docs: 24-month master plan — PikeOS firmware audit → Mycelium upgrade → UOS PPC port → MCU micro-kernel → guest emulation
- Phase 1 (M1-M6): BMW ECU discovery, firmware deep analysis, ISO 26262 requirements - Phase 2 (M7-M14): Mycelium binary fix, PPC target support, ISO 26262 source integration, BSP generator - Phase 3 (M15-M24): PPC kernel port, MCU micro-kernel, guest emulation framework, BMW ECU validation, certification - 7 risks identified, 6 open questions, 9 success metrics - Ground truth: 56K LOC UOS kernel (3 arches), 22 mycelium crates, 127 PikeOS .cmp files, no PPC backend yet
This commit is contained in:
Aurélio
fabiorafaelcoutada
parent
0eab84ca55
commit
5ebe30fc25
1 changed files with 410 additions and 0 deletions
|
|
@ -0,0 +1,410 @@
|
|||
# PikeOS Firmware Audit → UniversalisOS Micro-Kernel — 24-Month Master Plan
|
||||
|
||||
> **Generated:** 2026-07-13 · **Author:** Hermes Agent for Fábio
|
||||
> **Scope:** Audit BMW PikeOS MVP firmware → upgrade Mycelium with ISO 26262 source → port UniversalisOS to BMW MCUs/MPUs → build UOS micro-kernel for microcontrollers → emulate BMW ECUs as UOS guests
|
||||
> **Timeline:** 24 months (M1–M24) · **All deliverables due M24**
|
||||
|
||||
---
|
||||
|
||||
## 0. Context & Ground Truth
|
||||
|
||||
### What exists today
|
||||
|
||||
| Asset | Path | Reality |
|
||||
|-------|------|---------|
|
||||
| **PikeOS mirror** | `universalisos/pikeos-mirror/` | 3,810 files. Sources: `ukernel-{arm_v7hf,arm_v8hf,ppc_e500,ppc_e500mc,ppc_e500mc-4g,ppc_e5500,x86_amd64}/`. 127 `.cmp` component files. 7 target XMLs. 16 demo suites. |
|
||||
| **PikeOS kernel sources** | `pikeos-mirror/sources/ukernel-*/` | 640–656 files per arch. Includes ADT (abstract data types), kdev (kernel device framework), PSP (platform support package), APEX (ARINC-653) API. |
|
||||
| **UniversalisOS kernel** | `universalisos/kernel/` | 56,442 LOC. 33,945 core + 3,613 armv7 + 13,525 aarch64 + 5,277 riscv. **No PowerPC backend.** |
|
||||
| **Mycelium toolchain** | `mycelium/crates/` | 22 crates, all build clean, 40 tests passing. P0.4 complete. Replaces `pikeos-configconv` + `configmore` + host tools. |
|
||||
| **Mycelium codegen** | `mycelium/crates/mycelium-codegen/` | XSD → C headers / VMIT binary. Binary format has C-ABI alignment gaps (planned overhaul in implementation_plan.md). |
|
||||
| **Parity specs** | `universalisos/docs/parity/` | CDK/config/build, RPM, SCOV/RVS specs done. |
|
||||
| **Parity push ledger** | `universalisos/kernel/docs/PARITY_PUSH_LEDGER.md` | P-1 (time API) ✅, P-2 (ARINC IPC multi-arch) ✅, P-3 (HM multi-arch) ✅. |
|
||||
| **UOS guests** | `universalisos/guests/` | linux-aarch64, riscv-sampling, wasm3-app. **No PowerPC guest.** |
|
||||
| **BMW project** | Consultant engagement | Complete PikeOS MVP for ECU validation (BMW electrical car venture). ISO 26262 certified source code. Various ECUs on PowerPC E500/E500MC. |
|
||||
|
||||
### What does NOT exist yet
|
||||
|
||||
| Gap | Impact |
|
||||
|-----|--------|
|
||||
| **PowerPC backend** in UniversalisOS kernel | Cannot run on BMW MCUs/MPUs |
|
||||
| **ISO 26262 tooling** (static analysis, traceability, coverage) | Cannot certify UOS for automotive |
|
||||
| **Firmware audit of BMW ECUs** | Don't know what we're porting |
|
||||
| **MCU-targeted micro-kernel** | UOS is too heavy for constrained microcontrollers |
|
||||
| **Guest emulation of BMW ECUs** | Cannot validate replacement on UOS |
|
||||
|
||||
---
|
||||
|
||||
## 1. Architecture Overview
|
||||
|
||||
```
|
||||
┌─────────────────────────────────────────────────────────────────────┐
|
||||
│ 24-MONTH EXECUTION PLAN │
|
||||
│ │
|
||||
│ PHASE 1 (M1–M6) PHASE 2 (M7–M14) PHASE 3 (M15–M24)│
|
||||
│ ┌──────────────┐ ┌──────────────────┐ ┌──────────────┐ │
|
||||
│ │ FIRMWARE │ │ MYCELIUM UPGRADE │ │ UOS MICRO- │ │
|
||||
│ │ AUDIT │────────▶│ + ISO 26262 │───▶│ KERNEL + │ │
|
||||
│ │ │ │ + PPC PORT │ │ GUEST EMU │ │
|
||||
│ └──────────────┘ └──────────────────┘ └──────────────┘ │
|
||||
│ │ │ │ │
|
||||
│ ▼ ▼ ▼ │
|
||||
│ ┌──────────────┐ ┌──────────────────┐ ┌──────────────┐ │
|
||||
│ │ • ECU catalog│ │ • Mycelium PPC │ │ • MCU μkernel│ │
|
||||
│ │ • FW analysis│ │ • ISO 26262 src │ │ • PPC guest │ │
|
||||
│ │ • Safety req │ │ • Configconv fix │ │ • ECU emulate│ │
|
||||
│ │ • Component │ │ • BSP generator │ │ • Validation │ │
|
||||
│ │ model map │ │ • Trace tooling │ │ • Cert trail │ │
|
||||
│ └──────────────┘ └──────────────────┘ └──────────────┘ │
|
||||
└─────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
### Critical Path
|
||||
|
||||
```
|
||||
Firmware Audit (M1–M4)
|
||||
│
|
||||
├─▶ Component Model Extraction (M3–M5)
|
||||
│ │
|
||||
│ ▼
|
||||
│ Mycelium PPC Codegen (M7–M10)
|
||||
│ │
|
||||
│ ▼
|
||||
│ UOS PPC Kernel Port (M11–M16)
|
||||
│ │
|
||||
│ ▼
|
||||
│ Guest Emulation (M19–M24)
|
||||
│
|
||||
└─▶ ISO 26262 Requirements (M2–M6)
|
||||
│
|
||||
▼
|
||||
Mycelium ISO Tooling (M8–M14)
|
||||
│
|
||||
▼
|
||||
Certification Trail (M18–M24)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 2. Phase 1 — Firmware Audit & Requirements Extraction (M1–M6)
|
||||
|
||||
### 2.1 M1–M2: ECU Discovery & Catalog
|
||||
|
||||
**Objective:** Build a complete inventory of every ECU, MCU, MPU, and firmware component in the BMW PikeOS MVP.
|
||||
|
||||
| Task | Deliverable | Verification |
|
||||
|------|-------------|-------------|
|
||||
| Receive and catalog all ECU hardware specs | `audit/ECU_CATALOG.md` | Every ECU named with chip, arch, RAM, flash, PikeOS version |
|
||||
| Map PikeOS partition topology per ECU | `audit/PARTITION_MAP.md` | Every partition with role (safety,非safety, system) |
|
||||
| Identify MCU vs MPU classification | `audit/MCU_MPU_MATRIX.md` | Each chip classified: MCU (constrained) vs MPU (application processor) |
|
||||
| Catalog all `.cmp` component files per ECU | `audit/CMP_INVENTORY.md` | Every `.cmp` with type (Component/Kernel/Partition/Process/Psp) |
|
||||
| Identify ISO 26262 ASIL levels per ECU | `audit/ASIL_MAP.md` | Each ECU/safety function rated ASIL-A through ASIL-D |
|
||||
|
||||
**Key questions to answer:**
|
||||
- Which ECUs use PowerPC E500 vs E500MC vs E5500?
|
||||
- What are the safety-critical partitions (ASIL-D)?
|
||||
- Which ECUs have hardware security modules (HSM)?
|
||||
- What is the inter-ECU communication topology (CAN, FlexRay, Ethernet)?
|
||||
|
||||
### 2.2 M3–M4: Firmware Deep Analysis
|
||||
|
||||
**Objective:** Reverse-engineer and document the firmware architecture of each ECU.
|
||||
|
||||
| Task | Deliverable | Verification |
|
||||
|------|-------------|-------------|
|
||||
| Extract and analyze PikeOS kernel configs per ECU | `analysis/KERNEL_CONFIGS/` | One `.config` per ECU, annotated with non-default options |
|
||||
| Map driver inventory per ECU | `analysis/DRIVER_MAP.md` | Every kdev driver with interrupt, MMIO, DMA requirements |
|
||||
| Analyze ADT (Abstract Data Types) usage | `analysis/ADT_USAGE.md` | Every ADT instance with structure layout and usage pattern |
|
||||
| Analyze APEX (ARINC-653) partition configs | `analysis/APEX_CONFIGS.md` | Partition scheduling, communication ports, HM actions |
|
||||
| Document BSP (Board Support Package) per ECU | `analysis/BSP_DOCS/` | One BSP doc per ECU: memory map, peripherals, boot sequence |
|
||||
| Capture `.cmp` → binary → runtime mapping | `analysis/CMP_LIFECYCLE.md` | How .cmp files flow through configconv → .mod → boot |
|
||||
|
||||
**Methodology:**
|
||||
1. Use `mycelium` toolchain to parse `.cmp` files from each ECU
|
||||
2. Use `vmit-dump` to decode binary configs
|
||||
3. Use `romdump` to analyze ROM images
|
||||
4. Cross-reference with PikeOS mirror `sources/ukernel-*` for kernel-level understanding
|
||||
5. Use `strings` + `nm` + `objdump` on any proprietary blobs
|
||||
|
||||
### 2.3 M5–M6: Requirements & Safety Extraction
|
||||
|
||||
**Objective:** Extract ISO 26262 requirements and map them to UniversalisOS features.
|
||||
|
||||
| Task | Deliverable | Verification |
|
||||
|------|-------------|-------------|
|
||||
| Extract safety requirements from PikeOS configs | `requirements/SAFETY_REQS.md` | Every ISO 26262 requirement traced to a PikeOS feature |
|
||||
| Map PikeOS safety mechanisms to UOS equivalents | `requirements/SAFETY_MECHANISMS.md` | Every mechanism (HM, partition isolation, temporal/spatial) with UOS gap |
|
||||
| Define MCU constraints (RAM, flash, interrupt latency) | `requirements/MCU_CONSTRAINTS.md` | Per-MCU: max RAM, max flash, worst-case ISR latency, clock speed |
|
||||
| Define guest emulation requirements | `requirements/GUEST_EMU_REQS.md` | What must be emulated: peripherals, interrupts, memory map, timing |
|
||||
| Create traceability matrix | `requirements/TRACEABILITY.md` | ISO 26262 clause → PikeOS feature → UOS feature → test case |
|
||||
|
||||
**Phase 1 Exit Gate:**
|
||||
- ✅ Every ECU cataloged with chip, arch, ASIL level
|
||||
- ✅ Every `.cmp` file analyzed and documented
|
||||
- ✅ Safety requirements extracted and traced
|
||||
- ✅ MCU constraints defined
|
||||
- ✅ Guest emulation requirements specified
|
||||
|
||||
---
|
||||
|
||||
## 3. Phase 2 — Mycelium Upgrade & PowerPC Port (M7–M14)
|
||||
|
||||
### 3.1 M7–M8: Mycelium Binary Format Fix (CRITICAL)
|
||||
|
||||
**Objective:** Fix the C-ABI alignment and relocation issues in `mycelium-codegen` so it produces PikeOS-compatible binary configs.
|
||||
|
||||
| Task | Deliverable | Verification |
|
||||
|------|-------------|-------------|
|
||||
| Implement C-ABI padding & alignment in `binary.rs` | Modified `mycelium-codegen` | `cargo test` passes, binary matches PikeOS layout |
|
||||
| Implement out-of-line data (relocations) | Modified `binary.rs` | Pointer fields use relocation table, not inline data |
|
||||
| Fix header to 16-byte PikeOS format | Modified `header.rs` | Header matches PikeOS 16-byte format |
|
||||
| Fix vector/array lowering in `lower.rs` | Modified `mycelium-model` | Bounded arrays = inline C arrays; unbounded = vector companion |
|
||||
| Update kernel `uos_drv_config_get_data` for relocation patching | Modified `adt-kdev/uos_adt_kdev.c` | Kernel can load and relocate binary configs |
|
||||
| Port instance XML parser | New `mycelium-xml` crate | Parse `.xml` instance data, validate against XSD IR |
|
||||
|
||||
**Verification:** Round-trip test: parse PikeOS `.cmp` → generate binary → load in UOS kernel → same runtime behavior.
|
||||
|
||||
### 3.2 M9–M10: PowerPC Target Support in Mycelium
|
||||
|
||||
**Objective:** Add PowerPC E500/E500MC/E5500 targets to the mycelium toolchain.
|
||||
|
||||
| Task | Deliverable | Verification |
|
||||
|------|-------------|-------------|
|
||||
| Add PPC target definitions to mycelium CLI | Modified `mycelium-cli` | `--target=ppc_e500mc` flag works |
|
||||
| Generate PPC-specific C headers | Modified `mycelium-codegen` | Headers match PikeOS `ukernel-ppc_e500mc/` conventions |
|
||||
| Generate PPC ldscripts | Modified `mycelium-codegen` | Linker scripts match PikeOS PPC sections (`._vm_stack`, etc.) |
|
||||
| Add PPC binary format (big-endian, 32-bit) | Modified `mycelium-binary` | Binary output is valid big-endian PPC config |
|
||||
| Add PPC `.cmp` conformance tests | New tests in `mycelium-tfw` | Parse all 127 `.cmp` files → generate PPC output → verify |
|
||||
| Document PPC target support | `docs/PPC_TARGET.md` | Target matrix, memory model, ABI notes |
|
||||
|
||||
### 3.3 M11–M12: ISO 26262 Source Code Integration
|
||||
|
||||
**Objective:** Integrate ISO 26262 certified source patterns into Mycelium and UOS.
|
||||
|
||||
| Task | Deliverable | Verification |
|
||||
|------|-------------|-------------|
|
||||
| Analyze ISO 26262 PikeOS source patterns from BMW audit | `iso26262/ANALYSIS.md` | Documented safety patterns: partition isolation, HM, temporal isolation |
|
||||
| Implement static analysis hooks in mycelium | Modified `mycelium-cli` | `--check-safety` flag runs MISRA-C-like checks on generated C |
|
||||
| Add traceability metadata to generated code | Modified `mycelium-codegen` | Generated C includes requirement IDs in comments |
|
||||
| Create safety test harness | New `mycelium-safety` crate | Automated checks: stack overflow, buffer bounds, timing |
|
||||
| Document ISO 26262 compliance strategy | `iso26262/COMPLIANCE.md` | How UOS targets each ISO 26262 clause |
|
||||
|
||||
### 3.4 M13–M14: BSP Generator & Component Model
|
||||
|
||||
**Objective:** Build the `uos-bsp` generator that converts PikeOS `.cmp`/`.bsp.dom` to UOS board support packages.
|
||||
|
||||
| Task | Deliverable | Verification |
|
||||
|------|-------------|-------------|
|
||||
| Implement `.cmp` → UOS component schema converter | New `uos-component` crate | Parse all 127 `.cmp` → UOS component format |
|
||||
| Implement BSP domain parser | Modified `uos-component` | Parse `.bsp.dom` (PSP + board + memregions) |
|
||||
| Generate UOS board configs from BSP domains | New `uos-bsp` CLI | `uos-bsp generate --from=ecu1.bsp.dom --out=board/` |
|
||||
| Wire BSP into UOS kernel build | Modified `universalisos/kernel/Makefile` | `make BOARD=ecu1` builds with generated BSP |
|
||||
| Create conformance test suite | `conformance/bsp/` | 3 reference BSPs (qemu-arm, zynq, imx6) generate correctly |
|
||||
|
||||
**Phase 2 Exit Gate:**
|
||||
- ✅ Mycelium binary format matches PikeOS (round-trip verified)
|
||||
- ✅ PowerPC targets generate correct C headers, ldscripts, and binary configs
|
||||
- ✅ ISO 26262 traceability metadata in generated code
|
||||
- ✅ BSP generator produces valid UOS board configs from PikeOS `.cmp`/`.bsp.dom`
|
||||
- ✅ All 127 `.cmp` files parse and generate PPC output without errors
|
||||
|
||||
---
|
||||
|
||||
## 4. Phase 3 — UniversalisOS Micro-Kernel & Guest Emulation (M15–M24)
|
||||
|
||||
### 4.1 M15–M16: PowerPC Kernel Port
|
||||
|
||||
**Objective:** Add PowerPC E500/E500MC support to the UniversalisOS kernel.
|
||||
|
||||
| Task | Deliverable | Verification |
|
||||
|------|-------------|-------------|
|
||||
| Implement PPC boot sequence | `kernel/src/arch/ppc/boot.S` | PPC boots to UART banner on QEMU |
|
||||
| Implement PPC exception vectors | `kernel/src/arch/ppc/exceptions.S` | IRQ, decrementer, syscall handlers |
|
||||
| Implement PPC context switch | `kernel/src/arch/ppc/context.S` | Task switch saves/restores all GPRs, MSR, LR, CTR |
|
||||
| Implement PPC MMU (BATs or page tables) | `kernel/src/arch/ppc/mmu.cpp` | Flat identity map, device MMIO accessible |
|
||||
| Implement PPC BSP for target hardware | `kernel/src/platform/bmw-ecu/` | Memory map, peripherals, interrupt controller |
|
||||
| Implement PPC timer (decrementer) | `kernel/src/arch/ppc/timer.cpp` | Preemptive scheduling with decrementer interrupts |
|
||||
| Boot on QEMU PPC | `make ARCH=ppc PLATFORM=qemu-ppc` | Full boot with scheduler/IPC demos |
|
||||
|
||||
**Reference:** PikeOS `sources/ukernel-ppc_e500mc/` has 654 files with the exact boot sequence, exception handling, and MMU setup we need to match behaviorally.
|
||||
|
||||
### 4.2 M17–M18: MCU Micro-Kernel
|
||||
|
||||
**Objective:** Create a stripped-down UniversalisOS micro-kernel for resource-constrained microcontrollers.
|
||||
|
||||
| Task | Deliverable | Verification |
|
||||
|------|-------------|-------------|
|
||||
| Define MCU kernel subset (what to keep, what to strip) | `mcukernel/SPEC.md` | Documented: scheduler, IPC, HM only; no MMU, no guests |
|
||||
| Implement MCU kernel core | `kernel/src/mcukernel/` | Minimal scheduler + IPC + HM for bare-metal MCU |
|
||||
| Implement MCU HAL (Hardware Abstraction Layer) | `kernel/src/mcukernel/hal/` | UART, GPIO, Timer, Interrupt controller abstractions |
|
||||
| Implement MCU BSP for target chip | `kernel/src/mcukernel/platform/<chip>/` | Board support for BMW MCU |
|
||||
| Add FreeRTOS/Zephyr compatibility layer (optional) | `kernel/src/mcukernel/compat/` | API shim for existing FreeRTOS/Zephyr applications |
|
||||
| Create MCU build system | `mcukernel/Makefile` | Cross-compile for ARM Cortex-M / PowerPC e200 |
|
||||
| Boot on real hardware or QEMU MCU emulation | Verify | Boot on QEMU `mps2-an500` (Cortex-M) or `ppc405` |
|
||||
|
||||
**Design principles:**
|
||||
- **No MMU** — flat memory map, MPU-based isolation (if available)
|
||||
- **Static allocation only** — no malloc, no heap
|
||||
- **Deterministic scheduling** — RMS/DMS fixed-priority
|
||||
- **Minimal footprint** — target <16KB flash, <4KB RAM
|
||||
- **ISO 26262 compatible** — no dynamic memory, no recursion, no exceptions
|
||||
|
||||
### 4.3 M19–M20: BMW ECU Guest Emulation Framework
|
||||
|
||||
**Objective:** Build the framework for emulating BMW ECUs as UniversalisOS guests.
|
||||
|
||||
| Task | Deliverable | Verification |
|
||||
|------|-------------|-------------|
|
||||
| Define guest emulation architecture | `guestemu/ARCHITECTURE.md` | How PikeOS partitions map to UOS guest VMs |
|
||||
| Implement PPC guest boot | `kernel/src/arch/ppc/guest.cpp` | UOS boots PikeOS binary as PPC guest |
|
||||
| Implement peripheral emulation framework | `kernel/src/platform/guestemu/` | Timer, UART, interrupt controller emulation |
|
||||
| Implement inter-guest communication | `kernel/src/core/guest_comm.cpp` | Shared memory + signaling between guests |
|
||||
| Create guest configuration language | `guestemu/config/` | How to specify guest memory, peripherals, scheduling |
|
||||
| Validate with PikeOS demo suite | `conformance/guest/` | PikeOS APEX demo runs as UOS guest |
|
||||
|
||||
### 4.4 M21–M22: BMW ECU Validation
|
||||
|
||||
**Objective:** Run actual BMW ECU firmware as UniversalisOS guests and validate behavior.
|
||||
|
||||
| Task | Deliverable | Verification |
|
||||
|------|-------------|-------------|
|
||||
| Port 1st BMW ECU firmware to UOS guest | `validation/ecu1/` | ECU1 boots and runs partition schedule |
|
||||
| Port 2nd BMW ECU firmware to UOS guest | `validation/ecu2/` | ECU2 boots and runs partition schedule |
|
||||
| Validate inter-ECU communication | `validation/comm/` | CAN/Ethernet messages pass between emulated ECUs |
|
||||
| Validate timing constraints | `validation/timing/` | All ISR latencies within ISO 26262 bounds |
|
||||
| Validate safety mechanisms | `validation/safety/` | HM actions trigger correctly, partitions isolated |
|
||||
| Create validation report | `validation/VALIDATION_REPORT.md` | Full test results with pass/fail per requirement |
|
||||
|
||||
### 4.5 M23–M24: Certification Trail & Documentation
|
||||
|
||||
**Objective:** Complete the ISO 26262 certification trail and final documentation.
|
||||
|
||||
| Task | Deliverable | Verification |
|
||||
|------|-------------|-------------|
|
||||
| Generate traceability matrix | `certification/TRACEABILITY.md` | ISO 26262 clause → requirement → design → code → test |
|
||||
| Create safety case documentation | `certification/SAFETY_CASE.md` | Argument that UOS meets ASIL requirements |
|
||||
| Document MC/DC coverage evidence | `certification/COVERAGE.md` | Modified Condition/Decision Coverage for safety-critical code |
|
||||
| Create hardware-in-the-loop test plan | `certification/HIL_PLAN.md` | How to validate on real BMW hardware |
|
||||
| Final integration & regression test | `certification/REGRESSION_REPORT.md` | All tests pass, all ECUs validated |
|
||||
| Publish release notes | `RELEASE_NOTES.md` | What's new, what's validated, what's certified |
|
||||
|
||||
**Phase 3 Exit Gate:**
|
||||
- ✅ PowerPC kernel boots on QEMU with full scheduler/IPC/HM
|
||||
- ✅ MCU micro-kernel boots on constrained target (<16KB flash)
|
||||
- ✅ At least 2 BMW ECUs run as UOS guests
|
||||
- ✅ Inter-ECU communication validated
|
||||
- ✅ ISO 26262 traceability matrix complete
|
||||
- ✅ Safety case documentation complete
|
||||
|
||||
---
|
||||
|
||||
## 5. Resource Plan
|
||||
|
||||
### Track Ownership
|
||||
|
||||
| Track | Owner | Focus |
|
||||
|-------|-------|-------|
|
||||
| **Track 1: Firmware Audit** | Fábio + Hermes | Hardware specs, ECU catalog, requirements |
|
||||
| **Track 2: Mycelium** | Hermes (agent) | Rust toolchain, codegen, binary format |
|
||||
| **Track 3: UOS Kernel** | Hermes (agent) | PowerPC port, MCU micro-kernel, guest emulation |
|
||||
| **Track 4: ISO 26262** | Fábio + Consultant | Safety requirements, certification, traceability |
|
||||
| **Track 5: Validation** | Fábio + Hermes | ECU emulation, testing, hardware-in-the-loop |
|
||||
|
||||
### Session Allocation (estimated)
|
||||
|
||||
| Phase | Sessions | Focus |
|
||||
|-------|----------|-------|
|
||||
| Phase 1 (M1–M6) | 8–12 sessions | Audit + requirements |
|
||||
| Phase 2 (M7–M14) | 15–20 sessions | Mycelium + PPC + ISO 26262 |
|
||||
| Phase 3 (M15–M24) | 20–25 sessions | MCU kernel + guest emu + validation |
|
||||
| **Total** | **43–57 sessions** | |
|
||||
|
||||
### Hardware Requirements
|
||||
|
||||
| Item | Purpose | Priority |
|
||||
|------|---------|----------|
|
||||
| QEMU PPC (qemu-system-ppc) | PPC kernel development | HIGH |
|
||||
| QEMU Cortex-M (mps2-an500) | MCU micro-kernel dev | MEDIUM |
|
||||
| BMW ECU dev boards (if available) | Hardware validation | HIGH (M19+) |
|
||||
| Logic analyzer / oscilloscope | Timing validation | MEDIUM (M21+) |
|
||||
| CAN bus analyzer | Inter-ECU comm validation | MEDIUM (M21+) |
|
||||
|
||||
---
|
||||
|
||||
## 6. Risk Register
|
||||
|
||||
| # | Risk | Probability | Impact | Mitigation |
|
||||
|---|------|-------------|--------|-----------|
|
||||
| R1 | **BMW firmware is proprietary** — we may not have full source access | HIGH | HIGH | Focus on what we CAN analyze (configs, binary formats, component models). Use black-box testing for proprietary blobs. |
|
||||
| R2 | **PPC QEMU limitations** — `qemu-system-ppc` may not emulate target MCU accurately | MEDIUM | HIGH | Cross-validate with real hardware early (M15). Use QEMU for bring-up, real HW for validation. |
|
||||
| R3 | **ISO 26262 certification scope creep** — consultant may demand more evidence than planned | MEDIUM | MEDIUM | Define certification scope in M2. Focus on ASIL-B first (lowest automotive safety level). |
|
||||
| R4 | **MCU memory constraints too tight** — UOS micro-kernel may not fit in target flash/RAM | MEDIUM | HIGH | Profile early (M17). Have a "nano-kernel" fallback that strips HM and keeps only scheduler + IPC. |
|
||||
| R5 | **Guest emulation timing fidelity** — emulated ECUs may not meet real-time constraints | HIGH | MEDIUM | Document timing margins. Accept that emulated validation is ~80% fidelity; real HW validation in M21+ covers the gap. |
|
||||
| R6 | **PikeOS source analysis blocked** — some components may be encrypted or obfuscated | LOW | HIGH | Work with what's available. Document gaps. Use `strings`/`binwalk` for binary RE. |
|
||||
| R7 | **Mycelium binary format changes break existing tests** | MEDIUM | MEDIUM | Run full test suite after every change. Keep conformance oracle fixtures updated. |
|
||||
|
||||
---
|
||||
|
||||
## 7. Open Questions
|
||||
|
||||
1. **What BMW ECUs specifically?** Which chip variants (MPC5777M? S32R? MPC5748G?)? This determines the PPC core variant (e200 vs e500 vs e5500) and MMU capabilities.
|
||||
2. **How much source access do we have?** Full PikeOS project files? Just configs? Just binaries? This shapes the audit depth.
|
||||
3. **Is there an existing UOS target MCU?** Or do we choose one? Candidates: NXP S32K (ARM Cortex-M), Renesas RH850 (PPC e200), TI TDA4 (ARM Cortex-A + MCU).
|
||||
4. **Certification body?** TÜV? Internal assessment? This affects documentation rigor.
|
||||
5. **Guest emulation priority?** Should we emulate 1 ECU deeply or 3 ECUs shallowly?
|
||||
6. **MCU micro-kernel: which API surface?** ARINC-653 subset? FreeRTOS-compatible? POSIX-like? Custom?
|
||||
|
||||
---
|
||||
|
||||
## 8. Success Metrics
|
||||
|
||||
| Metric | Target | Measurement |
|
||||
|--------|--------|-------------|
|
||||
| **ECU coverage** | 100% of BMW MVP ECUs cataloged | `audit/ECU_CATALOG.md` has entry per ECU |
|
||||
| **Component analysis** | 100% of `.cmp` files analyzed | All 127 `.cmp` documented with structure + runtime mapping |
|
||||
| **Mycelium PPC** | All 127 `.cmp` → valid PPC output | `mycelium --target=ppc_e500mc` processes all files |
|
||||
| **Binary parity** | Round-trip test passes | Parse → generate → load → runtime matches PikeOS |
|
||||
| **UOS PPC boot** | Boots on QEMU PPC | UART banner + scheduler demo |
|
||||
| **MCU kernel** | Fits in target constraints | <16KB flash, <4KB RAM on Cortex-M |
|
||||
| **Guest emulation** | 2+ BMW ECUs run as guests | ECU firmware boots and executes partition schedule |
|
||||
| **ISO 26262 traceability** | 100% requirement coverage | Every safety requirement traced to code + test |
|
||||
| **Timing compliance** | All ISR latencies within bounds | Measured on real hardware or high-fidelity emulation |
|
||||
|
||||
---
|
||||
|
||||
## 9. References
|
||||
|
||||
| Document | Path |
|
||||
|----------|------|
|
||||
| PikeOS mirror | `universalisos/pikeos-mirror/` |
|
||||
| PikeOS kernel sources | `pikeos-mirror/sources/ukernel-{arm_v7hf,ppc_e500mc,...}/` |
|
||||
| PikeOS .cmp components | `pikeos-mirror/sources/*/config/` (127 files) |
|
||||
| PikeOS demo suite | `pikeos-mirror/demo/` (16 suites) |
|
||||
| UOS kernel | `universalisos/kernel/` (56,442 LOC) |
|
||||
| UOS parity push ledger | `universalisos/kernel/docs/PARITY_PUSH_LEDGER.md` |
|
||||
| Mycelium toolchain | `mycelium/crates/` (22 crates) |
|
||||
| Mycelium TOOL_STATUS | `mycelium/TOOL_STATUS.md` |
|
||||
| Mycelium implementation plan | `universalisos/implementation_plan.md` |
|
||||
| CDK/config/build parity spec | `universalisos/docs/parity/CDK_CONFIG_BUILD_PARITY_SPEC.md` |
|
||||
| RPM parity spec | `universalisos/docs/parity/RPM_PARITY_SPEC.md` |
|
||||
| SCOV/RVS parity spec | `universalisos/docs/parity/SCOV_PARITY_SPEC.md` |
|
||||
| PikeOS parity program | `universalisos/PIKEOS_PARITY_PROGRAM.md` |
|
||||
| RISC-V parity plan | `universalisos/RISCV_PIKEOS_PARITY_PLAN.md` |
|
||||
| Configconv contract | `mycelium/docs/CONFIGCONV_CONTRACT.md` |
|
||||
|
||||
---
|
||||
|
||||
## 10. Immediate Next Actions (M1)
|
||||
|
||||
1. **Receive BMW ECU hardware specs** from the consultancy client
|
||||
2. **Inventory all `.cmp` files** per ECU (we have 127 in the mirror — are there more in the BMW project?)
|
||||
3. **Identify MCU/MPU chip variants** — this determines the PPC core target
|
||||
4. **Set up QEMU PPC** development environment (`qemu-system-ppc`)
|
||||
5. **Schedule first audit session** — deep dive into ECU1 firmware
|
||||
|
||||
---
|
||||
|
||||
## 11. Subagent-Report Log
|
||||
|
||||
| Date | Task | Report |
|
||||
|------|------|--------|
|
||||
| 2026-07-13 | Fleet plan audit | Verified: 56K LOC UOS kernel (3 arches), 22 mycelium crates (P0.4), 127 PikeOS .cmp files, 7 target XMLs, 16 demo suites. No PPC backend in UOS. No MCU micro-kernel. No guest emulation framework. |
|
||||
Loading…
Reference in a new issue