Linux has rapidly come to be used in a wide range of applications in the industrial field, from domestic appliances to devices used in social infrastructure. However, the road leading here has not always been a smooth one. For many years, Toshiba has taken on difficult challenges related to power-saving, reducing startup times, real-time control, and more. We have contributed to the evolution of Linux by achieving these goals while creating new value. New challenges have arisen, such as long-term maintenance, improved reliability, and cyber-resilience, and our engineers are constantly pursuing further innovation. In this four-part running feature, we will look at the numerous difficulties Toshiba has faced and the measures we have used to overcome them.
In the previous three parts of this series, we introduced the fundamental challenges of embedded Linux, approaches for addressing them, the technical efforts involved, and the Civil Infrastructure Platform (CIP) initiative—which aims to solve shared issues through open collaboration—along with Toshiba’s leadership in this field. In Part 4, the final installment, we present Skelios—an industrial Linux distribution that incorporates the outcomes of these technical efforts and underpins a wide range of Toshiba products—and provide a summary of the series as a whole.

Skelios is a custom Linux distribution developed for Toshiba Group products. It integrates Toshiba’s long‑standing technologies and expertise in embedded Linux, incorporates components from open‑source software such as Debian, and leverages the outcomes obtained through the Civil Infrastructure Platform (CIP). Its name combines “Skeleton” and “Linux operating system,” expressing our aim for Skelios to serve as a common Linux framework—or “skeleton”—that supports Toshiba’s diverse product lineup.

A defining characteristic of Skelios is that it combines the outcomes of two OSS communities—the CIP and Debian communities—and integrates them with Toshiba’s own technologies and expertise (Fig. 2).

• CIP (Civil Infrastructure Platform, https://www.cip-project.org)
  CIP provides a kernel designed for long-term use and core packages common to infrastructure equipment as part of its Open Source Base Layer (OSBL). In addition to ensuring at least ten years of long‑term maintenance, CIP standardizes extensions to improve real‑time performance, aligns with international security standards, and implements secure software‑update mechanisms. Through these measures, it delivers a reliable, sustainable, industrial‑grade Linux platform. Skelios uses the CIP OSBL as the foundation for functions and performance commonly required across many Toshiba products.
• Debian (https://www.debian.org)
  Debian is one of the world’s most widely used Linux distributions. It is highly versatile and has an extensive track record in embedded systems. Tens of thousands of OSS packages conforming to the Debian Free Software Guidelines are maintained with a strong emphasis on compatibility and stability, while addressing vulnerabilities and bugs. These guidelines also underpin the Open Source Definition proposed by the Open Source Initiative. By combining Debian with the CIP OSBL, Skelios covers areas not addressed by OSBL alone, thereby achieving broad functionality and flexibility. Since 2015, Toshiba has been one of the largest contributors to Debian LTS (Long Term Support, https://www.debian.org/lts/), supporting its evolution for more than a decade. The experience accumulated in addressing embedded‑Linux vulnerabilities and providing long‑term maintenance is applied to Skelios and also supports the sustainable development of various OSS.

In Part 3 of this running feature, we introduced CIP’s concept for OSBL usage—a framework that combines OSBL with Linux distributions and related OSS. With Skelios, Toshiba has realized this framework internally and made it deployable across a diverse range of products.

That said, Skelios is not merely a combination of CIP and Debian. It also incorporates its own mechanisms to better support deployment across a wide range of products (Fig. 3).

• Package integration and management tools
  We provide a build environment and a set of management tools that integrate OSS packages from CIP and Debian into a deployable form for Skelios. This enables efficient handling of product‑specific customizations such as selecting and configuring combinations of OSS packages, managing their versions and settings, and applying security updates.
• Security and visualization
  Skelios automates the tracking and remediation of vulnerabilities across the entire distribution, including OSS packages managed through its package‑integration toolset. Based on these results, it can automate confirmation, remediation, and verification of vulnerabilities at the individual‑product level as well. In recent years, creating a Software Bill of Materials (SBOM) has become essential for tracing the software development lifecycle across the software supply chain. Skelios includes built‑in capabilities for visualizing per‑product software configurations, which makes SBOM generation straightforward. We are also expanding support for multiple SBOM formats and, as a company, addressing the associated challenges, while providing assurance to customers using products that incorporate Skelios.
• Product-specific optimization
  Different products have different requirements. Products such as programmable logic controllers (PLCs) demand high‑speed and precise real‑time performance; IoT devices place greater emphasis on low power consumption; and devices used in social‑infrastructure systems prioritize security. For this reason, Skelios is designed to accommodate diverse needs through a “common platform + customization” approach. Customization is not limited to combining OSS packages—it also includes a wide range of activities such as tuning individual OSS and adjusting security configurations.
  (https://www.global.toshiba/content/dam/toshiba/jp/technology/corporate/review/2023/06/b03.pdf (PDF)(671KB))

In the Skelios development process, Toshiba handles the product‑specific portions internally, while the remaining components are, in principle, developed in accordance with the “upstream first” approach.^* This means that technical development required for Skelios itself or for products adopting Skelios is primarily carried out through the CIP, Debian, and related OSS communities. For example, for fundamental technologies such as software‑update mechanisms, Toshiba contributes its development work directly to upstream OSS communities through CIP, where it first appears upstream once accepted. By adhering to this development principle, the OSS communities involved remain sustainable, and Skelios—which relies on OSS—benefits from the same sustainability.

^* The concept of developing in OSS, contributing the work back to the primary release branch (upstream), and then using it from there. For details, refer to Part 3.

Around the world, regulations are being strengthened—most notably the EU’s Cyber Resilience Act (CRA)—and in Japan the Labeling Scheme based on Japan Cyber‑Security Technical Assessment Requirements (JC‑STAR) has gone into effect. These frameworks require security measures across the entire product lifecycle, rather than a “build‑and‑forget” approach.

Skelios aims to enable cyber‑resilience—including rapid recovery from faults and continuous improvement—in products that adopt it by combining (1) a long‑term‑stable foundation through integration with CIP and Debian; (2) development processes and components conforming to the IEC 62443‑4 international standard, informed by CIP activities; and (3) mechanisms for continuous vulnerability monitoring and security updates. By strengthening the underlying Linux distribution that supports the new services and value delivered by various products, Skelios helps establish an environment in which those capabilities can be deployed with assurance—in effect, providing part of the foundation that supports our society.

In this running feature, we examined the challenges of embedded Linux and the evolution of approaches to address them, with reference to Toshiba’s contributions. We outlined solutions for power efficiency, reduced boot time, real‑time performance, long‑term maintenance, and high reliability. We also highlighted Toshiba’s sustained efforts to achieve the quality and performance required for industrial applications—through development and evaluation activities and collaboration with OSS communities. Skelios is the culmination of all of these activities.

Skelios is both a common platform supporting Toshiba’s diverse product portfolio and an outcome of collaboration with international OSS communities, including CIP and Debian. As this running feature has shown, many challenges in applying embedded Linux to products are common. Openly sharing these challenges fosters collaboration across organizational and national boundaries and helps drive their resolution. The resulting work ultimately feeds back into the product foundation. The technical strengths developed through these collaborations also provide avenues for addressing product‑specific issues.

Toshiba will continue to fulfill its responsibility to support social infrastructure while pursuing the creation of new value in the era of cyber‑resilience. At the same time, we will continue contributing to CIP—an open‑source community that aims to build foundational software for society and that also underpins Skelios. If this running feature has piqued your interest in our activities, we encourage you to explore CIP’s initiatives as well. We invite you to join us in advancing the software foundations that support a sustainable society.