WHITE PAPER
Single Board Computer (SBC) Safety Certification Strategies
mrcy.com 5
PRE-OS CHECKER VS. CERTIFIABLE BOOTLOADER – A COMPARISON
For the certifiable bootloader, we further distinguish the case where the allocated iDAL in the sense of the ARP4754 is DAL-D.
This case provides for a well-balanced solution, where the software component is built on a well-defined set of requirements
and at the same time without the need to specify all the details of the bootloader, particularly those that are part of the FSP
which are not accessible. The impact of the bootloader functions that are not traceable to the pre-defined requirements need
to be assessed. This should be part of the iDAL allocation process.
Criteria Pre -OS Checker Cer tifiable
Bootloader (DAL-D)
Cer tifiable Bootloader (>DAL-D)
COTS SW
(Alternative Methods)
Newly Developed SW
Cost LOW-TO-MODERATE
The cost depends on the
modularity of the design, the
more versatile it is, the higher
the cost (e.g. Intel Pre-OS
Checker vs. a project custom
checker)
LOW-TO-MODERATE MODERATE HIGH
Complexity LOW MODERATE MODERATE HIGH
Adaptability HIGH
The Pre-OS Checker only
verifies external obser vable
HW state. However, any new
updates from Intel might
impact not only the Pre-OS
check but also the application
verification to ensure that no
side effects are introduced.
HIGH
As for the Pre-OS Checker,
the requirements are
defined around the
external behavior of the
bootloader.
MODERATE
Different activities to
be re-per formed.
LOW
New updates from Intel for errata
correction or to support new features
require a new iteration of the complete or
a large part of the development process.
This has an impact both on the cost and
the delay.
Customization HIGH
The Pre-OS Checker
specification can be linked
directly to application
requirements.
A specific application need can
be fulfilled by adapting the SBL
implementation and including
an associated verification in
the checker.
HIGH HIGH LOW
Generic implementation. Bootloader
requirements need to be linked to
application requirements.
There might be a gap where a specific
application need cannot be achieved.
