Wind River and Airbus Advance Automatic Air-to-Air Refuelling
Wind River has announced its collaboration with Airbus to support the A330 Multi-Role Tanker Transport (MRTT) in achieving automatic air-to-air refuelling (A3R) capability.
The development represents an important milestone for safety-critical airborne systems. Airbus uses VxWorks 653 as the real-time operating system platform for the A330 MRTT’s air-to-air refuelling boom system (ARBS), supporting multiple safety-critical applications running under an ARINC 653-compliant architecture.
The resulting A3R capability was certified by Spain’s National Institute for Aerospace Technology (INTA), with multiple ED-12C / DO-178C Design Assurance Level A (DAL A) applications executing concurrently across multiple cores of a multicore processor.
For Wind River, the project also demonstrates how a safety-certified real-time operating system and a carefully engineered multicore architecture can support the stringent requirements of modern aerospace systems.
✈️ Airbus A330 MRTT Enters the Automated Refuelling Era #
The Airbus A330 MRTT is a multi-role military tanker aircraft designed to perform air-to-air refuelling alongside other transport and support missions.
Its air-to-air refuelling system uses the Air Refuelling Boom System (ARBS) to transfer fuel to compatible receiving aircraft.
The A3R capability introduces automation into this process.
According to Airbus and Wind River, the system can use advanced sensing and control technologies to identify the receiving aircraft and its refuelling receptacle, automatically establish contact, and manage fuel transfer while the aircraft operate at high altitude.
The goal is not simply to automate individual mechanical movements. A3R is designed to reduce the workload of the Air Refuelling Operator (ARO) while improving the efficiency and consistency of the overall refuelling operation.
The automation can also reduce the inherent operational risks associated with manually controlling the refuelling boom and help optimize the rate at which fuel is transferred between aircraft.
🧩 VxWorks 653 Provides the Safety-Critical Software Foundation #
The A330 MRTT ARBS uses VxWorks 653, Wind River’s safety-critical platform designed around the requirements of partitioned avionics systems.
The platform supports ARINC 653 application architectures, allowing multiple applications with different safety-criticality requirements to execute within a controlled system environment.
This is particularly important in aerospace systems because software components do not necessarily have identical assurance requirements.
A single computing platform may contain applications with different levels of criticality. The system architecture therefore needs to provide appropriate isolation and predictable execution while satisfying the certification requirements applicable to each component.
For the A3R system, multiple ARINC 653-compliant applications operate at different levels of safety criticality while contributing to the overall air-refuelling function.
Why Partitioning Matters #
Partitioned architectures are a fundamental concept in safety-critical avionics.
Rather than allowing every software component to freely access processor resources, an ARINC 653-style architecture separates applications into controlled execution environments.
This approach can help establish:
- Temporal separation between applications
- Spatial separation of application resources
- Predictable scheduling behavior
- Controlled inter-partition communication
- Clear boundaries for safety analysis
- A structured basis for certification
These properties become particularly important when multiple safety-critical applications share a common multicore computing platform.
🛡️ DO-178C DAL A Certification #
One of the most significant aspects of the A3R development is its DO-178C DAL A certification.
DO-178C, formally titled Software Considerations in Airborne Systems and Equipment Certification, defines objectives and processes used to establish confidence in airborne software.
Within the DO-178C framework, Design Assurance Level A represents the highest assurance level.
At this level, software failures are associated with the most severe potential consequences, requiring the highest level of evidence and process rigor.
The A3R implementation involved multiple ED-12C / DO-178C DAL A applications operating simultaneously on multiple cores.
This creates additional engineering and certification considerations compared with a single-core implementation.
🧠 Multicore Processing Adds a New Certification Challenge #
Modern aerospace computing platforms increasingly use multicore processors to obtain greater computational capability from a single device.
However, multicore processors introduce interactions that must be carefully understood when software with stringent certification requirements is executed on them.
One important consideration is the potential for shared hardware resources.
Multiple processor cores may compete for resources such as:
- Memory buses
- Caches
- Memory controllers
- Interconnects
- I/O paths
- Other shared processor infrastructure
These interactions can affect execution timing and therefore need to be accounted for during system design and certification.
For safety-critical systems, simply demonstrating that the software produces the correct logical result is not enough. Engineers also need confidence that the system behaves predictably under the conditions covered by its certification objectives.
CAST-32A Considerations #
The Airbus A3R development also involved CAST-32A multicore considerations.
CAST-32A provides guidance for addressing multicore processor-related issues in airborne systems. Its objectives include identifying and controlling interference channels and establishing sufficient evidence that multicore behavior does not undermine the required assurance level.
According to Airbus, the company became the first worldwide to certify airborne military equipment using an embedded multicore processor to DAL A while addressing CAST-32A requirements.
The achievement illustrates the additional certification work required when moving high-assurance airborne software onto multicore hardware.
🔬 INTA Certification and the A3R Milestone #
The A330 MRTT A3R capability received certification from Spain’s National Institute for Aerospace Technology (INTA).
The certification covered an architecture in which multiple DAL A applications run concurrently across multiple processor cores.
This combination is significant because it brings together several demanding requirements:
- Safety-critical airborne software
- DO-178C DAL A assurance
- ARINC 653 partitioning
- Multicore processor execution
- CAST-32A-related multicore considerations
- Automated air-to-air refuelling functions
The resulting system demonstrates that highly automated aircraft functions can be integrated with a certified multicore avionics architecture when the required software, hardware, verification, and certification processes are applied together.
🤖 How Automatic Air-to-Air Refuelling Works #
Traditional air-to-air refuelling requires close coordination between the tanker aircraft, the receiving aircraft, and the Air Refuelling Operator.
The A3R system automates important parts of this interaction.
At a high level, the system can:
- Detect and identify the receiving aircraft.
- Determine the relevant geometry of the aircraft and refuelling receptacle.
- Guide the refuelling boom toward the receptacle.
- Establish contact.
- Manage the fuel-transfer process.
- Maintain the required control behavior during the operation.
This automation is particularly valuable because air-to-air refuelling takes place while two aircraft maintain a carefully controlled relative position.
By automating parts of the operation, A3R can reduce operator workload and potentially improve the consistency and efficiency of fuel transfer.
Automation does not eliminate the need for rigorous safety mechanisms. Instead, it moves more of the control process into software and sensing systems that must themselves satisfy stringent requirements.
🏗️ Wind River’s Role in the Certification Journey #
For Wind River, the Airbus project demonstrates the role of the underlying real-time software platform in a broader certification program.
Avijit Sinha, Wind River’s Chief Product Officer, described A3R as an important development for airborne refuelling systems and highlighted the company’s role in supporting safety-critical real-time software requirements.
The company’s involvement extended beyond providing the operating system.
According to Airbus, Wind River also acted as a technical advisor during the multicore certification process, helping identify milestones, potential obstacles, and relevant metrics while the system architecture was being developed.
This type of collaboration is important in certification-driven projects because software architecture, hardware selection, scheduling behavior, resource allocation, and verification strategy can affect one another.
Certification therefore needs to be considered throughout system development rather than treated as a final testing phase.
⚙️ Why VxWorks 653 Matters for Safety-Critical Systems #
VxWorks 653 is designed for systems where deterministic behavior, partitioning, and certification evidence are central architectural requirements.
Wind River positions the platform for safety-critical applications across multiple industries and certification regimes, including aerospace, automotive, industrial, and transportation systems.
In aerospace applications, support for standards such as ED-12C / DO-178C is particularly relevant.
The platform’s partitioning model can provide a structured foundation for systems containing multiple applications with different safety requirements.
For a system such as the A330 MRTT A3R implementation, this provides an architectural foundation on which application software, multicore resource management, verification, and certification activities can be coordinated.
📋 A Broader Lesson for Multicore Avionics #
The A330 MRTT A3R project highlights a broader trend in aerospace computing: safety-critical systems are increasingly expected to deliver more functionality while operating on increasingly capable multicore processors.
That transition creates a fundamental engineering trade-off.
More computational resources can enable sophisticated perception, control, automation, and data-processing functions. At the same time, shared multicore resources introduce additional timing and interference considerations that must be understood and controlled.
The certification process therefore becomes closely connected to system architecture.
A successful design needs to account for:
- Processor and memory architecture
- Partition scheduling
- Interference channels
- Application criticality
- Inter-partition communication
- Timing behavior
- Fault handling
- Verification evidence
- Certification objectives
The A3R development provides a concrete example of how these concerns come together in a real airborne system.
🏁 Conclusion #
Airbus’s A330 MRTT A3R capability represents a significant step toward more automated air-to-air refuelling operations.
The system combines advanced sensing and control with a safety-critical software architecture based on Wind River VxWorks 653, ARINC 653-compliant applications, multicore processing, and DO-178C DAL A certification.
The involvement of multiple DAL A applications running concurrently across multicore processors also makes the project notable from a certification perspective. Addressing CAST-32A-related multicore considerations demonstrates the additional analysis and engineering required when high-assurance airborne software moves beyond traditional single-core architectures.
For Wind River, the project illustrates how a certified real-time software platform can form part of a broader engineering and certification strategy for mission-critical avionics.
More broadly, the A3R program shows how automation in aerospace is increasingly dependent not only on advanced algorithms and sensors, but also on deterministic, partitioned, and certifiable computing platforms capable of supporting increasingly sophisticated functions without compromising the assurance requirements of safety-critical systems.