 Hello everyone. Following the German tradition, let's start on punch hole. So, good evening everyone. And my name is Elio and I'm here to actually talk about the whole difficulty things that the whole automotive industry are facing right now to get Linux in there. I'm trying to go a little bit faster in the faster slides because I want to give some space for more questions in the end because I think the last slides will open more questions for them. So, let me present myself. So, my name is Elio Castro. I'm Brazilian but live in Germany almost five years right now. I'm working for BMW Karate. It's one part of the BMW Group. It's not very known to everyone but BMW Group is a huge holding that's mostly know about having a mini and a whole hoist as well together with BMW. And Ulm is in the middle between Munich, our headquarters, and in Turch-les-Heim where the self-driving development center. Ulm is basically the center of the software development where we do integration and basically development and everything. This is the building there and since I was open source developer, I've been a KD developer since ever and then I joined and it's very snowy time for a Brazilian. Arriving in a country is knowing it's a very completely different thing. So, let's talk about the industries. So, every single industry is different. One thing that people really don't realize when talking about Linux and adopting Linux is like we're not talking about and putting Linux inside your computer anymore and just use it. Every single industry has their peculiarity and then it's very detailed things that people need to understand. So, if you're looking around about mobile industry, it's a real embedded system in the past. Adopted Linux through Android really late. I was part of the Nokia Project N9 before the arrival of BMW. So, it's really the legacy UNIX and Linux-based platform oriented. So, as you're looking around, there's a telecon. Telecon is a UNIX legacy application. It comes from a long, long, long time ago. It's completely different about the mobile there. So, it's easily translatable for Linux Word. That's why it's the first industry that adopted massively. Then we have a special dedicated applications, heavily dependencies on safety aspects. It means that we barely see Linux running there. I'll tell you what I'm saying in the next slides there, why? And for example, financial. Financial is FTS applications. Then it's easy translatable to UNIX and Linux there on the time. There's a legacy there. So, it's easy there. But we have automotive. So, assembly lines are UNIX and LTS is like long time service. So, we think that usually cars need to be maintained like 10 years. In the modern world today, 10 years computers is like ages. So, why assembly line is so important? Several models of cars are still building. It was designed before years. And then we have one, two years, three years, five years of designs that actually has been produced in there. So, it's several tools to actually prepare the cars. They are in a line. You wrote there, pun intended, because it's literally a line. So, it doesn't matter which car you're doing. It's one after another. The assembly line must go until the end there. And something fails in one car. It stops the whole assembly line. It's money there. And then the companies cannot afford to actually use multiple tools. They need to be the same. You have one single tool for each operation there. And you need to follow exactly these strictly rules, usually made at home. And then, unlike the other companies, we cannot simply create a new assembly line for a new model of car. It would be better on time of price. So, in Linux, there are main bumps that we have actually. There was adopted the resulting platform to be used in assembly line without interfering the current process. Current process, I mean the cars that we are buying today and what is already in the assembly line. The moment that you put the new software and start to flush in the new cars, we are dealing with exactly what's happening already. So, we cannot stop the line. It's not a simple thing that if you're not working, you just fix it there. No. And most of the tools are legacy tools. It's coming like several detail formats and other things that come in from ages. So, for the one I explained in later, is that, for example, the interface for BMWs, the same code runs in several ages of cars. This is just applied and used it on several times. So, basically, we need to adopt and still use in there, in the modern environment, without affecting what is there in legacy environment. And the resultant deployment should be transparent. So, when you go on to the factory, the workers on the factory doesn't understand, oh, we are using Linux, we are doing differently. No. It's like, they press exactly the same button, the process needs to be the same. They don't care about it. The resultant in the end is like the car running. That's it. So, BMW already has Linux. If you actually buy a BMW in the last year for the modern ones, Serious, it's coming with a head unit. The head unit is fully Linux. Why is this first one? It's the foundation for the big plan. Why is it so like the first one? Because we have an important factor called, we don't have safety involved inside the head unit. Despite the something that people say, oh, we can hack the cars, plug in something on the head units and connect the car and everything, oh, it's actually not true. Because this is completely the couple of the safety systems of the car. We have specific commands for basically known safety related today there. This will change it in the future because the car will become unique. But in this case, so the head unit was a very good example. You can see here in the pictures, the Mini and the BMW there running there and the development station that we have at our offices there. It's behind the project of the head unit. We did the OS for the scratch. No safety relevant there. It's fully Linux based on Yachto and we get a nod for the Genevieve project. There, this is part of this one there. We use it Yachto for this part. It's fully based. It was completely integrated on Yachto. The UX are completely ported to Linux. So it's exactly the same UX you're using every evolution. So if you're talking about BMW UX, you can hear about, oh, you are using ID5, ID7, ID6. So it's exactly how the generations of the interface for the BMW are developed. It's the continuous integration that I made in-house. It was the first time that we made every single process there. So the software entering the form of source codes and end up in the integration there. It was my first project when they entered in BMW and that's exactly... We did an integration part when the resulting things go directly to the factory there. So what is there actually now? My current job is actually I'm the lead of the OS team there and we are supposed to put Linux entirely on the cars right now. Not anymore the parts on the head unit or details there. Everything that we'll be using in the future will be based on Linux. And it was really hard. This is the four related parts that I want to say them all. First one and the most important one right in the moment, safety. So Linux is not functional safety qualified. So in automotive world, different from the other industries, we have protocols called standards called A0B, A0D. So automotive, software, integration level, that's actually safety levels that actually determine how much you can able to fail or not during several thousand of operations there. It's a little bit lower than actually you have in the airplane and the aerospace industry but still it's very hard. So we are put in some place that we can actually could endanger the environment around. And Linux will not safety qualified yet. It's mostly not technical work. It's actually a lot of specification work. A lot of investigation work. And so this we are having two steps right now. The current project is now in the analysis. For this, exactly, we need to specify very strict things. We need to fix one kernel. We need to fix the compiler. We need to fix the options of the compiler. We need to see how the things are built in every single detail and we go to what is really safe to qualify it or not and we cannot simply change like that in the future for the updates. It's not something, it's a little like an embedded project but a little bit further because it's more you need to be more safe. It's really hard. And BMW joined the Linux foundation that's a project that's called Elisa as founder. We are the one of the first to join this project to make Linux safety qualified in the future. We hope that Linux there will be at some point use it everywhere. And we want to have Linux as the car of everything. So the Elisa project is really one of the main goals in this. The second thing security. Security is something that everyone actually understand in the Linux world. That's no deal. So why are you talking about security? Yes, because we still need to deal with algorithms restrictions. We need to deal with everything that's happening around there. The protocols is more simple protocols that we actually know is not simple protocol or simple MD5 or whatever you use it. It comes from different kind of protocols that you need to be introduced and you need to actually some point to qualify the connection and the communication about this. And that's interdependency with safety aspects. Because we cannot simply say that we are not put in a place to do everything. And you can guarantee that this will be completely safe under the end. So this is the part that you understand security, but in the end we need to deal a lot of things in there. The third part is about compliance. Compliance is the logical thing because it's in general companies that start whooping source without thinking about compliance don't know what happens. So there's a way to solve this. So what happens when you release a product? This is exactly what happens. So we release in the i3 and then some guy look and oh, they are using Linux inside the i3. The head unit is i3. So the guy wrote to the dealer that's not exactly the right way, but he's on the right side. Yes, I want the source code to every single source code there. He's exactly wrote about that because I know that BMW not answer. I know that actually they were not able to do that. He wrote that actually he's echoed a lot of the internet. But he didn't know about this. Oh, we answer that. Basically, he just wrote for the dealer that didn't actually understand that. If you get at the end of the whole process on the screen with all the license that we are mandatory to be and they are in the screens of the car, he says, if you need something for the source code of things, please send to this email. So the guy send the email and say, oh, we're not to answer that. And we answer. And then we send the DVD with full source code of i3. And then we put that online on GitHub and still there today. Did we bother with that? No, we are really happy. And I will tell to you about what we actually do since the start of the project. Every single build, I'm not talking about one time I've got the release and every time every single build that you create an image inside the CI, it comes automatically with set of torbos and everything compliance. So we don't need to bother to discover this since the beginning we started to make this and this actually paid off. He apologized and actually made the blog and it was there and he even finds some security flaws inside the code, which was perfect because this is exactly what we expect there. So then we could be able to solve it, we fix it, there we go. And this is one thing that is very important, compliance for open source compliance. It's okay, but we need to go farther. So we are part of a group of open source compliance with this tools is one example that we can really use it. It's really available, full open source group is a huge projects there. We can have a full two chain of open source compliance for all this open source software there. And we can do it this way. We can use the piece of the lawyers at some point at least and release the first time. Which is really hard to do it. And of course the ecosystem. This is actually a very curious thing. Automotive industry never used Linux and not open source as like effective there. They are actually using internally to development but not to produce there. So most of the people there are specific safety qualified operational systems. It's completely fair. It does not exist at that time. And software industry for automotive has a huge amount of companies around it. It's not one, two, three, it's several ones. Meaning that these people are working with legacy systems. And the people working inside the company are working with legacy systems. They never touch before. And we are jumping completely in Linux. So they understand about the past. But the new one they don't have time to understand. We face some large problems that people are still developing software like the old one. And you need to actually teach them. But this has happened during the process there. So it's really complex there. In the end that we even cannot bear doing this again. So what we should do, like it's a recommendation that for people that we are doing and jumping on Linux for some reason, for other environments, please give time to training these people and to understand everything there. Because they are afraid to do it exactly. They have things that are very critical and safety critical in their job. And they know about one way and they are not trusting in doing it. Sometimes they hurt the process so we need to teach people about that. This is the really difficult thing. We are not simply cannot hire another amount of developers. Even if you can afford in terms of money you know that's impossible today to find developers. Everyone is hiring. And the second thing is that we cannot simply change in a team or simply asking them. And that's the human factor that actually we have to do with new things and to do it in a different way. It needs to be understood. This is not simple thing that we actually expect. You know about C or C++ so you understand everything to do C, C++ is not the same. Really. And you need to be clear about that. The ecosystem around you will change and you need to teach the ecosystem how it will change. The future. The other view is the future projects. For this current project I think a lot of questions come from this one but we have multiple architectures running in parallel inside the car. This is for the future cars. We have strictly separation is meaning in the development way we need to make it an easy way to separate how the operational system, how the SDK and how the applications are developed because otherwise if you try to integrate everything together the speed will go down and it will be very difficult and force people to work on more things that should do actually. We have everything fully integrated on OSCI and no binary blobs at all. In the beginning of the project we really ask that binary blobs does not come in anything it doesn't matter where it comes as a matter which is. It's based on latest Linux LTS right now we are using 4.19 why? Because at the time that we decided to fix the project the new LTS will not be available if the new LTS will be available in time we demand that actually safe to go to the project we will go for that but we expect that this will be 4.19 and it will be basic for the dynamic driving it means that the car for self-driving in the future and BMWs will have full Linux that's exactly what is back then there I think that's for this I got a little bit faster then thanks I want to open for the questions that because then I can explain better some details so why we decided to go Linux? We made the first head unit and the results were really appreciated and we really sorry? No, it's a basically the reason is exactly that so the first project was started first in the open source and the car IT is working open source then we decided to go to head unit and the head unit was the project was really successful so the next one say can we actually go full Linux and the high management decided yes that's it it's a big bold yes we are using a real-time patch yes you are using the official real-time patch so no secret that there's this comment and we are even talking with the Linux foundation we are part of the project for RTL and the Linux foundation so it's not secret about that okay let's go first there then we need to have support for 10 years everything it need to be safety qualified it need to be on the road at the point that to be safe is that it's not different for any other operational system we just don't have the papers that say safety qualified but at the point it need to be supported it's no question about that minimum 10 years expected for more and there it's a very hard question I simply cannot answer with that and I can say the main question right now I say no we not expect that we support it and fix it as long as it stays there but I will be lying that at some point some things can happen that you needed to do that but right now official answer coming at least from our side we know we are staying there and maintaining this one as long as possible that's why actually we are taking measures to participate to exactly the foundations that we can guarantee that this happens in the future so the head unit in the past yes, graphics it has binary blobs future not anymore we are putting in the specific requirements so we are going after that there's no question asked there yeah I know that's difficult principally because the graphics my background comes from graphics as well understand about the whole algorithms and video playback there but we expect no binary blobs there's actually no reason to have binary blobs as long that we have contracts on the points this so we are going after that sometimes it cannot cannot happens because it's basically contractualism but our end goal is that today it's only head unit and this project means everything how far down is like everything yes yeah here and then go down and in this case there's no way to solve it but we are not using any video at the moment so if in the future we need to use any video yes there's something that we cannot solve it by ourselves it's true but in general this is I understand the question because they come from this background and open source long time in Linux distributions there and the reality and we are talking about we need to separate if you're thinking about feelings itself yes we are thinking about that but as a company if the proper business decision is done there's something that we cannot simplify yes we love that go to follow the ideology on this one but I don't think that's the not reality this is okay internally we actually do that so it needs to be evaluated we have the whole process so it's not simply blindly accepted we are explaining about the situation and then is it accepted or not that's the point but this is not something that we go blindly we cannot do that well this is explaining the whole process and it's everyone who knows about adaptive autosar itself it's basically an operating system that was made in for that and then we decided that autosar itself depends on some operating system in the case is most common is Aurex and the Aurex it's already there it's basically the start car and the start up and then we need the ECU need to have some software autosar itself is not the base of the ECU we need something more powerful soft driving in other things so we have the choices of operational system we have some trials of other operational systems in the end Linux and we already have the basic expertise because the head unit so there we go into Linux the CI is already we have the full expertise we have an internal CI entirely made it for the head unit so we created the new CI completely from the ground and to get this right in the process we code software we send the CI the CI build the CI it goes to the test ECU units and provide the full software ready to actually simply flash so we got one point to the other point no human intervention okay so let's put it in this way the base system is still the base system it's Linux there we have a goal for using a separated protected containers for parts of there and then we need to be exactly separated what is running or not and how it communicates it's very controlled yes we are going in this way it's still ongoing development because our target is future it's not exactly for the generation that you buy in now but yes we are looking for this part we already have a setup for this when possible yes because most of the time we are still users of the open source we are not exactly modifying the software with the for example the software that we already modified in the upstream and parts is DLT the logging daemon that actually opensource from Genevieve so in the in the stage of the project our head unit actually several softwares had some upstream code coming and Iokto has part we are able to actually do Iokto compile two or three kernels at the same time on the same build what people say that's when it's possible we did it there because we needed to generate be able to the resulting software generated be running on the emulator directly instead of going to ECU and we also needed to have build in two times to reduce the time of completion so this is the other thing that we can say today based on the previous experience the current project the same software that we are generating on the build for the car can be running on the emulator at same time so we have the real experience directly and it makes the life of the developer easier just so it's the project that comes in this way the whole car assembly design is made by the matrix in Munich that's the sign we are directly part of the project of self-driving and we are doing the base system but we are connected to the self-driving team so it is in the end we are doing the self-driving project completely that's exactly where we connect so everything there it's already building on top of what we are doing during this process at this moment no one we are not going to our providers and we actually it's depending of the course and how it actually the question is related to him one thing is about separations of virtualization so you can actually separate what is running there not to hypervisor it's started during runtime so you can actually can control what is in one part and another one we don't need to have another device monitors of course but not in hypervisor in the sense this is yes we evaluated some hypervisors and there's no need to use the advisors at this moment we don't actually have the need for that this is so many layers on the top there as already and the hypervisor will be just complicated things and not actually have a unit really usability in the future because next project coming so there we go okay so basically still have five minutes if you don't have any more questions I'll be around here so please ask thanks for your presence here and my email is there feel free to email me and go again we're going full Linux we're not joking about that it's official if you're looking on the press so you're not only us the software project we have a cooperation with Mercedes that we are working the same project as well so it goes big it's just take time and the whole safety and everything you see that will take some time okay thank you everyone