News
Most of our work doesn’t make headlines which is usually a good sign.
Still – some things are worth sharing. You can find them here.
EMBAR SB: A secure boot manager that establishes trust before your first line of code runs
safecubed releases EMBAR SecureBoot – a two-stage signature architecture with an integrity-protected audit log and built-in key exchange
Overview
We are thrilled to announce the first release of our security solution EMBAR SecureBoot (SB). EMBAR SB is designed as a companion for existing bootloaders and applications to allow the fulfilment of central security requirements with minimal software changes.
What sets EMBAR SB apart from other solutions is its two-stage signature architecture providing an integrity-protected audit log on top of firmware verification, and its lightweight built-in key exchange.
EMBAR SB is available now for evaluation. As an optional add-on, EMBAR HSM extends EMBAR SB with a hardware root of trust for even stronger protection.
We support customers with the integration of EMBAR SB, or take over the complete integration on request. Get in touch now.
Why EMBAR SB?
Secure software update without bootloader interaction
In many ECU projects, security logic is spread across the normal bootloader – if it was considered at all. Every bootloader change then puts the whole trust chain at risk again. EMBAR SB removes that dependency. It runs as the first stage after reset and owns every security-relevant decision before any other code executes. The normal bootloader can then focus on communication and diagnostics.
EMBAR realises this by employing a two-partition update model. A new software image is first written to a dedicated update partition. The SecureBoot Manager validates its signature and integrity. Only if an image passes verification, it is copied to the execution partition. Therefore, unverified or tampered images never reach executable memory. In the latter case, the device keeps running its last correctly verified software.
Two-stage signature: knowing what was installed, who installed it, and when
Conventional secure boot answers one question: is this firmware genuine? EMBAR SB answers a second one: how did it get onto this device?
- Stage one, the firmware signature. The software supplier signs the firmware image. This proves the code is authentic and unchanged, as in any secure boot solution.
- Stage two, the deployment signature. A second signature binds additional information to that image at installation time, for example who flashed it and when. The firmware stays untouched. The new information is attached and protected on top of it.
This gives OEMs, suppliers and service partners a tamper-proof record of every software installation. That record supports traceability, audits and incident investigation, and it fits the requirements of regulations such as IEC 62443.
Built-in key exchange: keys that can change without changing the device
Cryptographic keys don't last forever. A key may be compromised, a supplier relationship may end, or a security policy may require regular rotation. In many systems, replacing a verification key means returning the ECU to the factory or reprogramming it with special equipment.
EMBAR SB has a secure key exchange built in. New keys can be installed in the field through the same protected update path, and only with authorization from the currently trusted key. The chain of trust is never broken, and attackers cannot install keys of their own. As a result, devices can stay secure for their entire lifetime, not only until the first key has to change.
HSM integration
EMBAR SB is designed to work with hardware security modules (HSMs). It can use an HSM for cryptographic operations and secure key storage, so the root of trust stays anchored in dedicated hardware. safecubed has also developed its own HSM solution for the Infineon AURIX™ TriCore™ platform, EMBAR HSM, which is built to complement EMBAR SB. Further details on EMBAR HSM will be announced soon.
Availability
EMBAR SB is available now for evaluation. safecubed offers integration support, from configuration and timing analysis to customer-specific adaptation, as part of its consulting and development services.
About safecubed
safecubed delivers safety and cybersecurity services for embedded systems, from consulting to software development. Its work covers secure boot, hardware security modules, cryptographic libraries and automotive ECU development.
Funding
EMBAR SB was developed with the support of the Wirtschaftsagentur Wien as a part of the project SEDRIC.
Request an EMBAR SB evaluation →
For further information, please contact:
Nico Ondracek, CEO
nico.ondracek@safecubed.com
From Structured Text to Verified C Code
Streamlining safety-relevant industrial software development with Embedded Coder and EverTest
Summary
In safety-relevant industrial development, C code may be generated through multiple toolchain steps: Structured Text (ST) is generated from a model-based design, then converted into C code by a separate toolchain.
This workflow can split verification across different environments and make it harder to demonstrate that the code tested is representative of the final production implementation.
safecubed worked with EverBits to transition a real-world industrial customer application targeting an Infineon AURIX™ platform from an ST-based workflow to direct C code generation with MATLAB® Embedded Coder® and verification using EverTest®. The resulting workflow supports reuse of existing test cases across Model-in-the-Loop (MIL), Software-in-the-Loop (SIL), and Processor-in-the-Loop (PIL) verification, helping teams reduce duplicated effort and strengthen verification evidence for functional-safety development.
The Challenge
Some industrial teams use Simulink® PLC Coder™ to generate Structured Text as intermediate result and then rely on a second toolchain to generate the C code that runs on the target platform. This creates a fragmented verification workflow: model-level tests may run in MATLAB and Simulink, while later verification activities depend on a separate environment and toolchain.
Additional automation may be needed to connect the model-based test environment with the PLC toolchain. Depending on the workflow, the code executed during PIL testing may also include a generated test harness or integration code and therefore differ from the final production implementation. This can complicate the task of demonstrating equivalence between the tested code and the software intended for deployment. Limited support for automated parameter variation can further constrain systematic testing.
The Solution
safecubed and EverBits demonstrated a streamlined workflow that generates C code directly from the model using Embedded Coder and uses EverTest to support test-driven development and verification. The transition of the customer application was completed in less than four weeks by retaining and extending the existing verification assets rather than rebuilding the test process.Reusing (MIL) test cases during the transition
Existing Model-in-the-Loop (MIL) test cases were reused to verify that model adaptations needed for Embedded Coder did not introduce unintended behaviour. Requirements-based test cases were also used to demonstrate full structural test coverage of the model.Combining SIL and PIL verification in one workflow
EverTest integrates the generated production C code into the Simulink test environment as a model variant. The same test bench can therefore be used to exercise both the model and the compiled C code in Software-in-the-Loop (SIL) testing, keeping verification within MATLAB and EverTest rather than requiring a separate SIL toolchain. The same verification workflow can be extended to Processor-in-the-Loop (PIL) testing on the target processor, adding evidence from execution in the target environment. Together, SIL and PIL complete the verification strategy in accordance with IEC 61508 and ISO 26262 and create a consistent test strategy.Automated parameter variation
Existing MIL test cases, including cases that vary parameter values, can also be applied during SIL and PIL testing. EverTest uses a generated C-code wrapper to make parameter changes from the MATLAB environment effective during SIL and PIL execution, supporting systematic verification of the generated C code.The Outcome
In less than four weeks, safecubed and EverBits transitioned the customer application to a direct C-code generation and verification workflow using Embedded Coder and EverTest. The workflow reuses existing test cases, keeps model and SIL testing in the MATLAB environment, supports automated parameter variation, and extends verification to PIL testing on the target processor. These capabilities can reduce duplicated testing effort and help teams build clearer verification evidence for projects developed with reference to IEC 61508 and ISO 26262.TISAX Assessment Result Available for safecubed GmbH
Information security is an essential foundation for trusted cooperation with our customers and business partners. At safecubed GmbH, the confidentiality, availability and integrity of information therefore have a high priority.
We have implemented comprehensive measures to protect sensitive and/or confidential information. These measures are based on the Information Security Assessment catalogue of the German Association of the Automotive Industry (VDA ISA).
The ENX Association supports, with TISAX (Trusted Information Security Assessment Exchange), the common acceptance of information security assessments in the automotive industry on behalf of the German VDA. TISAX assessments are conducted by audit providers that demonstrate their qualifications at regular intervals.
The assessment of safecubed GmbH was conducted by the TISAX audit provider DQS GmbH.
Assessment ID: A1Z07R-1
TISAX and TISAX results are not intended for the general public. The assessment result is available exclusively through the ENX Portal.
Further information about TISAX is available at https://enx.com/tisax.
TISAX is a registered trademark of and governed by the ENX Association.
safecubed GmbH joins the MathWorks Connections Program
safecubed becomes official consulting partner for model-based development, functional safety, and cybersecurity engineering
safecubed GmbH has officially joined the MathWorks Connections Program. Through this membership, safecubed expands its consulting services for safety-critical model-based development, embedded software engineering, and functional safety using MATLAB® and Simulink®.
The MathWorks Connections Program is available to third-party organizations that develop and distribute complementary, commercially available products, training, and consulting based on MATLAB and Simulink. These partner offerings address technical needs across a wide range of applications and industries worldwide with software and hardware products that extend the usage of MATLAB and Simulink. These solutions seamlessly integrate with MathWorks products and ensure ongoing compatibility in conjunction with new MathWorks releases.
“Joining the MathWorks Connections Program further strengthens our ability to support customers developing safety-critical systems,” said Nico Ondracek at safecubed. “By combining deep embedded software expertise with workflows based on MATLAB and Simulink, we help customers accelerate development while meeting functional safety and compliance requirements.”
safecubed provides end-to-end consulting for ASIL D and SIL 3 applications, including traceable Simulink models, automated code generation, embedded integration, verification on host and target, and assessment support according to ISO 26262 and EN 61508 requirements. The company combines model-based development with strong embedded systems expertise to deliver efficient, maintainable, and production-ready software solutions.
About safecubed GmbH
safecubed GmbH is an engineering and consulting company specializing in embedded software, model-based development, cybersecurity, and functional safety for automotive and industrial systems. The company supports customers throughout the full product lifecycle with expertise in safety-critical software development, secure architecture, and certification-oriented engineering workflows.
About MathWorks
MathWorks is the leading developer of mathematical computing software for designing engineered systems. MATLAB, the language of engineers and scientists, is a programming and numeric computation environment for algorithm development, data analysis, and visualization. Simulink is a block diagram environment for simulation and Model-Based Design of multidomain and embedded systems. MATLAB and Simulink provide a unified computing platform that empowers engineering teams to model, simulate, and deploy complex engineered systems spanning industries such as automotive, aerospace, energy, and medical devices. MATLAB and Simulink are fundamental teaching and research tools at the world’s top universities and learning institutions. Founded in 1984, MathWorks employs more than 6,500 people in 34 offices globally, with headquarters in Natick, Massachusetts, USA. For additional information, visit www.mathworks.com.
For further information, please contact:
Nico Ondracek, CEO
nico.ondracek@safecubed.com
IQMS goes live!
With our intelligent, integrated information security and quality management system we succesfully passed our IRIS and ISO 9001 certification. Explore how it works.
Many management systems create overhead instead of clarity.
In many organizations, management systems
are not used during daily work but are simply created for display during audits. Processes are documented, evidence is collected and audits are prepared – but the work happens alongside development, not as part of it.
As a result, these systems often add effort without significantly improving how products are actually built.
Safety, security and quality are integral parts of development.
They must be visible at any time – not only during audits, but during daily work.
It must be clear what is implemented, how quality is ensured, who is responsible and where evidence is generated.
This requires a structure where development, quality management and compliance are aligned.
One system – one consistent reality
In our approach, there is no distinction between a system for development and a system for audits. Developers, project leaders, quality management and all work on the same system.
Requirements, processes and artifacts are directly connected.
The system always reflects the current state of development and auditability follows naturally from this structure.
With our approach, quality is not separated from development.
It is part of our safety culture and embedded in the way we work.
A single source of truth for processes
We apply the logic of Model-Based Systems Engineering (MBSE) to the management system itself.
Instead of maintaining multiple documents, a common model manages each task, role, artifact and template. Each model element exists exactly once and is consistently reused.
Responsibilities are explicitly assigned, and quality-relevant elements are directly linked to their context. The model grants different perspectives and a consistent structure: roles carry clear responsibilities, processes are linked to their required artifacts, and requirements are directly realized through their implementation.
How this is implemented in practice
This structure is realized directly within the company’s ALM system, using Polarion.
Normative requirements – for example from IRIS, ISO 9001 or IEC 62443 – are represented as dedicated work items and linked to process work items, which form the core structure of the management system. Depending on the context, these processes can exist at company level or within specific projects.
A key design decision was not to model elements such as roles or outputs as simple attributes of a process. While this might seem straightforward, it would require constant administrative changes whenever new work products are introduced and would prevent these elements from carrying their own structure and properties.
Instead, roles, artifacts, assets, tools and process steps are modeled as independent work item types and are explicitly linked to processes. This creates a flexible and extensible structure without duplication.
Parametrized report pages are used to generate role-specific and process-specific views, allowing all relevant information to be presented in a structured and accessible way without maintaining separate documentation
In addition, standard Polarion quality assurance mechanisms are applied to the system itself. Missing links, incomplete coverage of requirements or inconsistencies can be identified and evaluated directly within the system and used in reviews and audits.
As development and quality management are not separated, the system is actively used instead of being maintained in parallel.
It remains consistent, easy to update and directly relevant for daily work.
Built for real use
Using this approach, we established a consistent management system for IRIS (ISO 22163) and ISO 9001 with reasonable effort – without external consulting or creating additional documentation structures. Activities such as separate process documentation, retrospective traceability or audit preparation were largely unnecessary.
The same system, extended into projects
The same system is used directly in development projects.
When new requirements arise, for example from IEC 62443, they are integrated into the existing structure. If they align with existing processes, they can be linked immediately. If not, project-specific processes are added using the same model.
In both cases, implementation and compliance remain directly connected.
There is no transition between management system, project execution and audit preparation.
Everything happens within the same structure.
This enables continuous transparency, immediate traceability and auditability without leaving the system or creating additional artifacts.
The first internal project for which we employ this system is EMBAR – a safe and secure embedded architecture. We will provide more insights into our first product in our next post.