WHITE PAPER
Single Board Computer (SBC) Safety Certification Strategies
mrcy.com 2 mrcy.com 2
BACKGROUND
Intel platforms require a comprehensive set of firmware
components needed to configure and initialize the platform
before loading an operating system. This set is referred to as
an integrated firmware image (IF WI) and is typically stored in an
onboard SPI flash.
The IF WI includes the bootloader, commonly called BIOS, that
is executed when the processor comes out of reset. The IF WI
also includes other parts needed to initialize the platform such
as the processor microcode.
The bootloader has been standardized under the framework
of the UEFI (Universal Extensible Firmware Interface).Intel
provides a minimal version of the bootloader in open source,
called slim bootloader (SBL).
As Intel-based platforms become increasingly prevalent in safety-critical and mission-focused
systems, ensuring the reliability and certifiability of their boot processes is paramount. The
Integrated Firmware Image (IFWI), which includes the bootloader, plays a foundational role
in initializing hardware and launching the operating system. However, Intel's Slim Bootloader
(SBL), while open-source and modular, lacks the design assurance artifacts required
for compliance with standards such as DO-178C, presenting a challenge for certification
authorities and system integrators tasked with validating system integrity.
Mercury Systems offers a family of rugged single board computers (SBCs) designed for mission-
critical, SWaP-constrained edge platforms. They deliver superior resilience to shock/vibration,
altitude, dust, corrosion and temperature extremes.
This white paper explores certification strategies for Intel bootloaders on Mercury Systems' SBC
platforms, presenting three approaches:
1. a certifiable bootloader developed to meet specific design assurance levels
2. a Pre-OS Checker that verifies hardware integrity before OS handover
3. leveraging alternative methods as allowed by DO-178C section §12.3. This third approach
enables the use of Intel 's Slim Bootloader within a controlled configuration, supported
by a specific Software Assurance Case, offering a practical middle ground that provides
higher assurance than runtime-only verification while avoiding the complexity and cost
of full certification.
Together, these methods offer scalable solutions for balancing safety compliance, system
adaptability, and development efficiency.
The SBL consists of an open-source part and a Firmware
Support Package (FSP) in binary form, both provided by Intel.
The interaction between these two parts is illustrated in the
SBL boot flow
1
.
The SBL was not developed according to the DO-178C process
and hence does not provide the necessary artefacts to
demonstrate compliance with a target design assurance level
required by the application. This compliance ensures that the
bootloader is developed with a certain rigor and hence free
from errors and unintended behavior. The SBL also spans a
wide range of functionality that is not necessarily needed by
the application.
1
https://slimbootloader.github.io/developer-guides/boot-flow.html
