Linux OS Safety Mechanisms for ASIL-B Compliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of Linux OS in safety-critical automotive systems is not considered safe according to safety standards due to its large codebase and lack of qualification, making it unsuitable for meeting Automotive Safety Integrity Levels (ASIL) requirements, particularly in ISO 26262 part 8 section 8.12, which necessitates a safer operating system for modern ECUs.
Innovation Solution
Implementing a modified Linux OS with additional safety mechanisms, such as memory domain interface, memory integrity protection, timing and execution, and resource allocation safety mechanisms, to ensure compliance with higher ASIL levels like ASIL-B, by using hypercalls and hypervisors to manage memory and resource access, thereby preventing interference and ensuring data integrity and proper resource management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If Linux OS is used in safety-critical automotive systems, then the system can run multiple diverse applications with high versatility, but the system cannot meet the required ASIL safety levels due to the large codebase and lack of qualification
Solution Approach 1:
The system is segmented into multiple isolation domains (first isolation domain for safety-critical applications, second isolation domain for non-safety-critical applications). Each domain operates independently with its own protected memory space, preventing failures in one domain from affecting the other. This segmentation allows Linux to run diverse applications while maintaining ASIL compliance in the safety-critical domain.
Solution Approach 2:
A hypervisor acts as an intermediary layer between the Linux OS and the hardware resources. The hypervisor enforces memory protection mechanisms and resource allocation policies, mediating access between the untrusted Linux domain and the trusted safety-critical domain. This intermediary ensures that Linux applications cannot breach safety requirements while maintaining system versatility.
2Reliability
If a traditional safe operating system is used to meet ASIL requirements, then the system achieves high reliability, but the device complexity and development effort increase significantly
Solution Approach 1:
The hypervisor provides multiple functions in a single component: memory protection, resource allocation, domain isolation, and safety mechanism enforcement. This universal approach consolidates what would otherwise require separate safety mechanisms and trusted execution environments, reducing overall system complexity while maintaining ASIL compliance.
Solution Approach 2:
The system uses Linux's own virtualization capabilities (KVM/hypervisor) to provide the isolation and protection mechanisms needed for ASIL compliance. Rather than replacing Linux with a different safety-critical OS, the solution leverages Linux's built-in virtualization to create isolated domains, allowing Linux to serve itself for safety-critical operations.
3Reliability
If memory protection mechanisms are implemented to prevent Linux from breaching safety requirements, then the system achieves higher reliability, but the device complexity increases
Solution Approach 1:
The hypervisor serves as an intermediary that manages memory protection between domains. It implements the memory protection mechanisms centrally, handling address space isolation, permission enforcement, and fault handling. This centralized approach is less complex than implementing distributed protection across multiple kernel modules or safety mechanisms.
Data Source
AI summary
A method of implementing safety mechanisms in a safety-critical system, the method comprising: receiving, at a safety mechanism configured to provide a first level of safety, a message or command from a calling process operating at second level of safety, the first level of safety having more restrictive requirements than the second level of safety; and initiating by the safety mechanism, a resultant process based on the message or command, the resultant process configured to operate at the first level of safety.