Ravenscar profile

Ravenscar profile
Name	Ravenscar profile
Developer	UK Ministry of Defence, Ada community
Released	1995
Latest release	2019
Programming language	Ada
Platform	RTOS, embedded system, microcontroller
License	varies

Ravenscar profile

The Ravenscar profile is a restricted tasking subset for the Ada language designed for high-integrity, high-reliability embedded system and real-time system applications. It was developed to support certification regimes such as DO-178C, IEC 61508, and ISO 26262 by providing deterministic, analyzable tasking semantics for use in avionics, automotive, aerospace, and industrial control domains. The profile is referenced in standards and guidance from organizations including the UK Ministry of Defence, Ada Resource Association, and MISRA-style bodies.

Overview

The Ravenscar profile defines a minimal, static subset of Ada tasking features intended to simplify static analysis and formal verification for systems used in avionics, automotive industry, spacecraft, railway signaling, and industrial automation. It constrains Ada's runtime to a deterministic execution model by restricting features such as dynamic task creation, dynamic priorities, and selective accept statements while permitting protected objects, ceiling locking, and task-level timing services. The profile was motivated by safety requirements from authorities like Civil Aviation Authority and organizations such as RTCA and EUROCAE.

History and development

Work on the Ravenscar profile began in the mid-1990s within research groups associated with the UK Ministry of Defence and the Ada community to address certification challenges for embedded avionics systems like those developed by Boeing, Airbus, and contractors such as BAE Systems and Lockheed Martin. Influential reports and workshops from Ada-Europe, SIGAda, and ACM influenced the design, and academic contributions from institutions including Oxford University, Imperial College London, and University of York refined the semantics. The profile was standardized as guidance in Ada language annexes and incorporated into toolchains from vendors such as Green Hills Software, AdaCore, Wind River, and LynuxWorks.

Technical characteristics

Ravenscar restricts Ada tasking to enable static schedulability analysis and reduce runtime nondeterminism. Key technical elements include: - Use of protected objects with ceiling locking compatible with priority ceiling protocol and rate monotonic scheduling analyses for deployments in RTOS environments like VxWorks and RTEMS. - Prohibition of dynamic task creation, task termination, and dynamic priorities to simplify static analysis and mapping to scheduling theory used by researchers at Carnegie Mellon University and University of Pennsylvania. - Support for asynchronous transfer of control limited to well-defined cases, aligning with certification guidance from RTCA DO-178C and EUROCAE ED-12C. - Emphasis on static configuration compatible with verification tools from SPARK Pro, Frama-C adaptation projects, and model checkers used in projects at NASA and European Space Agency.

Applications and usage

Ravenscar is widely used in certified and safety-critical systems developed by organizations such as Airbus, Boeing, Rolls-Royce plc, Siemens, and Thales Group. It is applied in avionics flight control, automotive electronic control units (ECUs) for Volkswagen, Toyota Motor Corporation, and Bosch, and in space systems by European Space Agency and NASA missions. The profile is suitable for high-assurance projects in railway signaling undertaken by Siemens Mobility and Alstom and industrial control systems from ABB and Schneider Electric. Academic research on formal verification and timing analysis at institutions like MIT, ETH Zurich, and Delft University of Technology often uses Ravenscar-compliant subsets to validate scheduling theories and toolchains.

Implementation in Ada language

Ada compilers and runtimes including GNAT, AdaCore, Ravenscar-GNAT, Green Hills Ada, and Wind River Ada provide Ravenscar support or tailored runtime options. The implementation requires static elaboration and configuration: task and protected object declarations are fixed at compile-time, and pragma directives such as Pragma Profile (Ravenscar) are used to enable the subset. Integration with Ada Ravenscar Small Footprint runtimes allows deployment on ARM Cortex-M microcontrollers and PowerPC platforms used by vendors like NXP Semiconductors and STMicroelectronics. Tool support from SPARK, GNATprove, and commercial analyzers aids proof obligations and code generation for DO-178C evidence.

Safety and certification considerations

Ravenscar's constrained semantics reduce nondeterminism and simplify argumentation for certification standards including DO-178C, ISO 26262, and IEC 61508. Certification authorities such as Federal Aviation Administration and European Union Aviation Safety Agency accept certification artifacts that leverage Ravenscar to demonstrate determinism, controllability, and analyzability. Evidence commonly includes static analysis reports from CodePeer, formal proofs from SPARK Pro, timing analysis from Cheddar or SymTA/S, and test artifacts produced with frameworks used by Thales Group and Honeywell Aerospace. Traceability to system requirements and compliance matrices are prepared for auditors at FAA and EASA.

References and external resources

See documentation and guidance from AdaCore, UK Ministry of Defence, Ada-Europe, RTCA, EUROCAE, and research papers from ACM and IEEE conferences on real-time and embedded systems. For tooling and runtime implementations, consult resources from Green Hills Software, Wind River, AdaCore, SPARK Pro, and RTEMS projects.

Category:Programming languages Category:Real-time computing