Elektrobit’s EB corbos Linux for Safety Applications holds what Elektrobit calls a “positive technical assessment” from TÜV NORD, for a Safety Element out of Context against ISO 26262 ASIL B and IEC 61508 SIL 2. In every Elektrobit document read, dated 23 April 2024 to 21 October 2026, the operating system is described as assessed, and the product page and infosheet add “feasibility report”. Only the EB corbos Hypervisor is described as certified, by TÜV SÜD, in a release of 31 October 2024. No TÜV NORD certificate, safety manual, kernel version or hardware list was found in the public pages read, so the scope of the assessment cannot be stated from public sources.
Engineers who evaluate Linux for ADAS or autonomous-driving compute now meet the phrase “safety-certified Linux” in trade coverage, and the product most often attached to it is EB corbos Linux for Safety Applications from Elektrobit. The supplier’s own documents use a narrower phrase. This post reads them in date order and sets out what a team can and cannot conclude before it asks the supplier for the underlying assessment.
What EB corbos Linux is, in Elektrobit’s own description
EB corbos Linux is introduced in an Elektrobit release dated 23 April 2024 as an operating system solution built on Ubuntu, with a Canonical quotation saying it leverages Ubuntu. The release states up to 15 years of maintenance and availability for project integration worldwide, names ISO 26262 ASIL B and IEC 61508 SIL 2 as the target standards, and frames the assessed object as a Safety Element out of Context, meaning an element assessed against an assumed context and not against one vehicle item.
The two-page Elektrobit infosheet for EB corbos Linux, stored in the supplier’s 2025 tech-corner upload folder, shows how the pieces are arranged. The diagram has two software stacks above a common base. One stack is labelled QM and runs applications on a middleware API, automotive libraries and an “EB corbos Linux kernel”. The other stack is labelled ASIL-B and runs applications on a safety middleware API, the same kind of libraries, and an “EB corbos Linux for Safety Applications kernel”. Below both stacks sit SoC enablement, the EB corbos Hypervisor, an “OS safety monitor”, drivers, the bootloader and the SoC. The document does not give a kernel version, an Ubuntu release or a hardware list.
The 31 October 2024 Elektrobit release says the EB corbos Hypervisor hosts the safety monitor modules that form the essence of EB corbos Linux for Safety Applications. The hypervisor is described as microkernel-based, built on a variant of the L4Re framework maintained by Kernkonzept, and certified on ARMv8-A. The product is therefore not a Linux kernel with a safety label. It is a Linux kernel beside a monitor that runs outside it.
How the wording changed between April 2024 and October 2026
Four dated Elektrobit documents state the safety status of the operating system or of its hypervisor. They were all read on 7 November 2026. The table gives the operative wording for each, paraphrased where the original is long.
| Date | Document | Wording about the Linux operating system | Wording about the hypervisor |
|---|---|---|---|
| 23 April 2024 | Elektrobit release, product launch | Assessed to be compliant; “positive technical assessment” by TÜV NORD, Safety Element out of Context, ISO 26262 ASIL B and IEC 61508 SIL 2. | Not mentioned. |
| 31 October 2024 | Elektrobit release, hypervisor certification | TÜV NORD’s assessment “earlier this year” is said to have cleared the way towards full certification; the release calls this a “pathway to full safety compliance”. | The base of the EB corbos Hypervisor is certified by TÜV SÜD to ISO 26262 ASIL B as a Safety Element out of Context. |
| 24 February 2026 | Elektrobit release, Mobileye Drive | Same as April 2024: positive technical assessment for ASIL B and SIL 2 by TÜV NORD; called a “safety-compliant solution”. | Not mentioned. |
| Product page, last modified 21 October 2026; infosheet, undated, stored under 2025 | Elektrobit product page and infosheet | Compliance with ASIL B and SIL 2 requirements, with a footnote: “Positive technical assessment feasibility report” (attributed to TÜV NORD on the product page). | Not mentioned on these two documents. |
The change that can be dated is in the hypervisor, not in the operating system. Between April and October 2024 the hypervisor moved from an unmentioned component to one with a stated third-party certification. For the operating system, the February 2026 wording is the April 2024 wording, and the product page still carries the “feasibility report” footnote on 21 October 2026. In the pages read there is no Elektrobit statement that the full operating system has been certified, although the October 2024 release described the assessment as clearing the way towards that outcome. The documents give no reason.
A trade publication shows how the wording changes when it is relayed. An article dated 27 February 2026 on Autonomous Vehicle International is titled “Elektrobit’s safety-certified Linux OS integrated into Mobileye Drive”, while its body reports a positive technical assessment from TÜV Nord. The supplier’s release of three days earlier did not use the word certified for the operating system.
What a technical assessment and a feasibility report are, and what they are not
Four words are in use in this area and they are not interchangeable. Certified means an assessment took place and a certificate names a scope, an assessor and a standard. Certifiable means a package exists to support an assessment the integrator must still arrange. A safety package is available means documents exist and no assessment has been stated. Assessed, as Elektrobit uses it, is closer to the last two in what is publicly documented.
The documents read do not define “positive technical assessment” or “feasibility report”. Neither the April 2024 release nor the infosheet says whether TÜV NORD issued a certificate, a certification report or an opinion on a concept. The infosheet footnote joins the two terms, which suggests an assessment of whether the approach is feasible, but that is an inference from the words and the supplier’s document does not confirm it. In the public pages read, no certificate number is given, no register entry was located, and the scope sentence names a standards pair and a Safety Element out of Context but no software version.
The contrast with the hypervisor is stated by Elektrobit itself. In the October 2024 release the hypervisor base “has received certification” from TÜV SÜD, with the integrity level and architecture named, while the operating system result is called a positive technical assessment. Two verbs for two components in one document are the clearest evidence in the public record that Elektrobit treats them as different statuses, and an integrator should read them the same way.
Elektrobit’s own blog on EB corbos Linux supports caution. A post by its director of product management for high-performance computing, last modified on 6 October 2026, says certification is not the finish line and warns that in many Linux-based platforms only parts of the kernel are covered, which leaves the remaining safety argument with the customer. It describes EB corbos Linux for Safety Applications as a “TÜV-assessed platform”.
Why a monitor outside the kernel changes the question
The strongest case for Elektrobit’s design is architectural. A general-purpose Linux kernel has too many lines, interfaces and changes to be argued correct through the normal ISO 26262 software development route. ISO/PAS 8926:2024 is the published alternative for pre-existing software, and the earlier post What a Linux Safety Certification Actually Covers explains how it classifies and examines an element like the kernel. A monitor architecture takes a different route. If a small component outside Linux observes the kernel’s safety-relevant behaviour and puts the system into a defined state when that behaviour is wrong, the safety argument depends mainly on the monitor and its host, and less on every line of the kernel.
Elektrobit’s blog states this reasoning directly: safety can be ensured by containing the role of open-source components, isolating Linux from safety-critical functions with strict interfaces, so that the architecture does the work. NVIDIA’s talk at Ubuntu Summit 26.04, posted on 28 April 2026, describes an approach to an ASIL B qualified Linux that treats Linux as a Safety Element out of Context and adds avoidance and monitoring measures inside or outside the kernel. The talk page names no assessor.
The hypervisor certification supports the design in a precise way. A certified microkernel-based hypervisor that hosts the monitor gives the monitor a host whose own assurance, according to Elektrobit, has a named assessor and standard. That is the part Elektrobit describes as certified.
The EB corbos Linux design also leaves questions that the public documents do not answer. Which kernel behaviours does the monitor observe, and what does it do on a violation? How does its detection latency compare with the fault tolerance time of a safety goal? What does an ASIL B goal require of the kernel, the user-space libraries and the init system on the ASIL-B side of the diagram once the monitor is in place? The supplier’s technical paper “Enhancing automotive HPC safety with Linux” has a section on safety solutions, but only its contents list and introduction were readable, because the full paper is behind a request form. The monitor mechanism is therefore not described here.
What the public record does not show
An absence statement is only useful if it names where the search was made. The Elektrobit newsroom, product page, linked infosheet, blog and the technical-corner pages that were opened were checked, and web searches were made for TÜV NORD and Elektrobit certificate information. No TÜV NORD certificate, certificate number or register entry was found, although TÜV NORD’s own listing was not located and not read, so this does not show that none exists. No safety manual or Assumptions of Use is mentioned on the product page. The kernel version, Ubuntu release and supported hardware are not stated, and the infosheet date was inferred from its storage path. The content of the assessment was not read.
The hypervisor certification was read only as Elektrobit’s statement; the TÜV SÜD entry was not located. No production release date was found.
How this compares with the Red Hat In-Vehicle OS position
The other public Linux example is Red Hat’s release of 20 May 2025, which states that Red Hat In-Vehicle Operating System achieved functional safety certification as a Safety Element out of Context against ISO 26262 Edition 2 at ASIL-B, with exida as assessor and a Safety Guidance document including Assumptions of Use. The exida listing was not found when searched for on 16 October 2026, so this compares two vendor statements and not two certificates.
Red Hat names a certification, an assessor and a deliverable that carries obligations for the integrator. Elektrobit names an assessment, an assessor and a standards pair, and separates the hypervisor it calls certified from the operating system it calls assessed. Both are at ASIL B, and neither public record shows a published scope sentence listing software versions and hardware. The choice is between two architectures as well as two labels.
Questions to put to a supplier that uses this wording
The wording does not make the product unsafe or the claim false. It means the claim has not yet been given in the form an integrator needs. Ask for the TÜV NORD document itself, with its type, date and stated scope. Ask which software versions, hardware and configuration it covers, and what happens to that coverage when the Ubuntu base takes a security update. Ask for the safety manual, the Assumptions of Use and the allocation of safety requirements between monitor and kernel. Ask for the route from assessed to certified, with a date. The public record reviewed contains none of these.
Key takeaways
- Elektrobit describes EB corbos Linux for Safety Applications as having a positive technical assessment from TÜV NORD for a Safety Element out of Context at ISO 26262 ASIL B and IEC 61508 SIL 2. The product page footnote and the infosheet call it a feasibility report.
- The EB corbos Hypervisor, which hosts the safety monitor, is the component Elektrobit describes as certified, by TÜV SÜD at ASIL B, in a release dated 31 October 2024.
- The status wording for EB corbos Linux was the same on 23 April 2024, 24 February 2026 and 21 October 2026. A trade headline of 27 February 2026 used the word certified; the supplier’s release did not.
- No TÜV NORD certificate, certificate number, safety manual, kernel version or hardware list was found in the public pages read, so the scope of the assessment cannot be stated.
- The monitor outside Linux changes what the safety argument must establish about the kernel; how much is what the assessment scope would state, and it is not public.
Frequently asked questions
Is EB corbos Linux for Safety Applications certified to ISO 26262?
Not according to the Elektrobit documents read. They describe a positive technical assessment by TÜV NORD for a Safety Element out of Context at ASIL B, and the product page and infosheet add the words feasibility report. The hypervisor component is described as certified by TÜV SÜD.
What is the difference between assessed and certified?
A certification names an assessor, a standard and a scope in a certificate. The documents read do not define what an assessment of the kind described covers.
Why does the hypervisor matter to the Linux claim?
Elektrobit states that the EB corbos Hypervisor hosts the safety monitor modules that form the essence of the product. The monitor runs outside the Linux kernel, so the hypervisor’s certified status supports the host of the monitor and not the Linux kernel itself.
Has the wording about the operating system changed since 2024?
In the documents read, no. The April 2024 release, the February 2026 release and the product page of 21 October 2026 all use the technical assessment wording. The October 2024 release said the assessment cleared the way towards full certification, and no later statement of full certification was found.
Further reading
- Elektrobit, 23 April 2024: EB corbos Linux for Safety Applications release (vendor release)
- Elektrobit, 31 October 2024: EB corbos Hypervisor certification release (vendor release)
- Elektrobit, 24 February 2026: Mobileye Drive collaboration release (vendor release)
- Elektrobit infosheet: EB corbos Linux for Safety Applications (vendor document, undated)
- Elektrobit product page, last modified 21 October 2026 (vendor page)
- Autonomous Vehicle International, 27 February 2026: Elektrobit’s safety-certified Linux OS integrated into Mobileye Drive (trade press)
This article is technical commentary based on the public documents named above, read on 7 November 2026. It is not certification advice and does not replace the purchased standards, a supplier safety manual or a qualified assessor.
