How open source libraries can be qualified for safety-relevant systems and ISO 26262

At the upcoming Eclipse SDV Community Days at T-Systems in Bonn, Germany, Felix Mölders will present a talk on applying the Eclipse Trustable Software Framework (TSF) to the nlohmann/json library in Eclipse S-CORE. In this preview, he gives a sneak peek into the session.

What is nlohmann/json and what role does it play within Eclipse S-CORE?

nlohmann/json is a widely-used header-only C++ library for parsing, generating, and manipulating JSON data. Within Eclipse S-CORE, it is used for reading JSON-based configuration files and serves as a pilot third‑party open source component for applying the Eclipse Trustable Software Framework (TSF) to an existing library not originally developed under a safety-oriented V‑model.

“Many open source libraries have been hardened over years of real-world use, yet they often lack formal certification.”

What was the motivation behind applying the TSF to nlohmann/json?

There is a gap in frameworks that support the certification of existing open source libraries. Eclipse TSF, developed by Codethink and open sourced under the Eclipse Foundation, focuses on assessing whether software can be trusted in a safety context without enforcing a strict V-model. Applying TSF to nlohmann/json serves as a pilot to demonstrate how open source libraries can be qualified for ISO 26262 use and more broadly adopted in safety-relevant systems.

What benefits does the framework bring when applied to nlohmann/json within Eclipse S-CORE?

TSF provides a structured process to trace requirements to existing code, collect evidence, and generate safety documentation with the trudag tool. It incorporates the project’s defect history, builds a directed acyclic graph for the safety argumentation, and supports risk analysis based on RAFIA and STPA analyses. Subject matter experts score each statement in the graph, leading to an overall trust score. Despite an initial learning curve, the documentation, tooling, and Codethink’s support facilitated adoption.

How does this case study help demonstrate trust, quality, or security in open source software for SDVs?

Many open source libraries have been hardened over years of real-world use, yet they often lack formal certification. This case study shows how such libraries can be systematically assessed and qualified for safety-critical use, even if they were not developed under a traditional safety process. It helps close the gap between practical reliability and formal certification, enabling the responsible use of open source software in software-defined vehicles (SDVs).

Curious to learn more and discuss this topic with Felix? Then don’t miss our SDV Community Days in Bonn!