Freedom from Interference Analysis

/* Memory Protection Unit (MPU) configuration for FFI */
/* ARM Cortex-M MPU: 8–16 regions; each with base, size, access permission */
/* AUTOSAR OS: Trusted/Untrusted OS-Applications; MPU configured per application */

#include "Os.h"

/* MPU region definitions: ASIL-D data protected from QM access */
/* Configured by AUTOSAR OS generator from ARXML */

/* Example: Cortex-M MPU region for ASIL-D safety data */
/* Address: 0x20008000, Size: 8kB, Permissions: Privileged RW, Unprivileged NO ACCESS */

/* In AUTOSAR ARXML:

  SafetyApp_ASILB
  true   <- trusted: can access all memory


  QmApp
  false  <- untrusted: MPU enforces restrictions
  QM_MEMORY_REGION
  */

/* Runtime: AUTOSAR OS switches MPU settings on each context switch */
/* When QM task runs: MPU prevents write to ASIL-D regions */
/* If QM task attempts write: MPU fault trap → OS error hook */

void Os_MpuFaultHook(void)
{
    /* MPU violation: QM task attempted to write ASIL-D memory */
    /* Safety reaction: terminate QM application; log DEM event */
    Dem_ReportErrorStatus(DEM_EVENT_MPU_VIOLATION, DEM_EVENT_STATUS_FAILED);
    Os_TerminateApplication(QM_APPLICATION_ID, RESTART);
}

/* Stack protection: each task has dedicated stack region */
/* MPU monitors stack boundary: prevents stack overflow into adjacent data */

/* Temporal partitioning: ASIL-D tasks must meet their deadlines */
/* regardless of QM task behaviour */

/* AUTOSAR OS: Fixed Priority Preemptive scheduling */
/* ASIL-D tasks: priority 200+ (highest) */
/* ASIL-B tasks: priority 100–199 */
/* QM tasks: priority 0–99 (lowest) */

/* Task schedule:
   Period 1ms:  SafetyMonitor_ASILD (prio=255) — runs first; cannot be preempted by QM
   Period 5ms:  MotorControl_ASILB  (prio=150)
   Period 10ms: Diagnostics_ASILB   (prio=100)
   Period 20ms: StateEstimation_QM  (prio=50)
   Period 50ms: HMI_Update_QM       (prio=10)

CPU utilisation check:
   SafetyMonitor:  0.3ms / 1ms  = 30%
   MotorControl:   0.8ms / 5ms  = 16%
   Diagnostics:    0.5ms / 10ms =  5%
   StateEstim:     5.0ms / 20ms = 25%
   HMI:            2.0ms / 50ms =  4%
Total:                            80% < 100% (headroom for interrupts)

Watchdog: if SafetyMonitor_ASILD does not complete within 0.8ms
→ window watchdog triggers → CPU reset → safe state
*/

/* E2E protection: ASIL messages include counter + CRC */
/* AUTOSAR E2E library (SW-C level) or Transformer layer */
typedef struct {
    uint8_t  counter;     /* incremented each transmission; detect message loss */
    uint8_t  crc8;        /* CRC-8 over payload + counter */
    uint16_t steering_req; /* payload: steering torque request (mNm) */
} E2E_SteeringReq_t;

void E2E_Protect(E2E_SteeringReq_t *msg)
{
    static uint8_t counter = 0u;
    msg->counter = counter++;
    msg->crc8    = Crc_CalculateCRC8((const uint8_t *)msg, 3u, 0xFFu, TRUE);
}

boolean E2E_Check(const E2E_SteeringReq_t *msg, uint8_t *expected_counter)
{
    uint8_t calc_crc = Crc_CalculateCRC8((const uint8_t *)msg, 3u, 0xFFu, TRUE);
    if (calc_crc != msg->crc8) { return FALSE; }   /* data error */
    if (msg->counter != *expected_counter) { return FALSE; }  /* lost message */
    (*expected_counter)++;
    return TRUE;
}