Avionics electronic system with additional configuration file

Abstract

Avionics electronic system with additional configuration file. This avionics electronic system includes: - a computer platform running a set of application partition(s), hosting an operating system, and comprising: + resources; + a boot package including a kernel, a set of system partition(s), each including at least one service, and a primary resource configuration table of a first type with hardware resource configuration values; + a boot automaton executed first after powering on the platform and launching the boot package; - at least one secondary resource configuration table of a second type with resource configuration values ​​usable by a respective set of partition(s);- a set of tertiary system resource configuration tables for the system partition(s), of a third type, with resource configuration values ​​used by a respective partition; - the application partition(s), each including an avionics application and an application tertiary resource configuration table, of the third type, containing resource configuration values ​​used by the respective application partition. The startup automaton checks if an additional configuration file is present in storage memory, and then launches the additional configuration file (26, 60, 62) including at least one configuration table of the first, second, or third type, which is then used in place of a respective table of the same type among the primary, secondary, system tertiary, and application tertiary tables.

Description

Title of the invention: Avionics electronic system with additional configuration file

[0001] The present invention relates to an avionics electronic system intended to be carried on board an aircraft, the avionics system comprising a computer platform capable of executing a set of application partition(s), each including an avionics software application, comprising resources and hosting an operating system.

[0002] The invention relates to the field of configuring software applications, in particular avionics, loadable on a computer platform comprising resources, including a processor and at least one memory.

[0003] Such software applications, also called loadable software parts or LSPs (from the English "Loadable Software Parts"), are generally configurable:

[0004] - either during the design phase (from the English "at design time"), by integrating it during their development generation of configuration values ​​adapted to the execution context of the respective software application;

[0005] - either during execution (from the English "at run time"), by retrieving this configuration configuration in a software or hardware memory area specifically designed for this purpose. It is then necessary to program these memory areas beforehand with the appropriate configuration parameters.

[0006] Such loadable avionics software applications typically conform to the ARINC 665 standard, also noted as A665, in its version A665-3 of 12 / 08 / 2005 and subsequent versions.

[0007] In the case of software applications configurable during design, an avionics electronic system is known comprising a set of application partition(s), each including at least one avionics software application and at least one configuration table of resources used by a respective partition; a configuration table of resources usable by the set of application partition(s); and a computer platform capable of executing the set of application partition(s), the platform comprising resources including hardware resources and hosting an operating system, the hardware resources including a processor, RAM and storage memory.The computing platform also includes, in storage memory, a boot package including a kernel, at least one resource driver, a set of system partition(s) and a hardware resource configuration table, each system partition including at least one operating system service; and a boot automaton capable of being. executed first following a power-up of the platform and configured to launch the boot package.

[0008] The advantage of configuring software applications during the design phase is to ensure better control of the configuration taken into account, to avoid the need to add robustness to the configuration values, and to facilitate certification, in particular ETSO (European Technical Standard Ordered) certification of software applications by allowing the performance of the platform to be characterized precisely during the design phase, without any possible variation related to a user context during execution.

[0009] However, changes in the execution context of software applications very often require the regeneration of new versions of software applications, incorporating the new configuration values.

[0010] The aim of the invention is then to propose an avionics electronic system that makes it easier to take into account changes in the execution context of software applications.

[0011] To this end, the invention relates to an avionics electronic system intended to be installed on board an aircraft, the avionics system comprising:

[0012] - a computer platform capable of executing a set of partition(s) ap- plicative(s), comprising resources including hardware resources and hosting an operating system, the hardware resources including a processor, RAM and storage memory;

[0013] the computer platform further comprising in the storage memory:

[0014] + a boot package including a kernel, at least one resource driver, a a set of system partition(s) and a primary resource configuration table, each system partition including at least one operating system service, the primary table being of a first type containing hardware resource configuration values; and

[0015] + a startup automaton capable of being executed first following a power-up platform tension and configured to launch the boot packet;

[0016] - at least one secondary resource configuration table, stored in the storage memory, each secondary table being of a second type containing resource configuration values ​​usable by a respective set of application or system partition(s), the second type being distinct from the first type;

[0017] - a set of tertiary tables for a resource configuration system the set of system partition(s), stored in storage memory, each system tertiary table being of a third type containing resource configuration values ​​used by a respective partition, the third type being distinct from the first and second types;

[0018] - the set of application partition(s), stored in storage memory, each application partition including an avionics software application and an application tertiary resource configuration table, each application tertiary table being of the third type and containing resource configuration values ​​used by the respective application partition;

[0019] the startup automaton being configured to check if an additional configuration file is present in storage memory, and then to launch the additional configuration file,

[0020] the additional configuration file including at least one resource configuration table of a type chosen from the first, second and third types; each table in the additional configuration file then being used in place of a respective table of the same type from among the primary, secondary, tertiary system and tertiary application tables.

[0021] With the avionics system according to the invention, the additional configuration file including at least one resource configuration table facilitates taking into account changes in the execution context of the software application(s) by allowing the addition of new configuration values ​​after the design of said software application(s).

[0022] In other words, the avionics system according to the invention then makes it possible to configure the software applications during the design phase, with the associated advantages, while also allowing the addition of new configuration values ​​after said design, thus remedying the aforementioned disadvantage.

[0023] Preferably, the boot machine is configured to launch the additional configuration file before the boot package if said additional file includes a table of the first type, i.e. containing configuration values ​​of hardware resources, and the or each configuration table of the additional storage memory configuration file 36 is for example then replaces the configuration table of the same type among the primary, secondary and tertiary table(s).

[0024] Preferably, if the additional configuration file includes a hardware resource configuration table, i.e. a table of the first type, then the hardware resource configuration values ​​contained in said table each belong to value ranges for which the computer platform has been previously certified, which allows the benefit of the certification carried out to be retained, and thus avoids a new certification, or recertification.

[0025] Preferably, the additional configuration file consists of at least one configuration table, and the additional configuration file is then easier to generate and faster to load than a new version of the boot package modified to introduce the new configuration values.

[0026] According to other advantageous aspects of the invention, the avionics system comprises one or more of the following features, taken individually or in all technically possible combinations:

[0027] - if, during the verification of the presence of said additional configuration file, the storage memory does not contain any additional configuration files, so the boot automaton is configured to launch the boot package;

[0028] - if the additional configuration file includes a table of the first type, then The boot automaton is configured to launch the additional configuration file before the boot package;

[0029] - The startup automaton is configured to launch the additional configuration file configuration only if at least one launch condition is met, each launch condition being chosen from the group consisting of: an authenticity check of the additional configuration file, and an integrity check of the additional configuration file;

[0030] the startup automaton being preferably configured to launch the additional configuration file only if all the launch conditions are met among the verification of the authenticity of the additional configuration file and the verification of the integrity of the additional configuration file;

[0031] - the computer platform is capable of operating according to a mode of operation operation chosen at least from among a degraded mode where only the system partition(s) set is executable from among the system partition(s) and application partition(s) sets, and an operational mode where the system partition(s) and application partition(s) sets are each executable;

[0032] - the avionics system includes a resource configuration table of the second type for each of the operating modes between degraded mode and operational mode, the second type table for degraded mode containing resource configuration values ​​usable by the system partition(s) set and the second type table for operational mode containing resource configuration values ​​usable by the application partition(s) set;

[0033] - the avionics system includes, for each system partition, a configuration table third type resource configuration for each of the operating modes between degraded mode and operational mode, each third type table associated with a respective system partition for degraded mode containing the configuration values ​​of the resources used by said system partition in degraded mode and each third type table associated with a respective system partition for operational mode containing the configuration values ​​of the resources used by said system partition in operational mode;

[0034] - the boot package and the additional configuration file each include at plus a configuration table of the first type;

[0035] - if the additional configuration file includes a configuration table of the first type then the hardware resource configuration values ​​contained in said table each belong to value ranges for which the IT platform has been previously certified;

[0036] - the boot package and / or the additional configuration file include several configuration tables of the second type and / or several configuration tables of the third type;

[0037] - the avionics system includes, in the storage memory, at least one file additional configuration;

[0038] the avionics system preferably comprising several additional configuration files;

[0039] such as a first additional configuration file including at least one configuration table, one of which is of the first type, and at least one other additional configuration file including at least one configuration table of a type chosen from the second and third types;

[0040] - the additional configuration file(s) include only at least one configuration table of a type chosen from the first, second and third types;

[0041] the additional configuration file(s) preferably consisting of at least one configuration table of a type chosen from the first, second, and third types; and

[0042] - the avionics system further includes a display screen and / or an interface man-machine.

[0043] These features and advantages of the invention will become clearer upon reading the following description, given solely by way of non-limiting example, and made with reference to the accompanying drawings, in which:

[0044] [Fig-1] [Fig.1] is a schematic representation of an aircraft equipped with a avionics electronic system comprising a set of application partitions and a computing platform capable of executing the application partitions, the platform having resources, including hardware resources such as a processor, RAM, and storage memory, and hosting an operating system; the platform further comprising a bootloader and a boot package including a kernel, a resource driver, and a set of system partitions; the avionics system comprising primary, secondary, and tertiary resource configuration tables, these tables being of first, second, and third types, respectively; the bootloader being configured to check whether at least one additional configuration file including at least one configuration table is present in the storage memory and to launch the additional configuration file if necessary; at least one table from the additional configuration file is then used instead of at least one respective table of the same type;

[0045] [Fig.2] [Fig.2] is a view illustrating a first example of implementation of the invention, in operational mode of platform operation, where the avionics system includes a first additional configuration file including a configuration table of the first type, used then in place of the primary table;

[0046] [Fig.3] [Fig.3] is a view analogous to that of [Fig.2] in degraded operating mode of the platform;

[0047] [Fig.4] [Fig.4] is a view illustrating a second example of implementation of the invention, in operational mode of operation, where the avionics system includes both the first additional configuration file including the configuration table of the first type and a second additional configuration file including a configuration table of the second type, each additional configuration file table then being used in place of a respective table of the same type initially stored in the avionics system;

[0048] [Fig.5] [Fig.5] is a view illustrating a third example of implementation of the invention, in operational mode of operation, where the avionics system includes both the second additional configuration file including this time a configuration table of the second type and a configuration table of the third type, and a third additional configuration file including a configuration table of the third type, each additional configuration file table then being used in place of a respective table of the same type initially stored in the avionics system;

[0049] [Fig.6] [Fig.6] is a view illustrating a fourth example of implementation of the invention, in degraded operating mode, where the avionics system includes the first additional configuration file including both the first type configuration table and second and third type configuration tables, used then in place of respective primary, secondary and tertiary tables;

[0050] [Fig.7] [Fig.7] is a view analogous to that of [Fig.6], in operational mode, in which the second and third type configuration tables included in the first additional configuration file are not used; and

[0051] [Fig.8] [Fig.8] is a flowchart representing a startup sequence of the avionics system of [Fig.1], with verification of the presence or absence of at least one additional configuration file.

[0052] In [Fig. 1], an aircraft 5 is equipped with an avionics electronic system 10 comprising a set of application partitions 12 and a computer platform 15 capable of executing the entire set of application partitions 12.

[0053] Aircraft 5 is preferably an airplane. Alternatively, aircraft 5 is a helicopter, or even a drone remotely piloted by a pilot.

[0054] The computer platform 15 includes resources 18 and hosts an operating system 20. The computer platform 15 also includes a boot package 22, visible in [Fig.2] to 8, and a startup automaton 24 capable of being executed first following a power-up of the platform 15 and configured to launch the boot package 22.

[0055] Advantageously, the computer platform 15 also includes a first additional configuration file 26, visible in [Fig.2] to 8 and described in more detail thereafter.

[0056] Operating system 20, also called OS (from the English Operating System), is, for example, an operating system conforming to the ARINC 653 standard, or a POSIX operating system, or a hypervisor, or a middleware.

[0057] A person skilled in the art will then understand that the operating system 20 is understood in a broad sense and is, more generally, a set of at least one basic software 28, designed to offer services 29 of different types to each application partition 12 and / or system partition 30.

[0058] A service 29 is therefore a function of the base software usable by the application(s) and accessible by a call, also called a service call (of the OS) or a system call. An example of base software is an ARINC 653 or POSIX OS that provides such services. In the context of the invention, those skilled in the art will understand that it is the concept of a service call that is important, and not the service itself, offered by the base software.

[0059] The services 29 offered by the operating system 20 are known in themselves, and are for example input / output acquisition services, process management, communication protocol management, etc. The types of service are then input / output acquisition, process management, communication protocol management and timer management, in particular its triggering.

[0060] The avionics system 10 also includes a set of system partitions 30, each system partition 30 including at least one service 29 of the operating system 20.

[0061] The resources 18 of the platform 15 are physical, i.e. hardware, or logical elements suitable for being made available to the application partition(s) 12 and / or system partition(s) 30.

[0062] Resources 18 include hardware resources, notably a processor 32, and memory resources 34, such as random access memory 35 and storage memory 36. The storage memory 36 is, for example, programmable read-only memory, such as a PROM or FPROM memory (from the English Programmable Read Only Memory or Field Programmable Read Only Memory).

[0063] In addition, the resources 18 include input and output type resources 38, also called resources 10 (from the English Input Output), and graphic type resources 40, i.e. allowing a display of data.

[0064] In addition, resources 18 include avionics network-specific resources, not shown. Such resources are, for example, communication routers of an ARINC664 network, in particular ARINC664 Part 3 or ARINC664 Part 7.

[0065] The computer platform 15 is typically capable of operating according to an operating mode chosen at least from among a degraded mode, also noted PDL, where only the system partition(s) 30 is executable among the system partition(s) 30 and application partition(s) 12 sets, and an operational mode, also noted OPS, where the system partition(s) 30 and application partition(s) 12 sets are each executable.

[0066] The boot package 22 includes a kernel, at least one resource driver, a respective set of system partition(s) 30 and a primary resource configuration table 42, each system partition 30 including at least one operating system service 29 20, the primary table 42 being of a first type, denoted HWCT.

[0067] In addition, the avionics system 10 includes at least one secondary resource configuration table 44, stored in the storage memory 36, each secondary table 44 being of a second type, denoted MGCT, the second type MGCT being distinct from the first type HWCT.

[0068] Advantageously, the avionics system 10 comprises at least two distinct secondary tables 44, at least one designated 440 being intended for the computer platform 15 in operational mode, and at least the other designated 44P being intended for the computer platform in degraded operating mode. Each secondary resource configuration table 440 associated with the operational mode contains resource configuration values ​​usable by a respective set of application partition(s). Each secondary resource configuration table 44P associated with the degraded operating mode contains resource configuration values ​​usable by a respective set of system partition(s).

[0069] In addition, the avionics system 10 includes a set of system tertiary tables 46SO, 46P for resource configuration for the system partition(s) set 30, stored in storage memory 36. Each system tertiary table 46SO, 46P is of a third type HACT. The third type HACT is distinct from both the first type HWCT and the second type MGCT. In the example of [Fig.1], each tertiary table system 46SO, 46P is included within a respective partition 30.

[0070] Advantageously, the avionics system 10 includes a second-type resource configuration table (MGCT) for each of the operating modes, including degraded mode 44P and operational mode 440. The second-type table for degraded mode 44P consists of the resource configuration values ​​usable by the system partition(s) set 30. The second-type table for operational mode 440 consists of the resource configuration values ​​usable by the application partition(s) set 12.

[0071] Advantageously, the avionics system 10 includes, for each system partition 30, a third-type HACT resource configuration table for each of the operating modes: PDL degraded mode and OPS operational mode. Each third-type table associated with a respective system partition 30 for the HACT_PDL degraded mode consists of the resource configuration values ​​used by said system partition 30 in PDL degraded mode. Each third-type table associated with a respective system partition 30 for the 46SO operational mode consists of the resource configuration values ​​used by said system partition 30 in OPS operational mode.

[0072] Each application partition 12 includes an avionics software application 50 and an application tertiary resource configuration table 46AO. Each application tertiary table 46AO is of the third type HACT and contains configuration values ​​for the resources used by the respective application partition 12. Each avionics software application 50 is intended to be executed by the platform 15, is therefore designed to issue one or more calls to the operating system 20, and is also configured to use platform resources 18.

[0073] Each application partition 12 is capable of being executed only in operational mode (OPS), and is not executed in degraded mode (PDL). Each system partition 30 is capable of being executed in both operational mode (OPS) and degraded mode (PDL).

[0074] In addition, each application partition 12 also includes at least one library 52. ​​Each library 52 is a set of functions, classes, interfaces, or software modules that are grouped together for easier use by the respective avionics software application 50. The functions, classes, interfaces, or software modules of a respective library 52 relate, for example, to database management, file manipulation, graphics creation, or communication with other avionics software applications 50. When the software application 50 is executed, the library or libraries 52 of the corresponding application partition 12 are loaded. memory and the elements it contains are then ready to be called from the application code 50.

[0075] Each application partition 12 typically comprises, and is preferably made up of, a single avionics software application 50 and one or more libraries 52 associated with this avionics software application.

[0076] In the example of [Fig. 1], the avionics system 10 comprises three application partitions 12, namely a first application partition 12A, a second application partition 12B and a third application partition 12C. In this example, the first application partition 12A contains a single library 52, and the second and third application partitions 12B, 12C each contain two libraries 52.

[0077] A first-type HWCT configuration table contains configuration values ​​for the hardware resources of the computing platform 15, and thus forms a hardware resource configuration table for the platform 15. The first-type HWCT configuration table typically includes the values ​​of the following quantities: processor operating frequency 32; number of processor core(s) 32; amount of RAM, i.e., RAM size 35; amount of cache memory, i.e., processor memory size 32; number of input / output ports among the I / O resources 38; frequencies supported according to the ARINC 429 standard; value of the scaling coefficient (prescalef) to be programmed for message timestamping, etc.

[0078] A second-type MGCT configuration table contains resource configuration values ​​usable by a respective set of partition(s), for example by the application partition(s) set(s) 12, or respectively by the system partition(s) set(s) 30.

[0079] Since the computer platform 15 is likely to be included in different avionics systems 10 and / or to be positioned in different positions on board the aircraft 5, the resources 18 usable by a respective set of partition(s) 12, 30 do not necessarily correspond to all the supportable resources of the platform 15. These usable resources generally correspond only to a portion of said resources 18, strictly smaller, i.e. more reduced, than the total of said resources 18, the values ​​of which are directly linked to the position of the computer platform 15 on board the aircraft 5.

[0080] The configuration table of the second type MGCT typically includes the values ​​of the following quantities: the amount of processor time 32 usable by the respective set of partition(s) 12, 30; the number of processor core(s) 32 usable by said set of partition(s) 12, 30; the amount of RAM 35 usable by said set of partition(s) 12, 30; and the amount of cache memory. usable by said partition set(s) 12, 30; input / output identifier(s) usable by said partition set(s) 12, 30; acceleration coefficients for cursor movement on touchscreens included in graphic resources 40; threshold for triggering a partition sanction 12, 30 by a monitoring module of the IT platform 15. The partition sanction typically depends on whether or not the partition 12, 30 subject to this sanction has an associated authorization. When partition 12, 30 is an authorized partition, for example with module-level rights, the partition sanction is a restart of the platform 15. When partition 12, 30 is an unauthorized partition, for example without module-level rights, the partition sanction is a restart of the partition 12, 30 in question.

[0081] A configuration table of the third type HACT contains resource configuration values ​​used by a respective partition 12, 30, for example by a respective application partition 12, or by a respective system partition 30.

[0082] Preferably, each third-type HACT configuration table for a respective application partition 12, as well as each third-type HACT configuration table for a respective system partition 30, must be compatible with the budgets of the second-type MGCT configuration table for the sets of application partition(s) 12 and system partition 30. In other words, the sum of the configuration values ​​contained in all the respective third-type HACT configuration tables must not exceed those contained in the corresponding second-type MGCT configuration table.

[0083] The configuration table of the third type HACT typically includes the values ​​of the following quantities: time window identifier(s) of the processor 32 used by the respective partition 12, 30; core identifier(s) of the processor 32 used by said partition 12, 30; identifier of a RAM area 35 used by said partition 12, 30; definition of communication port type objects (name, size, refresh rate ...) and identifier of the resource concerned among the inputs / outputs used by said partition 12, 30.

[0084] In the example of [Fig.1], the avionics system 10 is represented as a stack of layers Cl, C2, C3; namely a first layer Cl, also called the hardware layer; a second layer C2 above the first layer Cl, the second layer C2 also being called the operating layer, or OS layer; and a third layer C3, also called the partition layer, above the second layer C2.

[0085] The first layer Cl then contains the resources 18. The second layer C2 contains the operating system 20, the startup automaton 24, the primary table 42 and the secondary table 44P associated with the degraded operating mode. The third layer C3 comprises the application partition set 12, the system partition set 30, the secondary table 440 associated with the operational operating mode, and the system and application tertiary tables 46SO, 46AO, it being recalled that the application tertiary tables 46AO are included directly in the application partitions 12.

[0086] A person skilled in the art will then observe that the computer platform 15 corresponds to the first and second layers Cl, C2 of the avionics system 10.

[0087] In the examples in Figures 2 to 7, the avionics system 10 is represented in terms of functional levels, with a first functional level NI corresponding to the elements likely to be launched first by the boot automaton 24, namely the boot package 22 and the first additional configuration file 26. The first functional level NI then includes the primary table(s) 42, the secondary table(s) 44P associated with the degraded operating mode, and the tertiary table(s) 46P associated with said degraded mode.

[0088] The avionics system 10 then includes a second functional level N2 typically including the secondary table 440 associated with the operational operating mode OPS, also called operational secondary table 440, and one or more tertiary system tables 46SO also associated with the operational operating mode OPS, as well as one or more auxiliary tables 58. The second functional level N2 is linked to the first functional level NI, the elements of the second functional level N2 being able to be called by a corresponding element of the first functional level NI.

[0089] The avionics system 10 then includes a third functional level N3, typically comprising the set of application partitions 12, as well as one or more system partitions 30. The tertiary application tables 46AO are then included in this third functional level N3, each being itself included in a corresponding application partition 12. The third functional level N3 is linked to the second functional level N2, as well as to the first functional level NI, the system partition 30 being, for example, executed in degraded mode, and then called directly by the boot package 22 or by the first additional configuration file 26. Each application partition 12 is typically called by a corresponding element of the second functional level N2, namely by the secondary operational table 440 or by a respective auxiliary table 58.

[0090] The avionics system 10 finally includes a fourth functional level N4 typically including one or more complementary software applications 56. The fourth functional level N4 is linked to the third functional level N3, each complementary application 56 being typically called by a partition ap plicative 12 respective, in particular by the corresponding avionics software application 50.

[0091] According to the invention, the avionics system 10 is capable of comprising at least one additional configuration file from among the first additional configuration file 26, a second additional configuration file 60, and a third additional configuration file 62, each additional configuration file 26, 60, 62 including at least one resource configuration table of a type selected from the first type HWCT, the second type MGCT, and the third type HACT. The first additional configuration file 26 typically includes a first-type HWCT table, as well as, optionally, a second-type MGCT table for the degraded operating mode and / or a third-type HACT table for said degraded mode. The second additional configuration file 60 includes a second-type MGCT configuration table and / or a third-type HACT configuration table.The third additional configuration file 62 typically includes a third-type HACT configuration table. Advantageously, each of the first, second, and third additional configuration files 26, 60, 62 includes only at least one configuration table of a type chosen from the first HACT, second MGCT, and third HACT types, and each of the first, second, and third additional configuration files 26, 60, 62 preferably consists of said at least one configuration table of the aforementioned type.

[0092] Advantageously, the avionics system 10 includes, in the storage memory 36, at least one additional configuration file 26, 60, 62, and preferably several additional configuration files 26, 60, 62 from among the first 26, second 60 and third 62 additional configuration files.

[0093] The startup automaton 24 is configured to check if an additional configuration file 26, 60, 62 is present in the storage memory 36, and then to launch the additional configuration file 26, 60, 62, each table of the additional configuration file 26, 60, 62 being then used in place of a respective table of the same type among the primary table 42, secondary table 440, 44P, system tertiary table 46SO, 46P and application tertiary table 46AO.

[0094] A person skilled in the art will observe that if, when checking for the presence of said additional configuration file, the storage memory 36 does not contain any additional configuration file 26, 60, 62, then the boot machine 24 is configured to launch the boot package 22, in the absence of said additional configuration file 26, 60, 62.

[0095] Advantageously, if the additional configuration file 26 includes a table of the first type HWCT, then the boot automaton 24 is configured to launch the additional configuration file 26 before the boot package 22.

[0096] In addition, the startup automaton 24 is configured to launch the additional configuration file 26, 60, 62 only if at least one launch condition is met. Each launch condition is either an authenticity check of the additional configuration file or an integrity check of the additional configuration file.

[0097] According to this supplement, the startup automaton 24 is preferably configured to launch the additional configuration file 26, 60, 62 only if all the launch conditions are met, i.e. if the additional configuration file 26, 60, 62 is both authentic and intact.

[0098] Preferably, the boot package 22 and the first additional configuration file 26 each include at most one configuration table of the first type HWCT.

[0099] Advantageously, if the first additional configuration file 26 includes a configuration table of the first type HWCT, then the hardware resource configuration values ​​contained in said table each belong to value ranges for which the computing platform 15 has been previously certified.

[0100] As an optional addition, the boot package 22 and / or the first additional configuration file 26 include several configuration tables of the second type MGCT and / or several configuration tables of the third type HACT.

[0101] Various examples of implementation of the invention will now be described with reference to figures 2 to 7.

[0102] In the example of [Fig. 2], the avionics system 10, and in particular the computer platform 15, includes the first additional configuration file 26, while not including any other additional configuration files. The boot package 22 includes the primary table 42, as well as the secondary table 44P and tertiary table 46P associated with the degraded operating mode PDL.

[0103] In this example in [Fig. 2], the first additional configuration file 26 contains only a configuration table of the first type HWCT, for example a new version of the primary table 42, the new version being denoted 42*. In this example, the first additional configuration file 26 does not contain a configuration table of the second type MGCT or the third type HACT.

[0104] When the first additional configuration file 26 is launched by the boot machine 24, the new version of the primary table 42* included in the first additional configuration file 26 is then used instead of the primary table 42 of the boot package 22. In other words, the primary table 42 of the boot package is then bypassed by the new version of the primary table 42* included in the first additional configuration file 26.

[0105] Generally, in the examples in Figures 2 to 7, each table bypassed by another table in a respective additional configuration file 26, 60, 62 is crossed out by a cross 65. In the example of [Fig.2], the primary table 42 of the boot package is then crossed out by the cross 65.

[0106] This example from [Fig.2] corresponds to the OPS operating mode, and the secondary 44P and tertiary 46P tables associated with the PDL degraded mode are not used.

[0107] In general, in the examples of Figures 2 to 7, the unused elements due to the mode of operation considered in the associated example are masked by an elliptical shape 70. In the example of [Fig.2], the secondary table 44P and tertiary table 46P are then masked by the elliptical shape 70.

[0108] In the example in [Fig.3], the avionics system 10, and in particular the computer platform 15, includes the same elements as in the example in [Fig.2], and the example in [Fig.3] differs from that in [Fig.2] in the mode of operation, this example corresponding to the degraded operating mode PDL.

[0109] In the same way as in the example of [Fig.2], when the first additional configuration file 26 is launched by the boot machine 24 following the power-up of the computer platform 15, the new version of the primary table 42* included in the first additional file 26 is used instead of the primary table 42 of the boot package 22.

[0110] Unlike the example in [Fig. 2], the secondary 44P and tertiary 46P tables associated with the degraded operating mode are used this time, and the tables of the second MGCT and third HACT types implemented are those of the boot package 22. The first additional configuration file 26 includes only the new version of the primary table 42* of the first HWCT type and does not contain a configuration table of the second MGCT type or the third HACT type. In other words, among the tables included in the boot package 22, only the primary table 42 is bypassed and is represented with a cross through it 65, while the secondary 44P and tertiary 46P tables are used normally.

[0111] This example of [Fig.3] corresponds to the degraded operating mode PDL, the System partition 30 is executed after the implementation of boot package 22. The other elements of the second, third and fourth functional levels N2, N3, N4 are not used, and are therefore masked by the elliptical form 70.

[0112] In the example of [Fig.4], the avionics system 10 includes the same elements as in the examples of Figures 2 and 3, and further includes the second additional configuration file 60 including a configuration table of the second type MGCT, for example a new version of the secondary table 440 associated with the operational operating mode OPS, the new version being denoted 440*.

[0113] Similar to the example in [Fig. 2], this example in [Fig. 4] corresponds to the OPS operating mode, and the secondary 44P and tertiary 46P tables associated with the PDL degraded mode is not used, these tables 44P, 46P being then masked by the elliptical form 70.

[0114] In the same way as in the examples in Figures 2 and 3, when the first additional configuration file 26 is launched by the boot machine 24 following the power-up of the computer platform 15, the new version of the primary table 42* included in the first additional file 26 is used instead of the primary table 42 of the boot package 22.

[0115] Next, the second additional configuration file 60 is also launched by the startup automaton 24, the new version of the secondary table 440* associated with the OPS operational mode is used instead of that of the second functional level N2 initially stored in the storage memory 36.

[0116] In this example of [Fig.4], the tables bypassed are therefore the primary table 42 of the boot package 22 and the initial secondary table 440 associated with the OPS operating mode, these two tables then being represented in a crossed-out manner by the cross 65.

[0117] The example in [Fig.5] is similar to that in [Fig.4], except that in this example in [Fig.5] the avionics system 10 further includes the third additional configuration file 62 including a configuration table of the third type HACT, for example a new version of the tertiary application table 46AO of the first application partition 12A, the new version being noted 46AO*.

[0118] Another difference between the examples in Figures 4 and 5 is that in the example in [Fig.5], the second additional configuration file 60 includes both a second-type MGCT configuration table, for example the new version of the operational secondary table 440*, and a third-type HACT configuration table, for example a new version of a respective system tertiary table 46SO, the new version being denoted 46SO*, so that both the operational secondary table 440 and the respective system tertiary table 46SO are then bypassed.

[0119] A final difference between the examples in Figures 4 and 5 is that in the example in [Fig.5], the first additional configuration file 26 is empty and does not contain a configuration table of the first type HWCT, or is absent, or is not authentic and / or integral, so that the primary table 42 of the boot package 22 is not bypassed and is used by the boot automaton 24.

[0120] In this example of [Fig.5], the tables bypassed are therefore the initial secondary table 440 associated with the OPS operating mode, the respective system tertiary table 46SO and the application tertiary table 46AO of the first application partition 12A, these three tables then being represented in a crossed-out manner by the cross 65.

[0121] The example in [Fig. 6] is similar to that in [Fig. 3], except that in this In the example of [Fig.6], the first additional configuration file 26 includes both a configuration table of the first type HWCT, for example the new version of the primary table 42*, a configuration table of the second type MGCT, for example a new version of the secondary table 44P associated with the degraded mode PDL, the new version being noted 44P*, and also a configuration table of the third type HACT, for example a new version of the tertiary table 46P associated with the degraded mode PDL, the new version being noted 46P*.

[0122] In this example of [Fig.6], the tables bypassed are therefore the primary table 42, and the secondary 44P and tertiary 46P tables associated with the degraded PDL mode, these three tables of the boot package 22 then being represented in a crossed-out manner by the cross 65.

[0123] This example of [Fig.6] corresponding to the degraded operating mode PDL, the system partition 30 is executed after the implementation of the first additional configuration file 26. The other elements of the second, third and fourth functional levels N2, N3, N4 are not used, and are therefore masked by the elliptical shape 70.

[0124] In the example in [Fig.7], the avionics system 10, and in particular the computer platform 15, includes the same elements as in the example in [Fig.6], and the example in [Fig.7] differs from that in [Fig.6] in the mode of operation, this example corresponding to the OPS operational mode.

[0125] In the same way as in the example of [Fig.6], when the first additional configuration file 26 is launched by the boot machine 24 following the power-up of the computer platform 15, the new version of the primary table 42* included in the first additional file 26 is used instead of the primary table 42 of the boot package 22.

[0126] On the other hand, unlike the example in [Fig.6], the secondary 44P and tertiary 46P tables associated with the PDL degraded mode, whether those of the boot package 22 or those of the first additional configuration file 26, are not used, and are therefore masked by the elliptical form 70.

[0127] In this example of [Fig.7], the only table bypassed is therefore the primary table 42 of the boot package 22 which is then represented in a crossed-out manner by the cross 65.

[0128] A person skilled in the art will then understand that the different possible cases for the avionics system 10 according to the invention are as follows:

[0129] - presence of the first additional configuration file 26, but not the second and third additional configuration files 60, 62: the table(s) bypassed are then the tables of the boot package 22 for which a new version is present in the first additional configuration file 26, and also taking into account the operating mode, the secondary table 44P and tertiary table 46P being used only in degraded PDL operating mode;

[0130] - presence of the second additional configuration file 60, but not the first and third additional configuration files 26, 62: the table(s) bypassed are the initial secondary table 440 associated with the OPS operational mode and / or one or more system tertiary tables 46SO for which a new version is present in the second additional configuration file 60;

[0131] - presence of the third additional configuration file 62, but not the first and second additional configuration files 26, 60: the table(s) bypassed are one or more tertiary application tables 46AO for which a new version is present in the third additional configuration file 62;

[0132] - presence of the first and second additional configuration files 26, 60, but not from the third additional configuration file 62, with then bypassing as described previously the tables for which a new version is present in these additional configuration files 26, 60;

[0133] - presence of the second and third additional configuration files 60, 62, but not from the first additional configuration file 26, with then bypassing as described previously the tables for which a new version is present in these additional configuration files 60, 62;

[0134] - presence of all additional configuration files, i.e. the first, second and third additional configuration files 26, 60, 62, with bypass as described previously of the tables for which a new version is present in these additional configuration files 26, 60, 62.

[0135] The startup sequence of the avionics system 10 according to the invention will now be explained with reference to the flowchart in [Fig.8].

[0136] When the avionics system 10 is powered on, and therefore the computer platform 15 contained therein, the startup automaton 24 is executed first by the processor 32, as represented by the arrow Fl.

[0137] The startup automaton 24 then begins by checking whether the first additional configuration file 26 is present in the storage memory 36 at a predefined location, provided for this purpose, this presence check being represented by the arrow F2 in [Fig.8].

[0138] If the first additional configuration file 26 is present at this location in the storage memory 36, the startup automaton 24 advantageously checks the authenticity and integrity of the first additional configuration file 26, as represented by the arrow F3, and if this check is positive, that is to say if the first additional configuration file 26 is both authentic and intact, the startup automaton 24 will then copy into the RAM 35 each table contained in the first additional configuration file 26.

[0139] If during the presence check carried out previously according to arrow F2 the startup automaton 24 determined that no additional configuration file 26 was present in the storage memory 36, or that a file was present but without a table, then the startup automaton 24 launches the boot package 22, as represented by arrow F4, and will then in particular use the configuration tables that the boot package 22 contains.

[0140] The boot process 24 then copies into RAM 35, as represented by arrow F5, the table(s) resulting from the checks previously performed according to arrows F2 and F3. In other words, the boot process copies into RAM 35 each table contained in the first additional configuration file 26, if the latter is determined to be present during the check according to arrow F2, and then advantageously as authentic and intact during the check according to arrow F3. Otherwise, the configuration table(s) contained in the boot package 22 are copied into RAM 35.

[0141] After this copying of the configuration tables into RAM 35, the startup automaton 24 executes an initialization program contained in the operating system 20, as represented by arrow F6, and the latter will begin by reading the configuration table(s) previously copied into RAM 35, as represented by arrow F7. The startup sequence of the avionics system 10 according to the invention is then completed.

[0142] The startup sequence described above concerns the case with the presence of the first additional configuration file 26, but not the second and third additional configuration files 60, 62, and a person skilled in the art will understand that the startup sequence is similar in the case of the presence of the second 60 and / or third 62 additional configuration files, the startup automaton 24 also taking care of checking the presence of the second 60 and / or third 62 additional configuration files at the predefined locations provided for this purpose; then advantageously checking their authenticity and / or integrity; and finally copying into RAM the tables contained in these additional files if the aforementioned check(s) are positive.

[0143] The person skilled in the art will also understand that, in a case with several additional configuration files, the checks are carried out in ascending order of their names, that is to say for example first for the first additional configuration file 26, then for the second additional configuration file 60 and finally for the third additional configuration file 62, this in the case with all the additional configuration files.

[0144] Thus, the additional configuration file(s) 26, 60, 62, including at least one resource configuration table, facilitates the consideration of changes in execution context of the software application(s) 50 by allowing the addition of new configuration values ​​after the design of said software application(s) 50.

[0145] This or these additional configuration files 26, 60, 62 make it possible in particular to retain the benefit of the certification carried out, and thus avoid a new certification, or recertification, and thus significantly reduce the necessary technical checks and tests.

[0146] Furthermore, each additional configuration file 26, 60, 62, consisting of at least one configuration table, is easier to generate and faster to load than a new version of the boot package 22 that would be modified to introduce the new configuration values. This then makes it possible to improve the performance, particularly in terms of execution and computation time, of the avionics electronic system 10 according to the invention.

[0147] The avionics electronic system 10 according to the invention then makes it possible to facilitate the consideration of changes in the execution context of avionics software applications 50, while significantly reducing the technical checks and tests resulting from these changes and having improved system performance when taking this into account.

Claims

Demands

1. An avionics electronic system (10) intended to be installed on board an aircraft (5), the avionics system (10) comprising: - a computer platform (15) capable of running a set of application partition(s) (12), comprising resources (18) including hardware resources and hosting an operating system (20), the hardware resources (18) including a processor (32), RAM (35) and storage memory (36); the computer platform (15) further comprising in the storage memory (36): + a boot package (22) including a kernel, at least one resource driver, a set of system partition(s) (30) and a primary resource configuration table (42), each system partition (30) including at least one operating system service (29) (20), the primary table (42) being of a first type (HWCT) containing hardware resource configuration values; and + a startup automaton (24) capable of being executed first following a power-up of the platform (15) and configured to launch the boot package (22); - at least one secondary resource configuration table (440, 44P), stored in storage memory (36), each secondary table (440, 44P) being of a second type (MGCT) containing resource configuration values ​​usable by a respective set of application or system partition(s), the second type (MGCT) being distinct from the first type (HWCT); - a set of system tertiary resource configuration tables (46SO, 46P) for the set of system partition(s) (30), stored in storage memory (36), each system tertiary table (46SO, 46P) being of a third type (HACT) containing resource configuration values ​​used by a respective partition, the third type (HACT) being distinct from the first type (HWCT) and the second type (MGCT); - the set of application partition(s) (12), stored in storage memory (36), each application partition (12) including an avionics software application and an application tertiary resource configuration table (46AO), each application tertiary table (46AO) being of the third type (HACT) and containing values ​​of configuration of resources used by the respective application partition (12); characterized in that the startup automaton (24) is configured to check if an additional configuration file (26, 60, 62) is present in the storage memory (36), and then to launch the additional configuration file (26, 60, 62), the additional configuration file (26, 60, 62) including at least one resource configuration table of a type chosen from the first (HWCT), second (MGCT) and third (HACT) types; each table of the additional configuration file (26, 60, 62) then being used in place of a respective table of the same type from among the primary (42), secondary (440, 44P), system tertiary (46SO, 46P) and application tertiary (46AO) tables.

2. Avionics system (10) according to claim 1, wherein if, during the check for the presence of said additional configuration file, the storage memory (36) does not contain any additional configuration file (26, 60, 62), then the boot machine (24) is configured to launch the boot package (22).

3. Avionics system (10) according to claim 1 or 2, wherein if the additional configuration file (26) includes a table of the first type (HWCT), then the boot automaton (24) is configured to launch the additional configuration file (26) before the boot package (22).

4. Avionics system (10) according to any one of the preceding claims, wherein the bootloader (24) is configured to launch the additional configuration file (26, 60, 62) only if at least one launch condition is met, each launch condition being chosen from the group consisting of: an authenticity check of the additional configuration file, and an integrity check of the additional configuration file; the bootloader (24) preferably being configured to launch the additional configuration file (26, 60, 62) only if all the launch conditions are met among the authenticity check of the additional configuration file and the integrity check of the additional configuration file.

5. Avionics system (10) according to any one of the preceding claims, wherein the computer platform (15) is capable of operating in an operating mode selected at least from a degraded mode (PDL) where only the system partition(s) set (30) is executable out of the system partition(s) (30) and application partition(s) sets (12), and an operational mode (OPS) where the system partition(s) (30) and application partition(s) (12) sets are each executable.

6. Avionics system (10) according to claim 5, wherein the avionics system (10) comprises a second type resource configuration table (MGCT) for each of the operating modes between degraded mode (44P) and operational mode (440), the second type table for degraded mode (44P) containing resource configuration values ​​usable by the system partition set(s) (30) and the second type table for operational mode (440) containing resource configuration values ​​usable by the application partition set(s) (12).

7. Avionics system (10) according to claim 5 or 6, wherein the avionics system (10) comprises, for each system partition (30), a third-type resource configuration table (HACT) for each of the operating modes between degraded mode (PDL) and operational mode (OPS), each third-type table associated with a respective system partition (30) for degraded mode (HACT_PDL) containing the resource configuration values ​​used by said system partition (30) in degraded mode (PDL) and each third-type table associated with a respective system partition (30) for operational mode (46SO) containing the resource configuration values ​​used by said system partition (30) in operational mode (OPS).

8. Avionics system (10) according to any one of the preceding claims, wherein the boot package (22) and the additional configuration file (26) each include at most one configuration table of the first type (HWCT).

9. Avionics system (10) according to any one of the preceding claims, wherein if the additional configuration file (26) includes a configuration table of the first type (HWCT) then the hardware resource configuration values ​​contained in said table each belong to value ranges for which the computing platform (15) has been previously certified.

10. Avionics system (10) according to any one of the preceding claims, wherein the boot package (22) and / or the ad- file configuration custom (26) include multiple configuration tables of the second type (MGCT) and / or multiple configuration tables of the third type (HACT).

11. Avionics system (10) according to any one of the preceding claims, wherein the avionics system (10) includes, in the storage memory (36), at least one additional configuration file (26, 60, 62); the avionics system (10) preferably including several additional configuration files (26, 60, 62); such as a first additional configuration file (26) including at least one configuration table, one of which is of the first type, and at least one other additional configuration file (60, 62) including at least one configuration table of a type chosen from the second and third types.

12. Avionics system (10) according to any one of the preceding claims, wherein the additional configuration file or each additional configuration file (26) includes only at least one configuration table of a type selected from the first, second and third types; the additional configuration file(s) (26) preferably consisting of at least one configuration table of a type chosen from the first, second and third types.

Images