Computer platform with additional configuration file, related electronic avionics system

A computer platform on board an aircraft, that executes a set of application partitions, hosts an operating system and includes: resources; a boot package including a kernel, at least one resource driver, a set of system partitions and at least one resource configuration table, each system partition including at least one operating system service; and a boot controller able to be executed first, following power-up of the platform and configured to launch the boot package. The boot controller verifies whether an additional configuration file is present in the storage memory, and launches, before the boot package, the additional configuration file including at least one resource configuration table, then used instead of a respective table of the same type from among the at least one table of the boot package.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a U.S. non-provisional application claiming the benefit of French Application No. 23 03958, filed on Apr. 20, 2023, which is incorporated herein by reference in its entirety.

TECHNICAL FIELD OF THE INVENTION

The present invention relates to a computer platform able to execute a set of application partitions, each one including an avionics software application, including resources and hosting an operating system.

The invention also relates to an electronic avionics system intended to be on board an aircraft, the avionics system comprising such a computer platform.

The invention relates to the field of configuring software applications, in particular avionics applications, able to be loaded onto a computer platform comprising resources, including a processor and at least one memory.

Such software applications, also known as Loadable Software Parts or LSPs, are generally configurable:either during design time, by integrating them during the generation of the configuration values adapted to the execution context of the respective software application;or during run time, by fetching this configuration from a dedicated software or hardware memory zone provided for this purpose. It is then necessary to pre-program said memory zones with the appropriate configuration parameters.

Such loadable avionics software applications typically comply with the ARINC 665 standard, also known as A665, in its version A665-3 dated Dec. 8, 2005 and subsequent versions.

BACKGROUND OF THE INVENTION

In the case of software applications that can be configured during the design stage, a computer platform able to execute the set of application partitions is known, the platform comprising resources, of which, hardware resources and hosting an operating system, the hardware resources including a processor, RAM and storage memory. The computer platform also includes, in the storage memory, a boot package including a kernel, at least one resource driver, one set of system partitions and one hardware resource configuration table, each system partition including at least one operating system service; and a boot controller able to be executed first following power-up of the platform and configured to launch the boot package.

The advantage of configuring software applications during the design stage is to guarantee better control over the configuration taken into account, to avoid the need to add robustness to configuration values, and to facilitate certification, in particular ETSO (European Technical Standard Order) certification, of software applications by allowing precise characterization of platform performance during the design stage, without any possible variation linked to a user context at runtime.

However, changes in the execution context of software applications very often require new versions of software applications to be regenerated, incorporating the new configuration values.

SUMMARY OF THE INVENTION

The aim of the invention is to provide a computer platform allowing the changes to be easily taken into account in the execution context of software applications.

To this end, the invention has as its object a computer platform intended to be on board an aircraft and able to execute a set of application partitions, the platform hosting an operating system and including resources, of which, hardware resources including a processor, a random access memory and a storage memory;the computer platform further including in the storage memory:a boot package including a kernel, at least one resource driver, one set of system partitions and at least one resource configuration table, each system partition including at least one operating system service, the or each table being selected from among the group consisting of: a table of a first type containing configuration values of hardware resources, a table of a second type containing configuration values of resources used by a respective set of partitions, a table of a third type containing configuration values of resources used by a respective partition, the first, second and third types being distinct from one another, one of the at least one table being of the first type; anda boot controller able to be executed first when the platform is powered up, and configured to launch the boot package;the boot controller being configured to verify whether an additional configuration file is present in the storage memory, and then to launch the additional configuration file before the boot package,the additional configuration file including at least one resource configuration table of a type selected from among the first, second and third types; each table of the additional configuration file then being used in place of a respective table of the same type from among the at least one table of the boot package.

With the computer platform according to the invention, the additional configuration file including at least one resource configuration table makes it easier to take into account evolution in the execution context of the software application(s) by allowing new configuration values to be added after the design of said software application(s).

In other words, the computer platform according to the invention allows the software applications configuration to be carried out during design, with the associated advantages, while allowing new configuration values to be added after said design, thus remedying the aforementioned drawback.

Preferably, the boot controller is configured to launch the additional configuration file before the boot package if said additional file includes a table of the first type, in other words, containing the hardware resource configuration values, and the or each configuration table of the additional configuration file then replaces the configuration table of the same type from among the at least one primary table.

More preferably, if the additional configuration file includes a hardware resource configuration table, that is, a table of the first type, then the hardware resource configuration values contained in said table each belong to value ranges for which the computer platform has been previously certified, which allows the benefit of the certification carried out to be retained, and then avoid a new certification, or recertification.

Even more preferably, the additional configuration file is constituted of the at least one configuration table, and the additional configuration file is then easier to generate and quicker to load than a new version of the boot package modified to introduce the new configuration values.

In other advantageous aspects of the invention, the computer platform comprises one or more of the following features, either individually or in any technically possible combination:if, during verification for the presence of said additional configuration file, the storage memory does not contain an additional configuration file, then the boot controller is configured to launch the boot package;the boot controller is configured to launch the additional configuration file only if at least one launch condition is met, each launch condition being selected from among the group consisting of: an authenticity verification of the additional configuration file, and an integrity verification of the additional configuration file;the boot controller being preferably configured to launch the additional configuration file only if all the launch conditions are met, from among the authenticity verification of the additional configuration file and integrity verification of the additional configuration file;the computer platform is able to operate in an operating mode selected at least from a degraded mode in which only the set of system partitions is executable from among the sets of system partitions and application partitions, and an operational mode in which the sets of system partitions and application partitions are each executable;at least one from among the boot package and the additional configuration file contains a second type resource configuration table for the degraded mode, the second type table for the degraded mode containing resource configuration values usable by the set of system partitions;at least one from among the boot package and the additional configuration file contains at least one resource configuration table of the third type for degraded mode, each table of the third type related to a respective system partition for degraded mode containing the resource configuration values used by said system partition in degraded mode;the boot package and the additional configuration file each include at most one configuration table of the first type;if the additional configuration file includes a configuration table of the first type, then the hardware resource configuration values contained in said table each belong to value ranges for which the computer platform has been previously certified;the boot package and/or the additional configuration file include several configuration tables of the second type and/or several configuration tables of the third type.

The invention also has as its object an avionics electronics system intended to be on board an aircraft, the avionics system comprising:a computer platform able to execute a set of application partitions, the computer platform being as defined above;a secondary resource configuration table, the secondary table being of the second type, stored in the storage memory, and containing the resource configuration values usable by the set of application partitions; andthe set of application partitions, each application partition including an avionics software application and a tertiary resource configuration table, each tertiary table being of the third type and containing the resource configuration values used by the respective application partition, the set of application partitions being stored in the storage memory.

In other advantageous aspects of the invention, the avionics system comprises one or more of the following features, either individually or in any technically possible combination:the avionics system comprises, in the storage memory, at least one additional configuration file;the avionics system preferably comprising several additional configuration files;such that the additional configuration file including at least one configuration table, one of which is of a first type, and at least one other additional configuration file including at least one configuration table of a type selected from among the second and third types;the or each additional configuration file includes only the at least one configuration table of a type selected from among the first, second and third types;the or each additional configuration file preferably constituted of the at least one configuration table of a type selected from among the first, second and third types; andthe avionics system further comprises a display screen and/or a human machine interface.

DETAILED DESCRIPTION

InFIG.1, an aircraft5is equipped with an electronic avionics system10comprising a set of application partitions12and a computer platform15able to execute the set of application partitions12.

Preferably, the aircraft5is an airplane. Alternatively, the aircraft5may be a helicopter, or a drone piloted remotely by a pilot.

The computer platform15includes resources18and hosts an operating system20. The computer platform15also includes a boot package22, visible inFIGS.2to8, and a boot controller24able to be executed first following power-up of the platform15and configured to launch the boot package22.

Advantageously, the computer platform15also includes a first additional configuration file26, visible inFIGS.2to8and described in greater detail below.

The operating system20, also known as OS, is, for example, an ARINC 653-compliant operating system, or a POSIX operating system, or even a hypervisor, or even a middleware.

The person skilled in the art will then understand that the operating system20is understood in a broad sense and is, more generally, a set of at least one basic software28, designed to offer services29of various types to each application partition12and/or system partition30.

A service29is therefore a function of the basic software that can be used by the application(s) and reached by a call, also known as a service call (of the OS) or even a system call. One example of basic software is an ARINC 653 or POSIX OS that provides such services. In the context of the invention, the person skilled in the art will understand that it is the notion of calling a service that is important, and not the service as such, offered by the basic software.

The services29offered by the operating system20are known per se, and are, for example, input(s)/output(s) acquisition services, process management services, communication protocol(s) management services, and so on. The types of service are therefore input/output acquisition, process management, communication protocol management and timer management, in particular triggering.

The avionics system10also comprises a set of system partitions30, each system partition30including at least one service29of the operating system20.

The resources18of the platform15are physical elements, that is, hardware, or logic elements able to be made available to the application partitions12and/or the system partitions30.

The resources18include the hardware resources, in particular a processor32, and memory resources34, such as a random access memory35and a storage memory36. The storage memory36is, for example, programmable read-only memory, such as a PROM or FPROM (Programmable Read Only Memory or Field Programmable Read Only Memory).

In addition, the resources18include input and output resources38, also known as IO resources, and graphic resources40, in other words, allowing data to be displayed.

In addition, the resources18further include resources specific to the avionics network, which are not shown. Such resources are, for example, communication routers of an ARINC664 network, in particular ARINC664 Part 3 or ARINC664 Part 7.

The computer platform15is typically able to operate in an operating mode selected from among at least a degraded mode, also noted PDL, where only the set of system partitions30is executable from among the sets of system partitions30and the application partitions12, and an operational mode, also noted OPS, where the sets of system partitions30and the application partitions12are each executable.

The boot package22includes a kernel, at least one resource driver, a respective set of system partitions30and a primary resource configuration table42, each system partition30including at least one service29of the operating system20, the primary table42being of a first type, noted HWCT.

In addition, the avionics system10comprises at least one secondary resource configuration table44, stored in the storage memory36, each secondary table44being of a second type, noted MGCT, the second type MGCT being distinct from the first type HWCT.

Advantageously, the avionics system10comprises at least two distinct secondary tables44, at least one noted440being provided for the computer platform15in the operational mode of operation, and at least the other noted44P being provided for the computer platform in the degraded mode of operation. Each secondary resource configuration table440related to the operational mode of operation contains the resource configuration values usable by a respective set of application partitions. Each secondary resource configuration table44P related to the degraded operating mode contains the resource configuration values usable by a respective set of system partitions.

As a further addition, the avionics system10comprises a set of system tertiary resource configuration tables46SO,46P for the set of system partitions30, stored in the storage memory36. Each system tertiary table46SO,46P is of a third type HACT. The third type HACT is distinct from both the first type HWCT and the second type MGCT. In the example ofFIG.1, each system tertiary table46SO,46P is included within a respective partition30.

Advantageously, the avionics system10comprises a resource configuration table of the second type MGCT for each of the operating modes from among the degraded mode44P and the operational mode440. The second type table for the degraded mode44P is constituted of the resource configuration values usable by the set of system partitions30. The second type of table for the operational mode440is constituted of the resource configuration values usable by the set of application partitions12.

Advantageously still, the avionics system10comprises, for each system partition30, a resource configuration table of the third type HACT for each of the operating modes from among the degraded mode PDL and the operational mode OPS. Each third type table related to a respective system partition30for the HACT_PDL degraded mode is constituted of the resource configuration values used by said system partition30in degraded mode PDL. Each third type table related to a respective system partition30for the operational mode46SO is constituted of the resource configuration values used by said system partition30in operational mode OPS.

Each application partition12includes an avionics software application50and a tertiary resource configuration application table46AO. Each tertiary application table46AO is of the third type HACT and contains resource configuration values used by the respective application partition12. Each avionics software application50is intended to be executed by the platform15, is then designed to issue one or more calls to the operating system20and is also configured to use the platform resources18.

Each application partition12is able to be executed only in the operational mode OPS and is not executed in the degraded mode PDL. Each system partition30is able to be executed in both the operational mode OPS and in the degraded mode PDL.

In addition, each application partition12also includes at least one library52. Each library52is a set of functions, classes, interfaces or software modules that are grouped together for easier use by the respective avionics software application50. The functions, classes, interfaces or even software modules of a respective library52relate, for example, to database management, file handling, graphics creation, or even communication with other avionics software applications50. When the software application50is executed, the or the libraries52of the corresponding application partition12are loaded into the memory, and the elements it contains are then able to be called up from the application50code.

Each application partition12typically includes, and preferably is constituted of, a single avionics software application50and one or more libraries52related to this avionics software application.

In the example ofFIG.1, the avionics system10comprises three application partitions12, namely a first application partition12A, a second application partition12B and a third application partition12C. In this example, the first application partition12A contains a single library52, and the second and third application partitions12B,12C each contain two libraries52.

A configuration table of the first type HWCT contains resource configuration values for the hardware of the computing platform15, and thus forms a hardware resource configuration table for the platform15. The configuration table of the first type HWCT typically comprises values for the following magnitudes: operating frequency of the processor32; number of processor32cores; amount of RAM, that is, size of the RAM35; amount of cache memory, that is, size of the processor32memory; number of inputs/outputs from among the I/O resources38; frequencies supported according to the ARINC 429 standard, pre-scaler value to be programmed for message dating, etc.

A configuration table of the second type, MGCT, contains the resource configuration values that can be used by a respective set of partitions, for example by the set of application partitions12, or even respectively by the set of system partitions30.

As the computer platform15being likely to be included in different avionics systems10and/or positioned in different positions on board the aircraft5, the resources18usable by a respective set of partitions12,30do not necessarily correspond to all the supportable resources of the platform15. These usable resources generally correspond only to a portion of said resources18, strictly smaller, that is, more reduced, than the totality of said resources18, the values of which are directly linked to the position of the computer platform15on board the aircraft5.

The configuration table of the second type MGCT typically comprises the values of the following magnitudes: amount of processor32time usable by the respective set of partitions12,30; number of processor32cores usable by said set of partitions12,30; amount of RAM35usable by said set of partitions12,30; amount of cache memory usable by said set of partitions12,30; input/output identifier(s) usable by said set of partitions12,30; cursor movement acceleration coefficients on the touch screens included in the graphics type resources40; threshold for triggering a partition12,30sanction by a monitoring module of the computer platform15. The partition sanction typically depends on an authorization related or not to the partition12,30which is the subject of this sanction. When the partition12,30is a partition with authorization, for example with module level rights, the partition sanction is a restart of the platform15. When the partition12,30is a partition without authorization, for example without module level rights, the partition sanction is a restart of the partition12,30concerned.

A configuration table of the third type HACT contains the resource configuration values used by a respective partition12,30, for example by a respective application partition12, or even by a respective system partition30.

Preferably, each configuration table of the third type HACT for a respective application partition12, as well as each configuration table of the third type HACT for a respective system partition30, must be compatible with the budgets of the configuration table of the second type MGCT for the sets of application partitions12and system partitions30. In other words, the sum of the configuration values contained in all the respective third type HACT configuration tables must not exceed those contained in the corresponding second type MGCT configuration table.

The configuration table of the third type HACT typically comprises the values of the following magnitudes: identifier(s) of the processor32time window(s) used by the respective partition12,30; identifier(s) of processor32core(s) used by said partition12,30; identifier of a RAM35zone used by said partition12,30; definition of communication port objects (name, size, refresh rate . . . ) and identifier of the resource concerned from among the I/Os used by said partition12,30.

In the example ofFIG.1, the avionics system10is represented in the form of a stack of layers C1, C2, C3; namely a first layer C1, also known as the hardware layer; a second layer C2above the first layer C1, the second layer C2also being known as the operating layer, or even OS layer; and a third layer C3, also known as the partition layer, above the second layer C2.

The first layer C1then includes the resources18. The second layer C2includes the operating system20, the boot controller24, the primary table42and the secondary table44P related to the degraded operating mode. The third layer C3includes the set of application partitions12, the set of system partitions30, the secondary table440related to the operational mode of operation, and the tertiary system and application tables46SO,46AO, it being remembered that the tertiary application tables46AO are included directly in the application partitions12.

A person skilled in the art will note that the computer platform corresponds to the first and second layers C1, C2of the avionics system10.

In the examples ofFIGS.2to7, the avionics system10is represented in the form of functional levels, with a first functional level N1corresponding to the elements likely to be launched first by the boot controller24, namely the boot package22and the first additional configuration file26. The first functional level N1then includes the primary table(s)42, the secondary table(s)44P related to the degraded operating mode, and the tertiary table(s)46P related to said degraded mode.

The avionics system10then includes a second functional level N2typically including the secondary table440related to the operational operating mode OPS, also known as the secondary operational table440, and one or more tertiary system tables46SO also related to the operational operating mode OPS, as well as one or more auxiliary tables58. The second functional level N2is linked to the first functional level N1, the elements of the second functional level N2being likely to be called by a corresponding element of the first functional level N1.

The avionics system10then includes a third functional level N3, typically including the set of application partitions12, as well as one or more system partitions30. The tertiary application tables46AO are then included in this third functional level N3, each being itself included in a corresponding application partition12. The third functional level N3is linked to the second functional level N2, as well as to the first functional level N1, the system partition30being executed in degraded mode, for example, and called directly by the boot package22or by the first additional configuration file26. Each application partition12is typically called by a corresponding element of the second functional level N2, that is, by the secondary operational table440or by a respective auxiliary table58.

Finally, the avionics system10includes a fourth functional level N4, typically including one or more complementary software applications56. The fourth functional level N4is linked to the third functional level N3, each complementary application56being typically called by a respective application partition12, in particular by the corresponding avionics software application50.

According to the invention, the avionics system10is likely to comprise at least one additional configuration file from among the first additional configuration file26, a second additional configuration file60and a third additional configuration file62, each additional configuration file26,60,62including at least one resource configuration table of a type selected from among the first type HWCT, the second type MGCT and the third type HACT. The first additional configuration file26typically includes a first type HWCT table, as well as a second type MGCT table, as an optional addition, for the degraded operating mode and/or a third type HACT table for said degraded mode. The second additional configuration file60includes a second type MGCT configuration table and/or a third type HACT configuration table. The third additional configuration file62typically includes a third type HACT configuration table. Advantageously, each of the first, second and third additional configuration files26,60,62includes only the at least one configuration table of a type selected from among the first type HACT, the second type MGCT and the third type HACT, and each of the first, second and third additional configuration files26,60,62is preferably constituted of said at least one configuration table of the aforementioned type.

Advantageously, the avionics system10comprises, in the storage memory36, at least one additional configuration file26,60,62, and preferably several additional configuration files26,60,62from among the first26, second60and third62additional configuration files.

The boot controller24is configured to verify whether an additional configuration file26,60,62is present in the storage memory36, and then to launch the additional configuration file26,60,62, each table of the additional configuration file26,60,62then being used instead of a respective table of the same type from the primary42, secondary440,44P, tertiary system46SO,46P and tertiary application46AO tables.

The person skilled in the art will observe that if, during verification for the presence of said additional configuration file, the storage memory36contains no additional configuration file26,60,62, then the boot controller24is configured to launch the boot package22, in the absence of said additional configuration file26,60,62.

Advantageously, if the additional configuration file26includes a table of the first type HWCT, then the boot controller24is configured to launch the additional configuration file26before the boot package22.

In addition, the boot controller24is configured to launch the additional configuration file26,60,62only if at least one launch condition is met. Each launch condition is an authenticity verification of the additional configuration file or an integrity verification of the additional configuration file.

According to this addition, the boot controller24is preferably configured to launch the additional configuration file26,60,62only if all launch conditions are met, in other words, if the additional configuration file26,60,62is both authentic and has integrity.

Preferably, the boot package22and the first additional configuration file26each include at most one configuration table of the first type HWCT.

Advantageously, if the first additional configuration file26includes a configuration table of the first type HWCT, then the hardware resource configuration values contained in said table each belong to a range of values for which the computer platform15has been previously certified.

As an optional addition, the boot package22and/or the first additional configuration file26including several configuration tables of the second type MGCT and/or several configuration tables of the third type HACT.

Various examples of the implementation of the invention will now be described with reference toFIGS.2to7.

In the example ofFIG.2, the avionics system10, and in particular the computer platform15, includes the first additional configuration file26, while no other additional configuration file is included. The boot package22includes the primary table42, as well as the secondary table44P and the tertiary table46P related to the degraded operating mode PDL.

In this example ofFIG.2, the first additional configuration file26includes only one configuration table of the first type HWCT, for example a new version of the primary table42, the new version being denoted42*. In this example, the first additional configuration file26does not include a configuration table of the second type MGCT nor of the third type HACT.

When the first additional configuration file26is launched by the boot controller24, the new version of the primary table42* included in the first additional file26is used instead of the primary table42of the boot package22. In other words, the primary table42of the boot package is then bypassed by the new version of the primary table42* included in the first additional configuration file26.

Generally speaking, in the examples ofFIGS.2to7, each table bypassed by another table in a respective additional configuration file26,60,62is masked by a cross65. In the example ofFIG.2, the primary table42of the boot package is then masked by the cross65.

This example ofFIG.2corresponds to the operating mode OPS, and the secondary44P and tertiary46P tables related to the degraded mode PDL are therefore not used.

Generally speaking, in the examples ofFIGS.2to7, the unused elements of the operating mode considered in the associated example are masked by an elliptical shape70. In the example ofFIG.2, the secondary table44P and tertiary table46P are masked by the elliptical shape70.

In the example ofFIG.3, the avionics system10, and in particular the computer platform15, includes the same elements as in the example ofFIG.2, and the example ofFIG.3differs from that of the example ofFIG.2in its operating mode, this example corresponding to the degraded operating mode PDL.

In the same way as in the example ofFIG.2, when the first additional configuration file26is launched by the boot controller24following power-up of the computing platform15, the new version of the primary table42* included in the first additional file26is used instead of the primary table42of the boot package22.

Unlike the example ofFIG.2, the secondary44P and tertiary46P tables related to the degraded operating mode are those used this time, and the tables of the second type MGCT and third type HACT implemented are then those of the boot package22, the first additional configuration file26including only the new version of the primary table42* of the first type HWCT, and not including any configuration table of the second type MGCT or the third type HACT. In other words, from among the tables included in the boot package22, only the primary table42is bypassed and then represented in a masked way by the cross65, the secondary44P and tertiary46P tables being used normally.

This example ofFIG.3corresponds to the degraded mode PDL of operation, the system partition30is executed after the boot package22has been implemented. The other elements of the second, third and fourth functional levels N2, N3, N4are not used, and are then masked by the elliptical shape70.

In the example ofFIG.4, the avionics system10includes the same elements as in the examples ofFIGS.2and3, and also includes the second additional configuration file60including a configuration table of the second type MGCT, for example a new version of the secondary table440related to the operational mode OPS of operation, the new version being noted440*.

Similarly to the example ofFIG.2, this example ofFIG.4corresponds to the OPS operational mode, and the secondary44P and tertiary46P tables related to the degraded mode PDL are not used, these tables44P,46P being masked by the elliptical shape70.

In the same way as in the examples ofFIGS.2and3, when the first additional configuration file26is launched by the boot controller24following power-up of the computer platform15, the new version of the primary table42* included in the first additional file26is used instead of the primary table42of the boot package22.

Then, the second additional configuration file60is also launched by the boot controller24, the new version of the secondary table440* related to the operational mode OPS is used in place of that of the second functional level N2initially stored in the storage memory36.

In this example ofFIG.4, the tables bypassed are therefore, the primary table42of the boot package22and the initial secondary table440related to the operational mode OPS, these two tables being represented in a masked manner by the cross65.

The example ofFIG.5is similar to that ofFIG.4, with the difference that in this example ofFIG.5the avionics system10also comprises the third additional configuration file62including a configuration table of the third type HACT, for example a new version of the tertiary application table46AO of the first application partition12A, the new version being noted46AO*.

A further difference between the examples ofFIGS.4and5is that in the example ofFIG.5, the second additional configuration file60includes both a configuration table of the second type MGCT, for example the new version of the operational secondary table440*, and a configuration table of the third type HACT, for example a new version of a respective system tertiary table46SO, the new version being noted46SO*, so that both the operational secondary table440and the respective system tertiary table46SO are then bypassed.

A final difference between the examples ofFIGS.4and5is that in the example ofFIG.5, the first additional configuration file26is empty and does not include a configuration table of the first type HWCT, or is absent, or even is not authentic and/or has no integrity, so that the primary table42of the boot package22is not bypassed and is used by the boot controller24.

In this example ofFIG.5, the bypassed tables are therefore, the initial secondary table440related to the operational mode OPS, the respective system tertiary table46SO and the application tertiary table46AO of the first application partition12A, these three tables being represented in a masked manner by the cross65.

The example ofFIG.6is similar to that ofFIG.3, with the difference that in this example ofFIG.6, the first additional configuration file26includes both a configuration table of the first type HWCT, for example the new version of the primary table42*, a configuration table of the second type MGCT, for example a new version of the secondary table44P related to the degraded mode PDL, the new version being noted44P*, and also a configuration table of the third type HACT, for example a new version of the tertiary table46P related to the degraded mode PDL, the new version being noted46P*.

In this example ofFIG.6, the tables bypassed are the primary table42, and the secondary table44P and tertiary table46P related to the degraded mode PDL, these three tables of the boot package22being represented in a masked manner by the cross65.

This example ofFIG.6corresponding to the degraded operating mode PDL, the system partition30is executed after implementation of the first additional configuration file26. The other elements of the second, third and fourth functional levels N2, N3, N4are not used, and are therefore masked by the elliptical shape70.

In the example ofFIG.7, the avionics system10, and in particular the computer platform15, includes the same elements as in the example ofFIG.6, and the example ofFIG.7differs from that ofFIG.6in the mode of operation, this example corresponding to the operational mode OPS.

In the same way as in the example ofFIG.6, when the first additional configuration file26is launched by the boot controller24following power-up of the computer platform15, the new version of the primary table42* included in the first additional file26is used instead of the primary table42of the boot package22.

On the other hand, unlike the example ofFIG.6, the secondary44P and tertiary46P tables related to the degraded mode PDL, whether it is those in the boot package22or those in the first additional configuration file26, are not used, and are therefore masked by the elliptical shape70.

In this example ofFIG.7, the only table bypassed is the primary table42of the boot package22, which is then represented in a masked manner by the cross65.

The person skilled in the art will note that the examples ofFIGS.2,3,6and7relate more specifically to the computer platform15, with only the first additional configuration file26of the additional configuration files26,60,62being present in the storage memory36in these examples.

The person skilled in the art will also understand that the various possible cases are as follows for the avionics system10according to the invention:presence of the first additional configuration file26, but not of the second and third additional configuration files60,62: the bypassed table(s) are then the tables of the boot package22for which a new version is present in the first additional configuration file26, and also taking into account the operating mode, the secondary44P and tertiary46P tables being used only in the degraded operating mode PDL;presence of the second additional configuration file60, but not of the first and third additional configuration files26,62: the bypassed table(s) are the initial secondary table440related to the OPS operating mode and/or one or more system tertiary tables46SO for which a new version is present in the second additional configuration file60;presence of the third additional configuration file62, but not of the first and second additional configuration files26,60: the bypassed table(s) are one or more application tertiary tables46AO for which a new version is present in the third additional configuration file62;presence of the first and second additional configuration files26,60, but not of the third additional configuration file62, with the tables for which a new version is present in these additional configuration files26,60bypassed as described above;presence of the second and third additional configuration files60,62, but not of the first additional configuration file26, bypassing as described above those tables for which a new version is present in these additional configuration files60,62;presence of all additional configuration files, in other words, the first, second and third additional configuration files26,60,62, bypassing as described above of the tables for which a new version is present in these additional configuration files26,60,62.

The boot sequence of the avionics system10according to the invention will now be explained with reference to the flowchart ofFIG.8.

When power is applied to the avionics system10, and therefore to the computer platform15contained within it, the boot controller24is executed first by the processor32, as represented by the arrow F1.

The boot controller24then begins by verifying whether the first additional configuration file26is present in the storage memory36at a predefined location, provided for this purpose, this presence verification being represented by the arrow F2ofFIG.8.

If the first additional configuration file26is present at this location in the storage memory36, the boot controller24advantageously verifies the authenticity and integrity of the first additional configuration file26, as represented by the arrow F3, and if this verification is positive, in other words, if the first additional configuration file26is both authentic and integral, the boot controller24will then copy each table contained in the first additional configuration file26into the RAM35.

If, during the presence verification previously carried out according to the arrow F2, the boot controller24determined that no additional configuration file26was present in the storage memory36, or even that a file was present but without a table, then the boot controller24launches the boot package22, as represented by the arrow F4, and will then in particular use the configuration tables that the boot package22contains.

The boot controller24then copies the table(s) resulting from the verifications carried out previously according to the arrows F2and F3back into the RAM35, as represented by the arrow F5. In other words, the boot controller copies into the RAM35each table contained in the first additional configuration file26, if the latter is determined to be present during verification according to the arrow F2, then advantageously as authentic and integral during verification according to the arrow F3. Otherwise, it is the configuration tables contained in the boot package22that are copied into the RAM35.

Once the configuration tables have been copied into the RAM35, the boot controller24executes an initialization program contained in the operating system20, as represented by the arrow F6, which begins by reading the configuration tables previously copied into the RAM35, as represented by the arrow F7. The boot sequence of the avionics system10according to the invention is then complete.

The boot sequence described above concerns the case where the first additional configuration file26is present, but not the second and third additional configuration files60,62, and the person skilled in the art will understand that the boot sequence is similar if the second60and/or third62additional configuration files are present, the boot controller24also taking care of verifying the presence of the second60and/or third62additional configuration files in the predefined locations provided for this purpose; then, advantageously, verifying their authenticity and/or integrity; and finally, copying the tables contained in these additional files into the RAM if the aforementioned verification is positive.

The person skilled in the art will also understand that, in the case of several additional configuration files, verifications are carried out in ascending order of their names, for example, first for the first additional configuration file26, then for the second additional configuration file60and finally for the third additional configuration file62, in the case of all additional configuration files.

Thus, the additional configuration file(s)26,60,62, including at least one resource configuration table, make it easier to take into account changes in the execution context of the software applications50, by allowing new configuration values to be added after the design of said software applications50.

This additional configuration file or files26,60,62allows, in particular, to retain the benefit of the certification already carried out, and thus to avoid a new certification or recertification, and thus to significantly reduce the technical verifications and tests required.

In addition, each additional configuration file26,60,62constituted of the at least one configuration table is easier to generate and faster to load than a new version of the boot package22that would be modified to introduce the new configuration values. This therefore allows the performance to be improved, particularly in terms of execution and calculation time, of the electronic avionics system10according to the invention.

The electronic avionics system10according to the invention, therefore, allows changes in the execution context of avionics software applications50to be taken into account more easily, while significantly reducing the technical verifications and tests resulting from these changes, and having an improved system performance when these 5 changes are taken into account.