Cockpit Electronics Audit-Readiness

Verdict: declared, not evidenced. Three findings stand between ICP-1 and its Q1 2027 audit

The one-line story: the supervision duties the old discrete cluster performed in hardware were deleted with the hardware, and the claims that replaced them ("the hypervisor handles it") do not cite evidence. The rest of this page shows how that verdict was earned.

One chip now carries both worlds, and the safety boundary moved with nobody watching

For two decades the instrument cluster and the infotainment unit evolved along parallel but strictly isolated trajectories: the cluster on deterministic, fail-safe real-time software, the infotainment on rich, resource-heavy consumer stacks. The integrated cockpit ends that isolation. A single heterogeneous SoC now drives the cluster, the center stack, the HUD, and the passenger display, with a Type-1 hypervisor holding an ASIL B safety island and a QM Android guest apart on shared silicon. The engineering is available. What most organizations cannot produce is evidence that their boundary actually holds: who supervises a rendered telltale, what happens to the regulatory chime when the infotainment guest restarts, and what independent path exists if the hypervisor itself faults.

The failure pattern is organizational before it is technical. The cluster team carries the safety culture; the infotainment team carries the release velocity; the consolidation program inherits both and a boundary that belongs to neither. Cost-downs quietly delete the mechanisms the old discrete architecture provided for free: the external safety MCU, the hardwired telltale, the independent watchdog reset path.

Andare Cockpit Systems, a Tier-1 mid-consolidation

Andare is fictional, but its shape is the standard shape of this engagement: a supplier with a trusted discrete cluster in production, a first integrated-cockpit award in hand, and two engineering cultures that have never shared a safety case.

The four entry findings the assessment inherits

The ICP-1 cockpit domain controller, boundary by boundary

This is the substrate the whole assessment runs on. One SA8295P-class SoC hosts a QNX cluster guest (the ASIL B island) and an Android Automotive IVI guest (QM) over a Type-1 hypervisor, feeding a 12.3-inch cluster display and a 14.6-inch center display through a serializer link. Every exercise output in this demo is drawn from this system, and the excerpts below are the exercises' actual work products in the simulation: real signal semantics, realistic timing, simulated identifiers.

What the consolidation removed, mechanism by mechanism

DC-2, the shipping discrete cluster, earns trust the classical way. The assessment's first job is naming exactly which of its mechanisms ICP-1 silently dropped:

Exercise E1 + E2 output · the cross-domain boundary register, excerpt

Extracted by AI from the hypervisor device tree, VirtIO configuration, ARXML and DBC exports, and build manifests; corrected in review; signed by the cluster and IVI leads in week 1. Eight of the 63 channels:

8 of 63 channels · full register signed W1, day 5 · identifiers simulated, semantics realistic

Exercise E3 output · the telltale path trace, excerpt

Every regulatory telltale traced from source frame to pixel, classified, and timed on the client's bench (client hands on hardware, Ordinara remote). Five of twelve:

5 of 12 regulatory telltales · full trace in the gap grid · OEM requirement: first telltale ≤ 2.0 s from KL15

Exercise E4 + E5 output · the evidence, as found

display0.pipe0.region_a   = { x:412, y:24, w:496, h:96 }   # speed · PRNDL
display0.pipe0.region_a.crc_ref   = crc_table_a.bin @ 60 Hz
display0.pipe0.region_a.on_fail   = FAULT_REACTION_50MS      # verified · TC-0763
display0.pipe0.region_b   = (absent)                          # telltale strip · TT-03/06/09 unsupervised
gpu.partition.qnx_slice   = 4ms/frame  # declared          # no test ID found in any evidence folder
watchdog.island.qa_window = 100ms                            # verified · TC-0781
watchdog.external         = (none)                            # DC-2 duty, unassigned since cost-down

t + 0.6 s   hypervisor up, guests scheduled
t + 3.1 s   QNX guest first frame (splash)
t + 3.8 s   telltale regions valid            # requirement: ≤ 2.0 s
t + 11.2 s  Android home surface ready
reference: DC-2 discrete cluster, same bench: first telltale < 2 s behind static splash

One artifact, end to end: the brake telltale, TT-03

Every exercise touches it, and it exits the assessment as a graded gap with a costed action. This is the spine of the whole service:

1. E1 names it. The domain map places 0x2C4 brake status among the safety-relevant signals terminating in the QNX cluster guest.
2. E2 registers its crossings. It enters the boundary register twice: XB-004 (through a QM gateway process) and XB-017 (framebuffer region B to the panel).
3. E3 traces and times it. Path class: rendered, region B. First valid at 3.8 s against a 2.0 s requirement. Supervision: none found.
4. E4 converts opinion to evidence. The safe_render.cfg pull shows region B absent from the CRC monitor. "The hypervisor handles it" is now a falsified claim, in writing.
5. E7 grades it. Criterion D3.2, safe-rendering supervision, grade 1 of 4. Finding G-01, severity high: three regulatory telltales unsupervised.
6. The report prices the fix. Roadmap item R-01: register region B, add the fault-reaction test, 30 days, no hardware change. Your board reads that line, not this page.

Four domains, sixteen criteria, one grading scale

The assessment grades against Ordinara's published cockpit reference architecture, assembled from certified-component practice (QNX OS for Safety, pre-certified Type-1 hypervisors, Vulkan SC) and the supervision mechanisms of production dual-processor cluster programs. Because the reference is public, the grade is comparable: across programs, across sites, and across re-grades.

The grading scale

Seven exercises, three weeks, sixteen criteria covered

Each exercise states who does what, where the AI sits, the signed artifact it produces, and the reference criterion it feeds. Nothing here is generic AI enablement: every output lands in the gap grid.

Three weeks, shown as they run

Week 1 is shown session by session; weeks 2 and 3 as run sheets. All remote: Andare's hands on Andare's hardware, everything on Andare's accounts, Ordinara on the call and in the evidence folders with read-only access.

The artifact your sponsor forwards upward

Two pieces leave the assessment: the graded gap grid (working document, excerpt below) and the findings report (forwardable, in full below). Both cite the same evidence.

The gap grid, excerpt

10 of 16 criteria shown · full grid delivered with the report · grades challenged live in the W3 calibration call

The report, in full

This report and the full gap grid are the deliverable. The grid re-runs cheaply: same reference, same criteria, next quarter's evidence. A re-grade before the OEM audit turns "we fixed it" into a second graded document.

The same three weeks, read from three seats

Scenario economics, stated as assumptions

Figures below are the Andare scenario's working assumptions, shown so the math can be challenged line by line. Your numbers replace them in the scoping call.

Fixed fee, fixed scope, graded output

From US$6,500 for the assess phase shown on this page; the full sprint, adding a game-day rehearsal and coached fixes, runs US$12 to 18k. Two to three weeks: week 1 architecture and domain review, week 2 safe-rendering and telltale path, weeks 2 to 3 gap grid and roadmap. 50% at signature, 50% on delivery. Read-only access, everything on your accounts, fully remote. The Executive AI evidence session (US$1,500 to 3,000, prepaid, 100% creditable against any engagement) is the natural entry: bring one nagging cockpit workflow, leave with a live demonstration on your own artifacts and the findings that scope this assessment. The Fractional AI Advisor (from US$3,000 monthly) is the natural continuation when you want the roadmap run on a weekly cadence with the same evidence discipline.

The method, inspectable

• Coach, not referee. No assessor certification is held or claimed. You already buy referees: your OEM's assessors, your homologation authority. This engagement makes sure you walk into their audit with zero surprises.
• Zero egress. Read-only access, everything on your accounts, fully remote. Reports carry judgments and gaps, never your absolute parameters. The tooling is a single inspectable file your security team can read line by line.
• Independence your own AI cannot supply. Consistency is not correspondence: documents that agree with each other are graded here against the system's behavior and a published external reference, not against each other. E4 above is that method producing a falsified claim in writing.
• Blind-probe challenge (founding clients). Your QA lead picks the threads and gives the method two hours. No finding your own team agrees is real, no fee.