Inspiration
In mission-critical autonomous mobility and drive-by-wire applications, real-time operating systems (RTOS) must guarantee microsecond determinism and ISO 26262 ASIL-D functional safety. Sensor anomalies, angular jerk violations, or memory corruption in low-level drivers can cause fatal failures if not intercepted deterministically within the Fault Tolerant Time Interval (FTTI).
The BlackBerry QNX Neutrino RTOS 8.0 Microkernel provides hardware MMU isolation, microkernel scheduling, and user-space POSIX resource managers. QNX SafePulse Lab transforms these architectural capabilities into an active, self-healing diagnostic cockpit: an inline microsecond safety linter, lock-free telemetry ringbuffer, and automated high-availability recovery supervisor.
What It Does
- Deterministic Microsecond Inline Safety Linter: Intercepts every binary telemetry frame at 50Hz directly inside the
/dev/safepulsePOSIX resource manager. Validates bounds, slew rate, timestamp freshness, CRC-32 integrity, and multi-sensor plausibility in < 1.3 microseconds. - ASIL-D-Targeted Dual-Rail Safe State FSM: Executes a 4-tier safety escalation hierarchy (
NORMAL->DEGRADED->LIMP_HOME->EMERGENCY_STOP). Protects against Single Event Upset (SEU) bit-flips via inverted shadow state registers (~state) and clamps actuators to fail-safe positions within a 10ms FTTI window. - High-Availability Self-Healing (HAM Pattern): Survives induced memory faults (SIGSEGV/SIGABRT) by separating volatile execution from persistent kernel POSIX Shared Memory (
/dev/shmem/safepulse_ring). The supervisor respawns the driver in < 60ms with zero telemetry loss. - Interactive 3D Digital Twin & Scrubber Cockpit: A real-time Three.js vehicle telemetry dashboard featuring interactive CAN fault injection (bit flips, packet drops, clock drift) and a 6.0-second (300-frame) blackbox scrubber for post-incident playback.
QNX 8.0 Native Architecture & Code Traceability
SafePulse Lab strictly avoids generic POSIX emulation and directly targets BlackBerry QNX Neutrino RTOS 8.0 user-space microkernel interfaces:
| QNX 8.0 Native Capability | Source Implementation Reference | Engineering Guarantee & Verification |
|---|---|---|
| User-Space Resource Manager | guest/resmgr/safepulse_resmgr.c:418-433 |
dispatch_create(), resmgr_attach() establishing /dev/safepulse in user space |
| Lock-Free Atomic POSIX SHM | guest/resmgr/safepulse_resmgr.c:354-373 |
shm_open() + mmap() on /dev/shmem/safepulse_ring with C11 stdatomic.h |
| Deterministic Priority Scheduling | guest/resmgr/safepulse_resmgr.c:449 |
SCHED_FIFO / SCHED_SPORADIC enforcement at Priority 50 |
| Nanosecond Hardware Timing | guest/benchmark_wcet.c:93-117 |
ClockCycles() hardware profiling across 100,000 continuous frames |
| Fault Injection & Signal Trap | guest/resmgr/safepulse_resmgr.c:156-165 |
Induces SIGSEGV, SIGFPE, SIGABRT, SIGILL to verify HAM supervisor resilience |
| 6.0s Blackbox Scrubber | host/dashboard/app.js:140-210 |
Circular buffer scanner caching past 6.0s (300 frames @ 50Hz) for post-crash replay |
| 7-Stage ASIL-D Diagnostic BIST | guest/linter/linter_engine.c:80-160 |
Range, Slew Rate, Stale Counter, CRC-32, Plausibility, FTTI, Shadow State |
Quantitative Engineering Benchmark (Empirical Evidence)
| Benchmark Metric | Empirical Target | Measured Value (QNX 8.0 SDP on QEMU) | Verification Verdict |
|---|---|---|---|
| Mean Execution Time (WCET) | < 10.0 µs |
904 ~ 938 ns | Target Met (Consumes 1.75% of 10ms FTTI) |
| Tail Latency (p99.9 WCET) | < 50.0 µs |
1.77 µs | Target Met |
| Dynamic Memory Leakage | 0 bytes / 100k pkts |
0 bytes (Deterministic Zero-Leak) | Target Met |
| 50-Crash Multi-Fault Survival | 100.0% Survival |
100.0% (50/50 Survival) | Target Met (Zero Data Loss) |
| Recovery Latency (Crash-to-Ready) | < 500 ms |
4.2 ms Mean (180 ms Worst-Case) | Target Met |
| Anti-Jerk Actuator Slew Rate | Ramped < 300 deg/s |
250 deg/s Ramped Steering | Target Met |
| Temporal FFI under 100% DoS | 0 Deadline Misses | 0 Misses across 5,000 pkts (0.00%) | Target Met |
How We Built It
- Microkernel Core (C11): Compiled using QCC (
qcc -Vgcc_ntox86_64 -std=c11 -D_QNX_SOURCE -O2). Implements user-space/dev/safepulseand lock-free atomic ringbuffers. - Host Tooling & Bridge (Python 3.12): VirtIO socket forwarder parsing binary telemetry packets at 50Hz and exposing JSON streams via WebSockets.
- Cockpit Dashboard (Three.js / Canvas): Interactive 3D visualization rendering steer angle, yaw rate, lateral acceleration, and time-series blackbox playback.
- Automated Verification Harness: 8-Gate autonomous test suite (
test_comprehensive_e2e.py) and 50-crash chaos marathon harness (test_chaos_marathon.py).
AI Tools Usage Disclosure
In compliance with hackathon regulations, AI tools were leveraged as engineering assistants:
- Google Antigravity Agent: Architecture scaffolding, test harness automation, and cross-platform build orchestration.
- DeepSeek V4.1 Flash: Hostile red-team adversarial code review, static boundary verification, and ISO 26262 FTTI calculation.
- Claude 3.7 Sonnet: Three.js kinematic shader modeling and mathematical proof for dual-rail shadow registers. All core safety logic, state machine invariants, and QNX C11 microkernel drivers were designed, implemented, and verified by the author.
Regulatory Notice & Disclaimer
- Trademark Notice: BlackBerry, QNX, Neutrino, and Momentics are registered trademarks of BlackBerry Limited. This project is independently created for the BlackBerry QNX Global Hackathon 2026.
- Safety Scope: SafePulse Lab is an ASIL-D-targeted architectural research prototype demonstrating Freedom from Interference (FFI) and fault recovery pursuant to ISO 26262-9:2018. It does not constitute an accredited Safety Element out of Context (SEooC) until undergoing formal accredited third-party certification.
