AUTOSAR Zero-Heap Design Achieves Full FFI Between QM and ASIL-D Domains

·1 views

Engineers validated Freedom From Interference (FFI) between Quality Managed (QM) and ASIL-D software domains on a Classic AUTOSAR R22-11 platform using a zero-heap, static-allocation architecture. Spatial and temporal isolation were enforced through MPU regions and OS-level execution budgets, while all cryptographic operations were routed through a dedicated Evita Full HSM acting as a safety guardian. A Hardware-in-the-Loop validation campaign on dSPACE SCALEXIO conducted over 1,000 fault injection tests — including pointer corruption, stack overflow, and MPU violation attempts — with 100% containment and no ASIL-D data corruption. The measured safe-state transition time came in at 8.7 microseconds, comfortably within the 10-microsecond FTTI requirement. The architecture was confirmed to meet full FFI requirements per ISO 26262-6 Annex D, covering memory, timing, and data exchange isolation, and is considered ready for an ASIL-D product audit.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Experiment Shows External Memory Can Restore Learned Behavior After Full Brain Reset

A developer built a small recurrent neural network paired with an external memory system to test whether learned experience could survive a complete substrate reset. The experiment used a fixed cue-response task where the network had to map specific inputs to correct actions, with chance performance at 33%. Results showed that external memory alone achieved near-perfect accuracy, while plasticity alone underperformed at roughly 47%, and combining both yielded 88%. Crucially, the memory system was constrained to only bias internal network states rather than directly select actions, preserving the integrity of the test. The key finding was that externally stored experience could reinstate correct behavior in a reset network that had never independently learned the task.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Installing Linux Packages Silently Runs Root Scripts You Never Audited

A software developer's routine installation of ffmpeg on a Linux machine prompted a deeper look at what package installation actually involves. Running apt install does far more than add a binary — it executes maintainer-written scripts as root, updates system databases, rewrites symlinks, drops config files into /etc, and triggers changes across dependencies. None of this process is sandboxed, meaning the user implicitly trusts the package maintainer and every upstream dependency with full system access. The author notes the greater risk lies not in obviously malicious packages but in routine, trusted ones that no longer attract scrutiny. The piece urges users and AI agents alike to treat any install command as a deliberate grant of root authority, not a harmless default action.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Critical Pre-Auth RCE Flaw Found in Fastjson 1.x; No Patch Available

A critical remote code execution vulnerability, tracked as CVE-2026-16723, has been disclosed in Fastjson versions 1.2.68 through 1.2.83, scoring as high as 9.8 on the CVSS scale. The flaw requires no authentication and exploits a trusted code path in the @JSONType annotation-handling branch, bypassing both AutoType and safeMode protections entirely. An attacker can host a malicious JAR file over plain HTTP and trigger execution simply by sending a crafted JSON payload to any endpoint calling JSON.parseObject(). Unlike previous Fastjson vulnerabilities, this exploit does not rely on known gadget classes or blacklisted type names, making existing defenses ineffective. Alibaba has declared Fastjson 1.x end-of-life and will not issue a patch, directing users to migrate to Fastjson2.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DevRel Leader Argues Bold, Unconventional Strategies Beat Safe Playbooks in AI Era

A Developer Relations leader argues that the standard DevRel operating model is broken, particularly as every company races to market with similar AI-focused strategies. Drawing on her experience at GitHub, she built a widely popular talk addressing developer skepticism about Copilot head-on, which later became one of O'Reilly Media's top live workshops. At Block's TBD unit, she tackled misconceptions about decentralized tech by inviting competitors onto public livestreams, a move that boosted credibility and community reach. Returning from maternity leave as Open Source DevRel lead at Block, she identified friction in live AI demos and launched a lighthearted vibe-coding competition called The Great Goose Off to keep audiences engaged even when models underperformed. Her core argument is that DevRel teams must take calculated creative risks rather than defaulting to safe, conventional approaches to cut through a saturated market.

0 comments Read more at DEV Community