example of [Fig.3] corresponding to the degraded operating mode PDL, the system partition 30 is executed after the implementation of the boot package 22. The other elements of the second, third and fourth functional levels N2, N3, N4 are not used, and are therefore masked by the elliptical shape 70.

[0113] In the example of [Fig.4], the avionics system 10 includes the same elements as in the examples of Figures 2 and 3, and further includes the second additional configuration file 60 including a configuration table of the second type MGCT, for example a new version of the secondary table 440 associated with the operational operating mode OPS, the new version being denoted 440*.

[0114] In a manner analogous to the example in [Fig.2], this example in [Fig.4] corresponds to the OPS operational mode, and the secondary 44P and tertiary 46P tables associated with the PDL degraded mode are not used, these tables 44P, 46P being then masked by the elliptical shape 70.

[0115] In the same way as in the examples in Figures 2 and 3, when the first additional configuration file 26 is launched by the boot machine 24 following the power-up of the computer platform 15, the new version of the primary table 42* included in the first additional file 26 is used instead of the primary table 42 of the boot package 22.

[0116] Next, the second additional configuration file 60 is also launched by the startup automaton 24, the new version of the secondary table 440* associated with the OPS operational mode is used instead of that of the second functional level N2 initially stored in storage memory 36.

[0117] In this example of [Fig.4], the tables bypassed are therefore the primary table 42 of the boot package 22 and the initial secondary table 440 associated with the OPS operating mode, these two tables then being represented in a crossed-out manner by the cross 65.

[0118] The example in [Fig.5] is similar to that in [Fig.4], except that in this example in [Fig.5] the avionics system 10 further includes the third additional configuration file 62 including a configuration table of the third type HACT, for example a new version of the tertiary application table 46AO of the first application partition 12A, the new version being noted 46AO*.

[0119] Another difference between the examples in Figures 4 and 5 is that in the example in [Fig.5], the second additional configuration file 60 includes both a second-type MGCT configuration table, for example the new version of the operational secondary table 440*, and a third-type HACT configuration table, for example a new version of a respective system tertiary table 46SO, the new version being denoted 46SO*, so that both the operational secondary table 440 and the respective system tertiary table 46SO are then bypassed.

[0120] A final difference between the examples in Figures 4 and 5 is that in the example in [Fig.5], the first additional configuration file 26 is empty and does not contain a configuration table of the first type HWCT, or is absent, or is not authentic and / or integral, so that the primary table 42 of the boot package 22 is not bypassed and is used by the boot automaton 24.

[0121] In this example of [Fig.5], the tables bypassed are therefore the initial secondary table 440 associated with the OPS operating mode, the respective system tertiary table 46SO and the application tertiary table 46AO of the first application partition 12A, these three tables then being represented in a crossed-out manner by the cross 65.

[0122] The example in [Fig.6] is similar to that in [Fig.3], except that in this example in [Fig.6], the first additional configuration file 26 includes both a configuration table of the first type HWCT, for example the new version of the primary table 42*, a configuration table of the second type MGCT, for example a new version of the secondary table 44P associated with the degraded mode PDL, the new version being noted 44P*, and also a configuration table of the third type HACT, for example a new version of the tertiary table 46P associated with the degraded mode PDL, the new version being noted 46P*.

[0123] In this example from [Fig.6], the tables bypassed are therefore the primary table 42, and the secondary 44P and tertiary 46P tables associated with the PDL degraded mode, these three tables of the boot package 22 then being represented in a crossed-out manner by the cross 65.

[0124] This example of [Fig.6] corresponding to the degraded operating mode PDL, the system partition 30 is executed after the implementation of the first additional configuration file 26. The other elements of the second, third and fourth functional levels N2, N3, N4 are not used, and are therefore masked by the elliptical shape 70.

[0125] In the example in [Fig.7], the avionics system 10, and in particular the computer platform 15, includes the same elements as in the example in [Fig.6], and the example in [Fig.7] differs from that in [Fig.6] in the mode of operation, this example corresponding to the OPS operational mode.

[0126] In the same way as in the example of [Fig.6], when the first additional configuration file 26 is launched by the boot machine 24 following the power-up of the computer platform 15, the new version of the primary table 42* included in the first additional file 26 is used instead of the primary table 42 of the boot package 22.

[0127] On the other hand, unlike the example in [Fig.6], the secondary 44P and tertiary 46P tables associated with the PDL degraded mode, whether those of the boot package 22 or those of the first additional configuration file 26, are not used, and are therefore masked by the elliptical form 70.

[0128] In this example of [Fig.7], the only table bypassed is therefore the primary table 42 of the boot package 22 which is then represented in a crossed-out manner by the cross 65.

[0129] A person skilled in the art will observe that the examples in Figures 2, 3, 6 and 7 relate more particularly to the computer platform 15, only the first additional configuration file 26 among the additional configuration files 26, 60, 62 being present in the storage memory 36 in these examples.

[0130] A person skilled in the art will also understand that the different possible cases for the avionics system 10 according to the invention are as follows:

[0131] - presence of the first additional configuration file 26, but not the second and third additional configuration files 60, 62: the table(s) bypassed are then the tables of the boot package 22 for which a new version is present in the first additional configuration file 26, and also taking into account the mode of operation, the secondary table 44P and tertiary table 46P being used only in degraded mode of operation PDL;

[0132] - presence of the second additional configuration file 60, but not the first and third additional configuration files 26, 62: the bypassed table(s) are the initial secondary table 440 associated with the OPS operational mode and / or one or several tertiary system tables 46SO for which a new version is present in the second additional configuration file 60;

[0133] - presence of the third additional configuration file 62, but not the first and second additional configuration files 26, 60: the table(s) bypassed are one or more tertiary application tables 46AO for which a new version is present in the third additional configuration file 62;

[0134] - presence of the first and second additional configuration files 26, 60, but not from the third additional configuration file 62, with then bypassing as described previously the tables for which a new version is present in these additional configuration files 26, 60;

[0135] - presence of the second and third additional configuration files 60, 62, but not from the first additional configuration file 26, with then bypassing as described previously the tables for which a new version is present in these additional configuration files 60, 62;

[0136] - presence of all additional configuration files, i.e. the first, second and third additional configuration files 26, 60, 62, with bypass as described previously of the tables for which a new version is present in these additional configuration files 26, 60, 62.

[0137] The startup sequence of the avionics system 10 according to the invention will now be explained with reference to the flowchart in [Fig.8].

[0138] When the avionics system 10 is powered on, and therefore the computer platform 15 contained therein, the startup automaton 24 is executed first by the processor 32, as represented by the arrow Fl.

[0139] The startup automaton 24 then begins by checking whether the first additional configuration file 26 is present in the storage memory 36 at a predefined location, provided for this purpose, this presence check being represented by the arrow F2 in [Fig.8].

[0140] If the first additional configuration file 26 is present at this location in the storage memory 36, the startup automaton 24 advantageously checks the authenticity and integrity of the first additional configuration file 26, as represented by the arrow F3, and if this check is positive, that is to say if the first additional configuration file 26 is both authentic and intact, the startup automaton 24 will then copy into the RAM 35 each table contained in the first additional configuration file 26.

[0141] If, during the presence check performed previously according to arrow F2, the startup automaton 24 determined that no additional configuration file 26 was present in the storage memory 36, or that a file was present but without a table, then the startup automaton 24 launches the boot package 22, as represented by arrow F4, and will then specifically use the configuration tables that boot package 22 contains.

[0142] The boot process 24 then copies into RAM 35, as represented by arrow F5, the table(s) resulting from the checks previously performed according to arrows F2 and F3. In other words, the boot process copies into RAM 35 each table contained in the first additional configuration file 26, if the latter is determined to be present during the check according to arrow F2, and then advantageously as authentic and intact during the check according to arrow F3. Otherwise, the configuration table(s) contained in the boot package 22 are copied into RAM 35.

[0143] After this copying of the configuration tables into RAM 35, the startup automaton 24 executes an initialization program contained in the operating system 20, as represented by arrow F6, and the latter will begin by reading the configuration table(s) previously copied into RAM 35, as represented by arrow F7. The startup sequence of the avionics system 10 according to the invention is then completed.

[0144] The startup sequence described above concerns the case with the presence of the first additional configuration file 26, but not the second and third additional configuration files 60, 62, and the person skilled in the art will understand that the startup sequence is similar in the case of the presence of the second 60 and / or third 62 additional configuration files, the startup automaton 24 also taking care of checking the presence of the second 60 and / or third 62 additional configuration files at the predefined locations provided for this purpose; then advantageously checking their authenticity and / or integrity; and finally copying into RAM the tables contained in these additional files if the aforementioned check(s) are positive.

[0145] The person skilled in the art will also understand that, in a case with several additional configuration files, the checks are carried out in ascending order of their names, that is to say for example first for the first additional configuration file 26, then for the second additional configuration file 60 and finally for the third additional configuration file 62, this in the case with all the additional configuration files.

[0146] Thus, the additional configuration file(s) 26, 60, 62 including at least one resource configuration table facilitates taking into account changes in the execution context of the software application(s) 50 by allowing the addition of new configuration values ​​after the design of said software application(s) 50.

[0147] This or these additional configuration files 26, 60, 62 allow, in particular, to retain the benefit of the certification carried out, and thus avoid a new certification, or recertification, and thereby significantly reduce the necessary technical checks and tests.

[0148] Furthermore, each additional configuration file 26, 60, 62, consisting of at least one configuration table, is easier to generate and faster to load than a new version of the boot package 22 that would be modified to introduce the new configuration values. This then makes it possible to improve the performance, particularly in terms of execution and computation time, of the avionics electronic system 10 according to the invention.

[0149] The avionics electronic system 10 according to the invention then makes it possible to facilitate the consideration of changes in the execution context of avionics software applications 50, while significantly reducing the technical checks and tests resulting from these changes and having improved system performance when taking this into account.

Claims

Demands

1. Computer platform (15) intended to be carried on board an aircraft (5) and capable of executing a set of application partition(s) (12), the platform (15) hosting an operating system (20) and comprising resources (18) including hardware resources including a processor (32), random access memory (35) and storage memory (36); the computer platform (15) further comprising in the storage memory (36): + a boot package (22) including a kernel, at least one resource driver, a set of system partition(s) (30) and at least one resource configuration table (42, 44P, 46P), each system partition (30) including at least one operating system service (29) (20), the table or tables being selected from the group consisting of: a table (42) of a first type (HWCT) containing hardware resource configuration values, a table (44P) of a second type (MGCT) containing resource configuration values ​​usable by a respective set of partition(s), a table (46P) of a third type (HACT) containing resource configuration values ​​used by a respective partition, the first (HWCT), second (MGCT) and third (HACT) types being distinct from one another, one (42) of the at least one table being of the first type (HWCT); and + a startup automaton (24) capable of being executed first following a power-up of the platform (15) and configured to launch the boot package (22); characterized in that the boot automaton (24) is configured to check whether an additional configuration file (26) is present in the storage memory (36), and then to launch the additional configuration file (26) before the boot package (22), the additional configuration file (26) including at least one resource configuration table of a type chosen from the first (HWCT), second (MGCT) and third (HACT) types; each table in the additional configuration file (26) then being used instead of a respective table of the same type from the at least one table in the boot package (22).

2. Platform (15) according to claim 1, wherein if during the verification If the presence of said additional configuration file (26) is confirmed, the storage memory (36) does not contain an additional configuration file (26), then the boot automaton (24) is configured to launch the boot package (22).

3. Platform (15) according to claim 1 or 2, wherein the startup automaton (24) is configured to launch the additional configuration file (26) only if at least one launch condition is met, each launch condition being chosen from the group consisting of: an authenticity check of the additional configuration file (26), and an integrity check of the additional configuration file (26); the startup automaton (24) preferably being configured to launch the additional configuration file (26) only if all the launch conditions are met among the authenticity check of the additional configuration file (26) and the integrity check of the additional configuration file (26).

4. Platform (15) according to any one of the preceding claims, wherein the computer platform (15) is capable of operating in an operating mode selected at least from a degraded mode (PDL) where only the system partition(s) set (30) is executable from among the system partition(s) (30) and application partition(s) (12) sets, and an operational mode (OPS) where the system partition(s) (30) and application partition(s) (12) sets are each executable.

5. Platform (15) according to claim 4, wherein at least one of the boot package (22) and the additional configuration file (26) contains a second-type resource configuration table (44P) for degraded mode (PDL), the second-type table for degraded mode (44P) containing resource configuration values ​​usable by the system partition set(s) (30).

6. Platform (15) according to claim 4 or 5, wherein at least one of the boot package (22) and the additional configuration file (26) contains at least one resource configuration table (46P) of the third type (HACT) for degraded mode (PDL), each third type table associated with a respective system partition (30) for degraded mode (46P) containing the resource configuration values ​​used by said system partition (30) in degraded mode (PDL).

7. Platform (15) according to any one of the preceding claims, wherein the boot package (22) and the additional configuration file (26) each include at most one configuration table of the first type (HWCT).

8. Platform (15) according to any one of the preceding claims, wherein if the additional configuration file (26) includes a configuration table of the first type (HWCT), then the hardware resource configuration values ​​contained in said table each belong to value ranges for which the computing platform (15) has been previously certified.

9. Platform (15) according to any one of the preceding claims, wherein the bootstrap package (22) and / or the additional configuration file (26) include multiple configuration tables of the second type (MGCT) and / or multiple configuration tables of the third type (HACT).

10. Avionics electronic system (10) intended to be carried on board an aircraft (5), the avionics system (10) comprising: - a computer platform (15) capable of executing a set of application partition(s) (12), the computer platform (15) being according to any one of the preceding claims; - a secondary resource configuration table (440), the secondary table (440) being of the second type (MGCT), stored in the storage memory (36), and containing resource configuration values ​​usable by the set of application partition(s) (12);and - the set of application partition(s) (12), each application partition (12) including an avionics software application (50) and a tertiary resource configuration table (46AO), each tertiary table (46AO) being of the third type (HACT) and containing configuration values ​​of the resources used by the respective application partition (12), the set of application partition(s) (12) being stored in the storage memory (36).;

11. Avionics system (10) according to claim 10, wherein the avionics system (10) comprises, in the storage memory (36), at least one additional configuration file (26, 60, 62); the avionics system (10) preferably comprising several additional configuration files (26, 60, 62); such as the additional configuration file (26) including at least one configuration table, one of which is of the first type (HWCT), and at least one other additional configuration file (60, 62) including at least one configuration table of a type chosen from the second (MGCT) and third (HACT) types.

12. Avionics system (10) according to claim 10 or 11, wherein the additional configuration file or files (26, 60, 62) includes only at least one configuration table of a type selected from the first (HWCT), second (MGCT) and third (HACT) types; the additional configuration file or files (26, 60, 62) preferably consisting of at least one configuration table of a type selected from the first (HWCT), second (MGCT) and third (HACT) types.

Images