Abstract
High-assurance embedded systems have very strict requirement in both design and analysis. This paper presents a trusted architecture named Hades to high-assurance system design for security and safety-critical embedded systems with MLS, which is based on the concept of separation. We define a rule that only authorized data can be transferred among partitions to absolutely guarantee the security and safety for high-assurance embedded systems. The inter-partition information flow control mechanism for Hades architecture can prevent untrustworthy and low-level partitions from violating other partitions, by means of which the security and safety of high-assurance embedded systems are assured.