IN Brief:
- STMicroelectronics and WITTENSTEIN have integrated SAFERTOS into a Stellar G3 automotive microcontroller demonstration.
- The system illustrates mixed-criticality applications, deterministic execution, and safety supervision within a shared hardware platform.
- SAFERTOS provides pre-certified operating system components and supporting ISO 26262 evidence, while complete vehicle applications require separate safety assessment.
STMicroelectronics and WITTENSTEIN high integrity systems are demonstrating the SAFERTOS real-time operating system on ST's Stellar G3 automotive microcontroller platform. The integration illustrates how applications with different functional safety requirements can operate within a consolidated electronic architecture while maintaining defined execution and supervision arrangements.
The demonstration is being presented at electronica 2026 in Munich, using ST's SR6G3 hardware and WITTENSTEIN's safety-critical operating system. It combines real-time control, visualisation, and user interaction functions with software partitioning and safety supervision, reflecting the growing use of shared computing platforms within automotive electronic systems.
Vehicle electronics have traditionally been distributed across numerous electronic control units, with individual controllers responsible for particular functions. Body control, lighting, communication, instrumentation, and other tasks may each have dedicated processing hardware. This arrangement can simplify separation between some functions, but increases the number of devices, connections, and software interfaces that must be maintained.
Software-defined vehicle architectures are changing how these functions are organised. Zonal controllers can aggregate electronics according to their physical location within the vehicle, while central computing platforms handle activities previously distributed across separate devices. Consolidation can reduce some hardware duplication, but it also requires software functions with different timing and safety requirements to coexist on shared processing resources.
Those differences are described as mixed criticality. A vehicle display application and a safety-related control function may both require dependable operation, but the consequences of failure and the timing constraints attached to each can differ substantially. Their software must therefore be organised so that activity or faults within one function do not undermine the safety requirements of another.
SAFERTOS provides a real-time operating system designed for embedded applications requiring formal functional safety assurance. Its deterministic scheduling model supports tasks that must execute within defined timing constraints, while its development and certification evidence can be incorporated into a larger system safety assessment.
Deterministic operation is particularly important when software controls physical equipment. A task may need to receive sensor information, calculate a response, and update an output within a specified interval. If competing software activity delays that sequence, the controlled system may not behave as required. Scheduling rules, interrupt handling, and access to processor resources must therefore be considered as part of the application design.
The Stellar G3 platform provides the hardware foundation for the demonstration. ST has developed the family for automotive gateway and zonal applications, incorporating processing and communication resources intended to support multiple electronic functions. Its architecture includes mechanisms that can contribute to the separation of software workloads according to their assigned requirements.
Hardware support is important because operating system scheduling alone cannot establish complete freedom from interference between applications. Memory protection, access to shared resources, interrupt behaviour, and communication between software partitions can all affect whether a fault propagates beyond its original function. The required isolation must be established across the hardware, operating system, and application configuration.
WITTENSTEIN and ST are demonstrating application partitioning alongside independent safety supervision. The arrangement illustrates how a consolidated controller can accommodate functions with different criticality levels while retaining mechanisms intended to monitor and protect safety-related operations.
Supervision can include monitoring software execution and responding to faults or conditions that violate defined requirements. The specific mechanisms available depend on the operating system configuration and supporting hardware. The companies have not published a detailed benchmark of response times, partition-switching overhead, or fault-containment performance for the electronica demonstration.
SAFERTOS is available with pre-certification to ISO 26262 for automotive functional safety applications. WITTENSTEIN supplies supporting material through its Design Assurance Pack, including documentation, verification evidence, and integration guidance that can be used during the development of a safety case.
Pre-certification of an operating system component does not establish certification of the complete vehicle controller. The finished application must still be assessed against its defined safety goals, the hardware on which it operates, the chosen software configuration, and the interactions between individual functions. Integration assumptions and evidence of correct behaviour remain the responsibility of the system developer.
Using an operating system with existing certification evidence can reduce work that would otherwise have to be undertaken for the software component itself. That does not remove the need to verify timing behaviour, peripheral interactions, application logic, and fault handling within the target product.
The demonstration also reflects an established relationship between WITTENSTEIN and ST. SAFERTOS supports a range of ST microcontroller platforms, while the Stellar family is intended for automotive designs requiring real-time control and communication. Extending the demonstration to SR6G3 provides a practical example of how safety-oriented operating system software can be deployed within a more consolidated vehicle architecture.
Andrew Longhurst, Managing Director of WITTENSTEIN high integrity systems, identified software architecture flexibility and confidence in functional safety as priorities for developers moving towards software-defined vehicles. The companies are demonstrating the configuration at ST's electronica stand from 10 to 13 November.
No production vehicle programme, customer deployment, or wider commercial release timetable has been identified for this particular integration. The demonstration establishes a working reference for mixed-criticality software on Stellar G3 hardware, with further application-specific verification required before the arrangement can be adopted in a safety-related vehicle system.
