Safety-critical database
A safety-critical database. LLiDA, for avionics, mission-critical and space operations.
A safety-critical database holds the data of a system in which a lost, late or corrupted value can harm people or a mission. It must answer in a known time, keep working on the node when the network is gone, and be written to the rules of flight software. LLiDA (Low Level integrated Database Architecture), developed by SkyDynamics, is a real-time time-series database designed for that, from the avionics of an aircraft to mission-critical ground systems and space operations.
LLiDA at the edge
From the avionics to the iPad. One high-assurance database, from on-board systems to the devices people carry.
Choose a feature to see it work: real-time time series on the aircraft, nodes that cover for each other, plugins for the iPad, a cryptographic boundary and semantic search on the device.
Aircraft avionics
Safety-critical, on board
- Engine 2 vibration0.62 ips
- Exhaust gas temperature624 °C
- Hydraulic pressure3011 psi
Sampled on a fixed period
LLiDA nodes
Each holds the record
- Avionics computerARMIn sync#8224
- Edge unitRISC-VIn sync#8224
- Ground serverServerIn sync#8224
Cryptographic boundary
Identity proven by key
- Crew iPadKey verified
- Engineer iPadKey verified
- Unknown deviceRefused: no key
User devices
Through the LLiDA plugin
LLiDA plugin
Engine 2 vibration0.62 ips
Semantic search, on the iPad
engine vibration rising in icing
- Engine 2 vibration, last 10 minutes0.94Live time series
- High engine vibration procedure0.89Operator QRH
- Engine anti-ice operation0.81FCOM
On the device · Low latency · Low energy
LLiDA plugin
Engine 2 vibration0.62 ips
Every value with its time, on board.
Avionics channels are sampled on a fixed period on the aircraft and held as time series in RAM and on disk, so the layers above read them without a round trip to a server.
Time series to flight-software rules
Sampling, storage and synchronisation are written to MISRA C and the objectives of DO-178C, so the time-series features carry the same assurance as the rest of the system.
No single point of failure
The record lives on every node. When one stops, it is isolated and the others carry on serving the data.
Plugins for user devices
The crew's and the engineers' iPads join through a LLiDA plugin, so on-board data reaches them directly, while the safety-critical function never waits for a device.
Cyber security by cryptography
Only platforms that prove their identity with a key can connect. Anything else is refused at the boundary.
Vector and semantic search
Plugins that search by meaning across readings and documents on the device, designed for speed, low latency and low energy.
For on-device AI
The same database feeds high-assurance AI at the edge: AeroBrain retrieves over LLiDA data, each reading with its source and time.
Illustrative figure: readings, scores and device names are invented. Timing, latency and energy figures depend on the hardware and the function: they are set with the customer and shown for each product.
Requirements
What a safety-critical database must do. Set against a general-purpose server database.
A database becomes part of a safety-critical function when the function relies on its values. From then on, timing, location and the way the code is written matter as much as what is stored.
| Criterion | General-purpose server database | LLiDA |
|---|---|---|
| When a value is available | Depends on load, the query and the network | Each channel is read on a fixed period, so timing is known in advance |
| Where the data is | On a server, reached over a link | On the node itself: working data in RAM, the record on disk |
| When the network is gone | The function waits or stops | The node keeps its data; nodes synchronise over whichever secured or common network is available |
| Hardware | Servers and desktop processors | RISC-V, ARM and other architectures, from a microcontroller to a server |
| Data model | General records and documents | Time series: every value with the time it was measured |
| How the code is written | General software practice | To MISRA C and the objectives of DO-178C |
The left column describes a typical server database; products differ. LLiDA timing figures depend on the hardware and the function: they are set with the customer and shown for each product.
Where it is used
One database architecture. For avionics, mission and safety-critical operations, and space.
A database for avionics
Engine vibration, temperatures, pressures and other avionics parameters are captured as time series on the aircraft, on an ARM avionics computer or a RISC-V microcontroller close to the sensor. The layers above read them without a round trip to a server.
Learn moreMission and safety-critical operations
Operations control, maintenance control and defence systems need their data when the network is not there. LLiDA holds it on the node and keeps the aircraft, the edge device and the ground on the same record.
A database for space operations
Spacecraft and ground segments work over links that come and go, on constrained processors. LLiDA is designed for that kind of operation: data held on the node, fixed sampling periods, synchronisation when a link exists, and RISC-V and ARM support. The software standards and evidence for a space programme, such as ECSS-E-ST-40C and ECSS-Q-ST-80C, are agreed with the customer.
How LLiDA works
Sampled, held, shared. The same three steps on every node.
LLiDA works in RAM, on disk and at processor level. The same architecture covers the newest values that a function reads and the record that is kept.
Sampled on a fixed period
Each channel is read at a set interval, so the time at which a value exists is known before the system runs.
Held where it is used
The newest samples stay in memory for the function that needs them; the record is written to disk on the same node.
Shared between nodes
Nodes exchange data live over secured or common networks, so every node holds the same record as it is written.
Evidence for safety-critical AI
LLiDA is the data layer of AeroBrain: the RAG engine retrieves over its time series, and each reading keeps its source and its time, so an AI answer can be audited.
Assurance
Written like flight software. So that the evidence for a product can be produced.
LLiDA is developed to high-assurance practice. Certification is granted for a specific product on specific hardware, with the authority, and is shown for that product.
MISRA C
The coding rules for C in critical systems, followed in LLiDA's C code.
The objectives of DO-178C
Requirements, design, code, tests and evidence traceable in both directions, as airborne software requires.
DO-278A
The software standard for ground-based CNS/ATM systems, which frames the ground side of a system the aircraft synchronises with.
DO-326A
The airworthiness security process, which frames synchronisation over secured and common networks.
How to choose
Eight questions for any vendor. Ask them before a database goes near a safety-critical function.
Whichever database you consider, these questions separate one built for safety-critical work from one adapted to it. LLiDA's answers are on this page.
When is a value available?
Ask for the timing model, not an average. A function that has to act in time needs to know when a value exists.
What happens without a network?
Ask what the function on board can still read when every link is down, and for how long.
What happens when a node fails?
Ask whether any single node, server or link can stop the data. If one can, it is a single point of failure.
Which processors does it run on?
Ask whether the same code runs on the microcontroller, the avionics computer and the ground server, or whether each needs a different product.
How is it written?
Ask for the coding rules and the development standard, such as MISRA C and the objectives of DO-178C, and for the traceability from requirement to test.
Who is allowed to connect?
Ask how a device proves its identity, and what happens to one that cannot. Passwords on a common network are not an answer.
How do people's devices get the data?
Ask how an iPad on the flight deck or at the aircraft reads on-board data without becoming part of the safety-critical function.
Can an AI answer built on it be audited?
Ask whether every value keeps its source and time, so that an AI answer can be replayed on the same data.
Terms
The vocabulary, in plain words. Ten terms used on this page.
Safety-critical database
A database whose values a safety-critical function relies on, so a lost, late or corrupted value can contribute to harm.
Mission-critical database
A database whose loss stops work that must not stop, such as operations control or a defence mission.
Time-series database
A database that stores each value with the time it was measured, channel by channel.
Real-time database
A database whose values are available within a known time, so a function can rely on them when it acts.
Fixed sampling period
The set interval at which a channel is read, decided before the system runs.
Node
One computer running the database: a microcontroller, an avionics computer, an edge unit or a server.
Single point of failure
One part whose failure stops the whole. A database without one keeps serving the data when any single node stops.
Cryptographic identity
A key that a platform uses to prove who it is before it is allowed to connect.
Vector search
Search that compares the numeric form AI models give to text or signals, to find the nearest matches.
Semantic search
Search by meaning rather than by exact words, built on vector search.
Questions about safety-critical databases
What is a safety-critical database?
A database whose values a safety-critical function relies on, so that a lost, late or corrupted value can contribute to harm. It has to make its values available in a known time, keep working on the node without a network, run on the processors the system uses, and be developed to the rules of critical software. LLiDA, from SkyDynamics, is a real-time time-series database built for this.
Which database is built for avionics data?
Avionics data is a set of time series: parameters sampled at a fixed rate, each with its time. LLiDA is a real-time time-series database developed by SkyDynamics for that data. It runs on ARM avionics computers and RISC-V microcontrollers as well as servers, holds the working data in RAM and the record on disk, and is developed to MISRA C and the objectives of DO-178C.
Is there a database for mission-critical and safety-critical operations?
Yes. LLiDA is designed for systems that must keep working: the data is on the node, values are available without a round trip to a server, and nodes synchronise live over secured or common networks, from the aircraft to the edge device and the ground.
Is there a database for space operations?
LLiDA is designed for operations of that kind: constrained RISC-V and ARM processors, data held on the node, fixed sampling periods and synchronisation when a link exists. For a space programme, the applicable software standards, such as ECSS-E-ST-40C and ECSS-Q-ST-80C, and the evidence are agreed with the customer.
What is LLiDA DB?
LLiDA DB is the LLiDA database: Low Level integrated Database Architecture, the real-time time-series database developed by SkyDynamics for high-reliability and high-assurance systems. It is part of AeroBrain, the SkyDynamics set of safety-critical AI technologies, and can also be used on its own.
Can avionics data reach an iPad securely?
With LLiDA, yes. The crew's and the engineers' iPads connect to the LLiDA nodes on board through a LLiDA plugin, across a boundary that admits only platforms proving their identity with a cryptographic key. The on-board function keeps running on its own nodes and does not depend on the device.
Does LLiDA support vector and semantic search?
Yes, through plugins. Vector and semantic search find the readings and passages closest in meaning to a question, on the device itself, and are designed for high speed, low latency and low energy, for high-assurance AI at the edge.
What is the difference between a real-time database and a time-series database?
A time-series database stores each value with the time it was measured. A real-time database makes its values available within a known time. Avionics needs both at once: LLiDA is a real-time time-series database.
Why not use a cloud database for avionics data?
Because the function on the aircraft cannot wait for a link. A cloud database is reached over a network whose delay and availability are outside the aircraft's control. LLiDA keeps the data on the node and synchronises with the ground when a link exists.
What is a single point of failure in a database?
One server, node or link whose failure stops the data for everyone. LLiDA is designed without one: every node holds the record, and a node that stops is isolated while the others keep serving.
Can a database be certified to DO-178C?
DO-178C applies to airborne software as part of a specific system, so certification is granted for that product on its hardware, by the authority. LLiDA is developed to MISRA C and the objectives of DO-178C so that the evidence for such a product can be produced.
How does a safety-critical database support AI?
An AI answer can only be audited if the data behind it can be found again. In AeroBrain, LLiDA keeps each avionics reading with its time; the RAG engine retrieves over those readings and the approved manuals, and every answer records which readings it used.
Tell us the signals and the time budget.
Name the processor, the network and the assurance level. We show how LLiDA holds the data and keeps the nodes in step.
We respond within one business day.