Software Architecture - Safety Patterns

/* AUTOSAR E2E Library: protects safety-relevant data in communication */
/* Covers: data corruption, message loss, out-of-sequence, bus errors */
/* Applied at SW-C level (sender + receiver) — transparent to middleware */

#include "E2E_P04.h"  /* E2E Profile 4: 32-bit CRC + 16-bit counter + 16-bit data ID */

/* Sender (AEB Domain Controller → Brake ECU) */
typedef struct {
    uint8_t  header[12];     /* E2E Profile 4 header: CRC32 + counter + data_id */
    uint16_t aeb_request;    /* 0 = no request; 1 = request braking */
    uint16_t decel_target;   /* target deceleration (dm/s²) */
} AEB_BrakeRequest_Msg_t;

static E2E_P04SenderStateType g_e2e_sender_state;

void AEB_SendBrakeRequest(boolean request, uint16_t decel_mds2)
{
    AEB_BrakeRequest_Msg_t msg;
    msg.aeb_request  = request ? 1u : 0u;
    msg.decel_target = decel_mds2;

    /* E2E protect: adds CRC-32 + increments counter in header */
    uint8_t *data = (uint8_t *)&msg;
    E2E_P04Protect(&g_e2e_sender_config,   /* includes data_id, data_length */
                   &g_e2e_sender_state,    /* counter state */
                   data,                   /* message buffer */
                   sizeof(msg));           /* total message length */

    CAN_Send(CAN_MSG_AEB_BRAKE_REQ, data, sizeof(msg));
}

/* Receiver (Brake ECU) */
static E2E_P04ReceiverStateType g_e2e_recv_state;

boolean Brake_ReceiveAEBRequest(uint16_t *decel_out)
{
    uint8_t buf[sizeof(AEB_BrakeRequest_Msg_t)];
    if (!CAN_Receive(CAN_MSG_AEB_BRAKE_REQ, buf, sizeof(buf))) { return FALSE; }

    E2E_P04CheckStatusType status;
    E2E_P04Check(&g_e2e_recv_config, &g_e2e_recv_state, buf, sizeof(buf));
    status = g_e2e_recv_state.Status;

    if (status == E2E_P04STATUS_OK || status == E2E_P04STATUS_OKSOMELOST) {
        AEB_BrakeRequest_Msg_t *msg = (AEB_BrakeRequest_Msg_t *)buf;
        *decel_out = msg->decel_target;
        return msg->aeb_request != 0u;
    }
    /* E2E error: treat as no request (safe default) */
    *decel_out = 0u;
    Dem_ReportErrorStatus(DEM_EVENT_E2E_ERROR_AEB, DEM_EVENT_STATUS_FAILED);
    return FALSE;  /* safe state: no braking request */
}

/* ASIL-D defensive programming: validate all inputs; never assume valid state */
#include 
#include "Std_Types.h"

/* Pattern 1: Input validation at function boundary */
Std_ReturnType SafetyMonitor_SetThreshold(float threshold_nm)
{
    /* Validate: threshold must be in physically plausible range */
    if (threshold_nm < 0.1f || threshold_nm > 10.0f) {
        Dem_ReportErrorStatus(DEM_EVENT_INVALID_PARAM, DEM_EVENT_STATUS_FAILED);
        return E_NOT_OK;   /* do not apply invalid threshold */
    }
    g_threshold = threshold_nm;
    return E_OK;
}

/* Pattern 2: Exhaustive switch with default → safe state */
typedef enum { STATE_INIT=0, STATE_ACTIVE, STATE_FAULT, STATE_SAFE } SafetyState_t;

void SafetyFSM_Process(SafetyState_t state, SafetyEvent_t event)
{
    switch (state) {
        case STATE_INIT:
            if (event == EVT_STARTUP_OK) { FSM_Transition(STATE_ACTIVE); }
            else                          { FSM_Transition(STATE_SAFE);   }
            break;
        case STATE_ACTIVE:
            if (event == EVT_FAULT_DETECTED) { FSM_Transition(STATE_FAULT);  }
            else if (event == EVT_HEARTBEAT)  { /* stay active */ }
            else                              { FSM_Transition(STATE_SAFE);   }
            break;
        case STATE_FAULT:
            /* In fault: any event results in safe state transition */
            FSM_Transition(STATE_SAFE);
            break;
        case STATE_SAFE:
            /* Safe state: no transitions out; only reset can recover */
            Safety_ApplySafeState();
            break;
        default:
            /* Undefined state (memory corruption): safe state immediately */
            FSM_Transition(STATE_SAFE);  /* MISRA: default must be present */
            break;
    }
}

/* Pattern 3: Inverse check (double-check critical decisions) */
boolean AEB_ShouldActivate(float ttc, float radar_conf, float cam_conf)
{
    boolean primary_decision = (ttc < 1.5f && radar_conf > 0.95f && cam_conf > 0.95f);

    /* Inverse check: independently computed — if inverse logic disagrees, fault */
    boolean inverse_check    = !(ttc >= 1.5f || radar_conf <= 0.95f || cam_conf <= 0.95f);

    if (primary_decision != inverse_check) {
        /* Impossible: indicates data corruption or compiler fault */
        Dem_ReportErrorStatus(DEM_EVENT_INVERSE_CHECK_FAIL, DEM_EVENT_STATUS_FAILED);
        return FALSE;  /* conservative: do not activate */
    }
    return primary_decision;
}