ISO 26262 Embedded GUI: MISRA C Compliant HMI Software for Automotive Safety Applications

When your instrument cluster, ADAS overlay, or warning display carries an ASIL rating, your GUI framework must meet the same coding standards as the rest of the safety software stack. Sparklet delivers MISRA C compliant embedded GUI source code — designed for integration into ISO 26262 ASIL B and ASIL C automotive HMI components.

Get Free Evaluation Contact Sales

What Is ISO 26262 in Embedded GUI Development?

ISO 26262 is the international functional safety standard for electrical and electronic systems in road vehicles. It defines requirements across the full safety lifecycle — from initial concept and hazard analysis through hardware and software design, production, and decommissioning. Automotive HMI software — including instrument cluster displays, ADAS warning overlays, and vehicle fault notification systems — falls directly within the ISO 26262 scope wherever those displays convey safety-relevant information to the driver.

The standard categorises software by Automotive Safety Integrity Level (ASIL), ranging from ASIL A (lowest safety requirement) to ASIL D (highest). The level is determined by a hazard analysis that scores the severity of a potential harm, the exposure frequency, and the controllability by the driver or other road users. Display software that shows a critical warning — brake system fault, battery thermal event, ADAS lane departure — is typically rated ASIL B or higher.

For software at ASIL B and above, ISO 26262 Part 6 (Software Development) mandates specific coding guidelines. MISRA C is the de facto standard for C software in this context — and selecting an embedded GUI framework that is not MISRA C compliant creates a compliance gap that auditors will require you to justify. Sparklet is MISRA C compliant throughout its source code.

ASIL Levels and What They Mean for Automotive Display Software

ASIL A & B — Instrument Cluster

ASIL A applies to functions where failure could cause minor, reversible injury with low exposure or high driver controllability. In display terms, ASIL A covers informational displays — fuel economy statistics, audio media information — where an incorrect value or momentary failure does not create a safety hazard.

ASIL B is the most commonly applicable level for automotive instrument cluster display software. It covers warning indicator rendering — low tyre pressure, engine fault, ABS activation — where failure could cause serious but not necessarily life-threatening injury with moderate exposure. ASIL B requires MISRA C compliance, module testing evidence, static analysis results, and documented software architecture. This is the primary ASIL level at which Sparklet integration is used in production instrument cluster programmes on the Renesas RH850.

ASIL C & D — ADAS Overlays

ASIL C applies to functions where failure has a high probability of severe injury with moderate controllability. ADAS warning overlays — forward collision warnings, blind spot indicators on a cluster or HUD — may require ASIL C. The software development requirements at ASIL C are substantially more rigorous: formal methods consideration, extended MC/DC test coverage, and detailed design documentation. Sparklet's MISRA C compliant source and Embien's engineering support contribute to ASIL C software component integration.

ASIL D is reserved for functions where failure could cause life-threatening injury with high exposure and limited driver controllability. Display software rarely carries a standalone ASIL D rating. Where ASIL D is required for the overall system, ASIL decomposition (splitting requirements into ASIL B + ASIL B) can reduce the software-level ASIL target. Functions with no safety relevance receive a QM (Quality Managed) designation — no ASIL applies, though using MISRA C throughout simplifies system boundary analysis.

Development Process Artifacts

ISO 26262 Part 6 specifies the software development lifecycle outputs required at each ASIL level. For embedded GUI components these are:

  • MISRA C compliance evidence: Static analysis results showing zero mandatory violations and documented justifications for any advisory deviations.
  • Software architecture documentation: Sparklet's 7-layer architecture (APP → WID → GDI → EXEC → RS_MIN → UTIL → HAL) maps directly onto ISO 26262 software component decomposition.
  • Tool qualification support: Flint UI Designer generates C code used in safety-related components — Embien provides Tool Qualification Management (TQM) documentation for Flint under ISO 26262 Part 8.
  • Test coverage evidence: ASIL B requires statement and branch coverage; ASIL C adds MC/DC. Embien supports test planning and execution for Sparklet widget API verification.
  • Anomaly management: Embien maintains a formal issue register for Sparklet with safety-significance assessments, provided to customers for inclusion in safety case documentation.

MISRA C and ISO 26262: Why Full Compliance Matters for Automotive GUI

MISRA C was created by the Motor Industry Software Reliability Association specifically to address the needs of automotive safety software. Its rules target documented classes of C language behaviour that have caused or are likely to cause real embedded system failures. ISO 26262 Part 6 references MISRA C directly as the coding guideline for C software, reflecting the standard's automotive origins.

For embedded GUI software, MISRA C compliance has specific practical implications:

The distinction between MISRA C compliant and MISRA C compatible is significant in an ISO 26262 audit. Compliant means verified: static analysis tools have been run, results reviewed, and violations resolved or formally deviated with documentation. Compatible is an unverified claim. Sparklet is MISRA C compliant — verified with static analysis — and Embien provides the analysis evidence to customers as part of the safety documentation package.

What Sparklet Does Not Claim

Sparklet does not claim ISO 26262 Part 8 tool qualification as a standalone pre-certified product. Sparklet is used as a software component within the customer's safety architecture. The system-level safety case — HARA, ASIL decomposition, safety requirements, V&V evidence, and production control — is the responsibility of the OEM or Tier 1 system integrator, as is standard in ISO 26262 supply chains. Embien's role is to provide the source code, documentation, and engineering support customers need to include Sparklet in their safety evidence package.

ISO 26262 Part 6 Software Requirements vs Sparklet's Contribution

Part 6 RequirementApplicable ASILSparklet SupportsTeam Responsibility
Software coding guidelines (MISRA C)A–D (HR)Full MISRA C compliance, static analysis evidence—
Software architecture documentationA–D7-layer module architecture docs providedSystem integration architecture
Software unit designB–DWidget API and interface documentationApplication layer design
Software unit testing (statement/branch)B–DUnit test support on requestIntegration into customer test plan
MC/DC test coverageC–DEngineering support for MC/DC planningCustomer executes test campaigns
Tool qualification (Flint)A–DTQM documentation providedTool qualification activity
Configuration managementA–DVersioned source releases, anomaly registerCustomer CM system integration
Hazard analysis (HARA)A–D—OEM / Tier 1 responsibility

How Sparklet Supports ISO 26262 Automotive HMI Development

Four engineering properties that make Sparklet the correct embedded GUI choice for ASIL B and ASIL C automotive display software components.
MISRA C

Full MISRA C Compliance — Verified

Every widget, rendering primitive, and HAL interface in Sparklet satisfies MISRA C rules — verified with static analysis. Embien provides compliance documentation to support ISO 26262 software integration reviews and tool qualification.

Deterministic

Deterministic Frame Timing for WCET

Sparklet's rendering pipeline executes in deterministic time bounded by widget count and display resolution. No garbage collection pauses, no heap allocations. Safety functions requiring WCET analysis can rely on Sparklet's fully bounded execution model.

Source Code

Complete Source Code Delivery

Sparklet is delivered as complete C source code — not a binary library. ISO 26262 supply chain and tool qualification requirements need source access for safety-relevant components. Customers can run their own static analysis and perform independent code review.

Automotive Platforms

Renesas RH850 and Infineon TRAVEO T2G

Sparklet is deployed in production on RH850 (instrument clusters) and supports TRAVEO T2G (body and cluster). Both are within established ISO 26262 supply chains. Embien provides BSP-level safety documentation for both platforms.

Automotive Platform Integration: Where Sparklet Is Deployed

Sparklet's ISO 26262 relevant deployments on the two leading automotive-grade MCU platforms.
RH850

Renesas RH850 — Instrument Clusters and Body Domain Controllers

The Renesas RH850 is the dominant MCU in automotive instrument cluster applications globally. It is an ASIL-D capable MCU family with extensive safety documentation from Renesas and a broad ecosystem of ISO 26262 supply chain components. Sparklet's RH850 integration includes the D/AVE2D 2D graphics accelerator — enabling hardware-accelerated rendering of gauge animations, dial faces, and warning icons without consuming CPU bandwidth needed for ASIL safety functions running on the same MCU. See the Automotive HMI case studies.

TRAVEO

Infineon TRAVEO T2G — Automotive Body and Cluster Applications

The Infineon TRAVEO T2G is an ISO 26262 ecosystem MCU targeting automotive cluster, body domain, and HMI applications. It offers lockstep CPU cores and hardware safety mechanisms appropriate for ASIL B and ASIL C applications. Sparklet's TRAVEO T2G integration provides the GUI rendering layer for TRAVEO-based HMI designs, with Embien providing BSP support and safety documentation for ISO 26262 integration.

Frequently Asked Questions: ISO 26262 Embedded GUI

Sparklet is not sold as a pre-certified standalone ISO 26262 software component. Instead, Sparklet provides MISRA C compliant source code and documentation that customers integrate into their ISO 26262 safety case as a software component — the standard model for embedded software component suppliers in automotive supply chains. Embien supports tool qualification activities, software architecture reviews, and safety documentation for ASIL B and ASIL C integration.

Evaluate Sparklet for Your ISO 26262 Automotive Display

Get the Sparklet evaluation package and connect with Embien's engineering team. We have direct experience supporting ISO 26262 ASIL B and ASIL C software integrations on Renesas RH850 and Infineon TRAVEO T2G — and we can support your safety case from architecture review through final audit.

Get Free Evaluation