Green Hills Software announced that the INTEGRITY^®-178 real-time operating system (RTOS) is deployed in the engine control units (ECUs) from Triumph Group, Inc. (TRIUMPH) for a wide variety of U.S. military helicopters, including the AH-64D Apache, CH-47D/F & MH-47D/F/G Chinook, UH-60L/M/V Black Hawk, HH-60 Pave Hawk, MH-60 Jayhawk, and SH-60 Sea Hawk. As flight-critical systems, those ECUs running INTEGRITY-178 have been developed to RTCA/DO-178B Design Assurance Level A (DAL A). TRIUMPH has also selected the INTEGRITY-178 tuMP™ multicore RTOS for its next generation of ECUs, which has applications running concurrently on all cores of a quad-core processor. Those TRIUMPH ECUs rely on the multicore robust partitioning provided by INTEGRITY-178 tuMP to the same level as for single-core processors. TRIUMPH selected the INTEGRITY-178 RTOS for the security and determinism of its DAL A partition scheduler, the quality of its certification artifacts for RTCA/DO-178B DAL A, and the high productivity of its MULTI^® integrated development environment (IDE).

“Based on the consistent, trouble-free performance of the INTEGRITY-178 operating system over the past 20 years, TRIUMPH continues to turn to Green Hills Software to support our current and future products,” said Lou Pannullo, Director of Advanced Technology at TRIUMPH. “INTEGRITY-178 and INTEGRITY-178 tuMP have continued to advance the state-of-the-art with unique multicore technology to meet our increased processing needs and by offering proven DO-178C/ED-12C and CAST-32A multicore artifacts to DAL A for the latest processors.”

TRIUMPH uses the INTEGRITY-178 RTOS on its full lines of ECUs. Some TRIUMPH ECU models are Full Authority Digital Engine Controls (FADECs), which have complete control of the engine without pilot backup. For example, the EMC-100 FADEC is a sophisticated, low-cost, dual-channel engine control in a single housing. The unit consists of two dissimilar, mechanically separated channels operating independently but cooperating with each other. The second channel provides full mission capability should a failure occur in the primary channel. The software is organized in a multi-partition architecture, with application-specific control system software running in isolated partitions on the INTEGRITY-178 RTOS. The ECU software has been designed to RTCA/DO-178B DAL A, but the software architecture permits partitions that perform non-critical functions to be developed to lower levels, thereby reducing life-cycle costs.

The INTEGRITY-178 high-assurance RTOS has a long pedigree of deployment in DAL A flight controls, including Honeywell’s flight control electronics for the Boeing 787 Dreamliner. INTEGRITY-178 and the multicore INTEGRITY-178 tuMP™ RTOS are engineered for the strict determinism required in safety-critical airborne systems to meet the requirements of RTCA DO-178B/C and EUROCAE ED-12B/C. Based on a modern separation microkernel design, INTEGRITY-178 tuMP provides robust partitioning in space, time, and resources, including for multicore processors. When an application is modified or replaced, robust partitioning minimizes regression testing for the unchanged applications. This reduced effort translates into considerable cost savings and faster time-to-market. The partitioning also supports multiple applications at different safety or security levels running on the same processor, either on the same core or different cores. It also supports resource allocation, fault detection, and fault isolation to prevent unintended interactions between independent applications. In 2002, INTEGRITY-178 was the first commercial RTOS approved as complying with DO-178B Level A objectives. In 2021, the INTEGRITY-178 tuMP multicore RTOS became the first and only RTOS to be part of a multicore civil certification to DO-178C and AC 20-193 (formerly CAST-32A) objectives. INTEGRITY-178 and INTEGRITY-178 tuMP are field-proven with over 80 DO-178B/C DAL A unique customer certification packages delivered across more than 40 different microprocessors.