RAFIA – A Roadmap for Certifying Open Source for Use in Safety-Relevant Systems
summary
RAFIA lays out a concrete pathway to get open source into safety systems: Risk Analysis (STPA) reduced to a single actionable level, automated CI/CD tests driven from YAML requirements, and systematic fault injection to break tests and prove mitigations. A rear‑camera Linux use case is implemented with a real‑time bitmap clock to measure latency, automated soak tests that exposed test‑harness causes of spikes, and traceable outputs for ISO 26262 compliance. Work already passes an initial assessment with Exeter, targets full certification, and runs on a ~10‑person team.
AI-written summary · about
chapters (13)
- 0:00Start
- 1:03Safety vs FOSS
- 2:26Safety by the book...
- 5:22Certification
- 12:22Traditional safety approaches...
- 15:46Automated Testing
- 16:42Fault Injections
- 17:42Compliance
- 20:03RAFIA process overview
- 23:51Safety Concept and Risk Analysis
- 24:34Test Derivation and Fault Injection
- 26:04Implementation and Integration
- 30:00Lessons learned so far #1
related talks
48mDeveloping Open-Source Software RTOS with Functional Safety in Mind
26mHow to Qualify a Safe Linux Distribution in Cars
25mContinuous compliance with Rust in automotive software
27mBuilding Trust Through Proactive Security - Key Parts of the Trusted Software Supply Chain
27mContinuous Compliance: Agile Practices for Software Compliance
15mRAIL: Risk-Aware Human-in-the-Loop Framework with Adaptive Intrusion Response...
50mWhen Human Life Depends on Software - Introduction to Safety-Critical Systems
39mHandling of Security Requirements in Software Development Lifecycle