SEGGER embOS-Safe for Indian Automotive Tier-1 Teams: The Cheapest Credible Path to ISO 26262 ASIL D

India’s automotive electronics supply chain is hitting a functional-safety inflection point. Major Indian passenger, commercial, two-wheeler, and EV OEMs alongside Bajaj, TVS, Ather, Ola Electric, Eicher, and Sonalika are all building products where ISO 26262 functional safety compliance is no longer optional, it is a procurement requirement from the OEM customer, and Indian Tier-1 suppliers in Pune, Bengaluru, and Chennai are being asked to produce ASIL B, ASIL C, and in some powertrain and brake cases ASIL D components. The engineering teams at major global Tier-1 India centres, KPIT, and the domestic Tier-1 base are all facing the same specific question: which functional-safety-certified RTOS do we build on?

The Western functional-safety RTOS market has three dominant players: Wind River VxWorks, ETAS RTA-OS (not a viable option for GSAS customers per our CLAUDE.md rules), and SafeRTOS. All three are capable, all three are commercially proven, and all three are substantially more expensive than a fourth option Indian teams routinely overlook: SEGGER embOS-Safe. embOS-Safe is certified to IEC 61508 SIL 3 (the baseline industrial functional safety standard), ISO 26262 ASIL D (the automotive derivative), IEC 62304 Class C (the medical derivative), and EN 50128 (the railway derivative), which is the full safety-certified quadrant. The certification was awarded by TÜV SÜD, the same certification body Indian Tier-1 teams already work with for other compliance submissions.

This post is for Indian automotive Tier-1 engineering leads, procurement engineers, and functional safety managers who need to evaluate embOS-Safe against the alternatives. It walks through what embOS-Safe actually is, what the certification evidence package looks like, how it integrates into an AUTOSAR Classic BSW stack, and the procurement and licensing model that makes it materially cheaper than the Western alternatives for Indian programs. GSAS Micro Systems is India’s authorized SEGGER partner, embOS-Safe commercial source licensing is available with INR invoicing and on-site functional safety integration consulting at Indian Tier-1 sites.

What embOS-Safe actually is

At the code level, embOS-Safe is the same embOS kernel that ships as SEGGER’s flagship RTOS, but compiled with additional runtime checks, shipped with a certified evidence package that covers the full ISO 26262 / IEC 61508 / IEC 62304 / EN 50128 qualification scope, and distributed under a commercial licence that includes long-term support and safety-manual maintenance.

The kernel itself is small, preemptive, priority-based, and designed for hard real-time responsiveness. It supports all the features Indian automotive ECU and medical device firmware teams need: tasks, software timers, mailboxes, semaphores, mutexes, event groups, memory protection via the MPU, tickless low-power operation, and ISRs. No feature gap between the non-certified and certified versions, the certification covers the full API.

What changes with the “Safe” variant is what the certification gives you: a documented evidence package that TÜV SÜD audited and approved, covering the kernel’s requirements, design, unit test results, integration test results, safety analysis (FMEDA), and safety manual. That package is what your Indian Tier-1’s functional safety manager hands to the OEM customer’s safety auditor when the ECU goes through its safety case review. Without it, your team would have to produce equivalent evidence from scratch, a multi-month, hundred-thousand-dollar engineering investment that is tangential to the actual product you are building.

The certifications: read the TÜV SÜD report carefully

embOS-Safe’s certifications cover:

• IEC 61508 SIL 3: the baseline industrial functional safety standard. Every derivative standard (ISO 26262 automotive, IEC 62304 medical, EN 50128 railway) traces back to IEC 61508.
• ISO 26262 ASIL D: the automotive derivative of IEC 61508. ASIL D is the highest safety level, required for brake, steering, airbag, and powertrain firmware in commercial vehicles and increasingly in passenger EVs. Indian Tier-1s working on two-wheeler and commercial-vehicle domain controllers are starting to hit ASIL C and ASIL D requirements from their OEM customers.
• IEC 62304 Class C: the medical device software derivative. Class C is the highest classification, required for software whose failure could lead to serious injury or death (infusion pumps, ventilators, defibrillators, anaesthesia machines). Relevant to Indian medical device OEMs building for CDSCO and export markets.
• EN 50128 SW-SIL 4: the railway derivative. Relevant to Indian railway signalling, rolling stock electronics, and traction control suppliers qualifying under RDSO requirements.

Important: the specific version of embOS-Safe you license must match the certification report your OEM customer’s safety auditor is reviewing. Certifications are dated, and SEGGER maintains a rolling certification program, when the kernel changes, the certification is re-issued. Always request the current certification evidence package from SEGGER (or from GSAS as SEGGER’s authorized India engineering partner) at the time you start a new program, and pin the version of embOS-Safe you build against for the life of that program.

What the evidence package contains

A TÜV-certified RTOS evidence package is substantial, it typically runs to several hundred megabytes of documentation, source code, test reports, and certificates. For embOS-Safe, SEGGER provides:

• Safety Manual: the authoritative guide to how the kernel must be integrated, configured, and used in a safety-certified product. Every assumption, restriction, and integration requirement is specified. Your Indian Tier-1’s functional safety manager reads this document cover-to-cover before integrating embOS-Safe.
• Requirements specification: what the kernel is designed to do, at a formal requirements level. Traceable from the safety manual to the source code to the test cases.
• Design description: how the kernel is internally architected. Used by your team’s safety analysis to argue that the kernel cannot violate the system-level safety requirements.
• FMEDA (Failure Modes, Effects, and Diagnostic Analysis): the safety-analysis artifact that shows what can go wrong inside the kernel and how those failure modes are detected, contained, or tolerated. This is what ISO 26262 Part 6 requires for a pre-certified software component.
• Unit test results: the test cases SEGGER runs against the kernel, with pass/fail evidence. Your auditor will want to see this and may spot-check specific tests.
• Integration test results: end-to-end tests against reference hardware configurations.
• Certification report from TÜV SÜD: the formal document stating that the kernel has been audited and certified to the listed standards at the stated version.
• Source code: embOS-Safe ships as source under commercial licence, which is essential for safety-certified work because your auditor may want to review specific kernel functions directly rather than trust the binary.
• Change log: every release of embOS-Safe is accompanied by a delta that explains what changed, so your Indian Tier-1 team can assess whether to upgrade or pin to the old version.

embOS-Safe inside an AUTOSAR Classic BSW stack

For Indian automotive Tier-1s building AUTOSAR-compliant ECUs, the integration question is where embOS-Safe fits relative to the AUTOSAR Basic Software (BSW). The short answer: embOS-Safe sits at the OS layer of the BSW, one of the three layers that AUTOSAR explicitly allows to be sourced from a third-party vendor (the other two being Microcontroller Abstraction Layer and Complex Drivers).

Practical integration notes for Indian AUTOSAR teams:

• embOS-Safe’s API is not AUTOSAR OS’s API. If your BSW integrator (Vector MICROSAR, EB tresos, Elektrobit, KPIT Epsilon, or an in-house stack) expects the AUTOSAR OS API (ActivateTask, TerminateTask, GetResource, ReleaseResource), you need a thin AUTOSAR-OS-compatible wrapper around embOS-Safe calls. SEGGER ships an AUTOSAR compatibility layer for this purpose, ask your SEGGER contact (or GSAS) for the current version.
• The AUTOSAR OS configuration specification (the .arxml OS description) needs to be generated to match what embOS-Safe supports. Most BSW generators can emit embOS-compatible configuration with a specific target profile.
• Tasks, events, and alarms defined in the AUTOSAR OSEK configuration map one-to-one onto embOS tasks, event groups, and software timers. The mapping is mechanical and handled by the compatibility layer.
• ISR integration follows the OSEK category 1 / category 2 distinction. embOS-Safe supports both.

The integration is not trivial, but it is well-trodden, SEGGER has done this with multiple European Tier-1 customers who build AUTOSAR ECUs on embOS-Safe, and the reference integration guide covers the common silicon families (Renesas RH850, Infineon AURIX / TriCore, NXP S32K).

The procurement case: cost vs the Western alternatives

This is the part of the story that Indian engineering procurement teams need to hear. The commercial licensing cost of embOS-Safe is materially lower than the cost of Wind River VxWorks Cert Platform, SafeRTOS, or the other Western safety RTOS options that have historically dominated European and US automotive programs. Exact numbers are commercial-confidential and depend on the silicon family, the number of product variants, and the volume terms your programme negotiates, but the delta between embOS-Safe and the main alternatives is typically large enough to move the decision on a mid-volume Indian automotive programme.

That delta becomes even more important when you layer on the other considerations:

• Indian support. GSAS provides on-site SEGGER functional-safety integration consulting at Indian Tier-1 facilities in Bengaluru, Pune, and Chennai. Western RTOS vendors route India support through their global support organization, which sometimes means a 9-hour time zone gap between your 22:00 crisis in Pune and a European or American support engineer’s 08:30.
• INR pricing and GST compliance. SEGGER licensing through GSAS is invoiced in INR with Indian GST, integrates with GeM, SAP Ariba, Coupa, and TReDS. Western RTOS vendors typically invoice in USD or EUR and require Indian Tier-1s to manage the foreign-currency procurement themselves, which adds operational overhead and a currency-risk line to the programme budget.
• License structure. SEGGER’s commercial licence is a per-product, one-time model for the kernel source. You pay once, you ship the product indefinitely, there is no per-unit royalty. Several of the Western alternatives use a royalty-per-device model that scales linearly with production volume and changes the programme economics at high volumes.

For an Indian Tier-1 finance director looking at a 5-year programme with 500,000 to 5 million units, the difference between a one-time source licence and a per-unit royalty adds up to a seven-figure procurement delta. That delta is frequently what decides embOS-Safe into the stack on Indian automotive programmes even when the Western alternatives are technically equivalent.

Getting started: the evaluation path GSAS recommends

1. Scope the safety requirements. Work with your functional safety manager to confirm the required ASIL (or SIL, Class, or SW-SIL) level for your programme. embOS-Safe covers up to ASIL D on automotive, Class C on medical, and SIL 3 on industrial, if your programme needs lower levels, the certification is a superset.
2. Request the current certification evidence package from GSAS. This is the input for your safety team’s due diligence. GSAS can deliver it under NDA within a week.
3. Run a technical evaluation. GSAS ships evaluation licences of embOS-Safe for bench testing on your target silicon (the Renesas RA, RH850, Infineon AURIX, NXP S32K, STM32 U5/H5, or whichever part your programme is building on). A typical evaluation takes two to four weeks and gives your team hands-on familiarity with the API, the safety manual, and the integration story.
4. Commission an integration workshop at your site. GSAS can run a day-long workshop at your Pune, Bengaluru, or Chennai facility covering embOS-Safe integration with your BSW, compiler, and debug tooling. This accelerates the engineering team’s confidence in the choice.
5. Procure commercial licences through GSAS. Once the programme commits to embOS-Safe, procurement is a standard GSAS order, INR invoice, GST, GeM/Ariba/Coupa paperwork as required, SEGGER licence certificates issued within a week.

Further reading

• SEGGER embOS product page at segger.com
• embOS-Safe safety-certified RTOS overview at segger.com
• SEGGER embOS product page at GSAS
• embOS Tickless mode for low-power designs, companion post on non-safety embOS features
• SystemView V4 for RTOS latency analysis, the verification tool that pairs with embOS-Safe for integration testing
• SEGGER at GSAS
• GSAS automotive industry solutions