+ All Categories
Home > Documents > Round Table on the Future of Embedded Software Is...

Round Table on the Future of Embedded Software Is...

Date post: 12-Sep-2018
Category:
Upload: hathuy
View: 217 times
Download: 0 times
Share this document with a friend
52
An RTC Group Publication Real World Connected Systems Magazine. Produced by Intelligent Systems Source Vol 17 / No 5 / MAY 2016 The Best Embedded Software of 2016 Is Your Soſtware Secure? The RTOS Dilemma: Are Open Source RTOSes Economic or Costly? Round Table on the Future of Embedded Soſtware
Transcript

An RTC Group Publication

Real World Connected Systems Magazine Produced by Intelligent Systems Source Vol 17 No 5 MAY 2016

The Best Embedded Softwareof 2016

Is Your Software Secure

The RTOS Dilemma Are Open Source RTOSes Economic or Costly

Round Table on the Future of Embedded Software

RTC Magazine MAY 2016 | 3

CONTENTSReal World Connected Systems Magazine Produced by Intelligent Systems Source

05by John Koon Editor-in-Chief

How Good is Your Software

EDITORIAL

The Best Embedded Software of 2016

14

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

Esol eT-Kernel

Micrium microCOS RTOS

Express Logic ThreadX

Micro Digital SMX RTOS

OAR RTEMS

Green Hills Software INTEGRITY

MicroEJ MicroEJ OS

SEGGER embOS

Interval Zero RTX64

Microsoft Windows 10 IoT Enterprise amp IoT Core

SYSGO AG AG PikeOS Real-Time Hypervisor

Lynx Software LynxOS 70 RTOS

MontaVista CGX 20

Tenasys INtime RTOS

Mentor Nucleus

Oracle Java ME Embedded 8

Wind River VxWorks

13

21

14

22

27

16

23

28

18

24

2910 ROUND TABLE WHAT WILL THE FUTURE HOLD

Sean LimingAnnabooks LLC

Bill LamieExpress Logic

Christian LeacutegareacuteMicrimicrom

Dinyar DastoorWind River

07

08

09

10

19

25

30

30 SOFTWARE THAT IS SAFE SECURE AND ROBUST

The RTOS Dilemma Are Open Source RTOSes Economic or Costlyby Jerry Krasner Embedded Market Forecasters

An Industry in Transition The Impact of Technical Debt on the Internet of Things by William McCaffrey Vector Software

Safety-critical RTOS Demands Verified Correctnessby Greg Rose DDC-I

Securing Control Over the IIoT RTOS Comes to the Rescueby Albert Rooyakkers Bedrock Automation

Can Devices be Secured in the Internet of Thingsby Dinyar Dastoor Wind River

32

36

40

44

47

20

26

31

Safty-critical RTOS Demands Verified Correctness

40

4 | RTC Magazine MAY 2016

RTC MAGAZINE

TO CONTACT RTC MAGAZINEHome OfficeThe RTC Group 905 Calle Amanecer Suite 150 San Clemente CA 92673Phone (949) 226-2000Fax (949) 226-2050Web wwwrtcgroupcom

Published by The RTC GroupCopyright 2016 The RTC Group Printed in the United States All rights reserved All related graphics are trademarks of The RTC Group All other brand and product names are the property of their holders

PUBLISHERPresidentJohn Reardon johnrrtcgroupcom

Vice PresidentAaron Foellmi aaronfrtcgroupcom

EDITORIALEditor-In-ChiefJohn Koon johnkrtcgroupcom

ARTPRODUCTIONArt DirectorJim Bell jimbrtcgroupcom

Graphic DesignerHugo Ricardo hugorrtcgroupcom

ADVERTISINGWEB ADVERTISINGWestern Regional Sales Manager John Reardon johnrrtcgroupcom (949) 226-2000

Eastern US and EMEA Sales ManagerRuby Brower rubybrtcgroupcom(949) 226-2004

BILLINGControllerTrudi Walde trudiwrtcgroupcom (949) 226-2021

full development kit

smart delivery7b

5

6

7

8

Z

5full development kit

8

single board computer

Z

single board computersingle board computer

single board computer

6

single board computer

7

full development kitfull development kit

full development kit

NOVAsom8copy is a module card designed with a System On Module (SOM) architecture based on quad core ARM Cortex-A9 from 512MB to 4GB of 64 bit DDR3 Memory

bull Processor CortexA9 Freescalebull IMX6 Quad Corebull 4GB RAM Memory bull 32GB FLASH Memory (eMMC) bull USD memory slot bull SATA IIbull Ethernet 101001000 bull USB hostdevice and OTG bull HDMI (High-Definition

Multimedia Interface)

WHY CHOOSE NOVASOM

NOVAsom Industries provides the added value of design creativity offering tailor-made solutions to both industrial and multimedia markets We specialize in proposing innovative options to improve productivity time to market and reach a truly competitive advantage

In addition to the embedded computing industry NOVAsom is involved in the newest high level video technologies including 4K displays The 2 key differences that make us stand out are our 3264 bit full architecture and the ability to provide interface to ANY displaysensor combination

wwwnovasomindustriescom

full development kit

smart delivery7b

5

6

7

8

Z

5full development kit

8

single board computer

Z

single board computersingle board computer

single board computer

6

single board computer

7

full development kitfull development kit

full development kit

EDITORIAL

Good software performs the tasks you specify securely safely and reliably Moreover it has to meet criteria such as application-specific real-time require-ments if your applications need them meet your cost budget and most impor-tantly it wonrsquot break Sometime ago I had a conversation with a Microsoft test man-ager I asked him ldquoWhy do I keep getting bug fixes from Microsoft for my Windows Why donrsquot you test your software to make it bug-freerdquo He answered ldquoIndeed we do extensive tests on all our software prod-ucts before we would consider releasing it to production When we find a bug you can be sure it will be fixed Why would I want to ship a product with bugsrdquo Micro-soft is the worldrsquos largest software compa-ny with a lot of resources If anyone could deliver bug-free software it would be Microsoft I am a hardware guy I remem-bered when our team designed a system we made sure everything worked before we released it to production Additionally Test Engineering and QA will have to sign off the product to ensure it really worked If it failed in the field we blamed it on software We all know a system is a combi-nation of software and hardware Software behaves in such a way that when certain combination of sequence of events occur the software will fail That is why Dynamic and Static Analysis tools are available to improve software quality

Safety and security are on my mind a lot these days When I think about driverless cars I think about safety and security How do you prevent future autonomous cars from getting into an accident when

we cannot even stop a train from derailing today According to John Paliotta CTO of Vector Software a software quality com-pany ldquoit is impossible to build completely bug-free applications but we can build dependable and robust applications if we implement a continuous test process and measure testing completeness using code coverage analysis The avionics indus-try has successfully used this approach to quality for years and the automotive industry is well on its way to adopting a similar approachrdquo My conclusion is when something happens to a good piece of software it will have either a backup plan or a way to shutdown orderly to avoid catastrophic consequences

Here is another area of concern We are all aware of the high profile hacking done to companies like Sony banks and yes even a police chief was hacked I have had first-hand experience of being attacked by malicious individuals Somehow my security software was not strong enough For a long time hackers stole personal information such as credit cards to sell it on line Now theyrsquove come up with a new business model call ransomeware Recent reports including that from BBC indicated the Ransomware has found an easy target hospitals to extract money A local hospital in Southern California gave in and paid the ransom According to Eric Knight CEO of SimpleWan a security software consulting firm ldquoToday compa-nies are not proactive enough You need to have the resources allocated including proper IT knowledge anti-virus software and the team in place to fight battle It will

only get worserdquo Demand for services form companies like SimpleWan has been in-creasing as more and more attacks occur

In this special software Edition we have listed solutions from 17 leading suppliers of RTOS and embedded software for your reference Additionally we have invited experts to share their expertise on safety and security Finally to look into the future of software we have a round table discussion with participants from Micrium Express Logic Wind River and Annabooks LLC If you have new ideas to share let me know

by John Koon Editor-In-Chief

How Good is Your Software

RTC Magazine MAY 2016 | 5

Technology is moving very fast The world is buzzing about how wonderful it will be to have connected driverless cars trucks and boats Communications among Machines the Cloud and now the Fog are taking place at very high speed The Internet-of-Things is unstoppable and will connect billions and maybe even trillions things together All these will require software good software Where are we heading In this Round Table section we have invited four veteran software experts An-nabooks Express Logic Micrium and Wind River to share their insights concern and tell us what the future will look like

Round Table What Does the Future Hold

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

6 | RTC Magazine MAY 2016

RTC Magazine MAY 2016 | 7

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Today the biggest feature is the machine communication protocol There are 4 to 5 proposed standards Thread Alljoyn Open Interconnect Consortium Connectivity Foundation and Industrial Internet Consortium Some operating system vendors are already integrating some solutions but each vertical industry segment will most likely define protocols and standards The operating system will have to have flexible support for the different industry standards Like all standards and proposed consortiums only time will tell which ones will be left standing

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

On big domains there are different types of servers to handle different types of operations There is already talk of data over-load for Cloud computing Being able to off load data storage and other cloud computing tasks to other levels is a logical step My belief is that careful cloud application design to off load data to local resources rather than push up to the bigger cloud will be important Companies will have to choose what data is import-ant versus what can be discarded Embedded operating systems only need to support the different cloud APIs

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

ldquoBeing able to off load data storage and other cloud computing tasks to other levels is a logical steprdquo

Name Sean Liming

Title Owner

Company Annabooks LLC Yorba Linda CA wwwannabookscom

Sean Liming has been involved with embedded systems for over two decades He has authored over 35 articles and eight books including the popular Windows XP Embedded Advanced Professionalrsquos Guide To Windowsreg Embedded Standard 7 and Start Guide for Windows System Image Manager He has traveled around the world as a featured speaker at Microsoft embed-ded conferences In 2001 he became a Microsoft MVP He received his BSEE from California State Polytechnic University in Pomona California focusing on computer architecture and design

Obviously the cloud is taking a big part in the embedded systems Only a couple of my customers are getting into the cloud today I anticipate that will change in 5 years Business decision makers need to determine what data and event triggers are relevant for their business The process takes time Once de-termined then finding companies with the right fit of products is important and this will influence smart sensors and other connected devices

8 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Fundamental features like fast context switching and real-time determinism will continue to be key features for RTOSrsquos as connected thingssystems evolve More devices will be collecting or generating data than ever before of course safety and security will play an increasingly important role as more safety-critical and sensitive data is transferred between devices

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

We believe Cloud and Fog computing will coexist Informa-tion captured or generated by the burgeoning number of things on the IOT will be a mixture of non-sensitive sensitive and safe-ty-critical data flowing across both the cloud and fog platforms The growing need for data to be collected or generated instantly requires high performance features RTOSrsquos will need to provide safe secure and reliable IoT communication solutions with minimal memorypower requirements

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

As mentioned earlier we believe Cloud and Fog computing will coexist The IOT is connecting devices that will provide information for lsquointelligentrsquo interpretation allowing systems and people to make decisions quicker and hopefully better We

ldquoThe growing need for data to be collected or generated instantly requires high per-formance featuresrdquo

Name Bill Lamie

Title President

Company Express Logic San Diego CA wwwrtoscom

William E Lamie is co-founder and CEO of Express Logic Inc located in San Diego CA Mr Lamie is the author of the ThreadX RTOS Prior to founding Express Logic Mr Lamie was the author of the Nucleus RTOS and co-founded Ac-celerated Technology Inc Mr Lamie has over 35 years of experience in embedded systems devel-opment 30 years of which is in the development of commercial real-time operating systems For information on Express Logic please visit wwwexpresslogiccom

are already seeing how wearable medical devices are providing real-time information that helps people avoid behaviors that might trigger adverse medical conditions As these devices become more integrated into larger diagnostic and treatment systems we see the need for safe secure and reliable real-time operating systems and middleware solutions expanding into new devices to address real-time capabilities and current devic-es that will be lsquosmarterrsquo

RTC Magazine MAY 2016 | 9

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Embedded operating systemsrsquo greatest need currently are securi-ty features that can scale to any processor size This is challenging especially on small microcontrollers but required by emerging security requirements Achieving secure boot secure firmware upgrades authentication authorization etc simply requires more hardware resources than are available on small microcontrollers As we reach the limits of Moorersquos law the next processor architec-ture step is to move to multiple cores Given the emerging security requirements symmetrical multiprocessing will become a necessi-ty for embedded operating systems

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

A move to fog computing would require the same security and processing performance enhancements outlined above as well as new mandatory requirements for improved connectivity From Mi-criumrsquos point of view we are already seeing a need for an embedded operating system (in our case an RTOS) to enable scaling from small microcontrollers to large application processors A system is com-posed of many components so having an operating system than can span the complete product architecture offers great economy of scale This aligns perfectly to the architecture proposed by fog computing

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

ldquoClearly embedded oper-ating systems offer many advantages in terms of size and performancerdquo

IoT is the sum of sensorsactuators microcontrollersmicroproces-sors wiredwireless connectivity multiple programming languag-es information technologies and operation technologies not to mention interoperability standards Much advancement in all of these technologies is required to enhance security performance artifi-cial intelligence and fog computing Clearly embedded operating systems offer many advantages in terms of size and performance over other operating systems so will have a significant role in the IoT That being said the main challenge today is one of cost Although the IoT can clearly be a business enabler full-scale IoT penetration can only happen with more economy of scale in a large number of fields

Name Christian Leacutegareacute

Title Chief Technology Officer

Company Micrium Weston FL wwwmicriumcom

Christian Leacutegareacute is EVP and CTO of Micrium a leading provider of embedded software Prior to Micrium he led the Internet Protocol certifi-cation program at the International Institute of Telecom in Montreal Canada During his 22 years in the telecom industry Christian served as an executive in large-scale organizations as well as start-ups mainly in engineering and RampD Christian currently also serves as president and chairman of the IPSO Alliance where he provides guidance on embedded systems to help make the IoT a reality Christian holds a MS in Electrical Engineering from the University of Sherbrooke Quebec Canada

10 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

At the very basic level any device participating in a connected system will need a robust connectivity solution and good enough security to protect it But that does not give you any benefits un-less you have figured out ldquohow to connectrdquo ldquowho to connectrdquo and most important ldquowhy should you connectrdquo

The OS should be able to seamlessly manage multi-element connectivity It should provide a framework to cache command signals or data streams should the device go off-line in a pre-planned manner or suddenly drop connection A robust OS will have a device-side management agent embedded inside to take care of exchanging credentials with unique identifiers with a device management cloud service The OS also needs to provide a framework for easy ldquoover the airrdquo maintenance upgrade and most important the ability to roll-back any updates should something go wrong Finally the OS should provide open standards based APIs to manage everything we discussed

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having every-thing done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

While the concept of ldquofog computingrdquo is not new it has gained lot of attention recently The business needs to collect as much data as possible and the need to optimize the cost of transporting this data has to be appropriately balanced Enter ldquofog computingrdquo It does not replace cloud computing it just creates one layer of lo-calized hierarchy for better management of systems This localized layer has an advantage of higher connectivity bandwidth at lower cost localize storage and assurance that data is not leaving a highly secure perimeter On the flip side fog computersquos storage and CPU bandwidth is more expensive than cloud infrastructure For some industries fog computing solves lot of technical and cost issues

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

In my opinion there is no one utopian vision for future of devices and their embedded OSs in IoT no one element of the

Name Dinyar Dastoor

Title Vice President and General Manager Operating Systems Platform

Company Wind River Alameda CA wwwwindrivercom

Dinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and security He has nearly 30 years of embedded de-vice industry experience holding various senior executive positions managing product manage-ment engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officefocusing on computer architecture and design

network will dominate Instead each element will play a key role in the larger system of systems and this role will constantly evolve as new use cases and innovation happens Yes devices will become ldquosmarterrdquo because they can analyze things in real-time and at the same time become ldquodumberrdquo as more decisions will be made somewhere in the network OSs will evolve to be flexible to fit such cases The cloud will move towards providing cheaper storage and compute networks will continue to boost performance and devic-es at the edge will continue to find new applications The sum total of this will lead to new use cases which we have not imagined yet

AN INTEL COMPANY

trade

Learn more at wwwsupermicrocomembeddedcopy Super Micro Computer Inc Speci cations subject to change without notice

Intel the Intel logo Intel Core Intel Quark Xeon and Xeon Inside are trademarks or registered trademarks of Intel Corporation in the US andor other countriesAll other brands and names are the property of their respective owners

SYS-5018A-FTN4 (Front IO)

SYS-5018A-AR12L

E100-8Q SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4

bull Low Power Intelreg Quarktrade Intelreg Coretrade processor family and High Performance Intelreg Xeonreg processors

bull Standard Form Factor and High Performance Motherboardsbull Optimized Short-Depth Industrial Rackmount Platformsbull Energy Efficient Titanium - Gold Level Power Suppliesbull Fully Optimized SuperServers Ready to Deploy Solutionsbull Remote Management by IPMI or Intelreg AMTbull Worldwide Service with Extended Product Life Cycle Supportbull Optimized for Embedded Applications

IoT Gateway Solutions

Network Security Appliances

Cold Storage

Compact Embedded Server Appliance

High Performance IPC Solution

SYS-6018R-TD (Rear IO)SYS-5028A-TN4

EmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT Solutions

Long Life Cycle middot High-E ciency middot Compact Form Factor middot High Performance middot Global Services middot IoT

Connecting the Intelligent World from Devices to the Cloud

SYS-6018R-TD (Rear IO)

SC946ED (shown)SC846S

Front and Rear Views

4U Top-Loading 60-Bay Server and 90-Bay Dual Expander JBODs

SYS-5018A-AR12L SC946ED SC846S

Front and Rear Views

SC946ED SC846S

Front and Rear ViewsFront and Rear ViewsFront and Rear ViewsFront and Rear Views

SM_USP_150224_X10_RTC_TwinPro_CeBitindd 1 1222015 34409 PM

2016

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

12 | RTC Magazine MAY 2016

2016

RTC Magazine MAY 2016 | 13

2016 RTC Software Survey QuestionnaireFlagship Embedded OS eT-Kernel

Type of embedded OS Real-Time Operating System (RTOS)

Description The eT-Kernel RTOS is designed for embedded systems that require high performance and reliability eT-Kernel is based on the open TRON architecture which is the most widely adopted in embedded systems in Japan and Asian countries eT-Kernel is scalable with multiple profiles to fit any system size and purpose These profiles include POSIX-compliant eT-KernelPOSIX enhanced eT-KernelExtended supporting memory protection and process model and basic eT-KernelCompact eT-Kernel Multi-Core Edition is available for multi-core processors featuring its unique Blended Schedulingreg that enables the coexistence of both symmetrical (SMP) and asymmetrical (AMP) multi-core processing in a single system eT-Kernel has proved its value in a wide range of embedded systems such as car navigation systems aerospace consumer electronics and more

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core)

Board support package Yes No

Source code availability Yes No

RAM memory requirements The total RAM storage depends on multipleparameters as the OS allows build-timeoptimization of OS resources based on the OSconfiguration Minimum required is 54KB with a maximum of 88KB

Minimum storage requirements 230KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFI The OS includes self-contained boot loader It can alsobe adapted to any external boot loading mechanism

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Thread Tracing JTAG and eSOLrsquos Eclipse-based eBinder IDE

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Installation to C drive 80GB or above Installation to other drive 50GB or above bull OS - Microsoft Windows 7 Ultimate ServicePack 1 or later bull Microsoft Windows 7 Professional Service Pack 1 or later bull Microsoft Windows Vista Service Pack 2 or later (only 32bit version)

RTOSOS product support lifecycle We provide renewable annual support and maintenance When a new revision is released the previous revision will be supported for 18 months Upon request we also provide long-term support and maintenance up to 10 years or more

eT-Kernel is a core part of the eT-Kernel Platform that integrates the eBinder IDE middleware components ndash including network protocols file systems USB hostdevice stacks and graphics tools ndash and professional services eT-Kernel Platform helps OEMs and ODMs to quickly create flexible development platforms for their software product lines and enables them to improve time to market cost productivity quality and other business drivers

eSOL Co LtdHarmony Tower 1-32-2 Honcho Nakano-ku Tokyo Japan 164-8721Tel +81 3 5302 1360

wwwesolcom

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS ThreadX

Type of embedded OS Real-Time Operating System (RTOS)

Description ThreadX is Express Logicrsquos advanced Real-Time Operating System (RTOS) designed specifically for deeply embedded IoT applications ThreadX provides advanced scheduling facilities message passing interrupt management and messaging services as well as many others ThreadX has many advanced features including its picokerneltrade architecture preemption-thresholdtrade scheduling event-chainingtrade and a rich set of system services Combined with its superior ease-of-use ThreadX is the ideal choice for the most demanding of embedded IoT applications According to VDC Research ThreadX has been deployed in over over 54 billion electronic products in the areas of consumer devices medical electronics industrial control equipment and space probes including NASArsquos Deep Impact and the Mars Reconnaissance Orbiter (MRO)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other ThreadX has support for most popular processors

Board support package Yes No

Source code availability Yes No

RAM memory requirements ThreadX automatically scales based on usageie no complicated compile-time configurationis necessary

Minimum storage requirements 2KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader ThreadX is agnostic in terms of bootloader ie any bootloader can be used

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license We work closely with IAR in terms of integration and customer engagements and support most popular development tools for all processor architectures

language support C and C

Debugger tools Eclipse JTAG Thread Tracing and TraceX is our host-based system event analysis tool

Built-in cloud API services Yes Express Logic is the only ARM mbed RTOS partnermeaning that mbed Client is available for the ThreadX developers to leverage in their designs In additionThreadX and NetX are the foundation for various IoT SoCs including Avago Technologiesrsquo WICED and GainSpanrsquos WiFi chips and modules

Cloud Service Providers Oracle Cloud Services Google Cloud Platform Amazon Web Services Microsoft Azure

Development host machine requirements NA

RTOSOS product support lifecycle Phonewebe-mail support channels with current product releases on web and automatic customer notifications of new service packs and new releases

We believe in simplicity which manifests in our elegant API and documentation We believe in small size and fast deterministic performance We believe in safety which is why ThreadX is the most pre-certified RTOS including conformance to international safety standards such as IEC 61508 SIL 4 IEC 62304 Class C ISO 26262 ASIL D ULIEC 60730 ULIEC 60335 UL 1998 and EN 50128 SW-SIL 4 ThreadX is also MISRA-C2004 and MISRA C2014 Compliant

All of these attributes are why ThreadX is arguably the most deployed commercial RTOS with over 54 Billion deployments worldwide Please explore further at wwwrtoscom

Express Logic11423 West Bernardo Court San Diego CA 92127Tel 8586136640

wwwexpresslogiccom

14 | RTC Magazine MAY 2016

July 18-20 2016San Jose Convention CenterThe Heart of Silicon Valley

wwwWearablesTechConcom

More than 60 Tech Sessions and Panelsbull Product Design bull Embedded System Development

bull Software Design bull Application Development

bull Leading SDKs bull Electronic Engineering for

Wearables Devices

and more tricks and techniques that will set your wearable project apart

Learn how to design build and develop apps for the wearable technology revolution at Wearables TechCon 2016

PLUS

ldquoThis is an excellent conference to attend to get an understanding from both a business and technicalsense of Wearables and IOTrdquo

mdashKevin Jones Electrical Engineer Dept of Defense

A BZ Media Event

Register Earlyand SAVE

All-Access PassONLY $695

Register before May 13 2016

Expo-Only Pass$25

Come to the Largest Wearable-IoT OEM Expo of 2016Go under the hood of the hottest wearable devices

Wearables_RTC_Layout 1 4816 201 PM Page 1

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

RTC Magazine MAY 2016 | 3

CONTENTSReal World Connected Systems Magazine Produced by Intelligent Systems Source

05by John Koon Editor-in-Chief

How Good is Your Software

EDITORIAL

The Best Embedded Software of 2016

14

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

Esol eT-Kernel

Micrium microCOS RTOS

Express Logic ThreadX

Micro Digital SMX RTOS

OAR RTEMS

Green Hills Software INTEGRITY

MicroEJ MicroEJ OS

SEGGER embOS

Interval Zero RTX64

Microsoft Windows 10 IoT Enterprise amp IoT Core

SYSGO AG AG PikeOS Real-Time Hypervisor

Lynx Software LynxOS 70 RTOS

MontaVista CGX 20

Tenasys INtime RTOS

Mentor Nucleus

Oracle Java ME Embedded 8

Wind River VxWorks

13

21

14

22

27

16

23

28

18

24

2910 ROUND TABLE WHAT WILL THE FUTURE HOLD

Sean LimingAnnabooks LLC

Bill LamieExpress Logic

Christian LeacutegareacuteMicrimicrom

Dinyar DastoorWind River

07

08

09

10

19

25

30

30 SOFTWARE THAT IS SAFE SECURE AND ROBUST

The RTOS Dilemma Are Open Source RTOSes Economic or Costlyby Jerry Krasner Embedded Market Forecasters

An Industry in Transition The Impact of Technical Debt on the Internet of Things by William McCaffrey Vector Software

Safety-critical RTOS Demands Verified Correctnessby Greg Rose DDC-I

Securing Control Over the IIoT RTOS Comes to the Rescueby Albert Rooyakkers Bedrock Automation

Can Devices be Secured in the Internet of Thingsby Dinyar Dastoor Wind River

32

36

40

44

47

20

26

31

Safty-critical RTOS Demands Verified Correctness

40

4 | RTC Magazine MAY 2016

RTC MAGAZINE

TO CONTACT RTC MAGAZINEHome OfficeThe RTC Group 905 Calle Amanecer Suite 150 San Clemente CA 92673Phone (949) 226-2000Fax (949) 226-2050Web wwwrtcgroupcom

Published by The RTC GroupCopyright 2016 The RTC Group Printed in the United States All rights reserved All related graphics are trademarks of The RTC Group All other brand and product names are the property of their holders

PUBLISHERPresidentJohn Reardon johnrrtcgroupcom

Vice PresidentAaron Foellmi aaronfrtcgroupcom

EDITORIALEditor-In-ChiefJohn Koon johnkrtcgroupcom

ARTPRODUCTIONArt DirectorJim Bell jimbrtcgroupcom

Graphic DesignerHugo Ricardo hugorrtcgroupcom

ADVERTISINGWEB ADVERTISINGWestern Regional Sales Manager John Reardon johnrrtcgroupcom (949) 226-2000

Eastern US and EMEA Sales ManagerRuby Brower rubybrtcgroupcom(949) 226-2004

BILLINGControllerTrudi Walde trudiwrtcgroupcom (949) 226-2021

full development kit

smart delivery7b

5

6

7

8

Z

5full development kit

8

single board computer

Z

single board computersingle board computer

single board computer

6

single board computer

7

full development kitfull development kit

full development kit

NOVAsom8copy is a module card designed with a System On Module (SOM) architecture based on quad core ARM Cortex-A9 from 512MB to 4GB of 64 bit DDR3 Memory

bull Processor CortexA9 Freescalebull IMX6 Quad Corebull 4GB RAM Memory bull 32GB FLASH Memory (eMMC) bull USD memory slot bull SATA IIbull Ethernet 101001000 bull USB hostdevice and OTG bull HDMI (High-Definition

Multimedia Interface)

WHY CHOOSE NOVASOM

NOVAsom Industries provides the added value of design creativity offering tailor-made solutions to both industrial and multimedia markets We specialize in proposing innovative options to improve productivity time to market and reach a truly competitive advantage

In addition to the embedded computing industry NOVAsom is involved in the newest high level video technologies including 4K displays The 2 key differences that make us stand out are our 3264 bit full architecture and the ability to provide interface to ANY displaysensor combination

wwwnovasomindustriescom

full development kit

smart delivery7b

5

6

7

8

Z

5full development kit

8

single board computer

Z

single board computersingle board computer

single board computer

6

single board computer

7

full development kitfull development kit

full development kit

EDITORIAL

Good software performs the tasks you specify securely safely and reliably Moreover it has to meet criteria such as application-specific real-time require-ments if your applications need them meet your cost budget and most impor-tantly it wonrsquot break Sometime ago I had a conversation with a Microsoft test man-ager I asked him ldquoWhy do I keep getting bug fixes from Microsoft for my Windows Why donrsquot you test your software to make it bug-freerdquo He answered ldquoIndeed we do extensive tests on all our software prod-ucts before we would consider releasing it to production When we find a bug you can be sure it will be fixed Why would I want to ship a product with bugsrdquo Micro-soft is the worldrsquos largest software compa-ny with a lot of resources If anyone could deliver bug-free software it would be Microsoft I am a hardware guy I remem-bered when our team designed a system we made sure everything worked before we released it to production Additionally Test Engineering and QA will have to sign off the product to ensure it really worked If it failed in the field we blamed it on software We all know a system is a combi-nation of software and hardware Software behaves in such a way that when certain combination of sequence of events occur the software will fail That is why Dynamic and Static Analysis tools are available to improve software quality

Safety and security are on my mind a lot these days When I think about driverless cars I think about safety and security How do you prevent future autonomous cars from getting into an accident when

we cannot even stop a train from derailing today According to John Paliotta CTO of Vector Software a software quality com-pany ldquoit is impossible to build completely bug-free applications but we can build dependable and robust applications if we implement a continuous test process and measure testing completeness using code coverage analysis The avionics indus-try has successfully used this approach to quality for years and the automotive industry is well on its way to adopting a similar approachrdquo My conclusion is when something happens to a good piece of software it will have either a backup plan or a way to shutdown orderly to avoid catastrophic consequences

Here is another area of concern We are all aware of the high profile hacking done to companies like Sony banks and yes even a police chief was hacked I have had first-hand experience of being attacked by malicious individuals Somehow my security software was not strong enough For a long time hackers stole personal information such as credit cards to sell it on line Now theyrsquove come up with a new business model call ransomeware Recent reports including that from BBC indicated the Ransomware has found an easy target hospitals to extract money A local hospital in Southern California gave in and paid the ransom According to Eric Knight CEO of SimpleWan a security software consulting firm ldquoToday compa-nies are not proactive enough You need to have the resources allocated including proper IT knowledge anti-virus software and the team in place to fight battle It will

only get worserdquo Demand for services form companies like SimpleWan has been in-creasing as more and more attacks occur

In this special software Edition we have listed solutions from 17 leading suppliers of RTOS and embedded software for your reference Additionally we have invited experts to share their expertise on safety and security Finally to look into the future of software we have a round table discussion with participants from Micrium Express Logic Wind River and Annabooks LLC If you have new ideas to share let me know

by John Koon Editor-In-Chief

How Good is Your Software

RTC Magazine MAY 2016 | 5

Technology is moving very fast The world is buzzing about how wonderful it will be to have connected driverless cars trucks and boats Communications among Machines the Cloud and now the Fog are taking place at very high speed The Internet-of-Things is unstoppable and will connect billions and maybe even trillions things together All these will require software good software Where are we heading In this Round Table section we have invited four veteran software experts An-nabooks Express Logic Micrium and Wind River to share their insights concern and tell us what the future will look like

Round Table What Does the Future Hold

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

6 | RTC Magazine MAY 2016

RTC Magazine MAY 2016 | 7

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Today the biggest feature is the machine communication protocol There are 4 to 5 proposed standards Thread Alljoyn Open Interconnect Consortium Connectivity Foundation and Industrial Internet Consortium Some operating system vendors are already integrating some solutions but each vertical industry segment will most likely define protocols and standards The operating system will have to have flexible support for the different industry standards Like all standards and proposed consortiums only time will tell which ones will be left standing

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

On big domains there are different types of servers to handle different types of operations There is already talk of data over-load for Cloud computing Being able to off load data storage and other cloud computing tasks to other levels is a logical step My belief is that careful cloud application design to off load data to local resources rather than push up to the bigger cloud will be important Companies will have to choose what data is import-ant versus what can be discarded Embedded operating systems only need to support the different cloud APIs

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

ldquoBeing able to off load data storage and other cloud computing tasks to other levels is a logical steprdquo

Name Sean Liming

Title Owner

Company Annabooks LLC Yorba Linda CA wwwannabookscom

Sean Liming has been involved with embedded systems for over two decades He has authored over 35 articles and eight books including the popular Windows XP Embedded Advanced Professionalrsquos Guide To Windowsreg Embedded Standard 7 and Start Guide for Windows System Image Manager He has traveled around the world as a featured speaker at Microsoft embed-ded conferences In 2001 he became a Microsoft MVP He received his BSEE from California State Polytechnic University in Pomona California focusing on computer architecture and design

Obviously the cloud is taking a big part in the embedded systems Only a couple of my customers are getting into the cloud today I anticipate that will change in 5 years Business decision makers need to determine what data and event triggers are relevant for their business The process takes time Once de-termined then finding companies with the right fit of products is important and this will influence smart sensors and other connected devices

8 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Fundamental features like fast context switching and real-time determinism will continue to be key features for RTOSrsquos as connected thingssystems evolve More devices will be collecting or generating data than ever before of course safety and security will play an increasingly important role as more safety-critical and sensitive data is transferred between devices

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

We believe Cloud and Fog computing will coexist Informa-tion captured or generated by the burgeoning number of things on the IOT will be a mixture of non-sensitive sensitive and safe-ty-critical data flowing across both the cloud and fog platforms The growing need for data to be collected or generated instantly requires high performance features RTOSrsquos will need to provide safe secure and reliable IoT communication solutions with minimal memorypower requirements

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

As mentioned earlier we believe Cloud and Fog computing will coexist The IOT is connecting devices that will provide information for lsquointelligentrsquo interpretation allowing systems and people to make decisions quicker and hopefully better We

ldquoThe growing need for data to be collected or generated instantly requires high per-formance featuresrdquo

Name Bill Lamie

Title President

Company Express Logic San Diego CA wwwrtoscom

William E Lamie is co-founder and CEO of Express Logic Inc located in San Diego CA Mr Lamie is the author of the ThreadX RTOS Prior to founding Express Logic Mr Lamie was the author of the Nucleus RTOS and co-founded Ac-celerated Technology Inc Mr Lamie has over 35 years of experience in embedded systems devel-opment 30 years of which is in the development of commercial real-time operating systems For information on Express Logic please visit wwwexpresslogiccom

are already seeing how wearable medical devices are providing real-time information that helps people avoid behaviors that might trigger adverse medical conditions As these devices become more integrated into larger diagnostic and treatment systems we see the need for safe secure and reliable real-time operating systems and middleware solutions expanding into new devices to address real-time capabilities and current devic-es that will be lsquosmarterrsquo

RTC Magazine MAY 2016 | 9

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Embedded operating systemsrsquo greatest need currently are securi-ty features that can scale to any processor size This is challenging especially on small microcontrollers but required by emerging security requirements Achieving secure boot secure firmware upgrades authentication authorization etc simply requires more hardware resources than are available on small microcontrollers As we reach the limits of Moorersquos law the next processor architec-ture step is to move to multiple cores Given the emerging security requirements symmetrical multiprocessing will become a necessi-ty for embedded operating systems

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

A move to fog computing would require the same security and processing performance enhancements outlined above as well as new mandatory requirements for improved connectivity From Mi-criumrsquos point of view we are already seeing a need for an embedded operating system (in our case an RTOS) to enable scaling from small microcontrollers to large application processors A system is com-posed of many components so having an operating system than can span the complete product architecture offers great economy of scale This aligns perfectly to the architecture proposed by fog computing

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

ldquoClearly embedded oper-ating systems offer many advantages in terms of size and performancerdquo

IoT is the sum of sensorsactuators microcontrollersmicroproces-sors wiredwireless connectivity multiple programming languag-es information technologies and operation technologies not to mention interoperability standards Much advancement in all of these technologies is required to enhance security performance artifi-cial intelligence and fog computing Clearly embedded operating systems offer many advantages in terms of size and performance over other operating systems so will have a significant role in the IoT That being said the main challenge today is one of cost Although the IoT can clearly be a business enabler full-scale IoT penetration can only happen with more economy of scale in a large number of fields

Name Christian Leacutegareacute

Title Chief Technology Officer

Company Micrium Weston FL wwwmicriumcom

Christian Leacutegareacute is EVP and CTO of Micrium a leading provider of embedded software Prior to Micrium he led the Internet Protocol certifi-cation program at the International Institute of Telecom in Montreal Canada During his 22 years in the telecom industry Christian served as an executive in large-scale organizations as well as start-ups mainly in engineering and RampD Christian currently also serves as president and chairman of the IPSO Alliance where he provides guidance on embedded systems to help make the IoT a reality Christian holds a MS in Electrical Engineering from the University of Sherbrooke Quebec Canada

10 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

At the very basic level any device participating in a connected system will need a robust connectivity solution and good enough security to protect it But that does not give you any benefits un-less you have figured out ldquohow to connectrdquo ldquowho to connectrdquo and most important ldquowhy should you connectrdquo

The OS should be able to seamlessly manage multi-element connectivity It should provide a framework to cache command signals or data streams should the device go off-line in a pre-planned manner or suddenly drop connection A robust OS will have a device-side management agent embedded inside to take care of exchanging credentials with unique identifiers with a device management cloud service The OS also needs to provide a framework for easy ldquoover the airrdquo maintenance upgrade and most important the ability to roll-back any updates should something go wrong Finally the OS should provide open standards based APIs to manage everything we discussed

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having every-thing done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

While the concept of ldquofog computingrdquo is not new it has gained lot of attention recently The business needs to collect as much data as possible and the need to optimize the cost of transporting this data has to be appropriately balanced Enter ldquofog computingrdquo It does not replace cloud computing it just creates one layer of lo-calized hierarchy for better management of systems This localized layer has an advantage of higher connectivity bandwidth at lower cost localize storage and assurance that data is not leaving a highly secure perimeter On the flip side fog computersquos storage and CPU bandwidth is more expensive than cloud infrastructure For some industries fog computing solves lot of technical and cost issues

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

In my opinion there is no one utopian vision for future of devices and their embedded OSs in IoT no one element of the

Name Dinyar Dastoor

Title Vice President and General Manager Operating Systems Platform

Company Wind River Alameda CA wwwwindrivercom

Dinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and security He has nearly 30 years of embedded de-vice industry experience holding various senior executive positions managing product manage-ment engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officefocusing on computer architecture and design

network will dominate Instead each element will play a key role in the larger system of systems and this role will constantly evolve as new use cases and innovation happens Yes devices will become ldquosmarterrdquo because they can analyze things in real-time and at the same time become ldquodumberrdquo as more decisions will be made somewhere in the network OSs will evolve to be flexible to fit such cases The cloud will move towards providing cheaper storage and compute networks will continue to boost performance and devic-es at the edge will continue to find new applications The sum total of this will lead to new use cases which we have not imagined yet

AN INTEL COMPANY

trade

Learn more at wwwsupermicrocomembeddedcopy Super Micro Computer Inc Speci cations subject to change without notice

Intel the Intel logo Intel Core Intel Quark Xeon and Xeon Inside are trademarks or registered trademarks of Intel Corporation in the US andor other countriesAll other brands and names are the property of their respective owners

SYS-5018A-FTN4 (Front IO)

SYS-5018A-AR12L

E100-8Q SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4

bull Low Power Intelreg Quarktrade Intelreg Coretrade processor family and High Performance Intelreg Xeonreg processors

bull Standard Form Factor and High Performance Motherboardsbull Optimized Short-Depth Industrial Rackmount Platformsbull Energy Efficient Titanium - Gold Level Power Suppliesbull Fully Optimized SuperServers Ready to Deploy Solutionsbull Remote Management by IPMI or Intelreg AMTbull Worldwide Service with Extended Product Life Cycle Supportbull Optimized for Embedded Applications

IoT Gateway Solutions

Network Security Appliances

Cold Storage

Compact Embedded Server Appliance

High Performance IPC Solution

SYS-6018R-TD (Rear IO)SYS-5028A-TN4

EmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT Solutions

Long Life Cycle middot High-E ciency middot Compact Form Factor middot High Performance middot Global Services middot IoT

Connecting the Intelligent World from Devices to the Cloud

SYS-6018R-TD (Rear IO)

SC946ED (shown)SC846S

Front and Rear Views

4U Top-Loading 60-Bay Server and 90-Bay Dual Expander JBODs

SYS-5018A-AR12L SC946ED SC846S

Front and Rear Views

SC946ED SC846S

Front and Rear ViewsFront and Rear ViewsFront and Rear ViewsFront and Rear Views

SM_USP_150224_X10_RTC_TwinPro_CeBitindd 1 1222015 34409 PM

2016

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

12 | RTC Magazine MAY 2016

2016

RTC Magazine MAY 2016 | 13

2016 RTC Software Survey QuestionnaireFlagship Embedded OS eT-Kernel

Type of embedded OS Real-Time Operating System (RTOS)

Description The eT-Kernel RTOS is designed for embedded systems that require high performance and reliability eT-Kernel is based on the open TRON architecture which is the most widely adopted in embedded systems in Japan and Asian countries eT-Kernel is scalable with multiple profiles to fit any system size and purpose These profiles include POSIX-compliant eT-KernelPOSIX enhanced eT-KernelExtended supporting memory protection and process model and basic eT-KernelCompact eT-Kernel Multi-Core Edition is available for multi-core processors featuring its unique Blended Schedulingreg that enables the coexistence of both symmetrical (SMP) and asymmetrical (AMP) multi-core processing in a single system eT-Kernel has proved its value in a wide range of embedded systems such as car navigation systems aerospace consumer electronics and more

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core)

Board support package Yes No

Source code availability Yes No

RAM memory requirements The total RAM storage depends on multipleparameters as the OS allows build-timeoptimization of OS resources based on the OSconfiguration Minimum required is 54KB with a maximum of 88KB

Minimum storage requirements 230KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFI The OS includes self-contained boot loader It can alsobe adapted to any external boot loading mechanism

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Thread Tracing JTAG and eSOLrsquos Eclipse-based eBinder IDE

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Installation to C drive 80GB or above Installation to other drive 50GB or above bull OS - Microsoft Windows 7 Ultimate ServicePack 1 or later bull Microsoft Windows 7 Professional Service Pack 1 or later bull Microsoft Windows Vista Service Pack 2 or later (only 32bit version)

RTOSOS product support lifecycle We provide renewable annual support and maintenance When a new revision is released the previous revision will be supported for 18 months Upon request we also provide long-term support and maintenance up to 10 years or more

eT-Kernel is a core part of the eT-Kernel Platform that integrates the eBinder IDE middleware components ndash including network protocols file systems USB hostdevice stacks and graphics tools ndash and professional services eT-Kernel Platform helps OEMs and ODMs to quickly create flexible development platforms for their software product lines and enables them to improve time to market cost productivity quality and other business drivers

eSOL Co LtdHarmony Tower 1-32-2 Honcho Nakano-ku Tokyo Japan 164-8721Tel +81 3 5302 1360

wwwesolcom

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS ThreadX

Type of embedded OS Real-Time Operating System (RTOS)

Description ThreadX is Express Logicrsquos advanced Real-Time Operating System (RTOS) designed specifically for deeply embedded IoT applications ThreadX provides advanced scheduling facilities message passing interrupt management and messaging services as well as many others ThreadX has many advanced features including its picokerneltrade architecture preemption-thresholdtrade scheduling event-chainingtrade and a rich set of system services Combined with its superior ease-of-use ThreadX is the ideal choice for the most demanding of embedded IoT applications According to VDC Research ThreadX has been deployed in over over 54 billion electronic products in the areas of consumer devices medical electronics industrial control equipment and space probes including NASArsquos Deep Impact and the Mars Reconnaissance Orbiter (MRO)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other ThreadX has support for most popular processors

Board support package Yes No

Source code availability Yes No

RAM memory requirements ThreadX automatically scales based on usageie no complicated compile-time configurationis necessary

Minimum storage requirements 2KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader ThreadX is agnostic in terms of bootloader ie any bootloader can be used

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license We work closely with IAR in terms of integration and customer engagements and support most popular development tools for all processor architectures

language support C and C

Debugger tools Eclipse JTAG Thread Tracing and TraceX is our host-based system event analysis tool

Built-in cloud API services Yes Express Logic is the only ARM mbed RTOS partnermeaning that mbed Client is available for the ThreadX developers to leverage in their designs In additionThreadX and NetX are the foundation for various IoT SoCs including Avago Technologiesrsquo WICED and GainSpanrsquos WiFi chips and modules

Cloud Service Providers Oracle Cloud Services Google Cloud Platform Amazon Web Services Microsoft Azure

Development host machine requirements NA

RTOSOS product support lifecycle Phonewebe-mail support channels with current product releases on web and automatic customer notifications of new service packs and new releases

We believe in simplicity which manifests in our elegant API and documentation We believe in small size and fast deterministic performance We believe in safety which is why ThreadX is the most pre-certified RTOS including conformance to international safety standards such as IEC 61508 SIL 4 IEC 62304 Class C ISO 26262 ASIL D ULIEC 60730 ULIEC 60335 UL 1998 and EN 50128 SW-SIL 4 ThreadX is also MISRA-C2004 and MISRA C2014 Compliant

All of these attributes are why ThreadX is arguably the most deployed commercial RTOS with over 54 Billion deployments worldwide Please explore further at wwwrtoscom

Express Logic11423 West Bernardo Court San Diego CA 92127Tel 8586136640

wwwexpresslogiccom

14 | RTC Magazine MAY 2016

July 18-20 2016San Jose Convention CenterThe Heart of Silicon Valley

wwwWearablesTechConcom

More than 60 Tech Sessions and Panelsbull Product Design bull Embedded System Development

bull Software Design bull Application Development

bull Leading SDKs bull Electronic Engineering for

Wearables Devices

and more tricks and techniques that will set your wearable project apart

Learn how to design build and develop apps for the wearable technology revolution at Wearables TechCon 2016

PLUS

ldquoThis is an excellent conference to attend to get an understanding from both a business and technicalsense of Wearables and IOTrdquo

mdashKevin Jones Electrical Engineer Dept of Defense

A BZ Media Event

Register Earlyand SAVE

All-Access PassONLY $695

Register before May 13 2016

Expo-Only Pass$25

Come to the Largest Wearable-IoT OEM Expo of 2016Go under the hood of the hottest wearable devices

Wearables_RTC_Layout 1 4816 201 PM Page 1

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

4 | RTC Magazine MAY 2016

RTC MAGAZINE

TO CONTACT RTC MAGAZINEHome OfficeThe RTC Group 905 Calle Amanecer Suite 150 San Clemente CA 92673Phone (949) 226-2000Fax (949) 226-2050Web wwwrtcgroupcom

Published by The RTC GroupCopyright 2016 The RTC Group Printed in the United States All rights reserved All related graphics are trademarks of The RTC Group All other brand and product names are the property of their holders

PUBLISHERPresidentJohn Reardon johnrrtcgroupcom

Vice PresidentAaron Foellmi aaronfrtcgroupcom

EDITORIALEditor-In-ChiefJohn Koon johnkrtcgroupcom

ARTPRODUCTIONArt DirectorJim Bell jimbrtcgroupcom

Graphic DesignerHugo Ricardo hugorrtcgroupcom

ADVERTISINGWEB ADVERTISINGWestern Regional Sales Manager John Reardon johnrrtcgroupcom (949) 226-2000

Eastern US and EMEA Sales ManagerRuby Brower rubybrtcgroupcom(949) 226-2004

BILLINGControllerTrudi Walde trudiwrtcgroupcom (949) 226-2021

full development kit

smart delivery7b

5

6

7

8

Z

5full development kit

8

single board computer

Z

single board computersingle board computer

single board computer

6

single board computer

7

full development kitfull development kit

full development kit

NOVAsom8copy is a module card designed with a System On Module (SOM) architecture based on quad core ARM Cortex-A9 from 512MB to 4GB of 64 bit DDR3 Memory

bull Processor CortexA9 Freescalebull IMX6 Quad Corebull 4GB RAM Memory bull 32GB FLASH Memory (eMMC) bull USD memory slot bull SATA IIbull Ethernet 101001000 bull USB hostdevice and OTG bull HDMI (High-Definition

Multimedia Interface)

WHY CHOOSE NOVASOM

NOVAsom Industries provides the added value of design creativity offering tailor-made solutions to both industrial and multimedia markets We specialize in proposing innovative options to improve productivity time to market and reach a truly competitive advantage

In addition to the embedded computing industry NOVAsom is involved in the newest high level video technologies including 4K displays The 2 key differences that make us stand out are our 3264 bit full architecture and the ability to provide interface to ANY displaysensor combination

wwwnovasomindustriescom

full development kit

smart delivery7b

5

6

7

8

Z

5full development kit

8

single board computer

Z

single board computersingle board computer

single board computer

6

single board computer

7

full development kitfull development kit

full development kit

EDITORIAL

Good software performs the tasks you specify securely safely and reliably Moreover it has to meet criteria such as application-specific real-time require-ments if your applications need them meet your cost budget and most impor-tantly it wonrsquot break Sometime ago I had a conversation with a Microsoft test man-ager I asked him ldquoWhy do I keep getting bug fixes from Microsoft for my Windows Why donrsquot you test your software to make it bug-freerdquo He answered ldquoIndeed we do extensive tests on all our software prod-ucts before we would consider releasing it to production When we find a bug you can be sure it will be fixed Why would I want to ship a product with bugsrdquo Micro-soft is the worldrsquos largest software compa-ny with a lot of resources If anyone could deliver bug-free software it would be Microsoft I am a hardware guy I remem-bered when our team designed a system we made sure everything worked before we released it to production Additionally Test Engineering and QA will have to sign off the product to ensure it really worked If it failed in the field we blamed it on software We all know a system is a combi-nation of software and hardware Software behaves in such a way that when certain combination of sequence of events occur the software will fail That is why Dynamic and Static Analysis tools are available to improve software quality

Safety and security are on my mind a lot these days When I think about driverless cars I think about safety and security How do you prevent future autonomous cars from getting into an accident when

we cannot even stop a train from derailing today According to John Paliotta CTO of Vector Software a software quality com-pany ldquoit is impossible to build completely bug-free applications but we can build dependable and robust applications if we implement a continuous test process and measure testing completeness using code coverage analysis The avionics indus-try has successfully used this approach to quality for years and the automotive industry is well on its way to adopting a similar approachrdquo My conclusion is when something happens to a good piece of software it will have either a backup plan or a way to shutdown orderly to avoid catastrophic consequences

Here is another area of concern We are all aware of the high profile hacking done to companies like Sony banks and yes even a police chief was hacked I have had first-hand experience of being attacked by malicious individuals Somehow my security software was not strong enough For a long time hackers stole personal information such as credit cards to sell it on line Now theyrsquove come up with a new business model call ransomeware Recent reports including that from BBC indicated the Ransomware has found an easy target hospitals to extract money A local hospital in Southern California gave in and paid the ransom According to Eric Knight CEO of SimpleWan a security software consulting firm ldquoToday compa-nies are not proactive enough You need to have the resources allocated including proper IT knowledge anti-virus software and the team in place to fight battle It will

only get worserdquo Demand for services form companies like SimpleWan has been in-creasing as more and more attacks occur

In this special software Edition we have listed solutions from 17 leading suppliers of RTOS and embedded software for your reference Additionally we have invited experts to share their expertise on safety and security Finally to look into the future of software we have a round table discussion with participants from Micrium Express Logic Wind River and Annabooks LLC If you have new ideas to share let me know

by John Koon Editor-In-Chief

How Good is Your Software

RTC Magazine MAY 2016 | 5

Technology is moving very fast The world is buzzing about how wonderful it will be to have connected driverless cars trucks and boats Communications among Machines the Cloud and now the Fog are taking place at very high speed The Internet-of-Things is unstoppable and will connect billions and maybe even trillions things together All these will require software good software Where are we heading In this Round Table section we have invited four veteran software experts An-nabooks Express Logic Micrium and Wind River to share their insights concern and tell us what the future will look like

Round Table What Does the Future Hold

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

6 | RTC Magazine MAY 2016

RTC Magazine MAY 2016 | 7

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Today the biggest feature is the machine communication protocol There are 4 to 5 proposed standards Thread Alljoyn Open Interconnect Consortium Connectivity Foundation and Industrial Internet Consortium Some operating system vendors are already integrating some solutions but each vertical industry segment will most likely define protocols and standards The operating system will have to have flexible support for the different industry standards Like all standards and proposed consortiums only time will tell which ones will be left standing

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

On big domains there are different types of servers to handle different types of operations There is already talk of data over-load for Cloud computing Being able to off load data storage and other cloud computing tasks to other levels is a logical step My belief is that careful cloud application design to off load data to local resources rather than push up to the bigger cloud will be important Companies will have to choose what data is import-ant versus what can be discarded Embedded operating systems only need to support the different cloud APIs

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

ldquoBeing able to off load data storage and other cloud computing tasks to other levels is a logical steprdquo

Name Sean Liming

Title Owner

Company Annabooks LLC Yorba Linda CA wwwannabookscom

Sean Liming has been involved with embedded systems for over two decades He has authored over 35 articles and eight books including the popular Windows XP Embedded Advanced Professionalrsquos Guide To Windowsreg Embedded Standard 7 and Start Guide for Windows System Image Manager He has traveled around the world as a featured speaker at Microsoft embed-ded conferences In 2001 he became a Microsoft MVP He received his BSEE from California State Polytechnic University in Pomona California focusing on computer architecture and design

Obviously the cloud is taking a big part in the embedded systems Only a couple of my customers are getting into the cloud today I anticipate that will change in 5 years Business decision makers need to determine what data and event triggers are relevant for their business The process takes time Once de-termined then finding companies with the right fit of products is important and this will influence smart sensors and other connected devices

8 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Fundamental features like fast context switching and real-time determinism will continue to be key features for RTOSrsquos as connected thingssystems evolve More devices will be collecting or generating data than ever before of course safety and security will play an increasingly important role as more safety-critical and sensitive data is transferred between devices

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

We believe Cloud and Fog computing will coexist Informa-tion captured or generated by the burgeoning number of things on the IOT will be a mixture of non-sensitive sensitive and safe-ty-critical data flowing across both the cloud and fog platforms The growing need for data to be collected or generated instantly requires high performance features RTOSrsquos will need to provide safe secure and reliable IoT communication solutions with minimal memorypower requirements

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

As mentioned earlier we believe Cloud and Fog computing will coexist The IOT is connecting devices that will provide information for lsquointelligentrsquo interpretation allowing systems and people to make decisions quicker and hopefully better We

ldquoThe growing need for data to be collected or generated instantly requires high per-formance featuresrdquo

Name Bill Lamie

Title President

Company Express Logic San Diego CA wwwrtoscom

William E Lamie is co-founder and CEO of Express Logic Inc located in San Diego CA Mr Lamie is the author of the ThreadX RTOS Prior to founding Express Logic Mr Lamie was the author of the Nucleus RTOS and co-founded Ac-celerated Technology Inc Mr Lamie has over 35 years of experience in embedded systems devel-opment 30 years of which is in the development of commercial real-time operating systems For information on Express Logic please visit wwwexpresslogiccom

are already seeing how wearable medical devices are providing real-time information that helps people avoid behaviors that might trigger adverse medical conditions As these devices become more integrated into larger diagnostic and treatment systems we see the need for safe secure and reliable real-time operating systems and middleware solutions expanding into new devices to address real-time capabilities and current devic-es that will be lsquosmarterrsquo

RTC Magazine MAY 2016 | 9

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Embedded operating systemsrsquo greatest need currently are securi-ty features that can scale to any processor size This is challenging especially on small microcontrollers but required by emerging security requirements Achieving secure boot secure firmware upgrades authentication authorization etc simply requires more hardware resources than are available on small microcontrollers As we reach the limits of Moorersquos law the next processor architec-ture step is to move to multiple cores Given the emerging security requirements symmetrical multiprocessing will become a necessi-ty for embedded operating systems

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

A move to fog computing would require the same security and processing performance enhancements outlined above as well as new mandatory requirements for improved connectivity From Mi-criumrsquos point of view we are already seeing a need for an embedded operating system (in our case an RTOS) to enable scaling from small microcontrollers to large application processors A system is com-posed of many components so having an operating system than can span the complete product architecture offers great economy of scale This aligns perfectly to the architecture proposed by fog computing

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

ldquoClearly embedded oper-ating systems offer many advantages in terms of size and performancerdquo

IoT is the sum of sensorsactuators microcontrollersmicroproces-sors wiredwireless connectivity multiple programming languag-es information technologies and operation technologies not to mention interoperability standards Much advancement in all of these technologies is required to enhance security performance artifi-cial intelligence and fog computing Clearly embedded operating systems offer many advantages in terms of size and performance over other operating systems so will have a significant role in the IoT That being said the main challenge today is one of cost Although the IoT can clearly be a business enabler full-scale IoT penetration can only happen with more economy of scale in a large number of fields

Name Christian Leacutegareacute

Title Chief Technology Officer

Company Micrium Weston FL wwwmicriumcom

Christian Leacutegareacute is EVP and CTO of Micrium a leading provider of embedded software Prior to Micrium he led the Internet Protocol certifi-cation program at the International Institute of Telecom in Montreal Canada During his 22 years in the telecom industry Christian served as an executive in large-scale organizations as well as start-ups mainly in engineering and RampD Christian currently also serves as president and chairman of the IPSO Alliance where he provides guidance on embedded systems to help make the IoT a reality Christian holds a MS in Electrical Engineering from the University of Sherbrooke Quebec Canada

10 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

At the very basic level any device participating in a connected system will need a robust connectivity solution and good enough security to protect it But that does not give you any benefits un-less you have figured out ldquohow to connectrdquo ldquowho to connectrdquo and most important ldquowhy should you connectrdquo

The OS should be able to seamlessly manage multi-element connectivity It should provide a framework to cache command signals or data streams should the device go off-line in a pre-planned manner or suddenly drop connection A robust OS will have a device-side management agent embedded inside to take care of exchanging credentials with unique identifiers with a device management cloud service The OS also needs to provide a framework for easy ldquoover the airrdquo maintenance upgrade and most important the ability to roll-back any updates should something go wrong Finally the OS should provide open standards based APIs to manage everything we discussed

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having every-thing done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

While the concept of ldquofog computingrdquo is not new it has gained lot of attention recently The business needs to collect as much data as possible and the need to optimize the cost of transporting this data has to be appropriately balanced Enter ldquofog computingrdquo It does not replace cloud computing it just creates one layer of lo-calized hierarchy for better management of systems This localized layer has an advantage of higher connectivity bandwidth at lower cost localize storage and assurance that data is not leaving a highly secure perimeter On the flip side fog computersquos storage and CPU bandwidth is more expensive than cloud infrastructure For some industries fog computing solves lot of technical and cost issues

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

In my opinion there is no one utopian vision for future of devices and their embedded OSs in IoT no one element of the

Name Dinyar Dastoor

Title Vice President and General Manager Operating Systems Platform

Company Wind River Alameda CA wwwwindrivercom

Dinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and security He has nearly 30 years of embedded de-vice industry experience holding various senior executive positions managing product manage-ment engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officefocusing on computer architecture and design

network will dominate Instead each element will play a key role in the larger system of systems and this role will constantly evolve as new use cases and innovation happens Yes devices will become ldquosmarterrdquo because they can analyze things in real-time and at the same time become ldquodumberrdquo as more decisions will be made somewhere in the network OSs will evolve to be flexible to fit such cases The cloud will move towards providing cheaper storage and compute networks will continue to boost performance and devic-es at the edge will continue to find new applications The sum total of this will lead to new use cases which we have not imagined yet

AN INTEL COMPANY

trade

Learn more at wwwsupermicrocomembeddedcopy Super Micro Computer Inc Speci cations subject to change without notice

Intel the Intel logo Intel Core Intel Quark Xeon and Xeon Inside are trademarks or registered trademarks of Intel Corporation in the US andor other countriesAll other brands and names are the property of their respective owners

SYS-5018A-FTN4 (Front IO)

SYS-5018A-AR12L

E100-8Q SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4

bull Low Power Intelreg Quarktrade Intelreg Coretrade processor family and High Performance Intelreg Xeonreg processors

bull Standard Form Factor and High Performance Motherboardsbull Optimized Short-Depth Industrial Rackmount Platformsbull Energy Efficient Titanium - Gold Level Power Suppliesbull Fully Optimized SuperServers Ready to Deploy Solutionsbull Remote Management by IPMI or Intelreg AMTbull Worldwide Service with Extended Product Life Cycle Supportbull Optimized for Embedded Applications

IoT Gateway Solutions

Network Security Appliances

Cold Storage

Compact Embedded Server Appliance

High Performance IPC Solution

SYS-6018R-TD (Rear IO)SYS-5028A-TN4

EmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT Solutions

Long Life Cycle middot High-E ciency middot Compact Form Factor middot High Performance middot Global Services middot IoT

Connecting the Intelligent World from Devices to the Cloud

SYS-6018R-TD (Rear IO)

SC946ED (shown)SC846S

Front and Rear Views

4U Top-Loading 60-Bay Server and 90-Bay Dual Expander JBODs

SYS-5018A-AR12L SC946ED SC846S

Front and Rear Views

SC946ED SC846S

Front and Rear ViewsFront and Rear ViewsFront and Rear ViewsFront and Rear Views

SM_USP_150224_X10_RTC_TwinPro_CeBitindd 1 1222015 34409 PM

2016

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

12 | RTC Magazine MAY 2016

2016

RTC Magazine MAY 2016 | 13

2016 RTC Software Survey QuestionnaireFlagship Embedded OS eT-Kernel

Type of embedded OS Real-Time Operating System (RTOS)

Description The eT-Kernel RTOS is designed for embedded systems that require high performance and reliability eT-Kernel is based on the open TRON architecture which is the most widely adopted in embedded systems in Japan and Asian countries eT-Kernel is scalable with multiple profiles to fit any system size and purpose These profiles include POSIX-compliant eT-KernelPOSIX enhanced eT-KernelExtended supporting memory protection and process model and basic eT-KernelCompact eT-Kernel Multi-Core Edition is available for multi-core processors featuring its unique Blended Schedulingreg that enables the coexistence of both symmetrical (SMP) and asymmetrical (AMP) multi-core processing in a single system eT-Kernel has proved its value in a wide range of embedded systems such as car navigation systems aerospace consumer electronics and more

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core)

Board support package Yes No

Source code availability Yes No

RAM memory requirements The total RAM storage depends on multipleparameters as the OS allows build-timeoptimization of OS resources based on the OSconfiguration Minimum required is 54KB with a maximum of 88KB

Minimum storage requirements 230KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFI The OS includes self-contained boot loader It can alsobe adapted to any external boot loading mechanism

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Thread Tracing JTAG and eSOLrsquos Eclipse-based eBinder IDE

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Installation to C drive 80GB or above Installation to other drive 50GB or above bull OS - Microsoft Windows 7 Ultimate ServicePack 1 or later bull Microsoft Windows 7 Professional Service Pack 1 or later bull Microsoft Windows Vista Service Pack 2 or later (only 32bit version)

RTOSOS product support lifecycle We provide renewable annual support and maintenance When a new revision is released the previous revision will be supported for 18 months Upon request we also provide long-term support and maintenance up to 10 years or more

eT-Kernel is a core part of the eT-Kernel Platform that integrates the eBinder IDE middleware components ndash including network protocols file systems USB hostdevice stacks and graphics tools ndash and professional services eT-Kernel Platform helps OEMs and ODMs to quickly create flexible development platforms for their software product lines and enables them to improve time to market cost productivity quality and other business drivers

eSOL Co LtdHarmony Tower 1-32-2 Honcho Nakano-ku Tokyo Japan 164-8721Tel +81 3 5302 1360

wwwesolcom

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS ThreadX

Type of embedded OS Real-Time Operating System (RTOS)

Description ThreadX is Express Logicrsquos advanced Real-Time Operating System (RTOS) designed specifically for deeply embedded IoT applications ThreadX provides advanced scheduling facilities message passing interrupt management and messaging services as well as many others ThreadX has many advanced features including its picokerneltrade architecture preemption-thresholdtrade scheduling event-chainingtrade and a rich set of system services Combined with its superior ease-of-use ThreadX is the ideal choice for the most demanding of embedded IoT applications According to VDC Research ThreadX has been deployed in over over 54 billion electronic products in the areas of consumer devices medical electronics industrial control equipment and space probes including NASArsquos Deep Impact and the Mars Reconnaissance Orbiter (MRO)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other ThreadX has support for most popular processors

Board support package Yes No

Source code availability Yes No

RAM memory requirements ThreadX automatically scales based on usageie no complicated compile-time configurationis necessary

Minimum storage requirements 2KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader ThreadX is agnostic in terms of bootloader ie any bootloader can be used

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license We work closely with IAR in terms of integration and customer engagements and support most popular development tools for all processor architectures

language support C and C

Debugger tools Eclipse JTAG Thread Tracing and TraceX is our host-based system event analysis tool

Built-in cloud API services Yes Express Logic is the only ARM mbed RTOS partnermeaning that mbed Client is available for the ThreadX developers to leverage in their designs In additionThreadX and NetX are the foundation for various IoT SoCs including Avago Technologiesrsquo WICED and GainSpanrsquos WiFi chips and modules

Cloud Service Providers Oracle Cloud Services Google Cloud Platform Amazon Web Services Microsoft Azure

Development host machine requirements NA

RTOSOS product support lifecycle Phonewebe-mail support channels with current product releases on web and automatic customer notifications of new service packs and new releases

We believe in simplicity which manifests in our elegant API and documentation We believe in small size and fast deterministic performance We believe in safety which is why ThreadX is the most pre-certified RTOS including conformance to international safety standards such as IEC 61508 SIL 4 IEC 62304 Class C ISO 26262 ASIL D ULIEC 60730 ULIEC 60335 UL 1998 and EN 50128 SW-SIL 4 ThreadX is also MISRA-C2004 and MISRA C2014 Compliant

All of these attributes are why ThreadX is arguably the most deployed commercial RTOS with over 54 Billion deployments worldwide Please explore further at wwwrtoscom

Express Logic11423 West Bernardo Court San Diego CA 92127Tel 8586136640

wwwexpresslogiccom

14 | RTC Magazine MAY 2016

July 18-20 2016San Jose Convention CenterThe Heart of Silicon Valley

wwwWearablesTechConcom

More than 60 Tech Sessions and Panelsbull Product Design bull Embedded System Development

bull Software Design bull Application Development

bull Leading SDKs bull Electronic Engineering for

Wearables Devices

and more tricks and techniques that will set your wearable project apart

Learn how to design build and develop apps for the wearable technology revolution at Wearables TechCon 2016

PLUS

ldquoThis is an excellent conference to attend to get an understanding from both a business and technicalsense of Wearables and IOTrdquo

mdashKevin Jones Electrical Engineer Dept of Defense

A BZ Media Event

Register Earlyand SAVE

All-Access PassONLY $695

Register before May 13 2016

Expo-Only Pass$25

Come to the Largest Wearable-IoT OEM Expo of 2016Go under the hood of the hottest wearable devices

Wearables_RTC_Layout 1 4816 201 PM Page 1

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

EDITORIAL

Good software performs the tasks you specify securely safely and reliably Moreover it has to meet criteria such as application-specific real-time require-ments if your applications need them meet your cost budget and most impor-tantly it wonrsquot break Sometime ago I had a conversation with a Microsoft test man-ager I asked him ldquoWhy do I keep getting bug fixes from Microsoft for my Windows Why donrsquot you test your software to make it bug-freerdquo He answered ldquoIndeed we do extensive tests on all our software prod-ucts before we would consider releasing it to production When we find a bug you can be sure it will be fixed Why would I want to ship a product with bugsrdquo Micro-soft is the worldrsquos largest software compa-ny with a lot of resources If anyone could deliver bug-free software it would be Microsoft I am a hardware guy I remem-bered when our team designed a system we made sure everything worked before we released it to production Additionally Test Engineering and QA will have to sign off the product to ensure it really worked If it failed in the field we blamed it on software We all know a system is a combi-nation of software and hardware Software behaves in such a way that when certain combination of sequence of events occur the software will fail That is why Dynamic and Static Analysis tools are available to improve software quality

Safety and security are on my mind a lot these days When I think about driverless cars I think about safety and security How do you prevent future autonomous cars from getting into an accident when

we cannot even stop a train from derailing today According to John Paliotta CTO of Vector Software a software quality com-pany ldquoit is impossible to build completely bug-free applications but we can build dependable and robust applications if we implement a continuous test process and measure testing completeness using code coverage analysis The avionics indus-try has successfully used this approach to quality for years and the automotive industry is well on its way to adopting a similar approachrdquo My conclusion is when something happens to a good piece of software it will have either a backup plan or a way to shutdown orderly to avoid catastrophic consequences

Here is another area of concern We are all aware of the high profile hacking done to companies like Sony banks and yes even a police chief was hacked I have had first-hand experience of being attacked by malicious individuals Somehow my security software was not strong enough For a long time hackers stole personal information such as credit cards to sell it on line Now theyrsquove come up with a new business model call ransomeware Recent reports including that from BBC indicated the Ransomware has found an easy target hospitals to extract money A local hospital in Southern California gave in and paid the ransom According to Eric Knight CEO of SimpleWan a security software consulting firm ldquoToday compa-nies are not proactive enough You need to have the resources allocated including proper IT knowledge anti-virus software and the team in place to fight battle It will

only get worserdquo Demand for services form companies like SimpleWan has been in-creasing as more and more attacks occur

In this special software Edition we have listed solutions from 17 leading suppliers of RTOS and embedded software for your reference Additionally we have invited experts to share their expertise on safety and security Finally to look into the future of software we have a round table discussion with participants from Micrium Express Logic Wind River and Annabooks LLC If you have new ideas to share let me know

by John Koon Editor-In-Chief

How Good is Your Software

RTC Magazine MAY 2016 | 5

Technology is moving very fast The world is buzzing about how wonderful it will be to have connected driverless cars trucks and boats Communications among Machines the Cloud and now the Fog are taking place at very high speed The Internet-of-Things is unstoppable and will connect billions and maybe even trillions things together All these will require software good software Where are we heading In this Round Table section we have invited four veteran software experts An-nabooks Express Logic Micrium and Wind River to share their insights concern and tell us what the future will look like

Round Table What Does the Future Hold

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

6 | RTC Magazine MAY 2016

RTC Magazine MAY 2016 | 7

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Today the biggest feature is the machine communication protocol There are 4 to 5 proposed standards Thread Alljoyn Open Interconnect Consortium Connectivity Foundation and Industrial Internet Consortium Some operating system vendors are already integrating some solutions but each vertical industry segment will most likely define protocols and standards The operating system will have to have flexible support for the different industry standards Like all standards and proposed consortiums only time will tell which ones will be left standing

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

On big domains there are different types of servers to handle different types of operations There is already talk of data over-load for Cloud computing Being able to off load data storage and other cloud computing tasks to other levels is a logical step My belief is that careful cloud application design to off load data to local resources rather than push up to the bigger cloud will be important Companies will have to choose what data is import-ant versus what can be discarded Embedded operating systems only need to support the different cloud APIs

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

ldquoBeing able to off load data storage and other cloud computing tasks to other levels is a logical steprdquo

Name Sean Liming

Title Owner

Company Annabooks LLC Yorba Linda CA wwwannabookscom

Sean Liming has been involved with embedded systems for over two decades He has authored over 35 articles and eight books including the popular Windows XP Embedded Advanced Professionalrsquos Guide To Windowsreg Embedded Standard 7 and Start Guide for Windows System Image Manager He has traveled around the world as a featured speaker at Microsoft embed-ded conferences In 2001 he became a Microsoft MVP He received his BSEE from California State Polytechnic University in Pomona California focusing on computer architecture and design

Obviously the cloud is taking a big part in the embedded systems Only a couple of my customers are getting into the cloud today I anticipate that will change in 5 years Business decision makers need to determine what data and event triggers are relevant for their business The process takes time Once de-termined then finding companies with the right fit of products is important and this will influence smart sensors and other connected devices

8 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Fundamental features like fast context switching and real-time determinism will continue to be key features for RTOSrsquos as connected thingssystems evolve More devices will be collecting or generating data than ever before of course safety and security will play an increasingly important role as more safety-critical and sensitive data is transferred between devices

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

We believe Cloud and Fog computing will coexist Informa-tion captured or generated by the burgeoning number of things on the IOT will be a mixture of non-sensitive sensitive and safe-ty-critical data flowing across both the cloud and fog platforms The growing need for data to be collected or generated instantly requires high performance features RTOSrsquos will need to provide safe secure and reliable IoT communication solutions with minimal memorypower requirements

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

As mentioned earlier we believe Cloud and Fog computing will coexist The IOT is connecting devices that will provide information for lsquointelligentrsquo interpretation allowing systems and people to make decisions quicker and hopefully better We

ldquoThe growing need for data to be collected or generated instantly requires high per-formance featuresrdquo

Name Bill Lamie

Title President

Company Express Logic San Diego CA wwwrtoscom

William E Lamie is co-founder and CEO of Express Logic Inc located in San Diego CA Mr Lamie is the author of the ThreadX RTOS Prior to founding Express Logic Mr Lamie was the author of the Nucleus RTOS and co-founded Ac-celerated Technology Inc Mr Lamie has over 35 years of experience in embedded systems devel-opment 30 years of which is in the development of commercial real-time operating systems For information on Express Logic please visit wwwexpresslogiccom

are already seeing how wearable medical devices are providing real-time information that helps people avoid behaviors that might trigger adverse medical conditions As these devices become more integrated into larger diagnostic and treatment systems we see the need for safe secure and reliable real-time operating systems and middleware solutions expanding into new devices to address real-time capabilities and current devic-es that will be lsquosmarterrsquo

RTC Magazine MAY 2016 | 9

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Embedded operating systemsrsquo greatest need currently are securi-ty features that can scale to any processor size This is challenging especially on small microcontrollers but required by emerging security requirements Achieving secure boot secure firmware upgrades authentication authorization etc simply requires more hardware resources than are available on small microcontrollers As we reach the limits of Moorersquos law the next processor architec-ture step is to move to multiple cores Given the emerging security requirements symmetrical multiprocessing will become a necessi-ty for embedded operating systems

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

A move to fog computing would require the same security and processing performance enhancements outlined above as well as new mandatory requirements for improved connectivity From Mi-criumrsquos point of view we are already seeing a need for an embedded operating system (in our case an RTOS) to enable scaling from small microcontrollers to large application processors A system is com-posed of many components so having an operating system than can span the complete product architecture offers great economy of scale This aligns perfectly to the architecture proposed by fog computing

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

ldquoClearly embedded oper-ating systems offer many advantages in terms of size and performancerdquo

IoT is the sum of sensorsactuators microcontrollersmicroproces-sors wiredwireless connectivity multiple programming languag-es information technologies and operation technologies not to mention interoperability standards Much advancement in all of these technologies is required to enhance security performance artifi-cial intelligence and fog computing Clearly embedded operating systems offer many advantages in terms of size and performance over other operating systems so will have a significant role in the IoT That being said the main challenge today is one of cost Although the IoT can clearly be a business enabler full-scale IoT penetration can only happen with more economy of scale in a large number of fields

Name Christian Leacutegareacute

Title Chief Technology Officer

Company Micrium Weston FL wwwmicriumcom

Christian Leacutegareacute is EVP and CTO of Micrium a leading provider of embedded software Prior to Micrium he led the Internet Protocol certifi-cation program at the International Institute of Telecom in Montreal Canada During his 22 years in the telecom industry Christian served as an executive in large-scale organizations as well as start-ups mainly in engineering and RampD Christian currently also serves as president and chairman of the IPSO Alliance where he provides guidance on embedded systems to help make the IoT a reality Christian holds a MS in Electrical Engineering from the University of Sherbrooke Quebec Canada

10 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

At the very basic level any device participating in a connected system will need a robust connectivity solution and good enough security to protect it But that does not give you any benefits un-less you have figured out ldquohow to connectrdquo ldquowho to connectrdquo and most important ldquowhy should you connectrdquo

The OS should be able to seamlessly manage multi-element connectivity It should provide a framework to cache command signals or data streams should the device go off-line in a pre-planned manner or suddenly drop connection A robust OS will have a device-side management agent embedded inside to take care of exchanging credentials with unique identifiers with a device management cloud service The OS also needs to provide a framework for easy ldquoover the airrdquo maintenance upgrade and most important the ability to roll-back any updates should something go wrong Finally the OS should provide open standards based APIs to manage everything we discussed

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having every-thing done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

While the concept of ldquofog computingrdquo is not new it has gained lot of attention recently The business needs to collect as much data as possible and the need to optimize the cost of transporting this data has to be appropriately balanced Enter ldquofog computingrdquo It does not replace cloud computing it just creates one layer of lo-calized hierarchy for better management of systems This localized layer has an advantage of higher connectivity bandwidth at lower cost localize storage and assurance that data is not leaving a highly secure perimeter On the flip side fog computersquos storage and CPU bandwidth is more expensive than cloud infrastructure For some industries fog computing solves lot of technical and cost issues

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

In my opinion there is no one utopian vision for future of devices and their embedded OSs in IoT no one element of the

Name Dinyar Dastoor

Title Vice President and General Manager Operating Systems Platform

Company Wind River Alameda CA wwwwindrivercom

Dinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and security He has nearly 30 years of embedded de-vice industry experience holding various senior executive positions managing product manage-ment engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officefocusing on computer architecture and design

network will dominate Instead each element will play a key role in the larger system of systems and this role will constantly evolve as new use cases and innovation happens Yes devices will become ldquosmarterrdquo because they can analyze things in real-time and at the same time become ldquodumberrdquo as more decisions will be made somewhere in the network OSs will evolve to be flexible to fit such cases The cloud will move towards providing cheaper storage and compute networks will continue to boost performance and devic-es at the edge will continue to find new applications The sum total of this will lead to new use cases which we have not imagined yet

AN INTEL COMPANY

trade

Learn more at wwwsupermicrocomembeddedcopy Super Micro Computer Inc Speci cations subject to change without notice

Intel the Intel logo Intel Core Intel Quark Xeon and Xeon Inside are trademarks or registered trademarks of Intel Corporation in the US andor other countriesAll other brands and names are the property of their respective owners

SYS-5018A-FTN4 (Front IO)

SYS-5018A-AR12L

E100-8Q SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4

bull Low Power Intelreg Quarktrade Intelreg Coretrade processor family and High Performance Intelreg Xeonreg processors

bull Standard Form Factor and High Performance Motherboardsbull Optimized Short-Depth Industrial Rackmount Platformsbull Energy Efficient Titanium - Gold Level Power Suppliesbull Fully Optimized SuperServers Ready to Deploy Solutionsbull Remote Management by IPMI or Intelreg AMTbull Worldwide Service with Extended Product Life Cycle Supportbull Optimized for Embedded Applications

IoT Gateway Solutions

Network Security Appliances

Cold Storage

Compact Embedded Server Appliance

High Performance IPC Solution

SYS-6018R-TD (Rear IO)SYS-5028A-TN4

EmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT Solutions

Long Life Cycle middot High-E ciency middot Compact Form Factor middot High Performance middot Global Services middot IoT

Connecting the Intelligent World from Devices to the Cloud

SYS-6018R-TD (Rear IO)

SC946ED (shown)SC846S

Front and Rear Views

4U Top-Loading 60-Bay Server and 90-Bay Dual Expander JBODs

SYS-5018A-AR12L SC946ED SC846S

Front and Rear Views

SC946ED SC846S

Front and Rear ViewsFront and Rear ViewsFront and Rear ViewsFront and Rear Views

SM_USP_150224_X10_RTC_TwinPro_CeBitindd 1 1222015 34409 PM

2016

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

12 | RTC Magazine MAY 2016

2016

RTC Magazine MAY 2016 | 13

2016 RTC Software Survey QuestionnaireFlagship Embedded OS eT-Kernel

Type of embedded OS Real-Time Operating System (RTOS)

Description The eT-Kernel RTOS is designed for embedded systems that require high performance and reliability eT-Kernel is based on the open TRON architecture which is the most widely adopted in embedded systems in Japan and Asian countries eT-Kernel is scalable with multiple profiles to fit any system size and purpose These profiles include POSIX-compliant eT-KernelPOSIX enhanced eT-KernelExtended supporting memory protection and process model and basic eT-KernelCompact eT-Kernel Multi-Core Edition is available for multi-core processors featuring its unique Blended Schedulingreg that enables the coexistence of both symmetrical (SMP) and asymmetrical (AMP) multi-core processing in a single system eT-Kernel has proved its value in a wide range of embedded systems such as car navigation systems aerospace consumer electronics and more

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core)

Board support package Yes No

Source code availability Yes No

RAM memory requirements The total RAM storage depends on multipleparameters as the OS allows build-timeoptimization of OS resources based on the OSconfiguration Minimum required is 54KB with a maximum of 88KB

Minimum storage requirements 230KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFI The OS includes self-contained boot loader It can alsobe adapted to any external boot loading mechanism

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Thread Tracing JTAG and eSOLrsquos Eclipse-based eBinder IDE

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Installation to C drive 80GB or above Installation to other drive 50GB or above bull OS - Microsoft Windows 7 Ultimate ServicePack 1 or later bull Microsoft Windows 7 Professional Service Pack 1 or later bull Microsoft Windows Vista Service Pack 2 or later (only 32bit version)

RTOSOS product support lifecycle We provide renewable annual support and maintenance When a new revision is released the previous revision will be supported for 18 months Upon request we also provide long-term support and maintenance up to 10 years or more

eT-Kernel is a core part of the eT-Kernel Platform that integrates the eBinder IDE middleware components ndash including network protocols file systems USB hostdevice stacks and graphics tools ndash and professional services eT-Kernel Platform helps OEMs and ODMs to quickly create flexible development platforms for their software product lines and enables them to improve time to market cost productivity quality and other business drivers

eSOL Co LtdHarmony Tower 1-32-2 Honcho Nakano-ku Tokyo Japan 164-8721Tel +81 3 5302 1360

wwwesolcom

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS ThreadX

Type of embedded OS Real-Time Operating System (RTOS)

Description ThreadX is Express Logicrsquos advanced Real-Time Operating System (RTOS) designed specifically for deeply embedded IoT applications ThreadX provides advanced scheduling facilities message passing interrupt management and messaging services as well as many others ThreadX has many advanced features including its picokerneltrade architecture preemption-thresholdtrade scheduling event-chainingtrade and a rich set of system services Combined with its superior ease-of-use ThreadX is the ideal choice for the most demanding of embedded IoT applications According to VDC Research ThreadX has been deployed in over over 54 billion electronic products in the areas of consumer devices medical electronics industrial control equipment and space probes including NASArsquos Deep Impact and the Mars Reconnaissance Orbiter (MRO)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other ThreadX has support for most popular processors

Board support package Yes No

Source code availability Yes No

RAM memory requirements ThreadX automatically scales based on usageie no complicated compile-time configurationis necessary

Minimum storage requirements 2KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader ThreadX is agnostic in terms of bootloader ie any bootloader can be used

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license We work closely with IAR in terms of integration and customer engagements and support most popular development tools for all processor architectures

language support C and C

Debugger tools Eclipse JTAG Thread Tracing and TraceX is our host-based system event analysis tool

Built-in cloud API services Yes Express Logic is the only ARM mbed RTOS partnermeaning that mbed Client is available for the ThreadX developers to leverage in their designs In additionThreadX and NetX are the foundation for various IoT SoCs including Avago Technologiesrsquo WICED and GainSpanrsquos WiFi chips and modules

Cloud Service Providers Oracle Cloud Services Google Cloud Platform Amazon Web Services Microsoft Azure

Development host machine requirements NA

RTOSOS product support lifecycle Phonewebe-mail support channels with current product releases on web and automatic customer notifications of new service packs and new releases

We believe in simplicity which manifests in our elegant API and documentation We believe in small size and fast deterministic performance We believe in safety which is why ThreadX is the most pre-certified RTOS including conformance to international safety standards such as IEC 61508 SIL 4 IEC 62304 Class C ISO 26262 ASIL D ULIEC 60730 ULIEC 60335 UL 1998 and EN 50128 SW-SIL 4 ThreadX is also MISRA-C2004 and MISRA C2014 Compliant

All of these attributes are why ThreadX is arguably the most deployed commercial RTOS with over 54 Billion deployments worldwide Please explore further at wwwrtoscom

Express Logic11423 West Bernardo Court San Diego CA 92127Tel 8586136640

wwwexpresslogiccom

14 | RTC Magazine MAY 2016

July 18-20 2016San Jose Convention CenterThe Heart of Silicon Valley

wwwWearablesTechConcom

More than 60 Tech Sessions and Panelsbull Product Design bull Embedded System Development

bull Software Design bull Application Development

bull Leading SDKs bull Electronic Engineering for

Wearables Devices

and more tricks and techniques that will set your wearable project apart

Learn how to design build and develop apps for the wearable technology revolution at Wearables TechCon 2016

PLUS

ldquoThis is an excellent conference to attend to get an understanding from both a business and technicalsense of Wearables and IOTrdquo

mdashKevin Jones Electrical Engineer Dept of Defense

A BZ Media Event

Register Earlyand SAVE

All-Access PassONLY $695

Register before May 13 2016

Expo-Only Pass$25

Come to the Largest Wearable-IoT OEM Expo of 2016Go under the hood of the hottest wearable devices

Wearables_RTC_Layout 1 4816 201 PM Page 1

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

Technology is moving very fast The world is buzzing about how wonderful it will be to have connected driverless cars trucks and boats Communications among Machines the Cloud and now the Fog are taking place at very high speed The Internet-of-Things is unstoppable and will connect billions and maybe even trillions things together All these will require software good software Where are we heading In this Round Table section we have invited four veteran software experts An-nabooks Express Logic Micrium and Wind River to share their insights concern and tell us what the future will look like

Round Table What Does the Future Hold

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

6 | RTC Magazine MAY 2016

RTC Magazine MAY 2016 | 7

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Today the biggest feature is the machine communication protocol There are 4 to 5 proposed standards Thread Alljoyn Open Interconnect Consortium Connectivity Foundation and Industrial Internet Consortium Some operating system vendors are already integrating some solutions but each vertical industry segment will most likely define protocols and standards The operating system will have to have flexible support for the different industry standards Like all standards and proposed consortiums only time will tell which ones will be left standing

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

On big domains there are different types of servers to handle different types of operations There is already talk of data over-load for Cloud computing Being able to off load data storage and other cloud computing tasks to other levels is a logical step My belief is that careful cloud application design to off load data to local resources rather than push up to the bigger cloud will be important Companies will have to choose what data is import-ant versus what can be discarded Embedded operating systems only need to support the different cloud APIs

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

ldquoBeing able to off load data storage and other cloud computing tasks to other levels is a logical steprdquo

Name Sean Liming

Title Owner

Company Annabooks LLC Yorba Linda CA wwwannabookscom

Sean Liming has been involved with embedded systems for over two decades He has authored over 35 articles and eight books including the popular Windows XP Embedded Advanced Professionalrsquos Guide To Windowsreg Embedded Standard 7 and Start Guide for Windows System Image Manager He has traveled around the world as a featured speaker at Microsoft embed-ded conferences In 2001 he became a Microsoft MVP He received his BSEE from California State Polytechnic University in Pomona California focusing on computer architecture and design

Obviously the cloud is taking a big part in the embedded systems Only a couple of my customers are getting into the cloud today I anticipate that will change in 5 years Business decision makers need to determine what data and event triggers are relevant for their business The process takes time Once de-termined then finding companies with the right fit of products is important and this will influence smart sensors and other connected devices

8 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Fundamental features like fast context switching and real-time determinism will continue to be key features for RTOSrsquos as connected thingssystems evolve More devices will be collecting or generating data than ever before of course safety and security will play an increasingly important role as more safety-critical and sensitive data is transferred between devices

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

We believe Cloud and Fog computing will coexist Informa-tion captured or generated by the burgeoning number of things on the IOT will be a mixture of non-sensitive sensitive and safe-ty-critical data flowing across both the cloud and fog platforms The growing need for data to be collected or generated instantly requires high performance features RTOSrsquos will need to provide safe secure and reliable IoT communication solutions with minimal memorypower requirements

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

As mentioned earlier we believe Cloud and Fog computing will coexist The IOT is connecting devices that will provide information for lsquointelligentrsquo interpretation allowing systems and people to make decisions quicker and hopefully better We

ldquoThe growing need for data to be collected or generated instantly requires high per-formance featuresrdquo

Name Bill Lamie

Title President

Company Express Logic San Diego CA wwwrtoscom

William E Lamie is co-founder and CEO of Express Logic Inc located in San Diego CA Mr Lamie is the author of the ThreadX RTOS Prior to founding Express Logic Mr Lamie was the author of the Nucleus RTOS and co-founded Ac-celerated Technology Inc Mr Lamie has over 35 years of experience in embedded systems devel-opment 30 years of which is in the development of commercial real-time operating systems For information on Express Logic please visit wwwexpresslogiccom

are already seeing how wearable medical devices are providing real-time information that helps people avoid behaviors that might trigger adverse medical conditions As these devices become more integrated into larger diagnostic and treatment systems we see the need for safe secure and reliable real-time operating systems and middleware solutions expanding into new devices to address real-time capabilities and current devic-es that will be lsquosmarterrsquo

RTC Magazine MAY 2016 | 9

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Embedded operating systemsrsquo greatest need currently are securi-ty features that can scale to any processor size This is challenging especially on small microcontrollers but required by emerging security requirements Achieving secure boot secure firmware upgrades authentication authorization etc simply requires more hardware resources than are available on small microcontrollers As we reach the limits of Moorersquos law the next processor architec-ture step is to move to multiple cores Given the emerging security requirements symmetrical multiprocessing will become a necessi-ty for embedded operating systems

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

A move to fog computing would require the same security and processing performance enhancements outlined above as well as new mandatory requirements for improved connectivity From Mi-criumrsquos point of view we are already seeing a need for an embedded operating system (in our case an RTOS) to enable scaling from small microcontrollers to large application processors A system is com-posed of many components so having an operating system than can span the complete product architecture offers great economy of scale This aligns perfectly to the architecture proposed by fog computing

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

ldquoClearly embedded oper-ating systems offer many advantages in terms of size and performancerdquo

IoT is the sum of sensorsactuators microcontrollersmicroproces-sors wiredwireless connectivity multiple programming languag-es information technologies and operation technologies not to mention interoperability standards Much advancement in all of these technologies is required to enhance security performance artifi-cial intelligence and fog computing Clearly embedded operating systems offer many advantages in terms of size and performance over other operating systems so will have a significant role in the IoT That being said the main challenge today is one of cost Although the IoT can clearly be a business enabler full-scale IoT penetration can only happen with more economy of scale in a large number of fields

Name Christian Leacutegareacute

Title Chief Technology Officer

Company Micrium Weston FL wwwmicriumcom

Christian Leacutegareacute is EVP and CTO of Micrium a leading provider of embedded software Prior to Micrium he led the Internet Protocol certifi-cation program at the International Institute of Telecom in Montreal Canada During his 22 years in the telecom industry Christian served as an executive in large-scale organizations as well as start-ups mainly in engineering and RampD Christian currently also serves as president and chairman of the IPSO Alliance where he provides guidance on embedded systems to help make the IoT a reality Christian holds a MS in Electrical Engineering from the University of Sherbrooke Quebec Canada

10 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

At the very basic level any device participating in a connected system will need a robust connectivity solution and good enough security to protect it But that does not give you any benefits un-less you have figured out ldquohow to connectrdquo ldquowho to connectrdquo and most important ldquowhy should you connectrdquo

The OS should be able to seamlessly manage multi-element connectivity It should provide a framework to cache command signals or data streams should the device go off-line in a pre-planned manner or suddenly drop connection A robust OS will have a device-side management agent embedded inside to take care of exchanging credentials with unique identifiers with a device management cloud service The OS also needs to provide a framework for easy ldquoover the airrdquo maintenance upgrade and most important the ability to roll-back any updates should something go wrong Finally the OS should provide open standards based APIs to manage everything we discussed

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having every-thing done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

While the concept of ldquofog computingrdquo is not new it has gained lot of attention recently The business needs to collect as much data as possible and the need to optimize the cost of transporting this data has to be appropriately balanced Enter ldquofog computingrdquo It does not replace cloud computing it just creates one layer of lo-calized hierarchy for better management of systems This localized layer has an advantage of higher connectivity bandwidth at lower cost localize storage and assurance that data is not leaving a highly secure perimeter On the flip side fog computersquos storage and CPU bandwidth is more expensive than cloud infrastructure For some industries fog computing solves lot of technical and cost issues

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

In my opinion there is no one utopian vision for future of devices and their embedded OSs in IoT no one element of the

Name Dinyar Dastoor

Title Vice President and General Manager Operating Systems Platform

Company Wind River Alameda CA wwwwindrivercom

Dinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and security He has nearly 30 years of embedded de-vice industry experience holding various senior executive positions managing product manage-ment engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officefocusing on computer architecture and design

network will dominate Instead each element will play a key role in the larger system of systems and this role will constantly evolve as new use cases and innovation happens Yes devices will become ldquosmarterrdquo because they can analyze things in real-time and at the same time become ldquodumberrdquo as more decisions will be made somewhere in the network OSs will evolve to be flexible to fit such cases The cloud will move towards providing cheaper storage and compute networks will continue to boost performance and devic-es at the edge will continue to find new applications The sum total of this will lead to new use cases which we have not imagined yet

AN INTEL COMPANY

trade

Learn more at wwwsupermicrocomembeddedcopy Super Micro Computer Inc Speci cations subject to change without notice

Intel the Intel logo Intel Core Intel Quark Xeon and Xeon Inside are trademarks or registered trademarks of Intel Corporation in the US andor other countriesAll other brands and names are the property of their respective owners

SYS-5018A-FTN4 (Front IO)

SYS-5018A-AR12L

E100-8Q SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4

bull Low Power Intelreg Quarktrade Intelreg Coretrade processor family and High Performance Intelreg Xeonreg processors

bull Standard Form Factor and High Performance Motherboardsbull Optimized Short-Depth Industrial Rackmount Platformsbull Energy Efficient Titanium - Gold Level Power Suppliesbull Fully Optimized SuperServers Ready to Deploy Solutionsbull Remote Management by IPMI or Intelreg AMTbull Worldwide Service with Extended Product Life Cycle Supportbull Optimized for Embedded Applications

IoT Gateway Solutions

Network Security Appliances

Cold Storage

Compact Embedded Server Appliance

High Performance IPC Solution

SYS-6018R-TD (Rear IO)SYS-5028A-TN4

EmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT Solutions

Long Life Cycle middot High-E ciency middot Compact Form Factor middot High Performance middot Global Services middot IoT

Connecting the Intelligent World from Devices to the Cloud

SYS-6018R-TD (Rear IO)

SC946ED (shown)SC846S

Front and Rear Views

4U Top-Loading 60-Bay Server and 90-Bay Dual Expander JBODs

SYS-5018A-AR12L SC946ED SC846S

Front and Rear Views

SC946ED SC846S

Front and Rear ViewsFront and Rear ViewsFront and Rear ViewsFront and Rear Views

SM_USP_150224_X10_RTC_TwinPro_CeBitindd 1 1222015 34409 PM

2016

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

12 | RTC Magazine MAY 2016

2016

RTC Magazine MAY 2016 | 13

2016 RTC Software Survey QuestionnaireFlagship Embedded OS eT-Kernel

Type of embedded OS Real-Time Operating System (RTOS)

Description The eT-Kernel RTOS is designed for embedded systems that require high performance and reliability eT-Kernel is based on the open TRON architecture which is the most widely adopted in embedded systems in Japan and Asian countries eT-Kernel is scalable with multiple profiles to fit any system size and purpose These profiles include POSIX-compliant eT-KernelPOSIX enhanced eT-KernelExtended supporting memory protection and process model and basic eT-KernelCompact eT-Kernel Multi-Core Edition is available for multi-core processors featuring its unique Blended Schedulingreg that enables the coexistence of both symmetrical (SMP) and asymmetrical (AMP) multi-core processing in a single system eT-Kernel has proved its value in a wide range of embedded systems such as car navigation systems aerospace consumer electronics and more

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core)

Board support package Yes No

Source code availability Yes No

RAM memory requirements The total RAM storage depends on multipleparameters as the OS allows build-timeoptimization of OS resources based on the OSconfiguration Minimum required is 54KB with a maximum of 88KB

Minimum storage requirements 230KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFI The OS includes self-contained boot loader It can alsobe adapted to any external boot loading mechanism

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Thread Tracing JTAG and eSOLrsquos Eclipse-based eBinder IDE

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Installation to C drive 80GB or above Installation to other drive 50GB or above bull OS - Microsoft Windows 7 Ultimate ServicePack 1 or later bull Microsoft Windows 7 Professional Service Pack 1 or later bull Microsoft Windows Vista Service Pack 2 or later (only 32bit version)

RTOSOS product support lifecycle We provide renewable annual support and maintenance When a new revision is released the previous revision will be supported for 18 months Upon request we also provide long-term support and maintenance up to 10 years or more

eT-Kernel is a core part of the eT-Kernel Platform that integrates the eBinder IDE middleware components ndash including network protocols file systems USB hostdevice stacks and graphics tools ndash and professional services eT-Kernel Platform helps OEMs and ODMs to quickly create flexible development platforms for their software product lines and enables them to improve time to market cost productivity quality and other business drivers

eSOL Co LtdHarmony Tower 1-32-2 Honcho Nakano-ku Tokyo Japan 164-8721Tel +81 3 5302 1360

wwwesolcom

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS ThreadX

Type of embedded OS Real-Time Operating System (RTOS)

Description ThreadX is Express Logicrsquos advanced Real-Time Operating System (RTOS) designed specifically for deeply embedded IoT applications ThreadX provides advanced scheduling facilities message passing interrupt management and messaging services as well as many others ThreadX has many advanced features including its picokerneltrade architecture preemption-thresholdtrade scheduling event-chainingtrade and a rich set of system services Combined with its superior ease-of-use ThreadX is the ideal choice for the most demanding of embedded IoT applications According to VDC Research ThreadX has been deployed in over over 54 billion electronic products in the areas of consumer devices medical electronics industrial control equipment and space probes including NASArsquos Deep Impact and the Mars Reconnaissance Orbiter (MRO)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other ThreadX has support for most popular processors

Board support package Yes No

Source code availability Yes No

RAM memory requirements ThreadX automatically scales based on usageie no complicated compile-time configurationis necessary

Minimum storage requirements 2KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader ThreadX is agnostic in terms of bootloader ie any bootloader can be used

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license We work closely with IAR in terms of integration and customer engagements and support most popular development tools for all processor architectures

language support C and C

Debugger tools Eclipse JTAG Thread Tracing and TraceX is our host-based system event analysis tool

Built-in cloud API services Yes Express Logic is the only ARM mbed RTOS partnermeaning that mbed Client is available for the ThreadX developers to leverage in their designs In additionThreadX and NetX are the foundation for various IoT SoCs including Avago Technologiesrsquo WICED and GainSpanrsquos WiFi chips and modules

Cloud Service Providers Oracle Cloud Services Google Cloud Platform Amazon Web Services Microsoft Azure

Development host machine requirements NA

RTOSOS product support lifecycle Phonewebe-mail support channels with current product releases on web and automatic customer notifications of new service packs and new releases

We believe in simplicity which manifests in our elegant API and documentation We believe in small size and fast deterministic performance We believe in safety which is why ThreadX is the most pre-certified RTOS including conformance to international safety standards such as IEC 61508 SIL 4 IEC 62304 Class C ISO 26262 ASIL D ULIEC 60730 ULIEC 60335 UL 1998 and EN 50128 SW-SIL 4 ThreadX is also MISRA-C2004 and MISRA C2014 Compliant

All of these attributes are why ThreadX is arguably the most deployed commercial RTOS with over 54 Billion deployments worldwide Please explore further at wwwrtoscom

Express Logic11423 West Bernardo Court San Diego CA 92127Tel 8586136640

wwwexpresslogiccom

14 | RTC Magazine MAY 2016

July 18-20 2016San Jose Convention CenterThe Heart of Silicon Valley

wwwWearablesTechConcom

More than 60 Tech Sessions and Panelsbull Product Design bull Embedded System Development

bull Software Design bull Application Development

bull Leading SDKs bull Electronic Engineering for

Wearables Devices

and more tricks and techniques that will set your wearable project apart

Learn how to design build and develop apps for the wearable technology revolution at Wearables TechCon 2016

PLUS

ldquoThis is an excellent conference to attend to get an understanding from both a business and technicalsense of Wearables and IOTrdquo

mdashKevin Jones Electrical Engineer Dept of Defense

A BZ Media Event

Register Earlyand SAVE

All-Access PassONLY $695

Register before May 13 2016

Expo-Only Pass$25

Come to the Largest Wearable-IoT OEM Expo of 2016Go under the hood of the hottest wearable devices

Wearables_RTC_Layout 1 4816 201 PM Page 1

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

RTC Magazine MAY 2016 | 7

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Today the biggest feature is the machine communication protocol There are 4 to 5 proposed standards Thread Alljoyn Open Interconnect Consortium Connectivity Foundation and Industrial Internet Consortium Some operating system vendors are already integrating some solutions but each vertical industry segment will most likely define protocols and standards The operating system will have to have flexible support for the different industry standards Like all standards and proposed consortiums only time will tell which ones will be left standing

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

On big domains there are different types of servers to handle different types of operations There is already talk of data over-load for Cloud computing Being able to off load data storage and other cloud computing tasks to other levels is a logical step My belief is that careful cloud application design to off load data to local resources rather than push up to the bigger cloud will be important Companies will have to choose what data is import-ant versus what can be discarded Embedded operating systems only need to support the different cloud APIs

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

ldquoBeing able to off load data storage and other cloud computing tasks to other levels is a logical steprdquo

Name Sean Liming

Title Owner

Company Annabooks LLC Yorba Linda CA wwwannabookscom

Sean Liming has been involved with embedded systems for over two decades He has authored over 35 articles and eight books including the popular Windows XP Embedded Advanced Professionalrsquos Guide To Windowsreg Embedded Standard 7 and Start Guide for Windows System Image Manager He has traveled around the world as a featured speaker at Microsoft embed-ded conferences In 2001 he became a Microsoft MVP He received his BSEE from California State Polytechnic University in Pomona California focusing on computer architecture and design

Obviously the cloud is taking a big part in the embedded systems Only a couple of my customers are getting into the cloud today I anticipate that will change in 5 years Business decision makers need to determine what data and event triggers are relevant for their business The process takes time Once de-termined then finding companies with the right fit of products is important and this will influence smart sensors and other connected devices

8 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Fundamental features like fast context switching and real-time determinism will continue to be key features for RTOSrsquos as connected thingssystems evolve More devices will be collecting or generating data than ever before of course safety and security will play an increasingly important role as more safety-critical and sensitive data is transferred between devices

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

We believe Cloud and Fog computing will coexist Informa-tion captured or generated by the burgeoning number of things on the IOT will be a mixture of non-sensitive sensitive and safe-ty-critical data flowing across both the cloud and fog platforms The growing need for data to be collected or generated instantly requires high performance features RTOSrsquos will need to provide safe secure and reliable IoT communication solutions with minimal memorypower requirements

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

As mentioned earlier we believe Cloud and Fog computing will coexist The IOT is connecting devices that will provide information for lsquointelligentrsquo interpretation allowing systems and people to make decisions quicker and hopefully better We

ldquoThe growing need for data to be collected or generated instantly requires high per-formance featuresrdquo

Name Bill Lamie

Title President

Company Express Logic San Diego CA wwwrtoscom

William E Lamie is co-founder and CEO of Express Logic Inc located in San Diego CA Mr Lamie is the author of the ThreadX RTOS Prior to founding Express Logic Mr Lamie was the author of the Nucleus RTOS and co-founded Ac-celerated Technology Inc Mr Lamie has over 35 years of experience in embedded systems devel-opment 30 years of which is in the development of commercial real-time operating systems For information on Express Logic please visit wwwexpresslogiccom

are already seeing how wearable medical devices are providing real-time information that helps people avoid behaviors that might trigger adverse medical conditions As these devices become more integrated into larger diagnostic and treatment systems we see the need for safe secure and reliable real-time operating systems and middleware solutions expanding into new devices to address real-time capabilities and current devic-es that will be lsquosmarterrsquo

RTC Magazine MAY 2016 | 9

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Embedded operating systemsrsquo greatest need currently are securi-ty features that can scale to any processor size This is challenging especially on small microcontrollers but required by emerging security requirements Achieving secure boot secure firmware upgrades authentication authorization etc simply requires more hardware resources than are available on small microcontrollers As we reach the limits of Moorersquos law the next processor architec-ture step is to move to multiple cores Given the emerging security requirements symmetrical multiprocessing will become a necessi-ty for embedded operating systems

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

A move to fog computing would require the same security and processing performance enhancements outlined above as well as new mandatory requirements for improved connectivity From Mi-criumrsquos point of view we are already seeing a need for an embedded operating system (in our case an RTOS) to enable scaling from small microcontrollers to large application processors A system is com-posed of many components so having an operating system than can span the complete product architecture offers great economy of scale This aligns perfectly to the architecture proposed by fog computing

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

ldquoClearly embedded oper-ating systems offer many advantages in terms of size and performancerdquo

IoT is the sum of sensorsactuators microcontrollersmicroproces-sors wiredwireless connectivity multiple programming languag-es information technologies and operation technologies not to mention interoperability standards Much advancement in all of these technologies is required to enhance security performance artifi-cial intelligence and fog computing Clearly embedded operating systems offer many advantages in terms of size and performance over other operating systems so will have a significant role in the IoT That being said the main challenge today is one of cost Although the IoT can clearly be a business enabler full-scale IoT penetration can only happen with more economy of scale in a large number of fields

Name Christian Leacutegareacute

Title Chief Technology Officer

Company Micrium Weston FL wwwmicriumcom

Christian Leacutegareacute is EVP and CTO of Micrium a leading provider of embedded software Prior to Micrium he led the Internet Protocol certifi-cation program at the International Institute of Telecom in Montreal Canada During his 22 years in the telecom industry Christian served as an executive in large-scale organizations as well as start-ups mainly in engineering and RampD Christian currently also serves as president and chairman of the IPSO Alliance where he provides guidance on embedded systems to help make the IoT a reality Christian holds a MS in Electrical Engineering from the University of Sherbrooke Quebec Canada

10 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

At the very basic level any device participating in a connected system will need a robust connectivity solution and good enough security to protect it But that does not give you any benefits un-less you have figured out ldquohow to connectrdquo ldquowho to connectrdquo and most important ldquowhy should you connectrdquo

The OS should be able to seamlessly manage multi-element connectivity It should provide a framework to cache command signals or data streams should the device go off-line in a pre-planned manner or suddenly drop connection A robust OS will have a device-side management agent embedded inside to take care of exchanging credentials with unique identifiers with a device management cloud service The OS also needs to provide a framework for easy ldquoover the airrdquo maintenance upgrade and most important the ability to roll-back any updates should something go wrong Finally the OS should provide open standards based APIs to manage everything we discussed

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having every-thing done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

While the concept of ldquofog computingrdquo is not new it has gained lot of attention recently The business needs to collect as much data as possible and the need to optimize the cost of transporting this data has to be appropriately balanced Enter ldquofog computingrdquo It does not replace cloud computing it just creates one layer of lo-calized hierarchy for better management of systems This localized layer has an advantage of higher connectivity bandwidth at lower cost localize storage and assurance that data is not leaving a highly secure perimeter On the flip side fog computersquos storage and CPU bandwidth is more expensive than cloud infrastructure For some industries fog computing solves lot of technical and cost issues

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

In my opinion there is no one utopian vision for future of devices and their embedded OSs in IoT no one element of the

Name Dinyar Dastoor

Title Vice President and General Manager Operating Systems Platform

Company Wind River Alameda CA wwwwindrivercom

Dinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and security He has nearly 30 years of embedded de-vice industry experience holding various senior executive positions managing product manage-ment engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officefocusing on computer architecture and design

network will dominate Instead each element will play a key role in the larger system of systems and this role will constantly evolve as new use cases and innovation happens Yes devices will become ldquosmarterrdquo because they can analyze things in real-time and at the same time become ldquodumberrdquo as more decisions will be made somewhere in the network OSs will evolve to be flexible to fit such cases The cloud will move towards providing cheaper storage and compute networks will continue to boost performance and devic-es at the edge will continue to find new applications The sum total of this will lead to new use cases which we have not imagined yet

AN INTEL COMPANY

trade

Learn more at wwwsupermicrocomembeddedcopy Super Micro Computer Inc Speci cations subject to change without notice

Intel the Intel logo Intel Core Intel Quark Xeon and Xeon Inside are trademarks or registered trademarks of Intel Corporation in the US andor other countriesAll other brands and names are the property of their respective owners

SYS-5018A-FTN4 (Front IO)

SYS-5018A-AR12L

E100-8Q SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4

bull Low Power Intelreg Quarktrade Intelreg Coretrade processor family and High Performance Intelreg Xeonreg processors

bull Standard Form Factor and High Performance Motherboardsbull Optimized Short-Depth Industrial Rackmount Platformsbull Energy Efficient Titanium - Gold Level Power Suppliesbull Fully Optimized SuperServers Ready to Deploy Solutionsbull Remote Management by IPMI or Intelreg AMTbull Worldwide Service with Extended Product Life Cycle Supportbull Optimized for Embedded Applications

IoT Gateway Solutions

Network Security Appliances

Cold Storage

Compact Embedded Server Appliance

High Performance IPC Solution

SYS-6018R-TD (Rear IO)SYS-5028A-TN4

EmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT Solutions

Long Life Cycle middot High-E ciency middot Compact Form Factor middot High Performance middot Global Services middot IoT

Connecting the Intelligent World from Devices to the Cloud

SYS-6018R-TD (Rear IO)

SC946ED (shown)SC846S

Front and Rear Views

4U Top-Loading 60-Bay Server and 90-Bay Dual Expander JBODs

SYS-5018A-AR12L SC946ED SC846S

Front and Rear Views

SC946ED SC846S

Front and Rear ViewsFront and Rear ViewsFront and Rear ViewsFront and Rear Views

SM_USP_150224_X10_RTC_TwinPro_CeBitindd 1 1222015 34409 PM

2016

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

12 | RTC Magazine MAY 2016

2016

RTC Magazine MAY 2016 | 13

2016 RTC Software Survey QuestionnaireFlagship Embedded OS eT-Kernel

Type of embedded OS Real-Time Operating System (RTOS)

Description The eT-Kernel RTOS is designed for embedded systems that require high performance and reliability eT-Kernel is based on the open TRON architecture which is the most widely adopted in embedded systems in Japan and Asian countries eT-Kernel is scalable with multiple profiles to fit any system size and purpose These profiles include POSIX-compliant eT-KernelPOSIX enhanced eT-KernelExtended supporting memory protection and process model and basic eT-KernelCompact eT-Kernel Multi-Core Edition is available for multi-core processors featuring its unique Blended Schedulingreg that enables the coexistence of both symmetrical (SMP) and asymmetrical (AMP) multi-core processing in a single system eT-Kernel has proved its value in a wide range of embedded systems such as car navigation systems aerospace consumer electronics and more

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core)

Board support package Yes No

Source code availability Yes No

RAM memory requirements The total RAM storage depends on multipleparameters as the OS allows build-timeoptimization of OS resources based on the OSconfiguration Minimum required is 54KB with a maximum of 88KB

Minimum storage requirements 230KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFI The OS includes self-contained boot loader It can alsobe adapted to any external boot loading mechanism

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Thread Tracing JTAG and eSOLrsquos Eclipse-based eBinder IDE

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Installation to C drive 80GB or above Installation to other drive 50GB or above bull OS - Microsoft Windows 7 Ultimate ServicePack 1 or later bull Microsoft Windows 7 Professional Service Pack 1 or later bull Microsoft Windows Vista Service Pack 2 or later (only 32bit version)

RTOSOS product support lifecycle We provide renewable annual support and maintenance When a new revision is released the previous revision will be supported for 18 months Upon request we also provide long-term support and maintenance up to 10 years or more

eT-Kernel is a core part of the eT-Kernel Platform that integrates the eBinder IDE middleware components ndash including network protocols file systems USB hostdevice stacks and graphics tools ndash and professional services eT-Kernel Platform helps OEMs and ODMs to quickly create flexible development platforms for their software product lines and enables them to improve time to market cost productivity quality and other business drivers

eSOL Co LtdHarmony Tower 1-32-2 Honcho Nakano-ku Tokyo Japan 164-8721Tel +81 3 5302 1360

wwwesolcom

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS ThreadX

Type of embedded OS Real-Time Operating System (RTOS)

Description ThreadX is Express Logicrsquos advanced Real-Time Operating System (RTOS) designed specifically for deeply embedded IoT applications ThreadX provides advanced scheduling facilities message passing interrupt management and messaging services as well as many others ThreadX has many advanced features including its picokerneltrade architecture preemption-thresholdtrade scheduling event-chainingtrade and a rich set of system services Combined with its superior ease-of-use ThreadX is the ideal choice for the most demanding of embedded IoT applications According to VDC Research ThreadX has been deployed in over over 54 billion electronic products in the areas of consumer devices medical electronics industrial control equipment and space probes including NASArsquos Deep Impact and the Mars Reconnaissance Orbiter (MRO)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other ThreadX has support for most popular processors

Board support package Yes No

Source code availability Yes No

RAM memory requirements ThreadX automatically scales based on usageie no complicated compile-time configurationis necessary

Minimum storage requirements 2KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader ThreadX is agnostic in terms of bootloader ie any bootloader can be used

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license We work closely with IAR in terms of integration and customer engagements and support most popular development tools for all processor architectures

language support C and C

Debugger tools Eclipse JTAG Thread Tracing and TraceX is our host-based system event analysis tool

Built-in cloud API services Yes Express Logic is the only ARM mbed RTOS partnermeaning that mbed Client is available for the ThreadX developers to leverage in their designs In additionThreadX and NetX are the foundation for various IoT SoCs including Avago Technologiesrsquo WICED and GainSpanrsquos WiFi chips and modules

Cloud Service Providers Oracle Cloud Services Google Cloud Platform Amazon Web Services Microsoft Azure

Development host machine requirements NA

RTOSOS product support lifecycle Phonewebe-mail support channels with current product releases on web and automatic customer notifications of new service packs and new releases

We believe in simplicity which manifests in our elegant API and documentation We believe in small size and fast deterministic performance We believe in safety which is why ThreadX is the most pre-certified RTOS including conformance to international safety standards such as IEC 61508 SIL 4 IEC 62304 Class C ISO 26262 ASIL D ULIEC 60730 ULIEC 60335 UL 1998 and EN 50128 SW-SIL 4 ThreadX is also MISRA-C2004 and MISRA C2014 Compliant

All of these attributes are why ThreadX is arguably the most deployed commercial RTOS with over 54 Billion deployments worldwide Please explore further at wwwrtoscom

Express Logic11423 West Bernardo Court San Diego CA 92127Tel 8586136640

wwwexpresslogiccom

14 | RTC Magazine MAY 2016

July 18-20 2016San Jose Convention CenterThe Heart of Silicon Valley

wwwWearablesTechConcom

More than 60 Tech Sessions and Panelsbull Product Design bull Embedded System Development

bull Software Design bull Application Development

bull Leading SDKs bull Electronic Engineering for

Wearables Devices

and more tricks and techniques that will set your wearable project apart

Learn how to design build and develop apps for the wearable technology revolution at Wearables TechCon 2016

PLUS

ldquoThis is an excellent conference to attend to get an understanding from both a business and technicalsense of Wearables and IOTrdquo

mdashKevin Jones Electrical Engineer Dept of Defense

A BZ Media Event

Register Earlyand SAVE

All-Access PassONLY $695

Register before May 13 2016

Expo-Only Pass$25

Come to the Largest Wearable-IoT OEM Expo of 2016Go under the hood of the hottest wearable devices

Wearables_RTC_Layout 1 4816 201 PM Page 1

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

8 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Fundamental features like fast context switching and real-time determinism will continue to be key features for RTOSrsquos as connected thingssystems evolve More devices will be collecting or generating data than ever before of course safety and security will play an increasingly important role as more safety-critical and sensitive data is transferred between devices

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

We believe Cloud and Fog computing will coexist Informa-tion captured or generated by the burgeoning number of things on the IOT will be a mixture of non-sensitive sensitive and safe-ty-critical data flowing across both the cloud and fog platforms The growing need for data to be collected or generated instantly requires high performance features RTOSrsquos will need to provide safe secure and reliable IoT communication solutions with minimal memorypower requirements

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

As mentioned earlier we believe Cloud and Fog computing will coexist The IOT is connecting devices that will provide information for lsquointelligentrsquo interpretation allowing systems and people to make decisions quicker and hopefully better We

ldquoThe growing need for data to be collected or generated instantly requires high per-formance featuresrdquo

Name Bill Lamie

Title President

Company Express Logic San Diego CA wwwrtoscom

William E Lamie is co-founder and CEO of Express Logic Inc located in San Diego CA Mr Lamie is the author of the ThreadX RTOS Prior to founding Express Logic Mr Lamie was the author of the Nucleus RTOS and co-founded Ac-celerated Technology Inc Mr Lamie has over 35 years of experience in embedded systems devel-opment 30 years of which is in the development of commercial real-time operating systems For information on Express Logic please visit wwwexpresslogiccom

are already seeing how wearable medical devices are providing real-time information that helps people avoid behaviors that might trigger adverse medical conditions As these devices become more integrated into larger diagnostic and treatment systems we see the need for safe secure and reliable real-time operating systems and middleware solutions expanding into new devices to address real-time capabilities and current devic-es that will be lsquosmarterrsquo

RTC Magazine MAY 2016 | 9

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Embedded operating systemsrsquo greatest need currently are securi-ty features that can scale to any processor size This is challenging especially on small microcontrollers but required by emerging security requirements Achieving secure boot secure firmware upgrades authentication authorization etc simply requires more hardware resources than are available on small microcontrollers As we reach the limits of Moorersquos law the next processor architec-ture step is to move to multiple cores Given the emerging security requirements symmetrical multiprocessing will become a necessi-ty for embedded operating systems

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

A move to fog computing would require the same security and processing performance enhancements outlined above as well as new mandatory requirements for improved connectivity From Mi-criumrsquos point of view we are already seeing a need for an embedded operating system (in our case an RTOS) to enable scaling from small microcontrollers to large application processors A system is com-posed of many components so having an operating system than can span the complete product architecture offers great economy of scale This aligns perfectly to the architecture proposed by fog computing

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

ldquoClearly embedded oper-ating systems offer many advantages in terms of size and performancerdquo

IoT is the sum of sensorsactuators microcontrollersmicroproces-sors wiredwireless connectivity multiple programming languag-es information technologies and operation technologies not to mention interoperability standards Much advancement in all of these technologies is required to enhance security performance artifi-cial intelligence and fog computing Clearly embedded operating systems offer many advantages in terms of size and performance over other operating systems so will have a significant role in the IoT That being said the main challenge today is one of cost Although the IoT can clearly be a business enabler full-scale IoT penetration can only happen with more economy of scale in a large number of fields

Name Christian Leacutegareacute

Title Chief Technology Officer

Company Micrium Weston FL wwwmicriumcom

Christian Leacutegareacute is EVP and CTO of Micrium a leading provider of embedded software Prior to Micrium he led the Internet Protocol certifi-cation program at the International Institute of Telecom in Montreal Canada During his 22 years in the telecom industry Christian served as an executive in large-scale organizations as well as start-ups mainly in engineering and RampD Christian currently also serves as president and chairman of the IPSO Alliance where he provides guidance on embedded systems to help make the IoT a reality Christian holds a MS in Electrical Engineering from the University of Sherbrooke Quebec Canada

10 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

At the very basic level any device participating in a connected system will need a robust connectivity solution and good enough security to protect it But that does not give you any benefits un-less you have figured out ldquohow to connectrdquo ldquowho to connectrdquo and most important ldquowhy should you connectrdquo

The OS should be able to seamlessly manage multi-element connectivity It should provide a framework to cache command signals or data streams should the device go off-line in a pre-planned manner or suddenly drop connection A robust OS will have a device-side management agent embedded inside to take care of exchanging credentials with unique identifiers with a device management cloud service The OS also needs to provide a framework for easy ldquoover the airrdquo maintenance upgrade and most important the ability to roll-back any updates should something go wrong Finally the OS should provide open standards based APIs to manage everything we discussed

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having every-thing done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

While the concept of ldquofog computingrdquo is not new it has gained lot of attention recently The business needs to collect as much data as possible and the need to optimize the cost of transporting this data has to be appropriately balanced Enter ldquofog computingrdquo It does not replace cloud computing it just creates one layer of lo-calized hierarchy for better management of systems This localized layer has an advantage of higher connectivity bandwidth at lower cost localize storage and assurance that data is not leaving a highly secure perimeter On the flip side fog computersquos storage and CPU bandwidth is more expensive than cloud infrastructure For some industries fog computing solves lot of technical and cost issues

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

In my opinion there is no one utopian vision for future of devices and their embedded OSs in IoT no one element of the

Name Dinyar Dastoor

Title Vice President and General Manager Operating Systems Platform

Company Wind River Alameda CA wwwwindrivercom

Dinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and security He has nearly 30 years of embedded de-vice industry experience holding various senior executive positions managing product manage-ment engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officefocusing on computer architecture and design

network will dominate Instead each element will play a key role in the larger system of systems and this role will constantly evolve as new use cases and innovation happens Yes devices will become ldquosmarterrdquo because they can analyze things in real-time and at the same time become ldquodumberrdquo as more decisions will be made somewhere in the network OSs will evolve to be flexible to fit such cases The cloud will move towards providing cheaper storage and compute networks will continue to boost performance and devic-es at the edge will continue to find new applications The sum total of this will lead to new use cases which we have not imagined yet

AN INTEL COMPANY

trade

Learn more at wwwsupermicrocomembeddedcopy Super Micro Computer Inc Speci cations subject to change without notice

Intel the Intel logo Intel Core Intel Quark Xeon and Xeon Inside are trademarks or registered trademarks of Intel Corporation in the US andor other countriesAll other brands and names are the property of their respective owners

SYS-5018A-FTN4 (Front IO)

SYS-5018A-AR12L

E100-8Q SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4

bull Low Power Intelreg Quarktrade Intelreg Coretrade processor family and High Performance Intelreg Xeonreg processors

bull Standard Form Factor and High Performance Motherboardsbull Optimized Short-Depth Industrial Rackmount Platformsbull Energy Efficient Titanium - Gold Level Power Suppliesbull Fully Optimized SuperServers Ready to Deploy Solutionsbull Remote Management by IPMI or Intelreg AMTbull Worldwide Service with Extended Product Life Cycle Supportbull Optimized for Embedded Applications

IoT Gateway Solutions

Network Security Appliances

Cold Storage

Compact Embedded Server Appliance

High Performance IPC Solution

SYS-6018R-TD (Rear IO)SYS-5028A-TN4

EmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT Solutions

Long Life Cycle middot High-E ciency middot Compact Form Factor middot High Performance middot Global Services middot IoT

Connecting the Intelligent World from Devices to the Cloud

SYS-6018R-TD (Rear IO)

SC946ED (shown)SC846S

Front and Rear Views

4U Top-Loading 60-Bay Server and 90-Bay Dual Expander JBODs

SYS-5018A-AR12L SC946ED SC846S

Front and Rear Views

SC946ED SC846S

Front and Rear ViewsFront and Rear ViewsFront and Rear ViewsFront and Rear Views

SM_USP_150224_X10_RTC_TwinPro_CeBitindd 1 1222015 34409 PM

2016

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

12 | RTC Magazine MAY 2016

2016

RTC Magazine MAY 2016 | 13

2016 RTC Software Survey QuestionnaireFlagship Embedded OS eT-Kernel

Type of embedded OS Real-Time Operating System (RTOS)

Description The eT-Kernel RTOS is designed for embedded systems that require high performance and reliability eT-Kernel is based on the open TRON architecture which is the most widely adopted in embedded systems in Japan and Asian countries eT-Kernel is scalable with multiple profiles to fit any system size and purpose These profiles include POSIX-compliant eT-KernelPOSIX enhanced eT-KernelExtended supporting memory protection and process model and basic eT-KernelCompact eT-Kernel Multi-Core Edition is available for multi-core processors featuring its unique Blended Schedulingreg that enables the coexistence of both symmetrical (SMP) and asymmetrical (AMP) multi-core processing in a single system eT-Kernel has proved its value in a wide range of embedded systems such as car navigation systems aerospace consumer electronics and more

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core)

Board support package Yes No

Source code availability Yes No

RAM memory requirements The total RAM storage depends on multipleparameters as the OS allows build-timeoptimization of OS resources based on the OSconfiguration Minimum required is 54KB with a maximum of 88KB

Minimum storage requirements 230KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFI The OS includes self-contained boot loader It can alsobe adapted to any external boot loading mechanism

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Thread Tracing JTAG and eSOLrsquos Eclipse-based eBinder IDE

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Installation to C drive 80GB or above Installation to other drive 50GB or above bull OS - Microsoft Windows 7 Ultimate ServicePack 1 or later bull Microsoft Windows 7 Professional Service Pack 1 or later bull Microsoft Windows Vista Service Pack 2 or later (only 32bit version)

RTOSOS product support lifecycle We provide renewable annual support and maintenance When a new revision is released the previous revision will be supported for 18 months Upon request we also provide long-term support and maintenance up to 10 years or more

eT-Kernel is a core part of the eT-Kernel Platform that integrates the eBinder IDE middleware components ndash including network protocols file systems USB hostdevice stacks and graphics tools ndash and professional services eT-Kernel Platform helps OEMs and ODMs to quickly create flexible development platforms for their software product lines and enables them to improve time to market cost productivity quality and other business drivers

eSOL Co LtdHarmony Tower 1-32-2 Honcho Nakano-ku Tokyo Japan 164-8721Tel +81 3 5302 1360

wwwesolcom

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS ThreadX

Type of embedded OS Real-Time Operating System (RTOS)

Description ThreadX is Express Logicrsquos advanced Real-Time Operating System (RTOS) designed specifically for deeply embedded IoT applications ThreadX provides advanced scheduling facilities message passing interrupt management and messaging services as well as many others ThreadX has many advanced features including its picokerneltrade architecture preemption-thresholdtrade scheduling event-chainingtrade and a rich set of system services Combined with its superior ease-of-use ThreadX is the ideal choice for the most demanding of embedded IoT applications According to VDC Research ThreadX has been deployed in over over 54 billion electronic products in the areas of consumer devices medical electronics industrial control equipment and space probes including NASArsquos Deep Impact and the Mars Reconnaissance Orbiter (MRO)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other ThreadX has support for most popular processors

Board support package Yes No

Source code availability Yes No

RAM memory requirements ThreadX automatically scales based on usageie no complicated compile-time configurationis necessary

Minimum storage requirements 2KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader ThreadX is agnostic in terms of bootloader ie any bootloader can be used

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license We work closely with IAR in terms of integration and customer engagements and support most popular development tools for all processor architectures

language support C and C

Debugger tools Eclipse JTAG Thread Tracing and TraceX is our host-based system event analysis tool

Built-in cloud API services Yes Express Logic is the only ARM mbed RTOS partnermeaning that mbed Client is available for the ThreadX developers to leverage in their designs In additionThreadX and NetX are the foundation for various IoT SoCs including Avago Technologiesrsquo WICED and GainSpanrsquos WiFi chips and modules

Cloud Service Providers Oracle Cloud Services Google Cloud Platform Amazon Web Services Microsoft Azure

Development host machine requirements NA

RTOSOS product support lifecycle Phonewebe-mail support channels with current product releases on web and automatic customer notifications of new service packs and new releases

We believe in simplicity which manifests in our elegant API and documentation We believe in small size and fast deterministic performance We believe in safety which is why ThreadX is the most pre-certified RTOS including conformance to international safety standards such as IEC 61508 SIL 4 IEC 62304 Class C ISO 26262 ASIL D ULIEC 60730 ULIEC 60335 UL 1998 and EN 50128 SW-SIL 4 ThreadX is also MISRA-C2004 and MISRA C2014 Compliant

All of these attributes are why ThreadX is arguably the most deployed commercial RTOS with over 54 Billion deployments worldwide Please explore further at wwwrtoscom

Express Logic11423 West Bernardo Court San Diego CA 92127Tel 8586136640

wwwexpresslogiccom

14 | RTC Magazine MAY 2016

July 18-20 2016San Jose Convention CenterThe Heart of Silicon Valley

wwwWearablesTechConcom

More than 60 Tech Sessions and Panelsbull Product Design bull Embedded System Development

bull Software Design bull Application Development

bull Leading SDKs bull Electronic Engineering for

Wearables Devices

and more tricks and techniques that will set your wearable project apart

Learn how to design build and develop apps for the wearable technology revolution at Wearables TechCon 2016

PLUS

ldquoThis is an excellent conference to attend to get an understanding from both a business and technicalsense of Wearables and IOTrdquo

mdashKevin Jones Electrical Engineer Dept of Defense

A BZ Media Event

Register Earlyand SAVE

All-Access PassONLY $695

Register before May 13 2016

Expo-Only Pass$25

Come to the Largest Wearable-IoT OEM Expo of 2016Go under the hood of the hottest wearable devices

Wearables_RTC_Layout 1 4816 201 PM Page 1

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

RTC Magazine MAY 2016 | 9

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

Embedded operating systemsrsquo greatest need currently are securi-ty features that can scale to any processor size This is challenging especially on small microcontrollers but required by emerging security requirements Achieving secure boot secure firmware upgrades authentication authorization etc simply requires more hardware resources than are available on small microcontrollers As we reach the limits of Moorersquos law the next processor architec-ture step is to move to multiple cores Given the emerging security requirements symmetrical multiprocessing will become a necessi-ty for embedded operating systems

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having everything done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

A move to fog computing would require the same security and processing performance enhancements outlined above as well as new mandatory requirements for improved connectivity From Mi-criumrsquos point of view we are already seeing a need for an embedded operating system (in our case an RTOS) to enable scaling from small microcontrollers to large application processors A system is com-posed of many components so having an operating system than can span the complete product architecture offers great economy of scale This aligns perfectly to the architecture proposed by fog computing

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

ldquoClearly embedded oper-ating systems offer many advantages in terms of size and performancerdquo

IoT is the sum of sensorsactuators microcontrollersmicroproces-sors wiredwireless connectivity multiple programming languag-es information technologies and operation technologies not to mention interoperability standards Much advancement in all of these technologies is required to enhance security performance artifi-cial intelligence and fog computing Clearly embedded operating systems offer many advantages in terms of size and performance over other operating systems so will have a significant role in the IoT That being said the main challenge today is one of cost Although the IoT can clearly be a business enabler full-scale IoT penetration can only happen with more economy of scale in a large number of fields

Name Christian Leacutegareacute

Title Chief Technology Officer

Company Micrium Weston FL wwwmicriumcom

Christian Leacutegareacute is EVP and CTO of Micrium a leading provider of embedded software Prior to Micrium he led the Internet Protocol certifi-cation program at the International Institute of Telecom in Montreal Canada During his 22 years in the telecom industry Christian served as an executive in large-scale organizations as well as start-ups mainly in engineering and RampD Christian currently also serves as president and chairman of the IPSO Alliance where he provides guidance on embedded systems to help make the IoT a reality Christian holds a MS in Electrical Engineering from the University of Sherbrooke Quebec Canada

10 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

At the very basic level any device participating in a connected system will need a robust connectivity solution and good enough security to protect it But that does not give you any benefits un-less you have figured out ldquohow to connectrdquo ldquowho to connectrdquo and most important ldquowhy should you connectrdquo

The OS should be able to seamlessly manage multi-element connectivity It should provide a framework to cache command signals or data streams should the device go off-line in a pre-planned manner or suddenly drop connection A robust OS will have a device-side management agent embedded inside to take care of exchanging credentials with unique identifiers with a device management cloud service The OS also needs to provide a framework for easy ldquoover the airrdquo maintenance upgrade and most important the ability to roll-back any updates should something go wrong Finally the OS should provide open standards based APIs to manage everything we discussed

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having every-thing done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

While the concept of ldquofog computingrdquo is not new it has gained lot of attention recently The business needs to collect as much data as possible and the need to optimize the cost of transporting this data has to be appropriately balanced Enter ldquofog computingrdquo It does not replace cloud computing it just creates one layer of lo-calized hierarchy for better management of systems This localized layer has an advantage of higher connectivity bandwidth at lower cost localize storage and assurance that data is not leaving a highly secure perimeter On the flip side fog computersquos storage and CPU bandwidth is more expensive than cloud infrastructure For some industries fog computing solves lot of technical and cost issues

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

In my opinion there is no one utopian vision for future of devices and their embedded OSs in IoT no one element of the

Name Dinyar Dastoor

Title Vice President and General Manager Operating Systems Platform

Company Wind River Alameda CA wwwwindrivercom

Dinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and security He has nearly 30 years of embedded de-vice industry experience holding various senior executive positions managing product manage-ment engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officefocusing on computer architecture and design

network will dominate Instead each element will play a key role in the larger system of systems and this role will constantly evolve as new use cases and innovation happens Yes devices will become ldquosmarterrdquo because they can analyze things in real-time and at the same time become ldquodumberrdquo as more decisions will be made somewhere in the network OSs will evolve to be flexible to fit such cases The cloud will move towards providing cheaper storage and compute networks will continue to boost performance and devic-es at the edge will continue to find new applications The sum total of this will lead to new use cases which we have not imagined yet

AN INTEL COMPANY

trade

Learn more at wwwsupermicrocomembeddedcopy Super Micro Computer Inc Speci cations subject to change without notice

Intel the Intel logo Intel Core Intel Quark Xeon and Xeon Inside are trademarks or registered trademarks of Intel Corporation in the US andor other countriesAll other brands and names are the property of their respective owners

SYS-5018A-FTN4 (Front IO)

SYS-5018A-AR12L

E100-8Q SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4

bull Low Power Intelreg Quarktrade Intelreg Coretrade processor family and High Performance Intelreg Xeonreg processors

bull Standard Form Factor and High Performance Motherboardsbull Optimized Short-Depth Industrial Rackmount Platformsbull Energy Efficient Titanium - Gold Level Power Suppliesbull Fully Optimized SuperServers Ready to Deploy Solutionsbull Remote Management by IPMI or Intelreg AMTbull Worldwide Service with Extended Product Life Cycle Supportbull Optimized for Embedded Applications

IoT Gateway Solutions

Network Security Appliances

Cold Storage

Compact Embedded Server Appliance

High Performance IPC Solution

SYS-6018R-TD (Rear IO)SYS-5028A-TN4

EmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT Solutions

Long Life Cycle middot High-E ciency middot Compact Form Factor middot High Performance middot Global Services middot IoT

Connecting the Intelligent World from Devices to the Cloud

SYS-6018R-TD (Rear IO)

SC946ED (shown)SC846S

Front and Rear Views

4U Top-Loading 60-Bay Server and 90-Bay Dual Expander JBODs

SYS-5018A-AR12L SC946ED SC846S

Front and Rear Views

SC946ED SC846S

Front and Rear ViewsFront and Rear ViewsFront and Rear ViewsFront and Rear Views

SM_USP_150224_X10_RTC_TwinPro_CeBitindd 1 1222015 34409 PM

2016

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

12 | RTC Magazine MAY 2016

2016

RTC Magazine MAY 2016 | 13

2016 RTC Software Survey QuestionnaireFlagship Embedded OS eT-Kernel

Type of embedded OS Real-Time Operating System (RTOS)

Description The eT-Kernel RTOS is designed for embedded systems that require high performance and reliability eT-Kernel is based on the open TRON architecture which is the most widely adopted in embedded systems in Japan and Asian countries eT-Kernel is scalable with multiple profiles to fit any system size and purpose These profiles include POSIX-compliant eT-KernelPOSIX enhanced eT-KernelExtended supporting memory protection and process model and basic eT-KernelCompact eT-Kernel Multi-Core Edition is available for multi-core processors featuring its unique Blended Schedulingreg that enables the coexistence of both symmetrical (SMP) and asymmetrical (AMP) multi-core processing in a single system eT-Kernel has proved its value in a wide range of embedded systems such as car navigation systems aerospace consumer electronics and more

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core)

Board support package Yes No

Source code availability Yes No

RAM memory requirements The total RAM storage depends on multipleparameters as the OS allows build-timeoptimization of OS resources based on the OSconfiguration Minimum required is 54KB with a maximum of 88KB

Minimum storage requirements 230KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFI The OS includes self-contained boot loader It can alsobe adapted to any external boot loading mechanism

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Thread Tracing JTAG and eSOLrsquos Eclipse-based eBinder IDE

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Installation to C drive 80GB or above Installation to other drive 50GB or above bull OS - Microsoft Windows 7 Ultimate ServicePack 1 or later bull Microsoft Windows 7 Professional Service Pack 1 or later bull Microsoft Windows Vista Service Pack 2 or later (only 32bit version)

RTOSOS product support lifecycle We provide renewable annual support and maintenance When a new revision is released the previous revision will be supported for 18 months Upon request we also provide long-term support and maintenance up to 10 years or more

eT-Kernel is a core part of the eT-Kernel Platform that integrates the eBinder IDE middleware components ndash including network protocols file systems USB hostdevice stacks and graphics tools ndash and professional services eT-Kernel Platform helps OEMs and ODMs to quickly create flexible development platforms for their software product lines and enables them to improve time to market cost productivity quality and other business drivers

eSOL Co LtdHarmony Tower 1-32-2 Honcho Nakano-ku Tokyo Japan 164-8721Tel +81 3 5302 1360

wwwesolcom

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS ThreadX

Type of embedded OS Real-Time Operating System (RTOS)

Description ThreadX is Express Logicrsquos advanced Real-Time Operating System (RTOS) designed specifically for deeply embedded IoT applications ThreadX provides advanced scheduling facilities message passing interrupt management and messaging services as well as many others ThreadX has many advanced features including its picokerneltrade architecture preemption-thresholdtrade scheduling event-chainingtrade and a rich set of system services Combined with its superior ease-of-use ThreadX is the ideal choice for the most demanding of embedded IoT applications According to VDC Research ThreadX has been deployed in over over 54 billion electronic products in the areas of consumer devices medical electronics industrial control equipment and space probes including NASArsquos Deep Impact and the Mars Reconnaissance Orbiter (MRO)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other ThreadX has support for most popular processors

Board support package Yes No

Source code availability Yes No

RAM memory requirements ThreadX automatically scales based on usageie no complicated compile-time configurationis necessary

Minimum storage requirements 2KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader ThreadX is agnostic in terms of bootloader ie any bootloader can be used

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license We work closely with IAR in terms of integration and customer engagements and support most popular development tools for all processor architectures

language support C and C

Debugger tools Eclipse JTAG Thread Tracing and TraceX is our host-based system event analysis tool

Built-in cloud API services Yes Express Logic is the only ARM mbed RTOS partnermeaning that mbed Client is available for the ThreadX developers to leverage in their designs In additionThreadX and NetX are the foundation for various IoT SoCs including Avago Technologiesrsquo WICED and GainSpanrsquos WiFi chips and modules

Cloud Service Providers Oracle Cloud Services Google Cloud Platform Amazon Web Services Microsoft Azure

Development host machine requirements NA

RTOSOS product support lifecycle Phonewebe-mail support channels with current product releases on web and automatic customer notifications of new service packs and new releases

We believe in simplicity which manifests in our elegant API and documentation We believe in small size and fast deterministic performance We believe in safety which is why ThreadX is the most pre-certified RTOS including conformance to international safety standards such as IEC 61508 SIL 4 IEC 62304 Class C ISO 26262 ASIL D ULIEC 60730 ULIEC 60335 UL 1998 and EN 50128 SW-SIL 4 ThreadX is also MISRA-C2004 and MISRA C2014 Compliant

All of these attributes are why ThreadX is arguably the most deployed commercial RTOS with over 54 Billion deployments worldwide Please explore further at wwwrtoscom

Express Logic11423 West Bernardo Court San Diego CA 92127Tel 8586136640

wwwexpresslogiccom

14 | RTC Magazine MAY 2016

July 18-20 2016San Jose Convention CenterThe Heart of Silicon Valley

wwwWearablesTechConcom

More than 60 Tech Sessions and Panelsbull Product Design bull Embedded System Development

bull Software Design bull Application Development

bull Leading SDKs bull Electronic Engineering for

Wearables Devices

and more tricks and techniques that will set your wearable project apart

Learn how to design build and develop apps for the wearable technology revolution at Wearables TechCon 2016

PLUS

ldquoThis is an excellent conference to attend to get an understanding from both a business and technicalsense of Wearables and IOTrdquo

mdashKevin Jones Electrical Engineer Dept of Defense

A BZ Media Event

Register Earlyand SAVE

All-Access PassONLY $695

Register before May 13 2016

Expo-Only Pass$25

Come to the Largest Wearable-IoT OEM Expo of 2016Go under the hood of the hottest wearable devices

Wearables_RTC_Layout 1 4816 201 PM Page 1

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

10 | RTC Magazine MAY 2016

10 ROUND TABLE WHAT WILL THE FUTURE HOLD

1 To address the needs of connected systems vechicle-2-vechicle drone control AI and M2M what features do you think should be included in future Embedded Operating Systems

At the very basic level any device participating in a connected system will need a robust connectivity solution and good enough security to protect it But that does not give you any benefits un-less you have figured out ldquohow to connectrdquo ldquowho to connectrdquo and most important ldquowhy should you connectrdquo

The OS should be able to seamlessly manage multi-element connectivity It should provide a framework to cache command signals or data streams should the device go off-line in a pre-planned manner or suddenly drop connection A robust OS will have a device-side management agent embedded inside to take care of exchanging credentials with unique identifiers with a device management cloud service The OS also needs to provide a framework for easy ldquoover the airrdquo maintenance upgrade and most important the ability to roll-back any updates should something go wrong Finally the OS should provide open standards based APIs to manage everything we discussed

2 Recently there are discussions on moving Cloud Computing to Fog Computing Instead of having every-thing done by the ldquoCloudrdquo more and more computing and storage will be shared by the localregional edge devices What are your thoughts on this and how would this affect the future Embedded Operating Systems

While the concept of ldquofog computingrdquo is not new it has gained lot of attention recently The business needs to collect as much data as possible and the need to optimize the cost of transporting this data has to be appropriately balanced Enter ldquofog computingrdquo It does not replace cloud computing it just creates one layer of lo-calized hierarchy for better management of systems This localized layer has an advantage of higher connectivity bandwidth at lower cost localize storage and assurance that data is not leaving a highly secure perimeter On the flip side fog computersquos storage and CPU bandwidth is more expensive than cloud infrastructure For some industries fog computing solves lot of technical and cost issues

3 I would like to explore with you what the future will be like in relation to IoT and Embedded Operating Systems For example do you believe Cloud will dominate sensor become smarter (with more local computing power) andor connected devices will have deep learning capability (Artificial Intelligence)

In my opinion there is no one utopian vision for future of devices and their embedded OSs in IoT no one element of the

Name Dinyar Dastoor

Title Vice President and General Manager Operating Systems Platform

Company Wind River Alameda CA wwwwindrivercom

Dinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and security He has nearly 30 years of embedded de-vice industry experience holding various senior executive positions managing product manage-ment engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officefocusing on computer architecture and design

network will dominate Instead each element will play a key role in the larger system of systems and this role will constantly evolve as new use cases and innovation happens Yes devices will become ldquosmarterrdquo because they can analyze things in real-time and at the same time become ldquodumberrdquo as more decisions will be made somewhere in the network OSs will evolve to be flexible to fit such cases The cloud will move towards providing cheaper storage and compute networks will continue to boost performance and devic-es at the edge will continue to find new applications The sum total of this will lead to new use cases which we have not imagined yet

AN INTEL COMPANY

trade

Learn more at wwwsupermicrocomembeddedcopy Super Micro Computer Inc Speci cations subject to change without notice

Intel the Intel logo Intel Core Intel Quark Xeon and Xeon Inside are trademarks or registered trademarks of Intel Corporation in the US andor other countriesAll other brands and names are the property of their respective owners

SYS-5018A-FTN4 (Front IO)

SYS-5018A-AR12L

E100-8Q SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4

bull Low Power Intelreg Quarktrade Intelreg Coretrade processor family and High Performance Intelreg Xeonreg processors

bull Standard Form Factor and High Performance Motherboardsbull Optimized Short-Depth Industrial Rackmount Platformsbull Energy Efficient Titanium - Gold Level Power Suppliesbull Fully Optimized SuperServers Ready to Deploy Solutionsbull Remote Management by IPMI or Intelreg AMTbull Worldwide Service with Extended Product Life Cycle Supportbull Optimized for Embedded Applications

IoT Gateway Solutions

Network Security Appliances

Cold Storage

Compact Embedded Server Appliance

High Performance IPC Solution

SYS-6018R-TD (Rear IO)SYS-5028A-TN4

EmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT Solutions

Long Life Cycle middot High-E ciency middot Compact Form Factor middot High Performance middot Global Services middot IoT

Connecting the Intelligent World from Devices to the Cloud

SYS-6018R-TD (Rear IO)

SC946ED (shown)SC846S

Front and Rear Views

4U Top-Loading 60-Bay Server and 90-Bay Dual Expander JBODs

SYS-5018A-AR12L SC946ED SC846S

Front and Rear Views

SC946ED SC846S

Front and Rear ViewsFront and Rear ViewsFront and Rear ViewsFront and Rear Views

SM_USP_150224_X10_RTC_TwinPro_CeBitindd 1 1222015 34409 PM

2016

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

12 | RTC Magazine MAY 2016

2016

RTC Magazine MAY 2016 | 13

2016 RTC Software Survey QuestionnaireFlagship Embedded OS eT-Kernel

Type of embedded OS Real-Time Operating System (RTOS)

Description The eT-Kernel RTOS is designed for embedded systems that require high performance and reliability eT-Kernel is based on the open TRON architecture which is the most widely adopted in embedded systems in Japan and Asian countries eT-Kernel is scalable with multiple profiles to fit any system size and purpose These profiles include POSIX-compliant eT-KernelPOSIX enhanced eT-KernelExtended supporting memory protection and process model and basic eT-KernelCompact eT-Kernel Multi-Core Edition is available for multi-core processors featuring its unique Blended Schedulingreg that enables the coexistence of both symmetrical (SMP) and asymmetrical (AMP) multi-core processing in a single system eT-Kernel has proved its value in a wide range of embedded systems such as car navigation systems aerospace consumer electronics and more

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core)

Board support package Yes No

Source code availability Yes No

RAM memory requirements The total RAM storage depends on multipleparameters as the OS allows build-timeoptimization of OS resources based on the OSconfiguration Minimum required is 54KB with a maximum of 88KB

Minimum storage requirements 230KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFI The OS includes self-contained boot loader It can alsobe adapted to any external boot loading mechanism

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Thread Tracing JTAG and eSOLrsquos Eclipse-based eBinder IDE

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Installation to C drive 80GB or above Installation to other drive 50GB or above bull OS - Microsoft Windows 7 Ultimate ServicePack 1 or later bull Microsoft Windows 7 Professional Service Pack 1 or later bull Microsoft Windows Vista Service Pack 2 or later (only 32bit version)

RTOSOS product support lifecycle We provide renewable annual support and maintenance When a new revision is released the previous revision will be supported for 18 months Upon request we also provide long-term support and maintenance up to 10 years or more

eT-Kernel is a core part of the eT-Kernel Platform that integrates the eBinder IDE middleware components ndash including network protocols file systems USB hostdevice stacks and graphics tools ndash and professional services eT-Kernel Platform helps OEMs and ODMs to quickly create flexible development platforms for their software product lines and enables them to improve time to market cost productivity quality and other business drivers

eSOL Co LtdHarmony Tower 1-32-2 Honcho Nakano-ku Tokyo Japan 164-8721Tel +81 3 5302 1360

wwwesolcom

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS ThreadX

Type of embedded OS Real-Time Operating System (RTOS)

Description ThreadX is Express Logicrsquos advanced Real-Time Operating System (RTOS) designed specifically for deeply embedded IoT applications ThreadX provides advanced scheduling facilities message passing interrupt management and messaging services as well as many others ThreadX has many advanced features including its picokerneltrade architecture preemption-thresholdtrade scheduling event-chainingtrade and a rich set of system services Combined with its superior ease-of-use ThreadX is the ideal choice for the most demanding of embedded IoT applications According to VDC Research ThreadX has been deployed in over over 54 billion electronic products in the areas of consumer devices medical electronics industrial control equipment and space probes including NASArsquos Deep Impact and the Mars Reconnaissance Orbiter (MRO)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other ThreadX has support for most popular processors

Board support package Yes No

Source code availability Yes No

RAM memory requirements ThreadX automatically scales based on usageie no complicated compile-time configurationis necessary

Minimum storage requirements 2KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader ThreadX is agnostic in terms of bootloader ie any bootloader can be used

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license We work closely with IAR in terms of integration and customer engagements and support most popular development tools for all processor architectures

language support C and C

Debugger tools Eclipse JTAG Thread Tracing and TraceX is our host-based system event analysis tool

Built-in cloud API services Yes Express Logic is the only ARM mbed RTOS partnermeaning that mbed Client is available for the ThreadX developers to leverage in their designs In additionThreadX and NetX are the foundation for various IoT SoCs including Avago Technologiesrsquo WICED and GainSpanrsquos WiFi chips and modules

Cloud Service Providers Oracle Cloud Services Google Cloud Platform Amazon Web Services Microsoft Azure

Development host machine requirements NA

RTOSOS product support lifecycle Phonewebe-mail support channels with current product releases on web and automatic customer notifications of new service packs and new releases

We believe in simplicity which manifests in our elegant API and documentation We believe in small size and fast deterministic performance We believe in safety which is why ThreadX is the most pre-certified RTOS including conformance to international safety standards such as IEC 61508 SIL 4 IEC 62304 Class C ISO 26262 ASIL D ULIEC 60730 ULIEC 60335 UL 1998 and EN 50128 SW-SIL 4 ThreadX is also MISRA-C2004 and MISRA C2014 Compliant

All of these attributes are why ThreadX is arguably the most deployed commercial RTOS with over 54 Billion deployments worldwide Please explore further at wwwrtoscom

Express Logic11423 West Bernardo Court San Diego CA 92127Tel 8586136640

wwwexpresslogiccom

14 | RTC Magazine MAY 2016

July 18-20 2016San Jose Convention CenterThe Heart of Silicon Valley

wwwWearablesTechConcom

More than 60 Tech Sessions and Panelsbull Product Design bull Embedded System Development

bull Software Design bull Application Development

bull Leading SDKs bull Electronic Engineering for

Wearables Devices

and more tricks and techniques that will set your wearable project apart

Learn how to design build and develop apps for the wearable technology revolution at Wearables TechCon 2016

PLUS

ldquoThis is an excellent conference to attend to get an understanding from both a business and technicalsense of Wearables and IOTrdquo

mdashKevin Jones Electrical Engineer Dept of Defense

A BZ Media Event

Register Earlyand SAVE

All-Access PassONLY $695

Register before May 13 2016

Expo-Only Pass$25

Come to the Largest Wearable-IoT OEM Expo of 2016Go under the hood of the hottest wearable devices

Wearables_RTC_Layout 1 4816 201 PM Page 1

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

Learn more at wwwsupermicrocomembeddedcopy Super Micro Computer Inc Speci cations subject to change without notice

Intel the Intel logo Intel Core Intel Quark Xeon and Xeon Inside are trademarks or registered trademarks of Intel Corporation in the US andor other countriesAll other brands and names are the property of their respective owners

SYS-5018A-FTN4 (Front IO)

SYS-5018A-AR12L

E100-8Q SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4 (Front IO) SYS-5018A-FTN4

bull Low Power Intelreg Quarktrade Intelreg Coretrade processor family and High Performance Intelreg Xeonreg processors

bull Standard Form Factor and High Performance Motherboardsbull Optimized Short-Depth Industrial Rackmount Platformsbull Energy Efficient Titanium - Gold Level Power Suppliesbull Fully Optimized SuperServers Ready to Deploy Solutionsbull Remote Management by IPMI or Intelreg AMTbull Worldwide Service with Extended Product Life Cycle Supportbull Optimized for Embedded Applications

IoT Gateway Solutions

Network Security Appliances

Cold Storage

Compact Embedded Server Appliance

High Performance IPC Solution

SYS-6018R-TD (Rear IO)SYS-5028A-TN4

EmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT SolutionsEmbeddedIoT Solutions

Long Life Cycle middot High-E ciency middot Compact Form Factor middot High Performance middot Global Services middot IoT

Connecting the Intelligent World from Devices to the Cloud

SYS-6018R-TD (Rear IO)

SC946ED (shown)SC846S

Front and Rear Views

4U Top-Loading 60-Bay Server and 90-Bay Dual Expander JBODs

SYS-5018A-AR12L SC946ED SC846S

Front and Rear Views

SC946ED SC846S

Front and Rear ViewsFront and Rear ViewsFront and Rear ViewsFront and Rear Views

SM_USP_150224_X10_RTC_TwinPro_CeBitindd 1 1222015 34409 PM

2016

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

12 | RTC Magazine MAY 2016

2016

RTC Magazine MAY 2016 | 13

2016 RTC Software Survey QuestionnaireFlagship Embedded OS eT-Kernel

Type of embedded OS Real-Time Operating System (RTOS)

Description The eT-Kernel RTOS is designed for embedded systems that require high performance and reliability eT-Kernel is based on the open TRON architecture which is the most widely adopted in embedded systems in Japan and Asian countries eT-Kernel is scalable with multiple profiles to fit any system size and purpose These profiles include POSIX-compliant eT-KernelPOSIX enhanced eT-KernelExtended supporting memory protection and process model and basic eT-KernelCompact eT-Kernel Multi-Core Edition is available for multi-core processors featuring its unique Blended Schedulingreg that enables the coexistence of both symmetrical (SMP) and asymmetrical (AMP) multi-core processing in a single system eT-Kernel has proved its value in a wide range of embedded systems such as car navigation systems aerospace consumer electronics and more

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core)

Board support package Yes No

Source code availability Yes No

RAM memory requirements The total RAM storage depends on multipleparameters as the OS allows build-timeoptimization of OS resources based on the OSconfiguration Minimum required is 54KB with a maximum of 88KB

Minimum storage requirements 230KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFI The OS includes self-contained boot loader It can alsobe adapted to any external boot loading mechanism

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Thread Tracing JTAG and eSOLrsquos Eclipse-based eBinder IDE

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Installation to C drive 80GB or above Installation to other drive 50GB or above bull OS - Microsoft Windows 7 Ultimate ServicePack 1 or later bull Microsoft Windows 7 Professional Service Pack 1 or later bull Microsoft Windows Vista Service Pack 2 or later (only 32bit version)

RTOSOS product support lifecycle We provide renewable annual support and maintenance When a new revision is released the previous revision will be supported for 18 months Upon request we also provide long-term support and maintenance up to 10 years or more

eT-Kernel is a core part of the eT-Kernel Platform that integrates the eBinder IDE middleware components ndash including network protocols file systems USB hostdevice stacks and graphics tools ndash and professional services eT-Kernel Platform helps OEMs and ODMs to quickly create flexible development platforms for their software product lines and enables them to improve time to market cost productivity quality and other business drivers

eSOL Co LtdHarmony Tower 1-32-2 Honcho Nakano-ku Tokyo Japan 164-8721Tel +81 3 5302 1360

wwwesolcom

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS ThreadX

Type of embedded OS Real-Time Operating System (RTOS)

Description ThreadX is Express Logicrsquos advanced Real-Time Operating System (RTOS) designed specifically for deeply embedded IoT applications ThreadX provides advanced scheduling facilities message passing interrupt management and messaging services as well as many others ThreadX has many advanced features including its picokerneltrade architecture preemption-thresholdtrade scheduling event-chainingtrade and a rich set of system services Combined with its superior ease-of-use ThreadX is the ideal choice for the most demanding of embedded IoT applications According to VDC Research ThreadX has been deployed in over over 54 billion electronic products in the areas of consumer devices medical electronics industrial control equipment and space probes including NASArsquos Deep Impact and the Mars Reconnaissance Orbiter (MRO)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other ThreadX has support for most popular processors

Board support package Yes No

Source code availability Yes No

RAM memory requirements ThreadX automatically scales based on usageie no complicated compile-time configurationis necessary

Minimum storage requirements 2KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader ThreadX is agnostic in terms of bootloader ie any bootloader can be used

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license We work closely with IAR in terms of integration and customer engagements and support most popular development tools for all processor architectures

language support C and C

Debugger tools Eclipse JTAG Thread Tracing and TraceX is our host-based system event analysis tool

Built-in cloud API services Yes Express Logic is the only ARM mbed RTOS partnermeaning that mbed Client is available for the ThreadX developers to leverage in their designs In additionThreadX and NetX are the foundation for various IoT SoCs including Avago Technologiesrsquo WICED and GainSpanrsquos WiFi chips and modules

Cloud Service Providers Oracle Cloud Services Google Cloud Platform Amazon Web Services Microsoft Azure

Development host machine requirements NA

RTOSOS product support lifecycle Phonewebe-mail support channels with current product releases on web and automatic customer notifications of new service packs and new releases

We believe in simplicity which manifests in our elegant API and documentation We believe in small size and fast deterministic performance We believe in safety which is why ThreadX is the most pre-certified RTOS including conformance to international safety standards such as IEC 61508 SIL 4 IEC 62304 Class C ISO 26262 ASIL D ULIEC 60730 ULIEC 60335 UL 1998 and EN 50128 SW-SIL 4 ThreadX is also MISRA-C2004 and MISRA C2014 Compliant

All of these attributes are why ThreadX is arguably the most deployed commercial RTOS with over 54 Billion deployments worldwide Please explore further at wwwrtoscom

Express Logic11423 West Bernardo Court San Diego CA 92127Tel 8586136640

wwwexpresslogiccom

14 | RTC Magazine MAY 2016

July 18-20 2016San Jose Convention CenterThe Heart of Silicon Valley

wwwWearablesTechConcom

More than 60 Tech Sessions and Panelsbull Product Design bull Embedded System Development

bull Software Design bull Application Development

bull Leading SDKs bull Electronic Engineering for

Wearables Devices

and more tricks and techniques that will set your wearable project apart

Learn how to design build and develop apps for the wearable technology revolution at Wearables TechCon 2016

PLUS

ldquoThis is an excellent conference to attend to get an understanding from both a business and technicalsense of Wearables and IOTrdquo

mdashKevin Jones Electrical Engineer Dept of Defense

A BZ Media Event

Register Earlyand SAVE

All-Access PassONLY $695

Register before May 13 2016

Expo-Only Pass$25

Come to the Largest Wearable-IoT OEM Expo of 2016Go under the hood of the hottest wearable devices

Wearables_RTC_Layout 1 4816 201 PM Page 1

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

2016

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

12 | RTC Magazine MAY 2016

2016

RTC Magazine MAY 2016 | 13

2016 RTC Software Survey QuestionnaireFlagship Embedded OS eT-Kernel

Type of embedded OS Real-Time Operating System (RTOS)

Description The eT-Kernel RTOS is designed for embedded systems that require high performance and reliability eT-Kernel is based on the open TRON architecture which is the most widely adopted in embedded systems in Japan and Asian countries eT-Kernel is scalable with multiple profiles to fit any system size and purpose These profiles include POSIX-compliant eT-KernelPOSIX enhanced eT-KernelExtended supporting memory protection and process model and basic eT-KernelCompact eT-Kernel Multi-Core Edition is available for multi-core processors featuring its unique Blended Schedulingreg that enables the coexistence of both symmetrical (SMP) and asymmetrical (AMP) multi-core processing in a single system eT-Kernel has proved its value in a wide range of embedded systems such as car navigation systems aerospace consumer electronics and more

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core)

Board support package Yes No

Source code availability Yes No

RAM memory requirements The total RAM storage depends on multipleparameters as the OS allows build-timeoptimization of OS resources based on the OSconfiguration Minimum required is 54KB with a maximum of 88KB

Minimum storage requirements 230KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFI The OS includes self-contained boot loader It can alsobe adapted to any external boot loading mechanism

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Thread Tracing JTAG and eSOLrsquos Eclipse-based eBinder IDE

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Installation to C drive 80GB or above Installation to other drive 50GB or above bull OS - Microsoft Windows 7 Ultimate ServicePack 1 or later bull Microsoft Windows 7 Professional Service Pack 1 or later bull Microsoft Windows Vista Service Pack 2 or later (only 32bit version)

RTOSOS product support lifecycle We provide renewable annual support and maintenance When a new revision is released the previous revision will be supported for 18 months Upon request we also provide long-term support and maintenance up to 10 years or more

eT-Kernel is a core part of the eT-Kernel Platform that integrates the eBinder IDE middleware components ndash including network protocols file systems USB hostdevice stacks and graphics tools ndash and professional services eT-Kernel Platform helps OEMs and ODMs to quickly create flexible development platforms for their software product lines and enables them to improve time to market cost productivity quality and other business drivers

eSOL Co LtdHarmony Tower 1-32-2 Honcho Nakano-ku Tokyo Japan 164-8721Tel +81 3 5302 1360

wwwesolcom

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS ThreadX

Type of embedded OS Real-Time Operating System (RTOS)

Description ThreadX is Express Logicrsquos advanced Real-Time Operating System (RTOS) designed specifically for deeply embedded IoT applications ThreadX provides advanced scheduling facilities message passing interrupt management and messaging services as well as many others ThreadX has many advanced features including its picokerneltrade architecture preemption-thresholdtrade scheduling event-chainingtrade and a rich set of system services Combined with its superior ease-of-use ThreadX is the ideal choice for the most demanding of embedded IoT applications According to VDC Research ThreadX has been deployed in over over 54 billion electronic products in the areas of consumer devices medical electronics industrial control equipment and space probes including NASArsquos Deep Impact and the Mars Reconnaissance Orbiter (MRO)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other ThreadX has support for most popular processors

Board support package Yes No

Source code availability Yes No

RAM memory requirements ThreadX automatically scales based on usageie no complicated compile-time configurationis necessary

Minimum storage requirements 2KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader ThreadX is agnostic in terms of bootloader ie any bootloader can be used

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license We work closely with IAR in terms of integration and customer engagements and support most popular development tools for all processor architectures

language support C and C

Debugger tools Eclipse JTAG Thread Tracing and TraceX is our host-based system event analysis tool

Built-in cloud API services Yes Express Logic is the only ARM mbed RTOS partnermeaning that mbed Client is available for the ThreadX developers to leverage in their designs In additionThreadX and NetX are the foundation for various IoT SoCs including Avago Technologiesrsquo WICED and GainSpanrsquos WiFi chips and modules

Cloud Service Providers Oracle Cloud Services Google Cloud Platform Amazon Web Services Microsoft Azure

Development host machine requirements NA

RTOSOS product support lifecycle Phonewebe-mail support channels with current product releases on web and automatic customer notifications of new service packs and new releases

We believe in simplicity which manifests in our elegant API and documentation We believe in small size and fast deterministic performance We believe in safety which is why ThreadX is the most pre-certified RTOS including conformance to international safety standards such as IEC 61508 SIL 4 IEC 62304 Class C ISO 26262 ASIL D ULIEC 60730 ULIEC 60335 UL 1998 and EN 50128 SW-SIL 4 ThreadX is also MISRA-C2004 and MISRA C2014 Compliant

All of these attributes are why ThreadX is arguably the most deployed commercial RTOS with over 54 Billion deployments worldwide Please explore further at wwwrtoscom

Express Logic11423 West Bernardo Court San Diego CA 92127Tel 8586136640

wwwexpresslogiccom

14 | RTC Magazine MAY 2016

July 18-20 2016San Jose Convention CenterThe Heart of Silicon Valley

wwwWearablesTechConcom

More than 60 Tech Sessions and Panelsbull Product Design bull Embedded System Development

bull Software Design bull Application Development

bull Leading SDKs bull Electronic Engineering for

Wearables Devices

and more tricks and techniques that will set your wearable project apart

Learn how to design build and develop apps for the wearable technology revolution at Wearables TechCon 2016

PLUS

ldquoThis is an excellent conference to attend to get an understanding from both a business and technicalsense of Wearables and IOTrdquo

mdashKevin Jones Electrical Engineer Dept of Defense

A BZ Media Event

Register Earlyand SAVE

All-Access PassONLY $695

Register before May 13 2016

Expo-Only Pass$25

Come to the Largest Wearable-IoT OEM Expo of 2016Go under the hood of the hottest wearable devices

Wearables_RTC_Layout 1 4816 201 PM Page 1

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

2016

RTC Magazine MAY 2016 | 13

2016 RTC Software Survey QuestionnaireFlagship Embedded OS eT-Kernel

Type of embedded OS Real-Time Operating System (RTOS)

Description The eT-Kernel RTOS is designed for embedded systems that require high performance and reliability eT-Kernel is based on the open TRON architecture which is the most widely adopted in embedded systems in Japan and Asian countries eT-Kernel is scalable with multiple profiles to fit any system size and purpose These profiles include POSIX-compliant eT-KernelPOSIX enhanced eT-KernelExtended supporting memory protection and process model and basic eT-KernelCompact eT-Kernel Multi-Core Edition is available for multi-core processors featuring its unique Blended Schedulingreg that enables the coexistence of both symmetrical (SMP) and asymmetrical (AMP) multi-core processing in a single system eT-Kernel has proved its value in a wide range of embedded systems such as car navigation systems aerospace consumer electronics and more

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core)

Board support package Yes No

Source code availability Yes No

RAM memory requirements The total RAM storage depends on multipleparameters as the OS allows build-timeoptimization of OS resources based on the OSconfiguration Minimum required is 54KB with a maximum of 88KB

Minimum storage requirements 230KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFI The OS includes self-contained boot loader It can alsobe adapted to any external boot loading mechanism

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Thread Tracing JTAG and eSOLrsquos Eclipse-based eBinder IDE

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Installation to C drive 80GB or above Installation to other drive 50GB or above bull OS - Microsoft Windows 7 Ultimate ServicePack 1 or later bull Microsoft Windows 7 Professional Service Pack 1 or later bull Microsoft Windows Vista Service Pack 2 or later (only 32bit version)

RTOSOS product support lifecycle We provide renewable annual support and maintenance When a new revision is released the previous revision will be supported for 18 months Upon request we also provide long-term support and maintenance up to 10 years or more

eT-Kernel is a core part of the eT-Kernel Platform that integrates the eBinder IDE middleware components ndash including network protocols file systems USB hostdevice stacks and graphics tools ndash and professional services eT-Kernel Platform helps OEMs and ODMs to quickly create flexible development platforms for their software product lines and enables them to improve time to market cost productivity quality and other business drivers

eSOL Co LtdHarmony Tower 1-32-2 Honcho Nakano-ku Tokyo Japan 164-8721Tel +81 3 5302 1360

wwwesolcom

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS ThreadX

Type of embedded OS Real-Time Operating System (RTOS)

Description ThreadX is Express Logicrsquos advanced Real-Time Operating System (RTOS) designed specifically for deeply embedded IoT applications ThreadX provides advanced scheduling facilities message passing interrupt management and messaging services as well as many others ThreadX has many advanced features including its picokerneltrade architecture preemption-thresholdtrade scheduling event-chainingtrade and a rich set of system services Combined with its superior ease-of-use ThreadX is the ideal choice for the most demanding of embedded IoT applications According to VDC Research ThreadX has been deployed in over over 54 billion electronic products in the areas of consumer devices medical electronics industrial control equipment and space probes including NASArsquos Deep Impact and the Mars Reconnaissance Orbiter (MRO)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other ThreadX has support for most popular processors

Board support package Yes No

Source code availability Yes No

RAM memory requirements ThreadX automatically scales based on usageie no complicated compile-time configurationis necessary

Minimum storage requirements 2KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader ThreadX is agnostic in terms of bootloader ie any bootloader can be used

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license We work closely with IAR in terms of integration and customer engagements and support most popular development tools for all processor architectures

language support C and C

Debugger tools Eclipse JTAG Thread Tracing and TraceX is our host-based system event analysis tool

Built-in cloud API services Yes Express Logic is the only ARM mbed RTOS partnermeaning that mbed Client is available for the ThreadX developers to leverage in their designs In additionThreadX and NetX are the foundation for various IoT SoCs including Avago Technologiesrsquo WICED and GainSpanrsquos WiFi chips and modules

Cloud Service Providers Oracle Cloud Services Google Cloud Platform Amazon Web Services Microsoft Azure

Development host machine requirements NA

RTOSOS product support lifecycle Phonewebe-mail support channels with current product releases on web and automatic customer notifications of new service packs and new releases

We believe in simplicity which manifests in our elegant API and documentation We believe in small size and fast deterministic performance We believe in safety which is why ThreadX is the most pre-certified RTOS including conformance to international safety standards such as IEC 61508 SIL 4 IEC 62304 Class C ISO 26262 ASIL D ULIEC 60730 ULIEC 60335 UL 1998 and EN 50128 SW-SIL 4 ThreadX is also MISRA-C2004 and MISRA C2014 Compliant

All of these attributes are why ThreadX is arguably the most deployed commercial RTOS with over 54 Billion deployments worldwide Please explore further at wwwrtoscom

Express Logic11423 West Bernardo Court San Diego CA 92127Tel 8586136640

wwwexpresslogiccom

14 | RTC Magazine MAY 2016

July 18-20 2016San Jose Convention CenterThe Heart of Silicon Valley

wwwWearablesTechConcom

More than 60 Tech Sessions and Panelsbull Product Design bull Embedded System Development

bull Software Design bull Application Development

bull Leading SDKs bull Electronic Engineering for

Wearables Devices

and more tricks and techniques that will set your wearable project apart

Learn how to design build and develop apps for the wearable technology revolution at Wearables TechCon 2016

PLUS

ldquoThis is an excellent conference to attend to get an understanding from both a business and technicalsense of Wearables and IOTrdquo

mdashKevin Jones Electrical Engineer Dept of Defense

A BZ Media Event

Register Earlyand SAVE

All-Access PassONLY $695

Register before May 13 2016

Expo-Only Pass$25

Come to the Largest Wearable-IoT OEM Expo of 2016Go under the hood of the hottest wearable devices

Wearables_RTC_Layout 1 4816 201 PM Page 1

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS ThreadX

Type of embedded OS Real-Time Operating System (RTOS)

Description ThreadX is Express Logicrsquos advanced Real-Time Operating System (RTOS) designed specifically for deeply embedded IoT applications ThreadX provides advanced scheduling facilities message passing interrupt management and messaging services as well as many others ThreadX has many advanced features including its picokerneltrade architecture preemption-thresholdtrade scheduling event-chainingtrade and a rich set of system services Combined with its superior ease-of-use ThreadX is the ideal choice for the most demanding of embedded IoT applications According to VDC Research ThreadX has been deployed in over over 54 billion electronic products in the areas of consumer devices medical electronics industrial control equipment and space probes including NASArsquos Deep Impact and the Mars Reconnaissance Orbiter (MRO)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other ThreadX has support for most popular processors

Board support package Yes No

Source code availability Yes No

RAM memory requirements ThreadX automatically scales based on usageie no complicated compile-time configurationis necessary

Minimum storage requirements 2KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader ThreadX is agnostic in terms of bootloader ie any bootloader can be used

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license We work closely with IAR in terms of integration and customer engagements and support most popular development tools for all processor architectures

language support C and C

Debugger tools Eclipse JTAG Thread Tracing and TraceX is our host-based system event analysis tool

Built-in cloud API services Yes Express Logic is the only ARM mbed RTOS partnermeaning that mbed Client is available for the ThreadX developers to leverage in their designs In additionThreadX and NetX are the foundation for various IoT SoCs including Avago Technologiesrsquo WICED and GainSpanrsquos WiFi chips and modules

Cloud Service Providers Oracle Cloud Services Google Cloud Platform Amazon Web Services Microsoft Azure

Development host machine requirements NA

RTOSOS product support lifecycle Phonewebe-mail support channels with current product releases on web and automatic customer notifications of new service packs and new releases

We believe in simplicity which manifests in our elegant API and documentation We believe in small size and fast deterministic performance We believe in safety which is why ThreadX is the most pre-certified RTOS including conformance to international safety standards such as IEC 61508 SIL 4 IEC 62304 Class C ISO 26262 ASIL D ULIEC 60730 ULIEC 60335 UL 1998 and EN 50128 SW-SIL 4 ThreadX is also MISRA-C2004 and MISRA C2014 Compliant

All of these attributes are why ThreadX is arguably the most deployed commercial RTOS with over 54 Billion deployments worldwide Please explore further at wwwrtoscom

Express Logic11423 West Bernardo Court San Diego CA 92127Tel 8586136640

wwwexpresslogiccom

14 | RTC Magazine MAY 2016

July 18-20 2016San Jose Convention CenterThe Heart of Silicon Valley

wwwWearablesTechConcom

More than 60 Tech Sessions and Panelsbull Product Design bull Embedded System Development

bull Software Design bull Application Development

bull Leading SDKs bull Electronic Engineering for

Wearables Devices

and more tricks and techniques that will set your wearable project apart

Learn how to design build and develop apps for the wearable technology revolution at Wearables TechCon 2016

PLUS

ldquoThis is an excellent conference to attend to get an understanding from both a business and technicalsense of Wearables and IOTrdquo

mdashKevin Jones Electrical Engineer Dept of Defense

A BZ Media Event

Register Earlyand SAVE

All-Access PassONLY $695

Register before May 13 2016

Expo-Only Pass$25

Come to the Largest Wearable-IoT OEM Expo of 2016Go under the hood of the hottest wearable devices

Wearables_RTC_Layout 1 4816 201 PM Page 1

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

July 18-20 2016San Jose Convention CenterThe Heart of Silicon Valley

wwwWearablesTechConcom

More than 60 Tech Sessions and Panelsbull Product Design bull Embedded System Development

bull Software Design bull Application Development

bull Leading SDKs bull Electronic Engineering for

Wearables Devices

and more tricks and techniques that will set your wearable project apart

Learn how to design build and develop apps for the wearable technology revolution at Wearables TechCon 2016

PLUS

ldquoThis is an excellent conference to attend to get an understanding from both a business and technicalsense of Wearables and IOTrdquo

mdashKevin Jones Electrical Engineer Dept of Defense

A BZ Media Event

Register Earlyand SAVE

All-Access PassONLY $695

Register before May 13 2016

Expo-Only Pass$25

Come to the Largest Wearable-IoT OEM Expo of 2016Go under the hood of the hottest wearable devices

Wearables_RTC_Layout 1 4816 201 PM Page 1

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

16 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INTEGRITYreg

Type of embedded OS Real-Time Operating System (RTOS)

Description From inception the INTEGRITY RTOS was designed so that embedded developers could ensure their applications met the highest possible requirements for security reliability and performance To achieve this INTEGRITY uses hardware memory protection to isolate and protect embedded applications Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious codemdashincluding denial-of-service attacks worms and Trojan horses Unlike other memory-protected operating systems INTEGRITY never sacrifices real-time performance for security and protection

Supported processors bull Altera Cyclone bull AMD x86 bull Applied Micro (APM) Power Architecture bull ARM Ltd bull Fujitsu ARM bull IBM Power Architecture bull Intel Architecture bull Marvell ARM and PXA bull MIPS Technologies bull NXP Qorivva bull NXP QorIQ bull NXP ColdFire bull NXP IMX (ARM) bull NXP Vybrid (ARM) bull Renesas R-Car bull Texas Instruments OMAP bull Texas Instruments DaVinci bull Texas Instruments Jacinto bull Texas Instruments Sitara bull Xilinx Zynq

Board support package Yes No

Source code availability Yes No

RAM memory requirements INTEGRITY is a scalable micro-kernel based operating system for microprocessors with MMUs In minimal configurations the RAM requirements can be a small as a few hundred kilobytes U-velOSity is a light weight kernel for micro-controllers In its smallest configuration only a few kilobytes of RAM are required Both of our operating systems come with a scalable set of middleware components like TCPIP stacks file systems USB stacks and drivers for on board peripherals The total RAM utilization is dependent on the middleware configuration and the final application but can range from a few kilobytes to gigabytes INTEGRITY is 64-bit capable for ARM x86Intel and Power Architecture and can support applications beyond the 4 gigabyte boundary

Minimum storage requirements Neither INTEGRITY nor u-velOSity require a file system for storage Each product has minimal RAM and ROM requirements that range from a few kilobytes of total memory (RAM and ROM) to megabytes depending on the configuration

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader INTEGRITY can be booted with any bootloader that is available for the target hardware We have supported all of these in the past In addition Green Hills Software offers our own bootloader called GILA

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Price per seat

language support C and C++ through GHS supplied compilers and libraries Java support is available for INTEGRITY from various third parties Ada95 Python has also been ported to INTEGRITY

Debugger tools MULTI IDE and GHS Probe and SuperTrace Probe

Built-in cloud API services Available from third parties

Cloud Service Providers Any cloud service back end can interoperate with INTEGRITY based target systems

Development host machine requirements A modern multi-core x86 processor with one of the following operating systems bull Windows 10 (64- or 32-bit mode) bull Windows 8 or 81 (64- or 32-bit mode) bull Windows 7 (64- or 32-bit mode) bull Windows Vista (64- or 32-bit mode) NET Framework 35 andor 45 NET Framework 45 requires Service Pack 2 or greater bull Ubuntu 14041 LTS (64- or 32-bit mode) bull Ubuntu 12045 LTS (64- or 32-bit mode) bull Ubuntu 1004 (64- or 32-bit mode) bull CentOS 7x (64- or 32-bit mode) bull CentOS 6x (64- or 32-bit mode) 4 GB of RAM 2 GB of free disk space per installation Display resolution of 1024x768 or higher

RTOSOS product support lifecycle We offer long-term support and maintenance for all products Major release cycles for INTEGRITY range from 3 to 5 years with maintenance releases in between for new processor and peripheral support Our current default shipping release for commercial INTEGRITY is version 1144 Email phone and on-site support services are available

Differentiating features for our products can be found on the product web pages belowwwwghscomproductshtmwwwghscomproductsrtosintegrityhtmlwwwghscomproductssafety_criticalintegrity-do-178bhtmlwwwghscomproductsmicro_velosityhtml

Green Hills Software34125 US Hwy 19 North bull Suite 100Palm Harbor FL 34684Tel 8007654733

wwwghscom

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

Copyright copy 2016 Green Hills Software Green Hills Software and the Green Hills logo are registered trademarks of Green Hills Software All other product names are trademarks of their respective holders

SAFE RELIABLE

SECURE

For over 30 years the worldrsquos leading companies have trusted Green Hills Softwarersquos secure and reliable high performance software for safety and security critical applications

From avionics and automotive through telecom and medical to industrial and smart energy Green Hills Software has been delivering proven and secure embedded technology

To find out how the worldrsquos most secure and reliable operating systems and development software can take the risk out of your next project visit wwwghscoms4e

TRUSTED SOFTWARE FOREMBEDDED DEVICES

Generic_RTC_0416indd 1 42616 1144 AM

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

18 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTX64

Type of embedded OS Real-Time Operating System (RTOS)

Description RTX64 is a key component of the IntervalZero RTOS Platform that supports x64 multi-core multiprocessors and the Windows operating system to outperform real-time hardware such as DSPs and MCUs and reduce the development costs for systems that require determinism or hard real-time Symmetric multiprocessing-enabled RTX64 takes full advantage of 64-bit memory and performance capabilities Uniquely the RTX64 RTOS scheduler enables embedded real-time applications to directly access the 512GB of addressable physical memory available on 64-bit Windows This is critical to modern day real-time systems and represents a gigantic leap from the 4GB physical memory limit of traditional 32-bit Windows systems The 4GB barrier has stymied innovation in many industries that depend on real-time systems and that require memory access far beyond 4GB

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements 256MB + Windows OS needs up to 192 GB

Minimum storage requirements 33MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Windows Boot loader

Pricing license model Purchase of a SDK to develop your application then a Runtime for each system that you will deploy yourapplication on

Development tools pricing license Development is done in Visual Studio which has anumber of editions some of which are free

language support C C and C++

Debugger tools Microsoft Visual Studio internal monitoring functionality

Built-in cloud API services No there is no built-in cloud functionality but there is aNetworking Stack for customers interested indeveloping their own solution

Cloud Service Providers None

Development host machine requirements Depends on the VIsual Studio version used andcomponents installed

RTOSOS product support lifecycle Support development for current major version and one major version back

You can use the same Windows OS features and development tools as a non embedded systems This can greatly reduce the learning curve to developing real-time application

IntervalZero400 5th ave 4th floor Waltham MA 02451Tel 7819964481

wwwintervalzerocom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

2016 RTC Software Survey QuestionnaireFlagship Embedded OS LynxOS 70 RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description The open standards-based LynxOS RTOS has been powering millions of embedded devices for the last 28 years across all industries and LynxOS 70 now adds significant built-in security features to help meet the needs of the billions of next-generation connected devices These security features help protect embedded systems from the common internet borne threats such as network infiltration Denial of Service attacks memory scraping and password and authentication attacks (eg root escalation or ldquorootingrdquo the system)

LynxOS is a deterministic hard real-time operating system that provides POSIX conformant APIs in a small footprint embedded kernel LynxOS provides symmetric multi-processing support to fully take advantage of modern multi-coremulti-threaded processors LynxOS comes with a high performance network stack including modern encryption technology and supports many different types of connection methods LynxOS is available in a safety certified version and will also run unmodified on top of the LynxSecure separation kernel hypervisor LynxOS is used in all embedded market segments including military aerospace industrial medical automotive and office automation LynxOS is available on Intel PowerPC and ARM architectures

Supported processors bull Intel x86 bull ARM bull PowerPC ISA

Board support package Yes No

Source code availability Yes No

RAM memory requirements A minimum of 16mb of RAM is needed with a maximum of 4GB

Minimum storage requirements 4mb ramdisk filesystem

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Netboot over tftp

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS only BIOS UEFI Das U-Boot

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools SPY Thread Tracing JTAG GDB Eclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Intel x86 bull 4GB of RAM bull 500MB of storage bull 64bit windows or linux

RTOSOS product support lifecycle First year support is included additional years can be optionally purchased

Training is included in the purchase of a LynxOS Development Seat

Lynx Software Technologies Inc855 Embedded Way San Jose CA 95138Tel 4089794404

wwwlynxcom

RTC Magazine MAY 2016 | 19

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

20 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Nucleusreg Real Time Operating System

Type of embedded OS Real-Time Operating System (RTOS)

Description Nucleus RTOS is highly scalable with a footprint as low as 3KB with vast middleware support The Nucleus Process model provides memory partitioning to isolate software components for increased system reliability dynamic loading to maximize the utilization of system resources and device software updates Nucleus connectivity options include 80211abgn 802154 BluetoothBLE USB 2030 and a dual IPv4IPv6 stack with over 50 protocols support for zero-configuration networking that includes mDNS and DNS-SD Nucleus includes CoAP6LoWPAN and MQTT IoT protocols Nucleus end-to-end security options including Root of Trust ARMreg TrustZonereg device storage options with password protected databases encryption through IPSecIKE and TLSSSL with support for AES-256 3DES DES RC4 and many other crypto algorithms Nucleus provides the industryrsquos only full featured power management framework that directly maps to the low-power features of the hardware including DVFS idle and sleep and hibernate modes Nucleus RTOS is certifiable to meet the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus is integrated with Industrial Field bus support that includes EtherCAT and EthernetIP with protocol support for OPC-UA

Supported processors bull Intel x86 - planned bull ARM ndash ARM 911 Cortex A R M ARM v7 ARMv8 (in-progressplanned) bull PowerPC ISA - PPC QorIQbull SuperH (J Core) bull Other MIPs DSP

Board support package Yes No

Source code availability Yes No

RAM memory requirements The minimal RAM requirements for Nucleus RTOS are less than 10 KBs The maximum RAM requirements varies depending on the required middleware With Nucleus POSIX support full featured 3rd party middleware components can be run on Nucleus RTOS which will increase the RAM requirements Nucleus RTOS is a highly scalable RTOS that is designed to allow developers to include only the required software components to minimize RAM requirements Typical Nucleus RTOS configurations with an IPv4 IPv6 dual networking stack and USB can easily fit in the internal memory of a MCU

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader A bootloader is not required however a bootloader can be used

Pricing license model Flexible pricing models including royalty free are available for Nucleus RTOS

Development tools pricing license Nucleus RTOS is packaged with a complete development based on Code Sourcery CodeBench with gccg++ tools that can be licensed per seat for a one-time fee or leased for a term period of various lengths

language support C and C++

Debugger tools Thread Tracing JTAG GDB Eclipse and SPY are all supported Nucleus RTOS is packaged with a complete development based on Sourcery CodeBench with gccg++ tools

Built-in cloud API services Yes Nucleus has been integrated with Cloud Services

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements bull Processor Requirements IAx86 ndash 64 bit bull 4GB Minimum RAM bull 2GB Minimum Storage bull Windows 7 32-bit and 64-bit bull Windows 8 32-bit and 64-bit bull Linux Ubuntu Desktop 1204 64-bit only bull Ubuntu Desktop 1404 32-bit and 64-bit bull Ubuntu Desktop 1504 64-bit only bull

Redhat Enterprise Linux 65 and 66 64-bit only bull Centos 7 and 71 64-bit only bull SUSE Enterprise Linux Desktop 11 sp3 and 12 64-bit only

RTOSOS product support lifecycle Mentor Graphics provides 5 Star World Wide Support with 24 x 7 customer portal SupportNET for online access to download Software Product Updates Patches and documentation Support is provided via phone email and web

Nucleus SafetyCert is a safety-certified RTOS and middleware solution that meets the highest level of safety for DO178C IEC61508 IEC62304 and ISO 26262 Nucleus SafetyCert is a complete package with documents and artifacts that reduces risk and cost for devices that require regulatory approval to meet the stringent safety requirements for avionics industrial medical and automotive

Mentor Graphics12255 El Camino Real 150 San Diego CA 92130Tel 8585232600

wwwmentorcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

2016 RTC Software Survey QuestionnaireFlagship Embedded OS microCOS RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description microCOS RTOS is a highly portable ROMable scalable preemptive real-time deterministic multitasking kernel for microprocessors microcontrollers and DSPs Offering unprecedented ease-of-use μCOS RTOS is delivered with complete 100 ANSI C source code and in-depth documentation It runs on the largest number of processor architectures with ports available for download from the Micrium Web site

microCOS RTOS allows for unlimited tasks semaphores mutexes event flags message queues timers and memory partitions The user allocates all kernel objects at run time It provides features to allow stack growth of tasks to be monitored

microCOS RTOS allows multiple tasks to run at the same priority level When equal priority tasks are ready-to-run microCOS RTOS runs each for a user-specified amount of time

microCOS RTOS provides extensive range checking which can be disabled at compile time microCOS RTOS thus checks for NULL pointers passed in API calls task level services from ISRs arenrsquot called arguments are within allowable range and specified options are valid Each API function provides an error code regarding the outcome of the function call

microCOS RTOSrsquos footprint can be scaled to contain only the features required for a specific application (typically 6ndash24 KBytes of code space residing in memory)

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Available on over 50 MCU architectures

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum RAM requirements are 500 bytes (kernel) Maximum is 1Kbytes + (kernel) 24Kbyte (typical withstacks) Memory requirements depends on application and number of tasks and stacks

Minimum storage requirements 6Kbyte (kernel) 60Kbyte (TCPIP)

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Compiled and downloaded by IDE

Pricing license model Upfront fee but no per unit royalty microCOS RTOS is also available for Free to Makers and Educational Institutions

Development tools pricing license We have a graphical realization tool - Probe which isavailable for $900yrseat

language support C

Debugger tools JTAG GDB Probe IAR and Keil

Built-in cloud API services Yes

Cloud Service Providers We work with several cloud providers Two of themore popular providers that have been pre-integratedare MediumOne and Amazon Web Services

RTOSOS product support lifecycle 1 year of maintenance included Optional for years 2+ We have a dedicated support portal with 247 support

Micrium is known for the quality of our software as well as our training documentation and support We are the most widely deployed RTOS in the world (based on UBM 2015 survey) Over 250K developers use our software Our sources are freely available for non-commercial applications and a small fee is required for commercial applications

Micrium Inc8123 Brittany Drive Dublin CA 94568Tel 4084299217

wwwmicriumcom

RTC Magazine MAY 2016 | 21

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

22 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS SMX RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description SMX is a royalty-free multitasking RTOS for embedded systems developed by Micro Digital It supports the most prevalent embedded CPU families especially those targeted at low-cost 32-bit embedded systems such as ARM Cortex and ColdFire It offers these modules Multitasking Kernel with graphical debugger plugin WiFi 80211 stack with security options TCPIP dual IPv4 IPv6 stack FAT and Flash file systems USB Host stack USB Device stack USB OTG GUI IEEE 754 Floating Point library and Bootloader All are integrated and work well together Many optional features protocols and drivers are available for each including security The smx multitasking kernel has been proven in hundreds of products over more than 25 years It has many unique features and continues to be improved Full source code is included and support is provided by the engineers that wrote the code

Supported processors ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements SMX kernel and TCPIP stack with web serverand some demo code running with acceptableperformance fits in 45KB Buffers and features scale for increased performance Task stack sizes are a main user of RAM inmultitasking systems smx has a system stackthat ISRs LSRs and scheduler run on so thattask stacks are not burdened by this extraoverhead In middleware protocol stacks bufferand cache sizes use most of the RAM soallocating modest amounts can greatly improveperformance For example smxFS can runslowly with about 5KB RAM With 20KBperformance is much better

Minimum storage requirements 25KB flash for smx kernel

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader None SMX is typically linked with the application andlocated in flash to run from reset

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license 3rd party tools are offered usually priced per seat

language support C and C++

Debugger tools JTAG

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements Typical PC

RTOSOS product support lifecycle Micro Digital supports customers on the version of software they are using even many years after newer versions have been released In rare cases it may become necessary to upgrade a customer This is decided jointly between the customer and Micro Digital

The smx kernel is a key differentiator of the SMX RTOS versus competitive offerings A great deal of design has been put into it in almost 30 years of development It continues to be actively developed and has been substantially improved in the v4 work done during the past 5 years The smx Datasheet smx Special Features smx Philosophy and other links at wwwsmxrtoscomspecial summarize what is special about it In addition smxAware is a very good kernel awareness tool with graphical and textual displays that show how the system is running and help to resolve problems

The breadth of the modules offered is another key differentiator of SMX RTOS In addition to multitasking kernel file systems TCPIP stack USB stacks and GUI WiFi and floating point libraries are offered Security and many options protocols and drivers are offered for each

Micro Digital Inc2900 Bristol St G204 Costa Mesa CA 92626Tel 7144377333

wwwsmxrtoscom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

2016 RTC Software Survey QuestionnaireFlagship Embedded OS MicroEJ OS

Type of embedded OS Specialized Embedded Operating System

Description MicroEJ OS enables delivery of app-driven experiences and services similar to smartphones and tablets on devices that canrsquot afford to run mobile platforms While a mobile OS typically requires gigabytes of memory and storage and gigahertz multi-core microprocessors which leads to high-cost hardware MicroEJ OS can run on low-power cost-effective megahertz microcontrollers in the range of kilobytes of memory and storage

MicroEJ OS is a scalable OS for resource-constraint devices running on 32-bit embedded microcontrollers or microprocessors MicroEJ OS allows devices to run multiple and mixed Java and CC++ applicationsMicroEJ OS is fast ndash it boots in 2 ms ndash and is optimized for low-power The OS engine is very compact (lt 30 KB footprint) and OS services can be built to match hardware capabilities and software needs It runs on ARM Cortex-M and A from Cortex-M0 with 128 KB flash and 32 KB RAM to Cortex-A9

MicroEJ OS provides a fully configurable set of services that can be expanded including bull A multi-application framework bull A basic analog and digital IO framework bull A sensor framework bull A USB stack- A file system (storage) bull A network connection with security (SSLTLS HTTPS RESThellip) bull A GUI framework for modern 2D graphics and touch

As it runs Java MicroEJ supports all security networking and IoT communication protocols and frameworks such as MQTT CoAP etc

Supported processors bull ARM bull MIPS32 bull TriCore bull TriCore bull RX

Board support package Yes No

Source code availability Yes No

RAM memory requirements 16KB

Minimum storage requirements 128KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Any provided by the BSPunderlying kernel

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools Eclipse GDB JTAG and IAR Keil

Built-in cloud API services Yes Can connect easily to any cloud platform thanks to ageneric data API and agent

Cloud Service Providers Microsoft Azure Amazon Web Services Oracle Cloud Services Eurotech Zebra Orange IBM BlueMix

Development host machine requirements bull Intel Core i5 bull 2 GB of RAM bull Able to run Eclipse

RTOSOS product support lifecycle Helpdesk included in price optional support options available

wwwmicroejcom for all details

MicroEJIS2T - Bat D 11 rue du Chemin RougeNantes France 44300Tel +33 624 280 885

wwwmicroejcom

RTC Magazine MAY 2016 | 23

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

24 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Windows 10 IoT Enterprise and Windows 10 IoT Core

Type of embedded OS General Purpose OS

Description Windows 10 IoT Core is a version of Windows 10 that is optimized for smaller devices with or without a display Windows 10 IoT Core utilizes the rich extensible Universal Windows Platform (UWP) API for building great solutions For commercial builders Windows 10 IoT Core provides a great platform to build your small footprint and low cost industry devices with the enterprise grade security management and servicing similar to rest of Windows 10 editions For Makers popular Maker boards such as Raspberry Pi2 amp 3 Arrow DragonBoard 410c amp MinnowBoard MAX are available making Windows 10 IoT Core a great choice for all your Maker projects Countless innovative projects can be built using the power of Windows on your favorite device Windows 10 IoT Enterprise

Windows 10 IoT Enterprise brings the capabilities of Windows 10 Enterprise to a wide range of industry devices across retail manufacturing health finance and other industries Windows 10 IoT Enterprise devices run powerful line of business applications and perform a specialized function in a secure reliable and streamlined way to support mission critical industry devices

Windows 10 IoT Enterprise supports both Universal Windows apps and Classic Windows applications plus a host of innovative capabilities advanced protection against modern security threats full flexibility of deployment updating and support options and comprehensive infrastructure device and app management features Companies that require manageability consistency and predictability choose Windows 10 IoT Enterprise and Windows 10 Enterprise

Supported processors bull Intel x86 IoT Core IoT Enterprise bull ARM IoT Core

Board support package BSP is provided by board manufacturer QC Intel amp RPi provide BSP for the boards that work with IoT Core Not needed for IoT Enterprise

Source code availability Yes No

RAM memory requirements 2 GB for Windows IoT Enterprise 256MB for headless IoT Core version and 512MB for headed version

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Storage support IoT Core SSD HDD Flash SD Card Compact Flash USB Flash

IoT Enterprise SSD HDD Flash SD Card Compact Flash USB Flash

Required firmware bootloader BIOS and BIOS UEFI

Pricing license model Per unit

Development tools pricing license Free

language support C C++ VBNET Python Javascript and F

Debugger tools Microsoft Visual Studio

Built-in cloud API services Yes

Cloud Service Providers Microsoft Azure

Development host machine requirements bull Processor Requirements x86x64 bull Minimum RAM 1GB or 2GB for x86x64 respectively bull Minimum Storage 16GB or 20GB for x86x64 respectively bull Windows 10

RTOSOS product support lifecycle The Microsoft Support Lifecycle policy applies to most products currently available through retail purchase or volume licensing and most future release products Microsoftrsquos current policies detailed below offer a minimum of 10 years of support (a minimum of 5 years Mainstream Support and a minimum of 5 years Extended Support) at the supported service pack level for Business Developer and Desktop Operating System products A minimum 5 years Mainstream Support at the supported service pack level for Consumer and Multimedia productsPlease refer to the following site for product specific lifecycle details httpssupportmicrosoftcomen-uslifecyclegpgp_msl_policy

Windows 10 IoT Core Windows 10 IoT Mobile Enterprise and Windows 10 IoT Enterprise are all part of the Windows 10 IoT family of editions designed to power a wide range of intelligent devices from small industrial gateways to larger more complex devices like point of sales terminals and ATMs Windows 10 IoT brings the power of Windows including security and servicing automatic updates through Windows Update when connected to the Internet and the Universal Windows Platform (UWP) APIs that give apps easy control over system management features Partners building solutions based on Windows 10 IoT will realize expanded opportunities when they harness the full breadth of Microsoft technologies to offer end-to-end solutions

MicrosoftOne Microsoft WayRedmond WA 98052

wwwmicrosoftcom

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

2016 RTC Software Survey QuestionnaireFlagship Embedded OS CGX 20

Type of embedded OS Real-Time Operating System (RTOS)

Description MontaVistareg Linuxreg Carrier Grade eXpress (CGX) 20 delivers Linux reliability security real-time and serviceability to embedded Internet of Things (IoT) gateways Carrier Grade networks NFVSDN solutions Military Aerospace projects medical devices and Industrial control systems CGX will follow rapid release cadence (once per year) to better align with latest Yoctoreg releases enabling adoption of newer Long Term Support (LTS) Kernels Tool-chains and emerging market technologies CGX 20 leverages Yocto 20 and included LTS Linux kernel 41 GCC 52 and supports the lastest x86 and ARM SoCs (with MIPS and PowerPC on future roadmap) Additionally CGX offers integrated IoT Security Virtualization Dataplane Carrier Grade technology profiles enabling developers to quickly get to market Finally MontaVista offers Long Term Maintenance of 10+ years on CGX giving support assurance throughout your productrsquos lifecycle

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements 1MB for kernel 10MB for rootfs The kernel and rootfs environment is very configurable for any application and hardware deployment Default image size is 5MB kernel 1GB forrootfs

Minimum storage requirements The host tools installation is about 13gb including DevRocket Each toolchain is about 600mb additional

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOS UEFIDas U-Boot and Secureboot

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Project license based Annual subscription

language support Java Python C and C++

Debugger tools EclipseGDBJTAGThread Tracing

Built-in cloud API services Yes OpenStack and ODL based cloud framework

Cloud Service Providers None

Development host machine requirements bull 64 bit x86 dual core processor running at 1GHz+ 8 core processor is recommended foroptimal performance bull 4 GB of RAM (8GB is recommended) bull 500MB of storage (1TB is recommended) bull 1Mbps boardband network connect (10Mbps recommended) Serial or USB port to target console connectivity (depending on your target hardware)

RTOSOS product support lifecycle 10+ Years

MontaVista has been a leader in embedded Linux for 16 years We have 100s of man years experience in processorSoCs Linux architecture backporting testing and building quality embedded Linux platforms MontaVista provides frequent maintenance updates on both bug fixes and critical security patches to the kernel userland and toolchain MontaVista as well have various support levels to address your projects needs whether it is just answers day to day questions to embedded a MontaVista engineer into your team to handle custom or difficult Linux requirements Finally we are flexible in our approach and licensing and view our customer relationships as a partnership Our goal is offering the best high quality commercial Linux platform so you can deliver your valued solution to market

MontaVista2315 N 1st St San Jose CA 95131Tel 4089437445

wwwmvistacom

RTC Magazine MAY 2016 | 25

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

26 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS Java ME Embedded 8

Type of embedded OS General Purpose Embedded Operating System

Description Oracle Java ME Embedded is a Java runtime that leverages the core Java technologies deployed in billions of devices around the world in the Internet of Things The Java ME Embedded specifications are designed to be rich in functionality portable to a wide range of devices flexible and secure while being very resource-efficient and keeping the demands on the underlying platform low The product provides dedicated embedded functionality including software provisioning and management and is targeted for low-power limited memory devices requiring support for a range of network services and IO interfaces Java ME Embedded has best-in-class Java Virtual Machine including advanced multi-tasking capabilities tuned for efficiency footprint and robustness

Supported processors bull Intel x86 bull ARM

Board support package Yes No

Source code availability Yes No

RAM memory requirements Java ME Embedded is highly configurablehighly configurable to scale across a widerange of target device The minimal RAM requirement is 128KBs The maximum RAM requirements 32MB

Minimum storage requirements Minimum storage requirements are 1MB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader In many cases bootloader is not required

Pricing license model No upfront fee but a per unit royalty

Development tools pricing license Free

language support Java and JVM-based languages

Debugger tools Eclipse and Netbeans

Built-in cloud API services Yes

Cloud Service Providers Oracle Cloud Services and MQTT support

Development host machine requirements bull Intel Core i5 bull 4GB of RAM bull 15 GB of storage

RTOSOS product support lifecycle Oracle Support

bull Platform-independent standards-based and efficient software environment for embedded devices - enables the rapid development and deployment of intelligent applications across a wide range of deviceOS combinations bull Java runtime based on Java ME Connected Limited Device Configuration (CLDC) 8 - features alignment with the Java SE platform for increased development efficiency and code portability a robust and efficient multi-tasking implementation advanced tooling and more bull Java ME Embedded Profile (MEEP) 8 - modern flexible embedded application platform built on CLDC 8 supports advanced security functionality enhanced connectivity including cellular and highly configurable to scale across a wide range of target device bull Software Provisioning and Management Functionality - enables remote software provisioning updatability and management bull Optimized for Embedded - full headless operation long-running operation fine- grain security auto-start monitoring and recovery and power management bull Device IO APIs ndash Part of Open JDK Project Easy access to peripherals as GPIO I2C SPI AT channel serialUART ADCDAC Pulse Counter PWM SD Card and more bull RESTful Web Services APIsndash ready-to-use HTTP Client JSON OAuth 20 bull Support for standard services APIs ndash File IO (JSR 75) Wireless Messaging (JSR 120) Web Services (JSR 172) Security and Trust Services Subset (SATSA ndash JSR 177) Location (JSR 179) XML (JSR 280)

Oracle Corporation10-th Krasnoarmeyskaya 22a Saint-Petersburg Russia 190103Tel +79219350309

wwworaclecom

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

RTC Magazine MAY 2016 | 27

2016 RTC Software Survey QuestionnaireFlagship Embedded OS RTEMS

Type of embedded OS Real-Time Operating System (RTOS)

Description RTEMS is a robust open source single process multi-threaded RTOS that supports open standard application programming interfaces (API) such as POSIX on over 175 BSPs on over fifteen architectures including ARM PowerPC x86 MIPS Coldfire and SPARC Using the GNU tools for development host environments include Linux MacOS MS-Windows and FreeBSD It is used in the space medical networking automotive and scientific instrument domains

RTEMS is a scaleable highly configurable RTOS with only those features used deployed on the target RTEMS has multiple filesystems including a RAM filesystem JFFS2 NFS client and FAT Networking includes the LwIP and the FreeBSD TCPIP stack with IPV4 IPV6 DHCP ftpd telnetd and httpd State of the art SMP support on PowerPC ARM SPARC and x86 features clustered scheduling and high performance synchronization algorithms as well as OpenMP Other features include USB i2c SPI tracing a full test suite with high coverage and a shell with over 100 built-in commands

The twenty-five year old project is hosted at rtemsorg and has a vibrant global community Commercial support is available from US and European companies Major decisions about RTEMS are made by the core developers in concert with the user community

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other Blackfin Epiphany LM32 M32C ColdFire M68KMicroblaze MIPS Moxie NIOS2 OpenRISC OR1kSPARC (ERC32 LEON234) SPARC64 V850

Board support package Over 175 BSPs are freely available

Source code availability Yes No

RAM memory requirements The minimal RAM requirements is 8 KBs The maximum RAM requirements varies depending on Maximum varies greatly depending on thenumber of RTOS objects and optional features such as networking etc included by the user application

Minimum storage requirements The smallest code space for a statically linked executable is on the order of lt 16K

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other RTEMS works with whatever mechanism is availableon the target hardware including network boot

Storage support SSD HDD SD Card Compact Flash USB Flash Other Embedded Flash

Required firmware bootloader BIOS onlyLILOGRUBDas U-Boot RTEMS can be booted directly from CPU reset or by any firmwarebootloader available on the target hardware

Pricing license model RTEMS is a completely free (no cost) open sourceRTOS A goal of the project is to ensure that allincluded features are free and impose no restrictionsor obligations on the end user such as redistributingsource source Commercial services are available forsupport training and custom development

Development tools pricing license Free

language support Java C C++ and Python

Debugger tools GDBEclipse

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull Any modern CPU (x86 x86_64 ARMPowerPCerc) capable of supporting LinuxMS-Windows FreeBSD or MacOS XObviously the faster the processor the faster the builds bull 2GB RAM on x86RTEMS can be built on a Raspberry Pi whichhas only 512MB bull 100GB of storage is recommended to be able to build the development tools from source

RTOSOS product support lifecycle RTEMS follows an open source community model with all development public The community supports the development version and two previous release branch series Support for older releases is available from commercial providers

The RTEMS Classic API which is based upon the VITA RTEIDORKID specifications which have a heritage in pSOS+ RTEMS supports Rate Monotonic Scheduling Priority Ceiling Protocol and Priority Inheritance Protocol All source code is provided for RTEMS optional capabilities and development tools A goal of the RTEMS Project is to ensure that users are able to build from source reproduce test results and configuration manage the source code for all of this as long as needed by very long life projects RTEMS supports all 32-bit space hardened CPUs and has been been to Venus Mars and the asteroid belt Missions include the Galileo GPS constellation Mars Curiosity Mars Reconnaissance Orbiter ISS Express Logistics Carrier for experiments NASA MMS NASA SDO NASA ICESat-2 and ESA HerschelPlanck The RTEMS Project is active in student programs and has mentored close to 100 students through the Google Summer of Code and ESA Summer of Code in Space programs The project has also participated in the Google Code-In program for high school students multiple times

OAR Corporation7047 Old Madison Pike Suite 320 Huntsville AL 35806Tel 2563619375

wwwoarcorpcom

RTC Magazine MAY 2016 | 27

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS embOS by SEGGER

Type of embedded OS Real-Time Operating System (RTOS)

Supported processors bull ARM bull PowerPC ISA bull SuperH (J Core) bull All Microcontrollers and Microprocessors

Board support package Yes No

Source code availability Yes No

RAM memory requirements The kernel requires approximately 70 Bytes Additional memory is required for the task stacks

Minimum storage requirements embOS requires approximately 1700 bytes of storage

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other Any this depends on whether a bootloader is used and which bootloader

is used the RTOS itself is agnostic of the media it is booted from

Storage support SSD HDD SD Card Compact Flash USB Flash Other Any the RTOS itself has its own memory pool which it uses Storage support is

provided by a file system library such as emFile

Required firmware bootloader embOS does not require a bootloader

Pricing license model Upfront fee but no per unit royalty

Development tools pricing license Free One-time fee Price per seat Price per company Other 3rd party tools are available

language support Java C and C++ Other programming languages require an application layer

Debugger tools Thread Tracing JTAG GDB Microsoft Visual Studio Eclipse and other 3rd party tools such as Rowley Atollic ARM IAR

Built-in cloud API services Yes No

Development host machine requirements bull Processor Requirements Depends on the development environment used no minimum requirementbull Minimum RAM Depends on the development environment used no minimum requirementbull Minimum Storage Depends on the development environment used no minimum requirementbull Other Requirements Development environments are available for Windows Mac OS X and Linux

RTOSOS product support lifecycle There are no limitation imposed on the developer Support is available for older versions as well

embOS has been deployed in several million devices in a wide range of application areas It is in the market for more than 20 years There is no start-up overhead embOS starts within 85 CPU cyclesembOS task switches are ultra fast embOS behavior is deterministic and meets hard real-time conditions

SEGGER Microcontroller LLC106 Front StreetWinchendon MA 01475Tel 9788740299

wwwseggercom

28 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

2016 RTC Software Survey QuestionnaireFlagship Embedded OS PikeOS Real-Time Hypervisor

Type of embedded OS Real-Time Operating System with built-in Hypervisor

Description The PikeOS real-time hypervisor is based on a microkernel with the performance of a traditional real-time operating system The hypervisor provides partitions that can host different applications ndash from a simple yet highly critical control task to a full-fledged operating system such as Linux or Android As a consequence embedded and IT applications can coexist on the same platform Complex systems consisting of multiple devices in the past can now be consolidated on a single hardware platform This saves weight energy consumption and cabling and reduces the Bill of MaterialThe PikeOS Hypervisor itself is certified according to the highest industry standards thus providing the foundation for mission-critical systems with both functional safety (EN 50128 IEC 61508 DO-178 IEC 26262) and IT Security (IEC 15408) requirements The safeguard mechanisms are essentially based on two principles strict separation of applications by time and resource partitioning and control of the communication channels The individual applications that comprise the overall system can represent different levels of criticality Due to the protection mechanisms provided by PikeOS the certification according to industry specific safety andor security standards can be made separately for each application

Supported processors bull PowerPC ISA bull ARM bull Intel x86 bull MIPs bull SuperH (J Core) bull SPARC

Board support package Yes No

Source code availability Yes No

RAM memory requirements 192kb RAM 192kb ROM minimum requirement Being a real-time virtualization platform themaximum memory requirement depends on thepartition content and the number of partitionsThus it is scalable from a few Kilo-Bites tomultiple Mega-Bytes

Minimum storage requirements PikeOS can reside in ROM and can be executed there Additional storage can be used but is not mandatory

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Das U-Boot GRUB BIOS UEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat Price per company

language support Java ADA C and C++

Debugger tools Thread Tracing JTAG GDB Health Monitor and System Monitor

Built-in cloud API services No

Cloud Service Providers None

Development host machine requirements bull State of the art processor bull 2 GB of RAM is recommended bull 1GB of storage is recommended bull JAVA Runtime for Eclipse

RTOSOS product support lifecycle As PikeOS is used in many safety critical devices (air-planes automobiles trains medical equipment traffic control hellip) SYSGO provides long-term support for PikeOS and its certified components Currents contract have a period of 30+ years

bull PikeOS is the first RTOS certified to SIL-4 on a Multi-Core platform bull SYSGO offers certification services for PikeOS BSPs and device drivers

SYSGO AGAm Pfaffenstein 14 Klein-Winternheim Germany 55270Tel +49 6136 9948 500

wwwsysgocom

RTC Magazine MAY 2016 | 29

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

20 THE BEST EMBEDDED SOFTWARE SOLUTIONS LIST

2016 RTC Software Survey QuestionnaireFlagship Embedded OS INtimereg RTOS

Type of embedded OS Real-Time Operating System (RTOS)

Description Designed for Scalable Multicore PC-based Embedded SolutionsINtimereg RTOS is an object-based multitasking pre-emptive priority based hard real-time operating system (RTOS) for creating scalable distributed embedded solutions INtimereg RTOSrsquo explicit hardware partitioning and asymmetric multicore processing (AMP) architecture extends the capabilities of todayrsquos powerful multicore PC platforms enabling consolidation of deterministic applications onto fewer platforms while simultaneously providing services for global objects allowing creation of interoperable distributed real time systems INtimereg RTOS runs standalone or alongside Windows and is a complete operating system that includes many services and capabilities that developers expect to see in modern operating systems to enable fast and efficient development of high-performance reliable applications

Supported processors Intel x86

Board support package Yes No

Source code availability Yes No

RAM memory requirements Minimum typical 32 megabytes Up to 4 gig memory per process per node Each process has its own full memory space limited only by the platformrsquos physical memory space

Minimum storage requirements Approx 100 megabytes

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader BIOSUEFI

Pricing license model Upfront fee and a per unit royalty

Development tools pricing license Price per seat

language support C and C++

Debugger tools Microsoft Visual Studio and Serial Console Proprietary Windows-based (Spider)

Built-in cloud API services None

Cloud Service Providers Various 3rd party clouds are supported

Development host machine requirements X86 PC Windows-based in both 32 and 64 bit environments Visual Studio 2008 and beyond

RTOSOS product support lifecycle Retain binary-compatibility with previous customer versions Actively support updates and regular release versions along with bug fixes for major releases

Tenasys has a long legacy of strong technology expertise (35 years) to its software products Proven in several decades in fields such as medical electronics industrial control robotics test amp measurement and military applications Tenasys provides strong networking services global support and customer expertise in hypervisor and embedded virtualization technologies

Tenasys Corporation1400 NW Compton Drive 301 Beaverton OR 97006Tel 5037484720

wwwtenasyscom

30 | RTC Magazine MAY 2016

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

2016 RTC Software Survey QuestionnaireFlagship Embedded OS VxWorks

Type of embedded OS Real-Time Operating System (RTOS)

Description Powering billions of intelligent devices VxWorks is the worldrsquos most widely deployed real-time operating system (RTOS) It delivers unrivaled deterministic performance and sets the standard for a scalable future-proof safe and secure operating environment for connected devices in the Internet of Things (IoT) Leading global innovators in aerospace and defense automotive industrial medical and networking industries use VxWorks to create winning IoT-ready products

VxWorks supports the broadest spectrum of silicon architectures including ARM PowerPC and Intel Its large ecosystem of validated third-party solutions from trusted partners enables customers to differentiate their platforms with best-of-breed capabilities reduce development costs and accelerate time-to-market

Supported processors bull Intel x86 bull ARM bull PowerPC ISA bull SuperH (J Core) bull Other MIPs

Board support package Yes No

Source code availability Yes No

RAM memory requirements As low as 300kb

Minimum storage requirements Minimum storage requirements for Nucleus File System are less than 30KB

Supported boot media SSD HDD Flash SD Card Compact Flash USB Flash Other_____________________

Storage support SSD HDD SD Card Compact Flash USB Flash Other (please specify)

Required firmware bootloader Wind River Boot Loader IOS only BIOS UEFI GRUB and Das U-Boot

Pricing license model Wind River offers different operating system productsto fit the varied requirements of customers acrossdifferent industries along with flexible pricing modelsthat range from free to fee based

Development tools pricing license Price per seat

language support Java C and C++

Debugger tools JTAGand Eclipse

Built-in cloud API services Yes

Cloud Service Providers IBM Blue Mix Wind River Helix Device Cloud and others coming soon

Development host machine requirements bull Pentium machine bull At least 2GB of RAM bull 10GB of storage

RTOSOS product support lifecycle VxWorks is backed by our award-winning global support organization Wind River offers a variety of product support offerings to fit the needs of our customers during various stages of their devicersquos life and to ensure we partner together with our customers to meet the long-term requirements of their end-customers Wind River offers live help in multiple time zones the online Wind River Support Network with multifaceted self-help options and premium services to provide the fastest possible time-to-resolution We are proud to have achieved Service Capability and Performance certification recognized as the gold standard for delivering world-class customer support

The VxWorks product family provides a suite of offerings to cover all ranges of devices from single function unregulated to the most complex heavily regulated devices requiring strict certification requirements such as ARINC 653 DO-178 FACE MILS IEC 61508 and others This includes devices built for aerospace and defense automotive industrial medical space transportation and other industries In addition to unrivaled deterministic performance VxWorks offers advanced middleware and protocols for security safety networking connectivity device manageability user interface and graphics that customers require to create the most demanding devices for the Internet of Things (IoT)

AN INTEL COMPANY

trade

Wind River500 Wind River Alameda CA 94501Tel 5107492727

wwwwindrivercom

RTC Magazine MAY 2016 | 31

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

32 | RTC Magazine MAY 2016

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Jerry Krasner Embedded Market Forecasters

The RTOS Dilemma Are Open Source RTOSes Economic or CostlyDevelopers are barraged with claims that developments based on open source soft-ware are less expensive that those developments using commercial OSes This paper presents data based on development information from more than 2700 developers that discuss this issue

OverviewTheodore Levitt the renowned Harvard professor used to tell

his students ldquoPeople donrsquot want to buy a quarter-inch drill they want a quarter-inch holerdquo Following this line of thought prices may vary depending on the type of drill required but the true cost of getting their quarter-inch hole depends more on the cost of the drill used as well as the time required of someone to drill it Similarly the acquisition of the RTOS is not for the RTOSes sake ndash but rather a choice in search of a cost effective and time sensitive designdevelopment solution

The RTOS enigma can be seen in the same light It matters little if the drill bit is free or if it comes at a price The true cost includes more than the acquisition cost

Intuitively the idea that a ldquofreerdquo RTOS reduces development costs can be no more than fanciful thinking ndash it depends on facts not on anecdotes

Anecdotes are not data ndash they supplement ideas for which no data exists (true or false) to provide guidance to developers managers and CFOs

Every day developers are barraged with claims and count-

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

RTC Magazine MAY 2016 | 33

er claims regarding the use of RTOSes development tools programming languages and more FUD has become less than an idea and more of an institutional malaise It frequently masquerades as a reasonable idea ndash open source software for example is ldquofreerdquo or so their proponents proclaim But is there any comprehensive source of user data that can validate this claim In this paper we will present a financial comparison (Cost of Development) between the RTOS industry a specific example of a commercial RTOS Linux developments and open source developments The results may be surprising to some and not so to others

The data presented herein is based on the results of the 2016 Annual EMF Embedded Developer Survey (1298 respondents) and is nearly identical to the data derived from 1337 respon-dents in 2015

In developing this cost data (using our unique EMF Dashboard wwwembeddedforecastcom) we were able to do a simultane-ous comparison of the data presented in the following Tables by determining the number of software developers per project the time period from design start to projectproduct shipment and the percentage of designs completed behind schedule

EMF based on the responses to their 2016 Survey of Embed-ded Developers (1298 respondents) created six cadres of data by filtering the responses to developers using any RTOS those using a commercially available (3 examples) those using Linux and those having reported using open source software As this is a vendor agnostic paper the commercial RTOSes are referred to as Commercial A Commercial B and Commercial CTHE DATA IS ACCURATE ndash JUST THE NAMES HAVE BEEN WITHHELD

Simultaneously arranging them in matrix format comparative data was derived from the database as follows

bull Number of software and hardware developers per projectbull Number of months between project start and project

completion (development duration)bull Percentage of developments completed behind schedule and

the number of months of behind schedule activityTHESE DATA CAN BE USED TO CALCULATE THE AVERAGE TOTAL COST OF DEVELOPMENT

bull Multiplying the number of developers per project by the development duration yields ldquoBase Development Cost in Man Monthsrdquo

bull Multiplying the number of developers per project by the percent of behind schedule completions and by the number of months the development was behind yields ldquoBehind Schedule Costs in Man Monthsrdquo

bull Combining these ldquoCosts in Man Monthsrdquo yields ldquoTotal Cost of Developmentrdquo measured in man months

By assuming that on average a developer man month (salary plus overhead) equal to $10000 the comparative Total Cost of Developments for the six cadres can be shown in dollars

WHAT WE LEARNED FROM TABLE Ibull One needs to look at the factors that create total direct

costs ndash not at any one particular data point Developers can improve time-to-market by adding more developers to the project ndash but at an increased cost Comparing behind schedule completions to each other can also be misleading The cost of the loss in schedule time depends on the number of project developers as well as the number of months lost to schedule

bull The Average Cost of Development (measured in man months) is measured by multiplying the number of develop-ers required for a project by the number of months required to complete the project

bull Although the average number of developersproject is bet-ter for Commercial RTOSes A and C Commercial RTOS B

2016 RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Development time in months 125 122 138 128 126 136

behind schedule 367 303 244 360 390 389

Months behind 36 40 38 37 38 40

SW Developersproj 83 65 79 63 97 93

Average Developer monthsproject 1038 793 1090 806 1222 1265

Developer months lost to schedule 110 79 73 84 144 145

Total developer months project 1147 872 1163 890 1366 1410

At $10000developer month

Average developer costproject $1037500 $793000 $1090200 $806400 $1222200 $1264800

Average cost to delay $109660 $78780 $73249 $83916 $143754 $144708

Total developer costproject $1147160 $871780 $1163449 $890316 $1365954 $1409508

Table 1 Total Costs of Development Comparing Developent Costs of Commercial Oses with those of Open Source and Embedded Linux Developments

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

34 | RTC Magazine MAY 2016

BEST HOTEL TO STAY Gitat hario Erferaturia sitatia tibusci officae sed minimol uptaquunto volupta il ipidus ere doluptatem dolecea porem voluptatur ut lat fugit in natur quaspe vel ius incitatem hic tem vendebitam ipsusandandi ullaccus dolenet late sit mo-luptatio consequassin restem

IS AM HIL IS DDOLORERE PERNATIA seri in exerovi duntia vent Ilitatque

dolecto enet lam accae nobitincid eatur

WRITEN BY SARAH HUGES | PHOTOGRAPH BY JOHN KEI

30 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

34 | RTC Magazine MAY 2015

had many fewer behind schedule completions and yet RTOS A had a 334 lower cost of development than RTOS B

bull What is important to cost sensitive managers (including CFOs) is the 6 cost figures presented in Table I Namely Average Man Monthsproject Man Months lost to behind schedule completion Man Months lost to Cancellation and Total Average Man Months required for completion

bull In addition it makes sense that projects that require few months to complete donrsquot experience the burden of lost op-portunities that longer projects may incur Our data cannot account for this

bull To complete the cost analysis one needs to include the RTOS acquisition cost To be fair in calculating comparative costs between commercial RTOSes and open source develop-ments one needs to add acquisition costs to the cost figures

WITHIN 10 FOR RTOSINDUSTRY

COMMERCIAL RTOS A

COMMERCIAL RTOS B

COMMERCIAL RTOS C

OPENSOURCE

EMBLINUX

Performance 460 684 476 497 537 565

Systems Functionality 450 579 524 376 482 547

presented in Table I Looking at Table I might lead some readers to conclude that

the average cost of development is the same for all RTOS devel-opments which includes Linux developments and open source developments This is not necessarily so There are a number of high power commercial RTOSes for which the cost of develop-ment is very high as well as a number of commercial RTOSes whose development costs are much lower than those of Linux or open source developments

The important take away from Table I is that although most Linux and open source software is free ndash that is free of acqui-sition costs ndash it canrsquot be really free if the actual cost of develop-ment is greater than the cost of a commercial RTOS

What Table I doesnrsquot take into consideration is whether the design was compromised (by removing features and capabili-ties) in order to meet a target window of opportunity In such

Table 2 Comparing Design Outcomes between Commercial Oses and those of Open Source anad Embedded Linux Developments

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

RTC Magazine MAY 2016 | 35

a design might appear to be cost effective but fail to reach its intended capabilities

The 2016 survey and associated data address this possibil-ity EMF calls this ldquoDesign Outcomesrdquo in which developers indicate how close their final design outcome compares with their pre-design expectation Developers are given choices from within 10 to within 50 with 10 intervals and a final data point ldquonot within 50rdquo

Clearly ldquowithin 10rdquo represents the best possible design outcome and shows that feature and capability requirements were met

SummaryIn an increasingly competitive embedded environment where

cost containment and time to market are keys to success it is important to inform developers and financial managers to the realities that extensive and comprehensive surveys can reveal The use of Linux and open source software can be very effec-tive ndash but there are reasons why developing with them is more expensive This is a topic for a future discussion

The purpose of this paper is an attempt to put forward a ra-tional discussion regarding the use of commercial and so-called ldquofreerdquo software The data presented in Tables I and II are based on data derived from a broad user base Certainly we may find that for certain verticals and for specific projects open source outcomes may prove to be less costly The 2016 EMF database

includes 32 different design projects reported by developers In addition we can break out developments into 4 distinct levels of complexity as well according to whether or not cadres of developers are working on IoT applications We did not pursue these possibilities

For example when looking specifically at automotivetrans-portation applications open source developments have been found to have the same or slightly better costs of development than those using a commercial RTOS

What we have presented here is data regarding costs of devel-opment between commercial and free RTOSes based on year-over-year data derived from over 2600 survey respondents Letrsquos base future discussions on these or other statistically accurate information ndash not on anecdotal stories

About the authorJerry Krasner PhD MBA is VP and Chief Analyst at Embedded Market Forecasters a Division of American Technology Interna-tional Inc Before moving to the analyst side of the marketplace he was the co-founder of 4 medical device companies two of which were taken publicwwwembeddedforecastcom

Industryrsquos First NVMe over Fabric Flash Array Dramatically Increases Application Performance

bull Delivers up to 10x higher bandwidth and 10x lower latency versus ISCSIFC flash arrays

bull Accesses data at nearly identical latencies as accessing local PCIe-based SSDs

bull User configurable into separate storage volumes and shareable across multiple hosts

bull 2015 Best of Show winner at Flash Memory Summit

13469 Middle Canyon Rd Carmel Valley CA 93924(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Middle Canyon and Mangstor delivers the industryrsquos first flash storage array supporting NVMe over Ethernet or Infiniband fabrics and packaged via an RDMA cluster scale-out architecture that delivers lower latency and higher IOPS performance than traditional SAN solutions The NX Series provides the highest performance storage tier for business analytics and HPC applications as well as a caching storage layer for Big Data applications It also provides high concurrent ReadWrite bandwidth for video storage and delivery The NX Series flash arrays are based on Mangstorrsquos MX6300 SSDs and its TITAN software stack TITAN provides industry-leading performance and latency by tightly integrating NVMe SSDs with a high-performance low latency network and efficient use of x86

server capabilities The array appears as local Direct Attached Storage (DAS) to any attached servers for seamless integration with existing applications and storage infrastructures and has all of the management and serviceability benefits of centralized storage

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

IntroductionSoftware was once seen as the ldquoholy grailrdquo since it is not me-

chanical many organizations figured it could be written once and used many times without breaking down But problems began to appear ultimately caused by the continual development of soft-ware without the correct quality control processes typically due to incredible business pressures to release new products

This has resulted in legacy software applications carrying an enormous amount of technical debt a metaphorical term for latent defects introduced during system architecture design or development The accumulated liability of technical debt created when organizations take design and test shortcuts in order to meet short-term goals eventually make software difficult to main-tain As technical debt increases developers spend a majority of their time fixing bugs and struggling with fragile code rather than building new features

For this reason legacy code bases are one of the biggest challenges in software today Many organizations are finding that legacy software typically has a waning lifespan after that they are forced to decide whether to throw it away and start again from scratch or try to salvage it In most cases a substantial financial investment has been made in the code base and there is tremen-dous pressure to re-use it

Security Concerns Increasing in an IoT World

When software was held in proprietary systems or closed en-terprise environments technical debt issues could stay somewhat contained However with the Internet of Things (IoT) enabling the interconnection of the physical and virtual world based on in-teroperable communication technologies technical debt becomes a more serious problem Gartner predicted that there would be ldquo49 billion connected things in 2015 up 30 from 2014 andhellip[could] reach 25 billion by 2020 Note 1rdquo

In IoT essentially every electronic device will have network

connectivity That means every manufacturer of electronic devices will also be in the software business This redefines the need for security by expanding the scope of responsibility into new platforms and services The demand for predictable behavior is paramount especially if the safety of users or the environment is at risk However in a fiercely competitive industry such as IoT first-to-market advantage is huge and developers will be under intense pressure to get products released quickly

It has been proven time and again in software development that this thinking sacrifices quality for speed This tradeoff can be dangerous with regard to many IoT-enabled products such as smart cars medical devices and home safety systems Malfunc-tion of these systems can put lives at risk Stricter software quality measures and a focus on testing are going to be a top priority for many senior executives

Characterizing the Behavior of SoftwareThe key to reducing technical debt is to refactor components

(the process of restructuring application components without changing its external behaviorAPI) over time but developers are often hesitant to do so for fear of breaking existing functionality One of the biggest impediments to refactoring is the lack of tests that formalize existing behavior or a testing environment that proves the correct behavior of the component Without refactor-ing an applicationrsquos code becomes overly complicated and difficult to maintain As new features and bug fixes are bolted onto existing functionality the original design often loses its simplicity

According to a Gartner study ldquoa lack of repeatable test cases limits an organizationrsquos ability to demonstrate functional equiva-lence in an objective measurable way Note 2rdquo This is a growing problem as there are many deployedfielded applications based on legacy code bases that donrsquot have test cases to run against The reason companies are facing an issue in the first place is often that they want to deploy software in a new platformproduct and they have essentially broken the existing test frameworks needed

36 | RTC Magazine MAY 2016

An Industry in Transition The Impact of Technical Debt on the Internet of Things

by William McCaffrey Co-founder and Chief Operating Officer of Vector Software

Software testing is an industry in transition as we become increasingly dependent on products whose functionality is controlled by software For example the industry is learning to adapt to the effects of Technical Debt on IoT as more devices become interconnected

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

Game Changing Performance for Data-Intensive Latency-Sensitive Enterprise Applications

Performance delivers industry-leading NVMe SSD IOPS and latency via software configurable flash controller

Manageability provides a suite of management features specific to PCIe flash memory and the NVMe specification

Reliability supports end-to-end data protection optimizing the entire data path from network to flash in the event of data corruption and power loss

Interoperability provides seamless integration with server operating systems using standard in-box drivers13469 Middle Canyon Rd Carmel Valley CA 93924

(408) 718-7854 bull salesmiddlecanyoncom bull middlecanyoncom

your fast flexible and responsive partner

Accelerate Application Response Times with Industryrsquos Fastest PCIe MX6300 SSDs from Middle Canyon and MangstorKey Performance AttributesInnovative software-based host offload design utilizes a highly efficient 100-core processor located on the SSD

bull Delivers leading performance low host CPU utilization

bull Offloads flash management and application acceleration operations to the SSD locally reducing system power while freeing the host resources for application processing

bull Includes high-performance algorithms and software that runs on the flash controller

bull Handles all data management at very high speed to and from the host CPU and SSDs

Figure 1 Approach to paying off technical debt Once the behavior of software has been baselined developers can make modifications to the code with confi-dence that application behavior has not regressed

RTC Magazine MAY 2016 | 37

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

38 | RTC Magazine MAY 2016

31 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

to validate the software There is a massive quality gap that needs to be addressed along with insurmountable work ahead ndash and companies usually donrsquot know where to start or donrsquot have the resources needed to address the problem

The lack of sufficient tests typically means that a software ap-plication cannot be easily modified since unfortunately changes frequently break existing functionality If some existing capability is broken the developer needs to understand if it was because the original software was written incorrectly or missed a requirement that wasnrsquot adequately captured in the original implementation

Baseline testing also known as characterization testing can be done to characterize the current behavior of software and is useful for legacy code bases that have inadequate test cases Once the cur-rent behavior of the software is understood it is then reasonable to look at the source code as a basis for defining test scenarios

By using automatic test case generation to quickly provide this baseline set of tests that capture existing behavior testing com-pleteness of legacy applications is improved and refactoring can be done with confidence that application behavior has not regressed

Approach for Paying Off Technical DebtThe baseline testing process will determine how much technical

debt an application is carrying To address it an organization will usually attempt to go through an exercise of refactoring

Once the behavior of the software has been characterized through baseline testing a developer can start making updates and modifications to the code Change-based testing can then be used to run only the minimum set of test cases needed to show what effect the code changes have on the integrity of the whole system It is not uncommon for a company to take one to two weeks to run all of its test cases With change-based testing a developer can make a ldquoone-linerdquo change and get feedback on its impact to the entire application within a few minutes (See Figure 1)

As a result developers are able to make quick increments on the code while knowing that they have the test cases needed to capture the existing behavior of the software They are also able to do further analysis if something is broken to work out if a bug has been introduced a capability has been removed that actual-ly should be there or if there is a bug that should be addressed because it may have other ramifications

IoT and Legacy Software When Consum-er-Grade Systems Become Safety-Critical

There has been an interesting shift driven by IoT that has re-sulted in a new generation of software that previously did not have safety-critical requirements but now does For example in the era of self-driving cars the telematics system is becoming one of the most critical in-vehicle systems Autonomous driving capabilities have shifted this software-driven system from a consumer-grade communication application to safety-critical as certain autono-mous driving capabilities are reliant on telematics information

This telematics information is enabling potentially life-saving applications For example if a vehicle five cars in front of yours brakes instead of you having to wait for a visual cue from the

vehicle directly in front the vehicle five cars ahead will send a broadcast to your vehicle over the telematics interface that it is braking ndashand that your vehicle also needs to start braking now In this case faulty software has severe ramifications so quality is no longer an option -- it is a necessity

Existing software usually has to be updated to accommodate these new capabilities and there often isnrsquot evidence to demon-strate how the software worked correctly in the past Baseline testing can be used to characterize the behavior of the existing software and to build the test cases needed to enable developers to make needed updates with quality and confidence

In this example the telematics system could possibly have latent system defects (technical debt) that may not be critical in its current environment -- but if the product were to be deployed in another environment those errors could manifest themselves as critical Baseline testing has two main benefits here it will uncov-er the latent bugs and when developers are doing a new revision in the software they can more easily make those changes without worrying about new issues as a result

Note 1 Gartner Concurrent Software License Metrics Are Disappearing and Require Proactive Negotiation to Minimize Material Budget Risk Rob Wilkes July 10 2015

Note 2 Gartner Monitor Key Milestones When Migrating Legacy Applica-tions Dale Vecchio May 18 2015

About the authorWilliam McCaffrey co-founded Vector Software in 1990 Mc-Caffrey teamed with John Paliotta in 1994 to develop the initial VectorCASTreg dynamic testing product He is currently the COO overseeing worldwide sales and marketing operations and business development activities at Vector Software and has over 30 years of experience in software development specializing in safety-critical embedded systems wwwvectorcastcom

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

Rugged Solutionsfor Mission Critical Applications

Contact Us Today to Discuss Your Rugged Needswwwsystelusacomcots 1-877-979-7835salessystelusacom

bull Military-Grade Custom and COTS Rugged Systems Designed to Excel in the Harshest Environments

bull 25 Year Track Record of Excellence bull SWaP Optimized

Rack Mount Servers and Workstations

Embedded SystemsHigh Performance Computing

Flat Panel Displays and Computers

MIL-STD-810GMIL-STD-901DMIL-STD-167MIL-STD-461DO-160IP66

All Systel products are designed manu-factured and tested in the USA

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

40 | RTC Magazine MAY 2016

From avionics and automotive control to medical instru-mentation there is a special class of applications where fast and available are not enough In these life or death applications the software must also exhibit safety criticality This heightened level of reliability ensures that the software is verified correct to minimize failure and that if it does fail that the design level and system safety assessment minimize the threat to life and limb

Undergirding this special breed of software is the safety-crit-ical real-time operating system which ensures that applications have guaranteed access to computer resources and that if they fail the damage is contained and the most critical functions continue to run These RTOSes must be not only fast secure and reliable but exhibit verified correctness through a rigid design and development process A safety-critical RTOS must

Safety-critical RTOS Demands Verified Correctness

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

by Greg Rose Vice president of marketing DDC-I

The real-time operating systems used in safety-critical applications must offer more than fast deterministic real-time response They must offer time and space partitioning facilities that ensure that critical tasks run to completion and prevent errant and mali-cious code from corrupting critical functions They must also undergo rigorous design and development processes that verify correctness

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

RTC Magazine MAY 2016 | 41

adhere to the most stringent development analysis verification and test methodologies and undergo the most extensive certi-fication processes by industry and governmental certification authorities

Verifying and certifying safety criticalityNowhere is the demand for safety criticality greater than in

avionics where DO-178C sets the guidance for verification and certification DO-178C specifies five levels of design assurance (Level A to Level E) with Level A being the most stringent Software that can result in a catastrophic failure and loss of life must meet Level A where the probability of failure cannot exceed more than one in 109 per operating hour At the other end of the design assurance level (DAL) spectrum is Level E which applies to software that canrsquot impact safe operation of the aircraft such as passively collecting maintenance data over time for later analysis

DAL A verification ensures that software performs its intend-ed function to an appropriate degree of confidence detecting and reporting software errors that have been introduced during the software development process It confirms that all executable code traces to system software architecture and source code requirements and that 100 of the code paths have been tested This becomes particularly important as the RTOS and appli-cation software evolve making it easier to identify and elimi-nate dead code that can creep into the design as new features upgrades and fixes are added

Verification consists of three activities review testing and analysis Review is a qualitative assessment of compliance with requirements architecture and verifiability to ensure accuracy correctness consistency and completeness

Testing demonstrates that the software meets requirements and to a given degree of confidence that errors that could lead to unacceptable failure conditions (ie incorrect software incorrect requirements incorrect test case) have been removed Hardwaresoftware integration tests verify correct operation in the target environment Software integration tests verify

software interfaces and interdependencies such as initialization control and data coupling

Analysis is a quantitative assessment of accuracy correctness consistency and completeness that utilizes test analysis coverage analysis and traceability analysis The purpose of structural cov-erage analysis which encompasses statement coverage decision coverage and modified condition decision coverage (MCDC) is to ensure adequacy of the test set -- that sufficient testing has been done for the desired assurance level

TraceabilityTraceability analysis makes it easier for designers to verify

that software developed using techniques like UML and math-ematical modeling object-oriented programming and formal methods achieves the desired level of safety criticality It ensures that every requirement is implemented and tested and that every line of code has a reason to be (all code traces to at least one requirement)

Traceability must be top-down and bottom-up from models and requirements down to each line of code and back from the code to the requirements and model including all interceding work products and test cases Traceability also requires that the executable code be intact relative to the source code Many com-pilers for example add branch points in the executable code that are not present in the original source code These branch points must be identified and tested Conversely some optimizations can remove constructs data in particular especially static data

Time and space partitioningUnlike conventional RTOSes which utilize purely pre-emp-

tive interrupt driven scheduling safety-critical RTOSes like Deos may utilize a hybrid approach that combines pre-emptive scheduling with time partitioning In this model safety-critical tasks are budgeted a fixed period time that guarantees sufficient time to execute If they exceed their budget an exception will be raises that can be handled appropriately by the system Remain-ing tasks run within their time budgets to completion or until

Figure 1 By reducing cache interference cache partitioning reduces both worst-case execution time (WCET) and the delta be-tween WCET and average case execution time (ACET) This not only speeds cache access for critical tasks but increases budgeting effi-ciency and CPU utilization

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

42 | RTC Magazine MAY 2016

32 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

they are pre-empted by a higher priority taskMost safety critical RTOSes utilize a partitioned memory

architecture that allows programmers to run the kernel and all critical application tasks each in their own separate memory partitions where they cannot be corrupted by code running in other partitions This not only enhances safety by isolating and containing failures it also enhances security by preventing lower design assurance or malicious user code from accessing the memory allocated to critical tasks

RTOSes such as Deos afford an extra level of protection that prevents developers of lower design assurance code or less ex-perienced developers from allocating and accessing critical por-tions of memory Typically it is the least skilled developer who poses the greatest risk to system integrity The Deos platform integrator prevents novice developers who would likely be work-ing on tasks with the lowest safety criticality requirements from allocating memory reserved to critical tasks or critical resources by defining their access privileges in the system registry

Performance considerationsWhile the ability to respond quickly to external events is key

to any real-time system it is the ability to minimize worst-case execution time for critical tasks while guaranteeing those tasks sufficient time to execute that characterizes safety-critical systems For developers managing shared resources is essential to mini-mizing worst case execution times (WCET) for critical tasks

For example on-chip cache allows processors to run at on-chip memory bus speeds and increases overall compute power However task switching and competition for cache resources can degrade cache performance and dramatically increase WCET Benchmarks show that WCET can be three times higher than average-case execution time (ACET) on single-core proces-sors and an order of magnitude (or more) higher on multi-core

processors due to cache effectsTo help programmers isolate safety-critical tasks from det-

rimental cache effects DDC-Irsquos Deos safety-critical operating system utilizes a technique called cache partitioning (Figure 1) By setting aside dedicated sections of the cache for critical tasks (or groups of tasks) developers can reduce interference and pro-vide timely deterministic access to cache This reduces WCET thereby decreasing the amount of time that must be budgeted for critical tasks maximizing the ldquoguaranteedrdquo execution time available to safety-critical tasks and increasing CPU utilization

Slack scheduling further increases performance by enabling programmers to harvest the unused time budgeted to time-crit-ical tasks (Figure 2) While cache partitioning reduces the delta between WCET and ACET time-critical tasks will on average still use less time than they are budgeted Slack scheduling enables that unused time to be recouped on the fly and made available to other threads

FACE brings interoperability to safety critical software

No discussion of safety critical software development would be complete without a word on cost and time to market where vendor lock and proprietary interfaces have exacerbated the already steep costs and long delays associated safety-critical verification and certification Leading the charge for cost con-tainment in the software realm is the Future Airborne Capability Environment (FACE) a collaboration of government and in-dustry charged with enhancing interoperability and portability across DoD avionics applications and platforms

By establishing standards for software interfaces interopera-bility and certification FACE will reduce vendor lock opening what have historically been sole-sourced software solutions from one vendor to interoperable solutions from multiple suppliers

This increased competition not only lowers per-program cost but also makes it easier for program managers to take advantage of best-in-class technology and services The new standards will also enhance portability and reuse further reducing cost by making it easier to utilize software compo-nents across multiple platforms and programs

As part of the FACE initiative

Figure 2 Time-critical tasks typically use less time on average than they are budgeted worst case Slack scheduling enables that unused time to be harvested in real time and made available to other threads thereby boosting CPU utilization

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

RTC Magazine MAY 2016 | 43

COTS Technology with a Custom Twist

Sundance Multiprocessor Technology Ltdcotssundancecom bull wwwsundancecom

Many companies choose to focus on what they offer to the customer by way of solutions and skills System providers and niche market OEMs often sub-contract their computer hardware design If your application has unusual requirements Sundance has the skills and resources to specify design manufacture and test a custom solution for you

Our design engineers will help you to develop a specification that meets your requirements whilst making every effort to ensure that your product conforms to appropriate industry

standards By doing so your product will be re-useable in future system-building applications As a result you will enjoy the benefits of both compatibility and an optimised

solution along with a fast cost-effective route to market

For more information on any of these products or assistance please contact us and we will help you the best we can

Photo US Air Force Sr Airman Nathanael Callon

the consortium has developed a base profile for RTOSes that combines ARINC-653 and POSIX scheduling The ARINC-653 interface provides the rigid fixed-in-time scheduling required for tasks with high safety criticality while POSIX enables developers to quickly access third party code for less critical functions such as maintenance functions with lower or no safety criticality requirements

DDC-I and On-Line Applications Research (OAR) the original developer of the RTEMS real-time operating system have announced an integrated solution for the FACE Safety Base Profile that incorporates ARINC-653 and POSIX functionality running on DDC-Irsquos Deos The integration features RTEMS host-ed in a Deos time partition giving safety-critical developers a DO-178C certifiable RTOS solution that delivers hard real-time response time- and space-partitioning and both POSIX and ARINC-653 interfaces

Reverse engineered or safety critical by design

Most so-called safety-critical RTOSes are actually generic RTOSes reverse engineered to comply with DO-178C Rather than starting with safety-critical requirements and producing RTOS code that is optimized for those requirements this band-aid approach starts with RTOS code and generates requirements

that are optimized for the code RTOSes like Deos by contrast was developed from the ground up for safety-critical applica-tions using RTCA DO-178B Level A processes This not only enhances safety critical performance and functionality but provides a streamlined path to DO-178 Level A certification

Performance functionality cost and time to market will always top the list for developers seeking an optimal safety-criti-cal COTS RTOS solution but what really separates safety-critical RTOSes from their generic counterparts is verified correctness Where safety is paramount developers must be confident that their RTOS of choice has been scrutinized at the highest level run the gauntlet of analysis test and verification and can meet the most demanding certification requirements

About the authorGreg Rose is the vice president of product management and mar-keting at DDC-I He has over 30 years of experience in marketing product management business development and engineering in embedded software hardware and intellectual property licensing Greg is a graduate of the Iowa State University where he earned a bachelor of science in electrical engineering wwwddcicom

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

44 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Securing Control Over the IIoT RTOS Comes to the Rescue

by Albert Rooyakkers Founder CTO VP Engineering Bedrock Automation

Instrumentation and Control System (ICS) vendors have been delivering Industrial Internet of Things (IIoT) solutions since mid-1990s But now as the tentacles of Moorersquos law software and communication standards spawn more powerful more connected ndash and potentially more vulnerable devices it is time to reexam-ine the fundamental assumptions about protecting this modern technology and the data that courses through it

Legacy ICS systems such as DCS PLC and SCADA systems were engineered using electronic technologies and tools from as far back as the 1970s and 1980s These ICS systems are now vulnerable to rogue actors and nations armed with cyber weapons orders of magnitude more sophisticated than the traditional ICSs they target Typical legacy systems expose pins connectors communication ports circuit boards and a host of back door operating system communication and application vulnerabilities Cyber-attack vectors of legacy platforms involve message flooding eavesdropping message spoofing message alteration message replay malformed messages server profiling session hijacking rogue servers module counterfeiting and compromised user credentials They intend to achieve remote control of the system or process steal intellectual property or both

The best alternative and most modern approach to ICS cyber security is ensuring that it is designed in This requires layering strong authentication of the ICS hardware firmware software communications and applications that comprise ICS computa-tion designing out most attack vectors and their consequences Following are some of the fundamental cyber building blocks of a secure by design ICS

Secure by Design The basicsLegacy ICS system modules are often left with multiple com-

munication ports including serial RS232 RS422 RS485 andor multiple USB and Ethernet ports for debugging diagnostic and interconnection purposes Most of these ports provide potential access to system resources and cyber-attack A modern ICS de-sign fundamentally should eliminate all but the essential network ports and then secure and authenticate all devices and networks that connect to it

Pins and interconnectionsICS backplane and module pins provide another simple means

for a host of cyber attacks including snooping and inserting communication traffic via these pins Replacing the ICS backplane and module pins with a pinless electromagnetic interconnection which is keyed and protected against snooping and insertion of unintended data packets is an effective way to counter a frontal assault through pinned interconnections (Figure 1)

ICS module and backplane pins serve as power and com-munication terminals that route receive and radiate DC to RF energy Every pin is an antenna susceptible to RFI bursts from handheld radios and EMI from motors variable frequency drives and other electrical equipment In addition most ICS system modules are constructed of vented plastic These factors make systems so susceptible to RFI that even a handheld radio

The increasing connectivity of intelligent industrial devices presents a tremendous op-portunity to transform industry The opportunity however brings potential new vulner-ability Building ICS cyber security into control systems at birth can provide the deep protection that must accompany the advance of the Industrial Internet of Things

Figure 1 The pin-less electromagnetic backplane of the Bedrocktrade industrial control system has a parallel architecture that supports ultra-fast scan times regardless of IO count The removal of IO pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every IO channel

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

RTC Magazine MAY 2016 | 45

can distort and disrupt communication and computation From crude ldquoRFI bombsrdquo to complex EMP weapons electromagnetic radiation is an ICS cyber vulnerability A pinless backplane and sealed all-metal modules counter this threat without expensive complex secondary containment

Counterfeiting protectionModule counterfeiting is widespread Rogue actors compa-

nies and nations incorporate malware into counterfeit hardware modules It is virtually impossible detect a fake from a real factory module Bolted-on cyber protection cannot defend against this but deeply embedded module hardware firmware and software authentication built upon very strong encryption can identify and reject even sophisticated fakes instantly disallowing the counter-feit module from booting compromising software

Digging deeperSecurity begins with the modular components of the system

The first requirement is a secure boot No unauthorized party should be able to tamper with the software while the processor is starting up ndash protection that cannot be just bolted-on A secure boot starts with an initial phase loaded from on chip-masked ROM so it must be built into the microprocessor silicon Numerical crypto keys that authenticate decrypt load and start additional levels of encrypted software would be stored in this secure memory A secure ICS must be able to start up and decay in a secure state Intentional or unintentional power cycling must not degrade the level of cyber protection and cyber security Secure boot of every system-wide microprocessor is essential to meet this requirement

Going longICS modules must be designed for a service life of many years

often decades Because of Moorersquos Law the strength of encryption methods degrades over time so a modern secure ICS design must use the strongest encryption available today

Encryption fundamentalsThere are two basic methods for encryption symmetric

encryption also known as secret key encryption and asymmetric encryption also known as public key encryption Symmetric encryption requires that both parties share a secret key that can be compromised on even the most tightly coupled networks while asymmetric encryption uses a public key and a private (or secret) key pair The public key can be shared and accessed without com-promising the private key and message The private key provides the means to create digital signatures which can only be verified with the associated public key Digital signatures then provide the means by which other entities can verify the integrity and authen-ticity of data sent with a particular private key

A secure ICS uses a combination of the two methods depend-ing on many factors Importantly every individual system module and digital component requires private key(s) Security depends upon keeping the private keys secret This can only be achieved if the key protection is deeply embedded and built into the hard-

ware and digital component technology All this imposes further requirements on the processor silicon It must not only support a secure method to store private keys but also be able to perform the required encryption and decryption calculations Hardware mathematical acceleration is required to ensure that built-in secu-rity does not degrade the primary objective of an ICS to perform real-time process control and monitoring

Random numbers High quality random numbers are fundamental to modern

cryptography They are used in real time to generate symmetric keys or as an initialization vector for an authentication protocol An example is a nonce an arbitrary single use number used in authentication to prevent the reuse of older communications a vulnerability known as a replay attack There are two types of random number generators pseudo random and true random Pseudo random numbers (PRNG) are mathematically generated in software while true random numbers (TRNG) also called entropy engines are hardware based and far less vulnerable to discovery The strength of the system security can be directly correlated to the quality of the randomness of the numbers A secure ICS should be built with every microprocessor having its own advanced hardware based TRNG

吀攀挀栀渀漀氀漀最礀 昀漀爀 戀爀椀氀氀椀愀渀琀 椀洀愀最椀渀最

挀漀渀最愀ⴀ吀匀㜀   ⴀ 㘀琀栀 䜀攀渀攀爀愀琀椀漀渀 䤀渀琀攀氀글 䌀漀爀攀∡ 

  ⴀ 䤀渀琀攀氀글 䜀攀渀㤀 䠀䐀 䜀爀愀瀀栀椀挀猀   

 圀攀 猀椀洀瀀氀椀昀礀 琀栀攀 甀猀攀 漀昀 攀洀戀攀搀搀攀搀 琀攀挀栀渀漀氀漀最礀

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

46 | RTC Magazine MAY 2016

33 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Operating systems and cyber securityOne of the more important technology selections in a se-

cure-by-design system is the operating system A general purpose operating system (OS) manages a computerrsquos basic functions and provides services to other applications running on the computer An RTOS (real time operating system) provides more determinis-tic event driven scheduling of computer resources An ICS will use an RTOS in the control IO and network computers and a general purpose OS in the workstation application computers (Figure 2)

Operating system cyber vulnerabilities are many and can wreak havoc on system security because they directly affect all aspects of the hardware computing engines While Windowstrade and Linux dominate the OS market there are actually more than 50 commercially available RTOSs and choosing the right one will have a significant impact on the cyber strength of control IO and network computing The operating system must have the inherent architecture to support integrated and validated middleware secure communication stacks network security protocols and em-bedded encryption libraries for safety and security applications

In Bedrock Automationrsquos patented OSAtrade secure architecture for example backplane power paths are parallel redundant and channel independent for every slot versus a typical ICS serial multi-drop power bus Each OSAtrade power path to each slot is in-dividually monitored and controlled by the Secure Power Module and Controller A user can shut off the power to a single slot if required and the system does it automatically if the slot is empty

Success metrics One metric test that can help determine if the OS is robust

enough for intrinsic cyber security protection is Evaluation

Assurance Level (EAL1 through EAL7) EAL is a numerical grade assigned following the completion of a Common Criteria security evaluation an international standard of security testing in effect since 1999 An increasing assurance level denotes increased assurance requirements required to achieve Common Criteria certification and to provide higher confidence that the systemrsquos security features are reliably implemented

Conclusion Achieving a modern secure by design automation platform is a

complex challenge but when properly designed and executed the resulting system cyber security is not only more effective but can be much simpler for users and easier to implement than the bolt-ed-on status quo at significantly lower security lifecycle costshellipand when simplicity reigns security wins

About the authorAlbert Rooyakkers has more than 30 years of process control and electronics experience Before founding Bedrock Automation he directed business and application development teams for Maxim Integrated Products including serving as Japan country manager He has also served in product and business development capac-ities for Invensys (now part of Schneider Electric) Albert holds more than 50 patents in electronics automation systems and cyber security with an additional 30 pendingwwwbedrockautomationcom

Figure 2 Layered and embedded security is outlined by this array of the cyber tech-nologies that are combined in Bedrock system modules With these cyber tools deep authentication of the module com-ponents hardware firmware operating system and applications occur

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Can Devices be Secured in the Internet of Things

by Dinyar Dastoor Wind River VP and GM of Operating Systems

Securing the Point of Interaction Device security in the Internet of Things is of paramount

importance After all devices are the ldquothingsrdquo in IoT that actually perform the system function and generate the data the system relies on They are often the points at which humans interact with the system Securing devices is particularly problematic because they are vulnerable to both physical tampering and network-borne threats

The consequences of a compromise can be severe Large-scale consumer identity theft can destroy a commercial enterprisersquos reputation and credibility A breach of a process controller on an industrial shop floor can cause costly downtime and safety hazards And in the case of networked medical devices a breach can put lives at risk

When a large-scale breach of devices occurs it is typically not the result of a single point of failure but a series of failures at multiple points of vulnerability Closing the gap at any one of those

points can go a long way toward preventing a breach altogether or at least detecting an attack in progress and limiting the damage

Developers need to address security at the device design phase which requires identifying those potential vulnerabilities based on how and where the device will be used There are a number of security measures device manufacturers can take The challenge is determining how much or how little security is needed and which measures will be most effective

Designing for ldquoJust Enoughrdquo Security Designing security into devices for IoT applications poses dif-

ferent challenges from securing enterprise software or networks Embedded devices generally have a small footprint and comput-ing resources are limited Too much security functionality can hinder the performance of the device or the system and increase the overall cost of development Yet too little can leave critical points unprotected The trick is building ldquojust enoughrdquo security to mitigate a breachmdashand the challenge for developers is figuring

out how much is ldquojust enoughrdquo (see Figure 1)

The answer depends on three key criteria

1 The environment in which the device will be deployed Is the device in a shopping mall visible to thousands of people and at risk of tampering Or is it behind locked doors in a secure facility These contrasting scenarios raise different types of security considerations

2 How the device will connect and communicate How is the device connected to a network Will it communicate over the air via a protocol such as ZigBee or Wi-Fi which may necessitate some form of encryption Is it behind a firewall

Security breaches at the device operating system level in the Internet of Things (IoT) can have severe consequences including steep financial losses damage to credibility and trust or even endangerment of human life Several high-profile data compromises illus-trate that large-scale breaches typically result from not one but multiple points of failure Closing any one of these gaps can help mitigate a breach or at least minimize the damage

Figure 1 Three criteria for designing ldquojust enoughrdquo security

RTC Magazine MAY 2016 | 47

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

48 | RTC Magazine MAY 2016

Is it connected to the public Internet or to a private intranet where it would be less vulnerable to outside interference

3 The type of data the device is storing Is the device collecting sensitive data such as personal financial or medical infor-mation Or is it capturing less-sensitive information such as weather conditions The latter case would likely require a lower level of security than the former

The answers to these questions will help you determine the security features you need to integrate into the devicersquos operating system to ensure the appropriate level of security To give yourself optimal flexibility it is helpful to use a real-time operating system that does not lock you into a set of prescribed security functions but instead gives a menu of security functionality from which you can choose the features you need

The Four Pillars of Device Security In addition to addressing these three key criteria for deter-

mining the right level of security developers need to account for security at each phase of the device lifecycle (see Figure 2)

bull Design At the inception itrsquos critical to prevent the intro-duction of malicious code during the development process Prevention measures might include signed binary delivery assuring the authenticity and non-alteration of code and developing on a software platform that has been certified

under industrial security standards such as IEC 62443 and IEC 27034

bull Execute In the execution phase the goal is to establish a ldquoroot of trustrdquo to prevent untrusted binaries from running which in turn ensures that the right software is in place on the right hardware and that they trust each other Establishing a root of trust might entail the use of secure boot technology and cryptographic key signatures to prevent unsigned code from executing

bull Operate Multiple measures can be deployed to prevent mali-cious attacks in operation mode including controls to prevent unauthorized access and securing networks using encryption

bull Power down When the device is at rest measures such as encrypted storage and secure data containers should be in place to prevent onboard data access

A Scalable Approach to Device SecuritySecurity does not always require preventive measures at every

point of vulnerability Often it makes sense to start with a few measures to secure the device for deployment then add security functionality as you progress through the device lifecycle You can achieve this with an operating system that allows you to scale and add features over time as new threats become apparent

Security Profile for VxWorksreg is an example of a technology that allows this type of scalable approach Security Profile provides a set of security capabilities designed for easy integration into the

34 HOW TO DEVELOP GOOD SOFTWARE THAT IS SAFE SECURE AND ROBUST

Figure 2 The four pillars of device security

Figure 3 Security Profile for VxWorks addresses the four pillars of device security

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

RTC Magazine MAY 2016 | 49

bullbull

salespixustechnologiescom | pixustechnologiescom

bull OpenVPX MicroTCA AdvancedTCA and more

The only limit is the imagination

Pixus offers virtually unlimited

configurations for 19rdquo rackmount

desktop and rugged enclosures

From electronics instrumentation

cases to embedded systems in the

latest backplane architectures Pixus

has a solution for you

Modular enclosure solutions and components

bull Electronics Cases

bull Subrack and faceplate components

bull Rugged options for MilAero Railway

core VxWorks real-time operating system As shown in Figure 3 the profile enhances the VxWorks

Core Platform with features that address each of the four pillars of security across the device lifecycle typical of any type of networked device (the same vulnerabilities exposed in the retail breach case study)

With Security Profile developers can select the security features they need based on their design criteria deployment environment communication and connectivity and sensitivity of data stored It enables them to implement blocking features at various levels to make it more difficult to break through security and breach the device And it gives them the flexibility to add security functionality over time

Conclusion Security of devices has to be a prime

concern of IoT system developers and device manufacturers and needs to be addressed at the design stage Building se-curity into devices poses unique challeng-esmdashdevices require ldquojust enoughrdquo security to mitigate intrusions without compromis-ing device performance

Experience shows that attacks on devices typically exploit multiple points of vulnerability Closing even a few of these gaps can mitigate the damage

Fortunately technology such as Security Profile allows developers to take a scalable approach to security adding as much or as little as the device requires for its purpos-es making it possible to control costs and deliver devices on schedule while reducing the risks of security breaches

About the authorDinyar Dastoor manages the Operating Systems portfolio of products at Wind River He is actively engaged in the end-to-end elements of the Internet of Things especially as applied to the industrial medical aerospace and defense markets that require high levels of safety and secu-rity He has nearly 30 years of embedded device industry experience holding various senior executive positions man-aging product management engineering sales professional services and customer support He holds an MBA and Masterrsquos Degree in Control Systems He is based in Wind Riverrsquos Santa Clara CA officewwwwindrivercom

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

RTC (Issn1092-1524) magazine is published monthly at 905 Calle Amanecer Ste 150 San Clemente CA 92673 Periodical postage paid at San Clemente and at additional mailing offices POSTMASTER Send address changes to The RTC Group 905 Calle Amanecer Ste 150 San Clemente CA 92673

Company Page Websitecongatec 45 wwwcongatecus

Green Hills Software 17 wwwghscom

Middle Canyon 35 37 50 wwwmiddlecanyoncom

Novasom Industries 4 wwwnovasomindustriescom

One Stop Systems 2 34 wwwonestopsystemscom

Pentek 52 wwwpentekcom

Pixus Technologies 49 wwwpixustechnologiescom

Sundance 43 wwwsundancecom

Supermicro 11 wwwsupermicrocom

Systel Rugged Computers 39 wwwsystelusacom

TQ 51 wwwembeddedmodulesnet

Wearables TechCon 15 wwwwearablestechconcom

ADVERTISER INDEX

50 | RTC Magazine MAY 2016

GET CONNECTED WITH INTELLIGENT SYSTEMS SOURCE AND PURCHASABLE SOLUTIONS NOWIntelligent Systems Source is a new resource that gives you the power to compare review and even purchase embedded computing products intelligently To help you research SBCs SOMs COMs Systems or IO boards the Intelligent Systems Source website provides products

articles and whitepapers from industry leading manufacturers---and its even connected to the top 5 distributors Go to Intelligent Systems Source now so you

can start to locate compare and purchase the correct product for your needs intelligentsystemssourcecom

Rugged Rack Server Storage at a Very Exceptional Value

ldquoGRANDrdquo 2U RACK MOUNT SERVER

bull Dual Intelreg Xeonreg E5-2600 v3 series (Haswell-EP)bull Memory Slots 16 DDR4 RDIMM LRDIMM UDIMM up to 2133 MHzbull Intelreg C610 (Wellsburg) PCH Platform Controller Hubbull Expansion Slots 4 PCI-E 30 x8 Full-Height Half-Length via riser slots OR

2 PCI-E 30 x16 (x16 mechanical) Full-Height Half-Length via riser slots 1 PCI-E 30 x8 mezzanine slot

bull Up to 12 Hot-Swap 35rdquo SASSATA rotational or solid state drives OR Up to 24 Hot-Swap 25rdquo SASSATA rotational or solid state drives

For a full descriptioncapabilities check out wwwmiddlecanyoncom13469 Middle Canyon Rd Carmel Valley CA 93924salesmiddlecanyoncom bull wwwmiddlecanyoncom

your fast flexible and responsive partner

Benefit from proven server design manufacturing and delivery experience to support your organizationrsquos data-center computing needs and total-cost-of-ownership (TCO) objectives Middle Canyon 2U rack-mount server leverages modular-design principles to provide a robust highly-configurable and energy-efficient platform Middle Canyonrsquos server products incorporate the latest processor memory and storage technology with thermally-optimized mechanical designs and advanced power solutions to increase your organizationrsquos networking performance and energy efficiency

Made in the USA

50 | RTC Magazine MAY 2016

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

Experience Real Design Freedom

For more information call 508 209 0294wwwembeddedmodulesnet

Only TQ allows you to choose betweenARMreg Intelreg NXP and TI

bull O-the-shelf modules from Intel NXP and TI bull Custom designs and manufacturingbull Rigorous testing bull Built for rugged environments -40degC +85degC bull Long-term availability bull Smallest form factors in the industrybull All processor functions available

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat

Critical Recording in Any Arena

Pentekrsquos rugged turn-key recorders are built and tested for fast reliable and secure operation in your environment

Call 201-818-5900 or go to wwwpentekcomgortctalonfor your FREE High-Speed Recording Systems Handbook and Talon Recording Systems Catalog

Introducing Pentekrsquos expanded line of Talonreg COTS

rugged portable and lab-based recorders Built to capture wideband SIGINT radar and communication signals right out-of-the-box

bull Analog RFIF 10 GbE LVDS sFPDP solutionsbull Real-time sustained recording to 4 GBsecbull Recording and playback operationbull Analog signal bandwidths to 16 GHzbull Shock and vibration resistant Solid State Drivesbull GPS time and position stampingbull Hot-swappable storage to Windows

reg NTFS RAIDs

bull Remote operation amp multi-system synchronizationbull SystemFlow

reg API amp GUI with Signal Analyzer

bull Complete documentation amp lifetime support

Pentek Inc One Park Way Upper Saddle River NJ 07458 bull Phone 2018185900 bull Fax 2018185904 bull e-mailinfopentekcom bull wwwpentekcomWorldwide Distribution amp Support Copyright copy 2013 Pentek Inc Pentek Talon and SystemFlow are trademarks of Pentek Inc Other trademarks are properties of their respective owners

When You Canrsquot Afford to Miss a Beat


Recommended