Hypervisors & Mixed-Criticality Systems
Modern vehicles collapse many ECUs onto one SoC, so a QM infotainment stack and an ASIL D cluster now share the same silicon. You learn how a certified hypervisor delivers freedom from interference through spatial and temporal isolation, so software of different criticalities can coexist without one corrupting the other.
- Chapters
- 12
- Chapters
- Isolation Dimensions
- 2
- Isolation Dimensions
- Interference Channels
- 3
- Interference Channels
- Hypervisors Compared
- 6
- Hypervisors Compared
- 01Why Virtualize the Car?
- 02Virtualization Fundamentals
- 03What the Silicon Provides
- 04What ISO 26262 Actually Requires
- 05Spatial Isolation
Why it pays for itself
Isolation you can argue in a safety case
Learn how stage-2 address translation, SMMU-gated DMA, and time-budget scheduling turn a hypervisor's isolation claims into a freedom-from-interference argument an assessor can follow down to the evidence.
Read a hypervisor safety manual critically
Certified hypervisors ship as SEooC with assumptions of use you must validate. Learn which assumptions matter, what the integrator owes, and where hidden coupling channels defeat the claimed separation.
Choose from the real landscape
Six production hypervisors compared - QNX, PikeOS, INTEGRITY, COQOS, seL4, Xen and Jailhouse - against cockpit, ADAS, gateway, and zonal deployment patterns, including the certified-versus-open-source trade-offs.
What you’ll be able to do
Choose the right hypervisor architecture
Weigh type-1 versus type-2 and certified versus open-source designs against your mixed-criticality and ASIL targets.
Enforce spatial isolation on real silicon
Use stage-2 MMU page tables and the SMMU to guarantee that a QM partition cannot touch ASIL memory or peripherals.
Guarantee temporal isolation under load
Design time-budget scheduling and bandwidth controls so a runaway partition never starves safety-critical work.
Interpret the hypervisor safety manual
Validate the SEooC assumptions of use and fold the isolation claims into your technical safety concept.
Design safe inter-partition communication
Build controlled shared-memory and VirtIO channels that exchange data without opening a coupling path.
Verify freedom from interference
Plan fault-injection and interference stress campaigns that turn isolation claims into audited evidence.
Chapter by chapter
- 01
Why Virtualize the Car?
The business and engineering forces driving ECU consolidation, and why collapsing many controllers onto one SoC creates a mixed-criticality problem that only a hypervisor can solve.
- ECU consolidation into cockpit, ADAS and zonal controllers
- Cost, weight and wiring pressure versus safety separation
- The mixed-criticality challenge on shared silicon
- 02
Virtualization Fundamentals
The core building blocks of virtualization, contrasting type-1 bare-metal hypervisors with type-2 hosted designs and defining what a partition really guarantees.
- Type-1 bare-metal versus type-2 hosted architectures
- Partitions, guests and the virtual machine boundary
- Where the safety-relevant separation actually lives
- 03
What the Silicon Provides
How hardware-assisted virtualization does the heavy lifting, using EL2 hypervisor mode, stage-2 address translation and the SMMU to enforce isolation the software alone could not.
- EL2 hypervisor mode and two-stage MMU translation
- SMMU / IOMMU isolation for DMA-capable devices
- Why hardware enforcement beats software checks
- 04
What ISO 26262 Actually Requires
The freedom-from-interference obligations of ISO 26262-6 Annex D and how a hypervisor is typically qualified as a Safety Element out of Context.
- Freedom from interference: memory, timing and exchange of information
- Hypervisor as an SEooC with a documented safety manual
- Assumptions of use the integrator must validate
- 05
Spatial Isolation
How partitions are prevented from reading or writing each other's memory, from stage-2 page tables to protecting shared peripherals and DMA masters.
- Stage-2 page tables and per-partition address spaces
- SMMU-gated DMA so a QM device cannot reach ASIL memory
- MPU regions, guard zones and fault containment
- 06
Temporal Isolation
How the hypervisor guarantees that a misbehaving partition cannot steal CPU time or bus bandwidth from a safety-critical one through time-budget scheduling.
- Time-partition scheduling and CPU execution budgets
- DRAM bandwidth and shared-cache interference control
- Worst-case execution time under contention
- 07
Safe Communication Between Partitions
How partitions exchange data without breaking isolation, using controlled shared-memory channels, VirtIO and integrity-protected inter-partition messaging.
- Controlled shared-memory and VirtIO channels
- Integrity, direction and back-pressure controls
- Preventing the communication path from becoming a coupling channel
- 08
The Safety Concept of a Virtualized ECU
How the hypervisor's isolation claims are woven into the technical safety concept, allocating requirements and monitors across QM and ASIL partitions.
- Allocating safety requirements to partitions and the hypervisor
- Health monitors, watchdogs and partition restart
- Arguing the safety case for one SoC, mixed ASIL
- 09
The Hypervisor Landscape & Deployment
A survey of production automotive hypervisors and the real vehicle architectures they power, from digital cockpits to zonal controllers.
- QNX, PikeOS, INTEGRITY, COQOS, seL4, Xen and Jailhouse compared
- Cockpit, ADAS, gateway and zonal deployment patterns
- Certified versus open-source and their trade-offs
- 10
Verifying Isolation, Pitfalls & Decisions
How to prove the isolation claims through fault injection and interference stress testing, and the trade-offs and traps to weigh when choosing a partitioning strategy.
- Fault injection and cross-partition interference stress tests
- Worst-case execution time and bandwidth-saturation verification
- Pitfalls, hidden coupling channels and a decision guide
Not just text: the visual toolkit
Type-1 vs Type-2 Hypervisor Stack
Contrasts the bare-metal and hosted architectures and shows where the safety-relevant partition boundary sits in each.
Stage-2 MMU & SMMU Isolation Map
Traces how two-stage address translation and the SMMU keep each partition, including its DMA masters, inside its own memory.
Temporal Partitioning Budget Timeline
Shows CPU execution budgets and time partitions guaranteeing safety-critical work even while a QM partition overruns.
Shared-SoC Interference Channel Map
Catalogues the memory, cache, bandwidth and communication channels through which one partition could couple into another.
Partition Scheduling State Machine
Models how the hypervisor cycles partitions through run, budget-exhausted and restart states under its scheduler.
Virtualized ECU Safety Concept
Maps safety requirements, monitors and safe-state reactions across the QM and ASIL partitions on one SoC.
Consolidating an ASIL D Cluster and a QM Infotainment Stack on One SoC
A digital cockpit program collapses a standalone ASIL D instrument cluster and a QM Android infotainment stack onto a single automotive SoC running a certified type-1 hypervisor. The worked example walks through the freedom-from-interference argument that lets the QM partition fail without ever corrupting the cluster's telltales.
- Partition layout: ASIL D cluster and QM infotainment placed in separate stage-2 address spaces
- SMMU configured so the infotainment GPU and DMA masters cannot reach cluster memory
- CPU time budgets and DRAM bandwidth caps guarantee cluster rendering under infotainment load
- Safety-critical telltales routed through an integrity-protected inter-partition channel
- Health monitor restarts a crashed QM partition without disturbing the ASIL D partition
- Fault-injection campaign proves no interference channel breaks the isolation claim
Unlock the full spatial, temporal and communication FFI argument with verification evidence
Who this guide is for
- Architects consolidating multiple ECUs onto one cockpit or zonal SoC
- Software engineers whose ASIL partition now shares silicon with Android
- Safety engineers writing the freedom-from-interference argument for a virtualized ECU
- Teams evaluating certified versus open-source hypervisors for an ASIL project
Frequently Asked Questions
Common questions about Hypervisors & Mixed-Criticality Systems
Start the course today
A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov simulator, and 5 practice exams per month. The Pro and Expert plans unlock more of the 77-guide library. No credit card required.