KopherBit
AUTOSAR

AUTOSAR RTE Cross-partition IOC: Multi-core ECU safety and general functional isolation

AUTOSAR IOC (Inter-OS-Application Communication) in Classic RTE is a standard mechanism for cross-OS Application/cross-core communication.After isolating the secure partition from the general partition on a multi-core MCU such as Infineon TC387QP, the IOC is a legal cross-partition communication path.This article summarizes the generation process, configuration methods and restrictions of IOC by KopherSAR RTE.

Summary

IOC (Inter-OS-Application Communication) is a cross-OS Application/cross-core communication mechanism provided by AUTOSAR Classic RTE. When the system divides the ECU into multiple OS Applications (different memory protection partitions, which can be executed on different cores), cross-partition SWC communication cannot use ordinary RTE Sender/Receiver direct calls, but must be carried out through IOC.Multi-core MCUs such as Infineon TC387QP often separate safety functions (SafetyRelevant Partition) from general functions (Non-Safety Partition), and IOC is the legal communication path between the two.KopherSAR RTE automatically generates IOC channels during the configuration phase and is managed uniformly by KopherConfig.

Technical Role

AUTOSAR OS allows the ECU software to be divided into multiple OS Application. Each OS Application can:

  • Independent allocation of memory protection unit (MPU) sections.
  • Assigned to different cores (TC387QP is 4 cores).
  • Set independent ASIL levels (e.g. ASIL-D Safety Partition vs. QM Application Partition).

SWC communication between different OS Applications cannot directly call the RTE API of the other party (this will trigger a memory protection violation).During the configuration phase, RTE automatically generates IOCs for cross-partition communication by analyzing which OS Application each SWC belongs to:

-IOC Send/Receive -IOC Read/Write -IOC Trigger

IOC uses APIs such as IocSend / IocReceive at the OS layer, and the OS performs inter-core synchronization and data replication.

Architecture

┌────────────────────────────┐ ┌──────────────────────────────┐
│ Partition A (Safety, ASIL-D)│ │ Partition B (QM, Non-Safety)│
│ ┌────────────┐ │ │ ┌────────────┐ │
│ │ SWC_A │ │ │ │ SWC_B │ │
│ └─────┬──────┘ │ │ └──────┬─────┘ │
│ │ Rte_Write │ │ │ Rte_Read │
│ ▼ │ │ ▼ │
│ ┌─────────────┐ │ │ ┌─────────────┐ │
│ │ IOC Send │─────IPC────▶│ │ │ IOC Recv │ │
│ └─────────────┘ │ │ └─────────────┘ │
└────────────────────────────┘ └───────────────────────────────┘
Core 0 Core 1

Key Capabilities

  • Cross-Core/Cross-Partition Communication: Provides legal SWC cross-partition data paths on multi-core MCUs (TC387QP).
  • MPU Friendly: Avoid triggering protection violations in environments using memory protection.
  • Automatically generated: KopherSAR RTE automatically analyzes cross-partition Send/Receive from ARXML configuration and generates corresponding IOC.
  • Synchronization primitive: IOC uses the synchronization mechanism (Spin Lock, IPC) provided by the OS to ensure data consistency.
  • Support Last-is-Best and Queued modes: IOC supports 1:1 and N:1 Sender/Receiver modes.

Engineering Inputs Required

InputPurpose
OS Application PlanningWhich SWCs belong to which Partition; the ASIL level of each Partition.
Core configurationIn which core each OS Application is executed.
Sender/Receiver interfacePort, Interface, Data Element definition between SWC.
Synchronization policyWhether Queued mode (sequence of events preserved) or Last-is-Best (latest value only) is required.
Security PolicyWhether cross-partition data requires additional integrity/scope checks.

How KopherBit Supports This

  • KopherSAR RTE: Full support for automatic IOC generation, compliant with AUTOSAR Classic specification.
  • KopherConfig: Configure OS Application, Partition, Core Mapping, and infer IOC requirements from SWC ARXML.
  • TC387QP integration: Make full use of TC387QP multi-core and Lock-Step mechanism to provide safe partition templates.
  • Consultant: Assist customers in designing the Partition structure and SWC allocation corresponding to ASIL.

FAQ

Why can’t I call RTE API directly across partitions?

Different OS Applications usually have independent MPU sections, and directly reading and writing the other party’s memory will trigger a protection violation.This is true even on the same core, because the OS will re-apply the MPU rules every time the OS Application is switched.

Will IOC increase latency?

yes.IOC transmits data through the IPC and synchronization mechanism of the OS. Compared with direct RTE calls to the same partition, there will be additional delay (depending on the OS and hardware, usually on the order of microseconds).The design must avoid passing high-frequency and high-priority signals across zones.

How to synchronize cross-core IOC?

The OS uses Spin Lock + Shared Memory + Inter-Core Interrupt (ICI) in cross-core IOC, and the sending core notifies the receiving core to read the data.KopherSAR RTE automatically configures these primitives, users do not need to write them manually.

Does IOC support Queued mode?

support.RTE can configure each IOC channel to be Queued (retains a sequence of events) or Last-is-Best (retains only the latest value).Queued mode is suitable for event-type signals (such as error notifications); Last-is-Best is suitable for periodic signals (such as sensor values).

Secure Partition (ASIL-D) How to verify data across partitions?

Check logic can be added at the SWC layer: range check, Plausibility, Stale Data detection; SecOC and other mechanisms can also be used to add MAC during cross-partition transmission.The implementation strategy is based on project safety analysis (FMEA / TARA / HARA).

Does all cross-partition communication require an IOC?

yes.The RTE configuration phase will analyze the correspondence between SWC and OS Application, and automatically replace cross-partition Send/Receive with IOC.Normal RTE calls are still used within the same zone without affecting performance.

JSON-LD

{
"@context": "https://schema.org",
"@type": "TechArticle",
"headline": "AUTOSAR RTE Cross-Partition IOC: Multi-core ECU Security and General Functional Isolation",
"description": "AUTOSAR Classic RTE's IOC (Inter-OS-Application Communication) provides cross-OS Application/cross-core SWC communication paths, often used for multi-core MCU secure partition isolation.",
"url": "https://kopherbit.com/knowledge/autosar-rte-cross-partition-ioc/",
"datePublished": "2026-05-09",
"dateModified": "2026-05-09",
"inLanguage": "zh-TW",
"keywords": ["AUTOSAR", "RTE", "IOC", "Multi-Core", "Safety Partition", "TC387QP"],
"articleSection": "AUTOSAR",
"author": { "@type": "Organization", "name": "KopherBit", "url": "https://kopherbit.com" },
"publisher": { "@type": "Organization", "name": "KopherBit", "logo": { "@type": "ImageObject", "url": "https://kopherbit.com/logo.png" } }
}
Back to Knowledge Base