EmbedIQ · Architecture & Compliance Overview

Structured, observable, compliant firmware — by architecture.

EmbedIQ is an open-source firmware framework for embedded and edge systems. It gives development teams a consistent component model above the RTOS — Function Blocks, typed messages, explicit state machines, and automatic traceability — where compliance evidence is generated by the architecture itself, not added afterward.

The result: behavior that is reusable, testable, portable, and audit-ready by default, with zero developer instrumentation code required.

Apache 2.0 POSIX / Linux Zephyr Path FreeRTOS Tested Open .iqtrace MISRA C:2023 Advisory IQ Sense · Production

The Problem, First Principles

RTOS gives primitives, not structure.
Every team rebuilds the application layer differently — callbacks, shared globals, semaphores — under delivery pressure.

Coupling is invisible until it fails.
Direct cross-module calls, shared state, and timing assumptions create hidden dependencies that break under change.

Compliance evidence is retrofitted.
Safety, security, and audit requirements arrive late. Adding traceability after-the-fact is expensive, incomplete, and not verifiable.

Real Client Deployment — IQ Sense Condition Monitoring System

Real blocks. Real boundaries. Real contracts.

Every chip below is a real Functional Block from a production deployment shared with permission. FBs communicate exclusively through the typed Message Bus — no direct calls, no shared state. The Observatory captures every event automatically. The .iqtrace output is the compliance evidence record. Open-source examples live in the repo: examples/thermostat and examples/gateway.

Client Deployment

IQ Sense

Raspberry Pi Zero 2W

+ Raspberry Pi 4

Shared with permission

External World Real-World Interfaces

RLIPS Customer Interface Local IP · Pi 4

MQTT Broker Cloud Uplink Mosquitto · Pi 4

AI Backend Local Inference EmbedIQ Studio

Sensors · Pi Zero 2W ADXL345 · DS18B20 ADS1115 · SCT-013

Application Message Contract

Application Layer Function Blocks — Domain Logic

fb_ext_rlips Customer Gateway RLIPS protocol · Pi 4

fb_ext_cloud Cloud Bridge MQTT upstream

fb_ext_ai_agent AI Agent local inference

fb_vibration_monitor Vibration Analysis FFT · alert · Pi Zero

↕ All Application FBs communicate exclusively through the typed Message Bus — no direct calls, no shared state, every interaction is traceable

Core Contract — Typed Messages + Endpoint Schema

Layer 1 — Framework Engine Core Runtime FB registry & lifecycle
Endpoint router & dispatcher
FSM engine (table-driven)
Boot phase sequencing
Compile-time enforcement

Typed Message Bus

async · zero-copy · schema-enforced

Observatory

zero dev code · all layers

FB lifecycle · FSM transitions

Message bus traffic

OSAL fault events

HAL peripheral faults

Security incidents

.iqtrace open format

14-byte record · TLV · HASH_CHAIN · Apache 2.0

Core Contract Headers + Message Schemas

Service Layer Portable Infrastructure FBs

fb_telemetry_buffer Buffer · Batch · Retry queue service · OTel-aligned

fb_health_monitor Watchdog · Fault Track self-healing FSM

fb_config_mgr config.iq · NVS validated config · integrity checked

fb_trace_svc Observatory Flush .iqtrace writer · hash chain

↕ Service FBs use the same typed Message Bus — reusable across projects, independently testable, fully observable

HAL / OSAL Contracts

Driver Layer Hardware Function Blocks

fb_drv_adxl345 Vibration Sensor SPI · 3-axis accel · Pi Zero

fb_drv_ds18b20 Temperature 1-Wire · ±0.5°C · Pi Zero

fb_drv_ads1115 Current Monitor I²C · SCT-013 CT · Pi Zero

fb_drv_mqtt MQTT Transport Pi Zero → Pi 4 link

↕ Driver FBs own the hardware boundary — platform-specific HAL implementation behind the contract, portable FB above it

HAL API Contract — C Interface

Abstraction HAL + OSAL

OSAL · OS Abstraction Layer Operating System Services

threadmutex queuetimer signalsleep

HAL · Hardware Abstraction Layer Hardware Interface

spi_initi2c_read gpio_irquart_tx hal_inithal_obs

Substrate Boundary — Platform Implementation

Sensor Node · Raspberry Pi Zero 2W Pi Zero 2W — POSIX EmbedIQ

ADXL345 — 3-axis vibration SPI

DS18B20 — temperature ±0.5°C 1-Wire

ADS1115 + SCT-013 — current CT I²C

MQTT to Pi 4 Gateway

Gateway · Raspberry Pi 4 Pi 4 — POSIX EmbedIQ

Mosquitto MQTT Broker TCP

RLIPS — customer interface IP

EmbedIQ Engine · all FBs active pthreads

Cloud · AI Backend · Studio

What are FB chips? Each chip is a real EmbedIQ Function Block — an independent unit of state, logic, and typed message endpoints. No direct calls between FBs, ever.

What are the connector labels? Enforced contracts between layers. Compile-time boundaries make layer swaps possible and boundary violations a build error — not a runtime surprise.

What does Observatory capture? Every FB lifecycle event, FSM transition, message, OSAL fault, and HAL error — automatically, in 14-byte structured records. Zero developer code required.

Compliance by Architecture, Not Afterthought

What EmbedIQ delivers by default

Safety and compliance evidence in traditional firmware is retrofitted at the end of a project. In EmbedIQ, the structured component model is the evidence generator. Every FB lifecycle event, every message, every FSM transition, every fault is captured in a tamper-evident, hash-chained audit record — not because a developer remembered to log it, but because the architecture produces nothing else.

What EmbedIQ claims, and does not. EmbedIQ is a framework that enables compliance — it is not itself a certified product. No certification body has assessed EmbedIQ. What follows is an honest map of which standard requirements the architecture is designed to support, the levels currently targeted, and the levels that are explicitly out of scope. The certification of any system built on EmbedIQ is the responsibility of that system's owner.

Built into the Framework

Deterministic Execution Trace

The complete causal chain — from hardware interrupt through driver FB, message bus, application FSM, to output — is in the .iqtrace file. Timestamped, sequenced, verifiable. Supports IEC 61508 / ISO 26262 behavioral evidence requirements.

Built into the Framework

Tamper-Evident Audit Trail

HASH_CHAIN TLV links every event record to the previous one. A single altered record breaks the chain. ECDSA-P256 session signing (Phase 3) adds device-level non-repudiation. The .iqtrace format is open, Apache 2.0, usable offline.

Built into the Framework

Explicit FSM per Component

Every FB with non-trivial behavior uses a flat, table-driven FSM. States, transitions, guards, and actions are visible in one place — not scattered conditional logic. FSM transitions are auto-captured by Observatory. Directly satisfies IEC 61508 "structured programming" requirements.

Built into the Framework

Zero Shared State

FBs do not share globals or call each other directly. The typed Message Bus is the only inter-component boundary. This is a compile-time enforced rule. Eliminates an entire class of safety-relevant coupling failures.

Built into the Framework

Layer Contracts

Compile-time enforced boundaries between Application, Service, Driver, HAL, and OSAL layers. Layer swaps (RTOS migration, hardware platform change) do not break application code. Contract violations are build errors, not runtime surprises.

Built into the Framework

safety_class per Function Block

Every FB declares a safety classification at registration. AI-authored code in safety-classified FBs triggers a mandatory human security review gate at CI. The classification is captured in every Observatory session record and in the CycloneDX SBOM.

Built into the Framework

MISRA C:2023 Advisory

Core headers (core/include/) are written to MISRA C:2023 advisory compliance: no implicit integer conversions, no VLAs, no dynamic allocation in framework code, no recursion in the engine, default cases on all switches. Project-level enforcement via Cppcheck, LDRA, or PC-lint Plus is the application's choice — the architectural properties keep findings low.

Built into the Framework

SBOM — CycloneDX + SPDX

CycloneDX v1.5 is the primary SBOM format — lists every FB with safety_class, vendored libraries, and license IDs. SPDX 2.3 supported via Protobom translation. ML-BOM extension for AI-using FBs satisfies EU AI Act Annex IV technical-documentation requirements. Required by EU CRA, recommended by NIST SSDF.

Phase-1 Events Live · FB on Roadmap

EU AI Act Logging

AI inference events live today in the SYSTEM band: AI_INFERENCE_START (0x17), AI_INFERENCE_END (0x18), AI_CONFIDENCE_THRESHOLD (0x1A) — supports Art.12 logging and Art.13 explainability. The dedicated fb_compliance_log Service FB (Apache 2.0, on the open-source roadmap) consolidates inference invocations, input hashes, and output decisions into a tamper-evident audit trail.

Standard / Requirement	How EmbedIQ Addresses It	Mechanism	Status
IEC 61508 — Functional Safety Behavioural evidence, structured programming	Deterministic .iqtrace of every FB lifecycle + FSM transition. Explicit flat FSMs replace scattered conditionals. Zero shared state by architecture. Targeted: SIL 1, SIL 2. SIL 3/4 not targeted (requires formal verification toolchain beyond EmbedIQ's scope).	Observatory · FSM engine · .iqtrace	SIL 1 / 2
ISO 26262 — Automotive Safety ASIL-relevant traceability	Same .iqtrace evidence foundation as IEC 61508. Layer contracts enforce architectural separation of concerns. safety_class field per FB enables ASIL tracking. Targeted: ASIL A, ASIL B. ASIL C/D not targeted (requires AUTOSAR binding outside v1 scope).	safety_class · layer contracts · .iqtrace	ASIL A / B
IEC 62443 — Industrial Cybersecurity Security event logging, credential isolation	SECURITY_INCIDENT (0x61) and AUTH_EVENT (0x62) Observatory events on every policy violation. HASH_CHAIN tamper-evident log satisfies SL 1/2 audit-log requirements today. Targeted: SL 1, SL 2. SL 3+ requires per-event device signing, addressed by TRACE_SIGNATURE TLV in Phase 3.	SEC track · obs events · HASH_CHAIN	SL 1 / 2
MISRA C:2023 Code quality stance for safety-critical C	Core headers are written to MISRA C:2023 advisory compliance — no implicit conversions, no VLAs, no dynamic allocation in framework code, no recursion in the engine, default cases on all switches. Per-project enforcement (Cppcheck / LDRA / PC-lint Plus) is the application's choice; framework architecture keeps findings low.	core/include/ · CODING_RULES.md	Advisory
DO-178C — Avionics Software Structural coverage, trace evidence	FB component isolation enables MC/DC coverage measurement per unit. .iqtrace provides requirements-to-runtime trace evidence. Explicit FSMs make structural coverage analysis tractable. Targeted: DAL C, DAL D. DAL A/B not targeted (formal methods + full MC/DC tooling outside scope).	FB isolation · .iqtrace · FSM tables	DAL C / D
EU AI Act AI decision audit trail, logging	AI inference events live in SYSTEM band today: AI_INFERENCE_START (0x17), AI_INFERENCE_END (0x18), AI_CONFIDENCE_THRESHOLD (0x1A) — supports Art.12 logging and Art.13 explainability. fb_compliance_log Service FB consolidates these into a dedicated audit trail (Apache 2.0, on roadmap).	SYSTEM band events · fb_compliance_log	Phase 1 live
CycloneDX SBOM Software supply chain transparency	CycloneDX v1.5 is the primary SBOM format. SPDX 2.3 supported via Protobom translation. Lists every FB with safety_class, vendored third-party libraries, license IDs. ML-BOM extension for AI-using FBs. Required by EU CRA; recommended by NIST SSDF.	CycloneDX v1.5 · SPDX 2.3 · ML-BOM	Available
Tamper-Evident Trace Signing Non-repudiable audit record	Tier 1 — SHA-256 HASH_CHAIN TLV (0x0005) links every event batch to the previous one, on every device, zero RAM overhead — available today. Tier 2 — TRACE_SIGNATURE TLV (0x0009) adds device-key-signed non-repudiation for SL 3+ environments; format reserved, signing infrastructure ships in Phase 3 (P2-SIGN-01 through 05).	HASH_CHAIN TLV · TRACE_SIGNATURE TLV	Tier 1 live · Tier 2 P3

Compliance is not a feature added at the end. It is a property of the architecture itself. When every component interaction crosses a typed, observable boundary — the audit record is the by-product of correct operation, not a separate system.

Three Paths to Structured Observability

Greenfield · EmbedIQ Agent · Offline Ingest

EmbedIQ is designed for new firmware where the full framework is adopted from day one. For teams with existing deployed systems, two additional paths bring .iqtrace observability without a full rewrite. All three produce the same open .iqtrace format — but with explicit, encoded trust levels so every downstream tool knows exactly how much confidence to place in each event. Greenfield is shipping today; the EmbedIQ Agent (brownfield) and Offline Ingest are on the open-source roadmap.

Path A — Greenfield

Highest Trust · Native

Full EmbedIQ Framework

Adopt EmbedIQ from the start. The framework generates .iqtrace automatically. Every event is deterministic, framework-verified, and structurally correct by construction.

Complete .iqtrace from day one — zero developer instrumentation code

All compliance foundations built in: FSMs, layer contracts, safety_class, HASH_CHAIN

Every FB, every message, every state transition automatically captured

OSAL and HAL fault events captured at abstraction boundaries

Portable across Linux/POSIX, FreeRTOS, Zephyr — same source code

source=native confidence=high origin=runtime

Path B — Brownfield Agent

High Trust · Agent-Captured

EmbedIQ Agent

An open-source Linux daemon that attaches to any existing system — no framework adoption, no code changes required. Captures live events and writes verifiable, real-time .iqtrace.

Runs alongside existing Linux / edge systems — zero code changes (Mode A)

Reads journald, Unix sockets, syslog — normalises to .iqtrace in real time

Every event tagged source=agent, confidence=high, sequence-integrity enforced

Optional Mode B: in-process C library (iq_agent_emit) for higher trust, requires code instrumentation

Enables Observatory-compatible traceability on deployed systems before full adoption

source=agent confidence=high origin=runtime

Path C — Offline Ingest

Exploratory · Low Trust

Upload Any Log File

Upload an existing log file from any system. The open-source ingestion library (published by Studio team) converts it to .iqtrace for exploration, debugging, and migration evaluation.

Accepts any structured log — syslog, journald export, custom text formats, CSV

YAML adapter configuration describes the mapping to .iqtrace events

All converted events explicitly marked source=converted, confidence=low

Useful for evaluating EmbedIQ Studio before committing to brownfield deployment

Trust provenance always visible — Studio never mixes trust levels silently in compliance exports

source=converted confidence=low origin=log

We separate what the system knows from what tools infer. Structured runtime trace is the ground truth. Analysis adds interpretation — with provenance so every insight carries its source and confidence level, visible to any compliance auditor.

Design → Effect

Architecture choices and what they solve

Architecture Choice	Problem Solved	Effect
Function Blocks FB per concern	Rebuild · Coupling	Each concern owns its state. No shared globals. Independently testable. safety_class declared at registration.
Typed Message Bus async · schema-enforced	Coupling · Compliance	All inter-component interaction is observable, schema-validated, hash-chained, and replayable. Every message is evidence.
Flat FSMs table-driven · auto-traced	Coupling · Safety evidence	Non-trivial behavior is an explicit table. FSM transitions are auto-captured in Observatory. IEC 61508 "structured programming" satisfied.
Layer Contracts HAL · OSAL · Message	Rebuild · Portability	RTOS, HAL, libraries, and application code evolve independently. Contract violations are compile errors.
Observatory zero dev code	Compliance · Debugging	Runtime behavior captured by the framework — not by developer memory or printf discipline. Compliance evidence as a by-product of operation.
Open .iqtrace Apache 2.0 · TLV · HASH_CHAIN	Evidence portability	The audit format is open, portable, and usable outside commercial tooling. Trust levels and provenance encoded per-event. Offline verifiable.
OSAL + HAL Observation XOBS-1 · XOBS-2	Cross-layer root cause	OSAL faults (0x66) and HAL faults (0x67) captured at abstraction boundaries. Root causes below the FB layer are visible — not just symptoms at the application layer.

Open Trust Layer + Commercial Insight Layer

How the ecosystem stays trustworthy

The trust and data layer is Apache 2.0 — permanently open. Developers, ecosystems, and regulators can inspect, adopt, and extend it without commercial dependency. The commercial layer turns open trace data into understanding, workflow, and compliance evidence packages.

Apache 2.0 Open Foundation

The runtime, trace format, CLI, and brownfield tooling are permanently open. The principle: the trust layer has to be open for ecosystem adoption — anything else turns the audit record into a vendor dependency.

EmbedIQ core runtime and framework engine — available
Observatory runtime — auto-capture, buffer, flush, HASH_CHAIN — available
Open .iqtrace format specification (v1.1) — available
All Driver FBs and Service FBs, including fb_cloud_mqtt, fb_ota, fb_provisioning, fb_secure_boot, fb_fleet_diag, fb_compliance_log
embediq obs CLI — decode, stats, filter, export, tail — available
Project-management CLI (init, add, build) — roadmap
EmbedIQ Agent (Brownfield Sidecar, Mode A) — roadmap
Log ingestion library + integrity / validation / provenance CLI — roadmap

EmbedIQ Studio — Intelligence Layer

Commercial. Turns open .iqtrace data into visual analysis, AI-assisted diagnosis, and compliance evidence packages. Does not own or restrict the .iqtrace format or data.

Visual timeline replay and cross-layer correlation
AI-assisted failure diagnosis and anomaly detection
Cross-run and cross-subsystem diff analysis
Code / requirement / test / trace gap analysis
Compliance evidence package generation (IEC 61508, ISO 26262)
Team collaboration and domain knowledge packs
Fleet analytics — .iqtrace stream join across N devices

CLI Tooling

One binary, two command families

The embediq CLI covers the full developer workflow. "git for behaviour + grep for execution + top for embedded events" — the open-source developer interface to the .iqtrace ecosystem before Studio is needed. Console output throughout, CI-pipeline friendly. Available today: the embediq obs family — decode, stats, filter, export, tail. The remaining commands ship across Phase 2 (project management + brownfield) and Phase 3 (hardware flash/monitor).

Firmware Commands

init add build flash monitor obs

Trace + Brownfield Commands

ingest validate provenance filter timeline diff stats integrity export tail

The Short Version

Why this exists

Embedded teams already have RTOSes, drivers, libraries, and cloud platforms. What remains underspecified is the application behavior layer: how product logic is composed, how components interact, how state changes, and how runtime behavior becomes auditable evidence.

EmbedIQ fixes that layer by making structure explicit — Function Blocks, typed messages, layer contracts, flat FSMs, and Observatory traces. The result is not only better debugging. It is a foundation for portability, reuse, safety evidence, compliance, and AI-assisted development.

RTOS standardizes execution primitives.
EmbedIQ standardizes application behavior above them — and makes every behavioral decision a traceable, auditable, open record.