Applying specific design and architecture rules to Safety Critical computing

Safe-ready COTS meeting the highest safety levels for life critical applications


SAFe-VX, a fully integrated Secure Platform by Kontron & SYSGO

A solid and flexible basis for certifiable applications in trains and signaling

  • Development Platform for immediate software development
    • Based on qualified VPX building blocks (Intel x86 CPUs and Ethernet Switch)
    • Adding specific I/O boards to SAFe-VX to deploy the target system
    • Using the same VPX modules, running strictly the same binary software
  • Pre-certified platform with safety critical RTOS
    • CPU boards integrated in SAFe-VX already certified with safety critical real time hypervisor PikeOS from SYSGO
    • Possibility to build an all-in-one safe control system with non-vital tasks: SYSGO PikeOS hypervisor is partitioning and segregating critical and non-critical tasks and application code in independent time and memory spaces
    • Enabling train operators to run several applications on a single platform needed in Data Analytics, AI or Autonomous Trains

Certification Kit

The certification kit is made available for the customer at the very start of the SAFe-VX customer project.

  • Boards Failure mode analysis FMECA
  • CPU board Hardware API detailed documentation
  • Known errata for CPU, Ethernet switch and other boards
  • Boards hardware verification reports
  • Boards firmware verification reports
  • Environmental test reports
  • EMI and other electrical tests reports
  • Certificate from TUV for PikeOS, independent of Platform Support Package
  • Certification artifacts for PikeOS generic part including requirements, test cases and test results
  • Certification artifacts for SAFe VX Board Support Package (PSP specific part and drivers)
  • Certification artifacts for application safety library
  • Safety manual
  • Tool qualification reports

Long Term Support

Program life time management is supported over long periods thanks to Kontron solid background in obsolescence management.

  • EoL management with early notice warranty
  • Last time buy packages are offered
  • Tech refresh minimizes the cost of re-qualification: VPX modular architecture allows fit/form/function upgrades of the building blocks,
    providing the same electrical, mechanical and thermal specifications, with state-of-the-art silicon technology
  • Long life-time program is supported for 25+ years

SAFe-VX Architecture

Hardware architecture

The base configuration is redundant, including three VPX processor modules, interconnected by a Gigabit Ethernet switch module through a backplane. SAFe-VX does not present any single point of failure.

Due to its modular architecture, SAFe-VX offers a high level of flexibility in terms of CPU, storage and I/Os.
CPU boards integrated in SAFe-VX have already been certified with safety-critical real-time hypervisor and RTOS such as PikeOS from SYSGO.
The other major building blocks like the PSU and the fan trays can be offered with redundancy. In the simplest implementation, all boards are sharing the same Power Supply Unit.
The boards are electrically isolated from each other by the backplane design in order to guarantee the absence of common root cause of failure. Safety I/O are optionally implemented on channel A and B through dedicated I/O card(s), mainly serial UARTs, GPIOs and analog inputs.

Software architecture

PikeOS hypervisor, certified RTOS from Kontron’s software partner SYSGO, Partitioning critical and non-critical application code in independent time and memory spaces

PikeOS, a well-established embedded RTOS from Kontron’s software partner SYSGO, acts as an hypervisor partitioning the critical and non-critical application code in independent time and memory spaces. The critical part of the application runs under the PikeOS hard real-time partition whereas all complex non-safety related code can run in a Linux partition, as depicted in the figure below.

    The main software characteristics of the SAFe-VX which ensure the safety of the platform are:

  • Verification of proper BIOS initialization by PikeOS
  • The firmware allowing the OS to inject ECC errors for testing purpose
  • Power-on built-in tests (PBIT) during the OS initialization including ECC error injection test
  • Continuous built-in tests (CBIT) including temperature monitoring
  • Memory regions protection against unexpected access from I/O controllers
  • Modular update capability: OS, application
  • Application safety library including heartbeat, voting, watchdog
  • Eclipse Development tools: C compiler, debugger, performance monitor
  • Based on qualified VPX building blocks (Intel x86 CPUs and Ethernet Switch)
  • CPU boards running Safety Critical RTOS: SYSGO PikeOS
  • Compact 40HP platform, 4U height typical
  • SIL-ready certifiable architecture (SIL2/SIL3/SIL4)
  • Safety documentation kit available (HW and SW)

SAFe-VX-DEV is immediately available at the start of the project to begin the software development with fully representative hardware. The chassis, the power supply and the cooling subsystem can then be customized depending on the requirements. When needed, two SAFe-VX platforms can be used in parallel to reach the expected availability at SIL4 level.

Use cases

Railway signalling program

Kontron 3U VPX computer certified by Alstom at the SIL-4 level for safe railway applications

  • Extractable Line Replacement Units (LRU) in order to provide a low maintenance time and repair (MTTR)
  • Computing unit featuring SBCs and an ethernet switch card
  • Versatility and modularity of a 3U VITA46 VPX standard architecture to offer a SIL-4 certifiable and long-term maintainable solution.