The part that transfers across every product.
SIL 4 MISRA C source implementing a real-time OS-like environment, largely independent of the specific hardware. Developed entirely in house, which is the difference between a platform vendor and an integrator reselling a third-party RTOS.
Diagram: the boot and execution chain. Mass memory with signature, verification, load into RAM, normal operation with cyclical testing, and the transition to safe state with the failure recorded and retained across restarts.
What it implements.
- Multi-state static scheduler
- Isochronous IRQ handler to manage I/O
- Cross-communication API
- An API inspired by the ARINC® 653 APEX interface, exposed to the application
- Safety code calculation routines
- Safe loader
- Diagnostic routines
- Drivers for generic I/O, and HW/SW drivers and API
- Configuration infrastructure
Why APEX matters here.
ARINC® 653 is the avionics standard for space and time partitioning, and APEX is the interface an application sees. The GeminiX-OS kernel API is inspired by that interface: an avionics engineer reading it recognises the model immediately, and that recognition is the technical reason the rail story and the space story are one story rather than two.
Inspired by, and not certified against. GeminiX-OS is certified to EN 50128 and IEC 61508-3 for SIL 4, not under an avionics conformance scheme. The value is in the design model, not in a compliance claim.
SIL 4 according to EN 50128 and IEC 61508-3. MISRA C:2012 with defined coding rules, applied to source that NEAT wrote and maintains.
ARINC is a trademark of its respective owner and ARINC 653 is published by AEEC. NEAT is not affiliated with, endorsed by or certified by either.
Segregation, as a mechanism rather than a claim.
The application reaches hardware resources only through the GeminiX-OS API.
The OS configuration, using the GeminiX-Cores measures, fixes the resources used at compilation time. That is what makes spatial and temporal segregation full rather than nominal: the passive memory protection unit enforces the space, and the time-window watchdog on its own time base enforces the time.
Boot and integrity chain
Code and data are held in dedicated mass memory protected by a safety code, or loaded through an external mechanism into a specific part of dedicated RAM. Signatures are verified before execution continues in RAM. On reboot the mass memory signature is recomputed and checked, and a mismatch enforces the safe state before the application is ever loaded.
Continuous diagnostics
Cyclical testing of the safety-related resources during operation: the bus, the memories, the instruction set and the internal registers of the processing unit. This is how latent error accumulation is prevented rather than merely hoped against.
NEAT / OS / EXECUTION AND BOOT CHAINGeminiX-Tools.
Three tools, each with its EN 50128 classification stated. Publishing the class is the point.
Defend-IT
Inserts defensive programming and logical monitoring into MISRA-C source without changing the semantics. Classified T1: the output is treated as hand-written code and follows the same lifecycle.
Target-IT
Runs black-box module tests on target against the final executable, with no code modification. Classified T2: it supports verification, so an error in the tool can fail to reveal a defect but cannot create one.
Development Kit
IDE, hardware reference designs with production kit, emulation environment, communication libraries, configuration helper, application examples and documentation. Classified T1: the final product is still validated as a whole.
GeminiX-OS for rail, GRIO-SW for microcontroller-class remote I/O, GeminiX-OS-Space for space. Common core, different targets, different certification status.