Embedded Linux is increasingly used in complex embedded systems for automotive, industrial, and other safety-relevant applications. Such systems often combine architectural elements with different criticalities, properties, and development lifecycles. Safety-critical functions may therefore be developed and maintained independently from continuously evolving non-safety-critical software. While this separation enables system integrators to evolve individual elements independently, it also creates a lifecycle challenge: the assumptions underlying their independence, and the evidence supporting these assumptions, must remain valid throughout the product lifecycle.

This contribution investigates how a Safety Management System (SMS) can support system integrators in maintaining safety claims across such independent lifecycles.

The central research question is: How can safety boundaries between independently evolving architectural elements be managed as lifecycle objects so that their assumptions, interfaces, and supporting evidence remain accurate and up to date? 

The proposed approach treats the safety boundary itself as an object of continuous safety management. The SMS provides the framework for defining responsibilities and safety policies, coordinating hazard and risk analyses, managing safety goals and requirements, overseeing verification and validation, and governing configuration and change management. Within this framework, changes to either side of a boundary can be assessed against the assumptions and evidence on which the corresponding safety claim depends.

The approach can be illustrated using Linux-based mixed-criticality systems. The focus is on architectural separation between safety-critical functions and continuously evolving non-safety-critical software rather than on making Linux itself safety-critical. Mechanisms such as safety islands, supervisors, hypervisor-based partitioning, separation kernels, resource isolation, and controlled communication interfaces provide examples of how such boundaries can be established. A particular challenge is maintaining the boundary when elements within the Linux ecosystem—such as kernels, drivers, libraries, security patches, and applications—evolve independently and frequently.

The contribution therefore examines how the evidence supporting claims of independence can be integrated into the safety management process. This includes evidence concerning freedom from interference, resource and memory isolation, controlled communication, fault containment, independent monitoring, and controlled access to safety-related I/O. Architectural analysis, verification, testing, fault injection, and the associated safety arguments are considered as complementary means of establishing and maintaining this evidence. The resulting perspective shifts the focus from assessing an individual technology in isolation to continuously managing the boundaries, assumptions, and evidence that connect independently evolving architectural elements.

This provides a basis for maintaining an integrated and up-to-date assurance argument over the product lifecycle, while allowing non-safety-critical parts of complex embedded systems to evolve independently. The SMS and its perspective are primarily developed for functional-safety claims and can, where applicable, also support the management of related cybersecurity assumptions and dependencies.

Short Bio:

Florence Wagner is a PhD Student from University of Applied Sciences Kempten and a Research Assistant at the Institute for Driver Assistance Systems and Connected Mobility (IFM) working on functional safety and safety management systems for automated driving.