Three tools that turn embedded CI into safety evidence
reqthread threads hazards to requirements to code to tests. faultbench proves the safety mechanism reacts inside its fault-tolerant time interval. edgegate stops a model or firmware change from quietly regressing latency, memory or power on the target. Every chart below is generated from the tools' own output on the reference project, not drawn by hand.
reqthread: the thread, with its gaps
The reference project is a wireless e-stop heartbeat receiver in C. Hover or tap any node to light up its thread. Red is a gap that fails the pipeline. Dashed is a test that runs but is traced to nothing.
reqthread check on main
- rule 1 SSR-003 has no verifying test at level module.
- rule 4 HIL test
test_link_loss_tripsonly skipped at baseline (no board in CI). - rule 12 FM-001, enable driver stuck-high, has no mitigating requirement and no accepted-risk record.
Exit code 2. With a baseline, only new gaps fail, so a team can adopt it on a codebase that already has some.
Coverage says 100%. The thread says no evidence.
seq_check(), the replay rejection, is now fully covered: . A faultbench scenario replays a heartbeat and the receiver trips. But that scenario carries no @verifies SSR-003, so when the assessor asks for the test behind the requirement, there is nothing to point at.
The fix is one docstring line. reqthread told you which one.
faultbench: does the safe state arrive in time?
Each strip is the machine-enable output of the receiver under one injected fault on a virtual CAN FD bus with virtual time. The fault starts at 1000 ms. The shaded band is the 300 ms fault-tolerant time interval. Measured by running the scenarios, not sketched.
Scenarios map to the EN 50159 transmission threats: deletion (stop, drop), delay, corruption and insertion (forged tag), repetition (replay). The two-drop case is the availability check: two lost heartbeats at 10 Hz must not cause a nuisance trip.
edgegate: a model or firmware change on the target, compared to baseline
Two runs of the same tiny ONNX model on the host, taken as baseline and candidate. On a Jetson the same config adds TensorRT engines, the tegrastats rails and an nvpmodel sweep.
edgegate on the Orin NX: ResNet-50 across power modes
edgegate matrix: variants times repeats, with a verdict per cell
One YAML names a base config and a list of variants. edgegate runs them interleaved so drift cannot favour one, resumes if interrupted, and tabulates crash rate, time to crash and clean-run rate per cell with one JUnit case each. This is the public stand-in engine: a script that emits detections, with a batch-size bug and a timed crash built in so the gate has something to catch.
A cell fails on a crash, or on a run that stayed alive but missed a check, like the slow variant here that runs clean yet never reaches the detections minimum. Crashed runs carry a forensics block: when the process tree's memory collapsed and what RAM, power rails and RSS did in the 30 seconds before, classified as a plateau or allocation cycling. A baseline that failed its own gate is refused for regression checks, so a run that died early can never make the next one look like a power regression.
How they fit a safety lifecycle
IEC 61508 part 3
Requirements, architecture and design elements map to the lifecycle sections you load from your own copy of the standard. Tools are declared with their T1/T2/T3 class. Module, integration and PE-integration test levels are separate, so a passing host test cannot stand in for a board test.
Black-channel comms
A safety link works by continuously saying "all is well" and stopping the machine when that stops arriving. faultbench injects exactly the threats a black-channel receiver must defend against and reports the measured detection time when it is too slow.
Edge AI on the target
A smaller model can be slower, and a quantised one can be wrong. edgegate measures p50/p90/p99 latency, peak memory, rail power and accuracy on the device and fails on regressions past both a percentage and an absolute floor, so jitter on a sub-millisecond model does not block a merge.