Aerospace and Electronic Systems - March 2019 - 15

Annighoefer et al.

Figure 8.
Failure reports of topology discovery detected by the automated topology verification (problems in red). (a) Missing IOM. (b) Missing
partition. (c) Wrong interface.

either caused by physical modifications during runtime,
i.e., cable disconnection, or by injections of the test system. All single instances of broken connections, passive,
and corrupted IOMs, and passive CPMs were tested and
were correctly self-healed by the ACMS.

DISCUSSION
The AAP was designed to relieve the problematic situation
concerning the configuration of standardized avionics.
The AAP provides generic mechanisms to enable selfconfiguration for a large number of topologies irrespective
of the individual application or peripherals. The suggested
module and network types match most of today's avionics
systems, i.e., CPMs, IOMs, and a switched network. Using
the ACMS, self-configuration is shown to work reliably
using commercial off-the-shelf (COTS) hardware and software. The self-configuration time of 150 s is far less than
would be required for manual configuration activities.
However, neither today nor in the future will all peripherals
be smart, so a small portion of configuration remains, but
this was shown to work seamlessly with self-configuration.
The extended self-knowledge of the AAP enables additional fault-tolerance mechanisms without extra effort,
which means increased reliability. Finally, the integration
of system fault handling and redundancy management in
the middleware of the modules, instead of the system
MARCH 2019

applications, makes application development and change
significantly simpler, i.e., only a simplex application must
be developed and tested. Redundancy management is standardized and provided in a tested manner by the AAP.
Open issues are safety-criticality and certification. The
current realization cannot be used in a safety-critical environment. The first issue is the uncertified non-real-time OS.
Currently, major A653 compatible OS do not provide the
features necessary for self-configuration. A way out of this
dilemma might be through the use of a certified POSIX OS
or the suggestion of an extension of the ARINC 653 standard. The same applies for the network. All bus technologies currently used in aerospace rely on static routing.
Configuration during operation is not possible. Here, the
emergence of new reconfigurable buses is expected, or an
extension of the AFDX standard. Certification is the largest
open issue. The mechanisms of the AAP are oriented on
what is state-of-the-art in aircraft today. The result of selfconfiguration could be certified with existing methods
since configuration is static during operation. However,
fault-tolerance and topic-based message forwarding
require additional thoughts. Finally, some smaller issues
stated for the AAP are: 1) The publisher-subscriber mechanism hides parts of the configuration inside the applications
and can be unsuitable in a large concurrent development
process. 2) The application model of P-APP/C-APP/P-APP
is insufficient for larger distributed system applications. An
alternative is proposed [32].

IEEE A&E SYSTEMS MAGAZINE

Aerospace and Electronic Systems - March 2019

Table of Contents for the Digital Edition of Aerospace and Electronic Systems - March 2019