An AUTOSAR-compatible microkernel for systems with safety-relevant components

The integration of safety-relevant software and software developed to normal quality standards in the same embedded system needs a protection mechanism to ensure that the safety-relevant software cannot be adversely affected by failures in the rest the system. The protection mechanism is usually assumed to be provided by the "system software", which implies that the system software must be developed to the same exacting standards as the safety-relevant software. In the AUTOSAR model that may not be possible in practice. This article explores ways of isolating the safety-relevant software from the bulk of the AUTOSAR system software while retaining the core functionality needed by the system software and the components that