Apex.OS Cert

Safety-certified application framework and communication middleware

®

Apex.OS Cert adds ISO 26262 functional safety certification to the Apex.OS runtime bundle. It combines the Apex.Grace application framework and Apex.Ida communication middleware in a designated release assessed at ASIL B as a Safety Element out of Context (SEooC). The additional value for customers is an independently assessed software foundation and documented conditions for incorporating it into a safety-related production system.

Customers can use the covered product assessment as an input to their system safety case. This can reduce the work of developing and qualifying the runtime foundation themselves and helps them direct engineering effort toward application hazards, system integration, and verification. Safety-related production use requires an issued certificate for the designated release and fulfillment of the applicable Safety Manual.

Apex.OS is used in diverse safety-critical applications across domains.

Difference from Apex.OS

Apex.OS provides the framework, middleware, and development capabilities described in its product definition. Apex.OS Cert uses the same underlying product family and application model. Its distinguishing contribution is the documented functional safety assurance for a specific release and configuration.

An issued certificate identifies the assessed ISO 26262 ASIL B scope. Customers gain an independent reference for evaluating the runtime element within their safety architecture and supplier assessment.
A qualification process supports that scope through defined development, analysis, and verification activities. Customers can build on an assessed supplier element rather than establishing the runtime’s qualification entirely within their own project.
The Safety Manual defines the assumptions, permitted configurations, safety mechanisms, and integration obligations. Customers gain a concrete basis for deciding whether the element fits their application and what evidence their integration must provide.

Execution, zero-copy transport, ROS-compatible interfaces, and other runtime capabilities are described in Apex.OS and its component definitions. For Cert, the relevant distinction is which capabilities are covered for safety-related use, under which assumptions, and in which release and configuration.

Customer value of functional safety certification

Less runtime qualification work — The product assessment covers a shared runtime element that would otherwise require a qualification approach within the customer’s project. Customers can concentrate their own safety engineering on how the application uses that element, whether its assumptions are satisfied, and how it interacts with the complete system. The amount of work avoided depends on the project and its assessment requirements; application and system verification remain necessary.

Independent assurance for the safety argument — For a certified release, the TÜV NORD certificate provides independent assessment of the stated product scope. Together with the Safety Manual, it gives customers an identified reference for reviews with their safety engineers, suppliers, and assessors. This supports confidence in the covered foundation without requiring every customer to establish the same product-level assurance from the beginning. Acceptance within the system safety argument depends on the intended integration.

The component user manuals, tutorials, and examples guide application development and integration, helping teams establish a shared implementation approach and onboard developers.

Earlier decisions about integration and safety mechanisms — The Safety Manual makes integration conditions visible during architecture selection. Customers can identify required monitoring, fault responses, resource constraints, and platform dependencies before committing to deployment. The covered safety mechanisms have defined roles and conditions of use, giving customers a basis for incorporating them into their safety architecture and verifying the required system response. This helps expose gaps and allocate engineering work earlier.

A controlled basis for production and later changes — The certified release, component versions, permitted configuration, and Safety Manual revision establish a baseline that customers can relate to their system safety case. This helps teams assess software updates, ports, and variant changes against an identified scope. Applicable qualification and integration work may be reused where justified, with verification of the changes. The baseline also supports planning around certificate availability and the intended production schedule

Qualification and evidence

Qualification activities include requirements and architecture definition, requirements-to-test traceability, static and dynamic code analysis, production-code line and branch coverage, Failure Mode and Effects Analysis (FMEA), Fault Tree Analysis (FTA), and security and vulnerability analysis. These activities support the product assessment and the assurance customers obtain for the covered runtime foundation.

Product structure and certification scope

Apex.OS Cert comprises the designated Apex.Grace and Apex.Ida components, user documentation, and Safety Manual. The certificate and Safety Manual identify the covered release, features, interfaces, operating modes, and configurations. The scope applies to the assessed element and its stated assumptions of use.

A SEooC is developed against assumptions about its operating environment and safety requirements. Customers must check that these assumptions fit their application. Certification of another Apex.OS release, a single component, or the operating system does not establish coverage of the complete deployed configuration. Features outside the covered scope require a determination of permitted use.

Mixed-criticality configurations may be used where the Safety Manual permits them. The customer must establish the required freedom from interference between safety-related and other functions. A non-safety function does not become qualified through coexistence with a qualified function.