White Paper

WHITE PAPER Evaluating Safety-Certifiable Computing For Tomorrow 's Avionics mrcy.com 3 PROCESSOR METRICS Processors Released Cores Power DMIPS Perf/Core PPC 7448 - (2005) 2005 1 25 3,900 3,900 PPC T2080 2010 4 22 43,200 10,800 NXP LS1043 (ARM A53) 2017 4 15 14,720 3,680 NXP LS2084 (ARM A72) 2015 4 20 39,480 9,870 NXP LS2088 (ARM A72) 2015 8 25 78,960 9,870 NXP LS2160 (ARM A72) 2017 16 45 165,440 10,340 Denverton-C3708 2016 8 17 76,160 9,520 Apollo Lake - E3850 2016 4 15 35,840 8,960 Xeon-D-1529 2016 4 20 56,680 14,170 Xeon D-1539 2016 8 35 139,520 17,440 Tiger Lake 4 core 2020 4 18 107,520 26,880 Processor Metrics. As noted in the table, Intel has 2-4x performance per core capabilities over ARM and PowerPC. THE NEED FOR TRUSTED AND MODERN AIRCRAFT COMPUTING Exploding per formance demands are matched by equally critical business needs for a long-term cer tifiable technology from vendors they trust. Safety-cer tifiable processing for avionics has long been dominated by PowerPC, the most widely deployed safety- cer tified architecture; however, that processing line is approaching EOL. Designers are now forced to find an alternatives, but changing processor architectures is not easy. It comes with an array of hidden costs and unpredictable schedule impacts. System architects are now looking for long-term stability that will continue across multiple generations of evolving technology. Even more critical is the platform vendors' need for a trusted supply chain. In a world where our national adversaries are constantly deploying new cyber threats, essential systems and end users must be protected at multiple levels. The most basic level is the processing silicon itself. Processors fabricated within the United States are better protected from malicious alteration than units fabricated offshore because U.S. based companies could face ramifications if regulations that drive supply chain transparency and protect against counter feits are not enforced. EVALUATING SAFETY-CERTIFIABLE PROCESSING OPTIONS Based on the market and technology demands discussed earlier, there are several factors driving the safety-cer tifiable processor evaluation, including: ▪ Performance of each processor ▪ Number of cores ▪ Power requirement ▪ Performance per watt ▪ Performance per core ▪ Certifying GPUs The current technology landscape suppor ts two leading architectures for general purpose processors, Intel and ARM (see sidebar). Most current processors for both architectures implement multiple processing cores. In the safety-cer tification evaluation, Mercur y compared processors from both architectures. The complexity of processor safety verifiability multiplies as the number of cores increases. Figure 3, from the FA A Technical Repor t DOT/FA A /TC-16/51, shows how the number of theoretical inter ference paths increases nearly exponentially with the number of cores. At some point, it becomes almost impossible to prove safe operation for all possible combinations of potential interactions.

• Cover