Automotive Safety PlatformZonal Vehicle Architecture Prototype

Pattern: Table-driven state machine — 6 states x 11 events

"Every transition is statically defined — no runtime surprises"

static const uint8 transition_table[CVC_STATE_COUNT][CVC_EVT_COUNT] = {
    /* CVC_STATE_INIT */
    {
        CVC_STATE_RUN,         /* EVT_SELF_TEST_PASS     -> RUN        */
        CVC_STATE_SAFE_STOP,   /* EVT_SELF_TEST_FAIL     -> SAFE_STOP  */
        CVC_STATE_INVALID,     /* EVT_PEDAL_FAULT_SINGLE -> (invalid)  */
        CVC_STATE_INVALID,     /* EVT_PEDAL_FAULT_DUAL   -> (invalid)  */
        ...
    },
    /* CVC_STATE_RUN */
    {
        CVC_STATE_INVALID,     /* EVT_SELF_TEST_PASS     -> (invalid)  */
        CVC_STATE_INVALID,     /* EVT_SELF_TEST_FAIL     -> (invalid)  */
        CVC_STATE_DEGRADED,    /* EVT_PEDAL_FAULT_SINGLE -> DEGRADED   */
        CVC_STATE_SAFE_STOP,   /* EVT_PEDAL_FAULT_DUAL   -> SAFE_STOP  */
        CVC_STATE_LIMP,        /* EVT_CAN_TIMEOUT_SINGLE -> LIMP       */
        CVC_STATE_SAFE_STOP,   /* EVT_CAN_TIMEOUT_DUAL   -> SAFE_STOP  */
        CVC_STATE_SAFE_STOP,   /* EVT_ESTOP              -> SAFE_STOP  */
        CVC_STATE_SAFE_STOP,   /* EVT_SC_KILL            -> SAFE_STOP  */
        ...
    },
    /* ... DEGRADED, LIMP, SAFE_STOP, SHUTDOWN */
};

Pattern: Cross-check two independent sensors, debounce before fault

"Both AS5048A sensors must agree within threshold for N consecutive cycles"

/* Plausibility check (only if both sensors read OK) */
if (new_fault == CVC_PEDAL_NO_FAULT) {
    delta = Pedal_AbsDiff16(raw1_local, raw2_local);

    if (delta >= Pedal_CfgPtr->plausThreshold) {
        Pedal_PlausDebounce++;
        if (Pedal_PlausDebounce >= Pedal_CfgPtr->plausDebounce) {
            new_fault = CVC_PEDAL_PLAUSIBILITY;
        }
    } else {
        Pedal_PlausDebounce = 0u;
    }
}

Pattern: AUTOSAR E2E Profile P01 — CRC + counter packed into CAN PDU

"16 of 32 CAN messages are E2E-protected — detects corruption, loss, and replay"

Std_ReturnType E2E_Protect(const E2E_ConfigType* Config,
                           E2E_StateType* State,
                           uint8* DataPtr, uint16 Length)
{
    uint8 crc;

    if ((Config == NULL_PTR) || (State == NULL_PTR) || (DataPtr == NULL_PTR))
        return E_NOT_OK;

    if (Length < E2E_PAYLOAD_OFFSET)
        return E_NOT_OK;

    /* Increment alive counter (4-bit, wraps 0..15) */
    State->Counter = (State->Counter + 1u) & 0x0Fu;

    /* Write byte 0: [counter:4 | dataId:4] */
    DataPtr[E2E_BYTE_COUNTER_ID] =
        (uint8)((State->Counter << 4u) | (Config->DataId & 0x0Fu));

    /* Compute CRC over payload (bytes 2..N-1) + DataId */
    crc = E2E_ComputePduCrc(DataPtr, Length, Config->DataId);
    DataPtr[E2E_BYTE_CRC] = crc;

    return E_OK;
}

• Item Definition— 7 functions, system boundary, interface list
• Hazard Analysis & Risk Assessment— 6 operational situations, 16 hazardous events, ASIL determination
• Safety Goals— 8 safety goals (3 ASIL D, 2 ASIL C, 1 ASIL B, 2 ASIL A)
• Functional Safety Concept— 23 safety mechanisms, 4 safe states, 25 FSRs

• Safety Plan— Lifecycle phases, roles, activities, tool qualification
• Safety Case— Claims, argument, evidence structure

• Failure Mode & Effects Analysis— 50 failure modes, 11 severity >= 9
• Dependent Failure Analysis— 6 common cause failures, 5 cascading failures
• Hardware Architectural Metrics— SPFM >= 99%, PMHF 5.2 FIT
• ASIL Decomposition— 2 decompositions with independence arguments

• Functional Safety Requirements— 25 FSRs (FSR-001 to FSR-025)
• Technical Safety Requirements— 51 TSRs — 26 ASIL D, 17 C, 4 B, 4 A
• Software Safety Requirements— 81 SSRs across 4 physical ECUs
• Hardware Safety Requirements— 25 HSRs across 4 ECUs
• HW-Software Interface Specification— Per-ECU peripheral configs, memory maps, MPU, startup

• Safety Validation Report— Vehicle-level validation plan and evidence

• Stakeholder Requirements— 32 stakeholder reqs (STK-001 to STK-032)
• System Requirements Specification— 56 system reqs — 18 ASIL D, 12 C
• System Architecture— 10 element categories, system state machine, FFI
• CAN Message Matrix— 32 message types, 16 E2E-protected, 24% bus load
• Interface Control Document— 22 interfaces (CAN, SPI, UART, ADC, PWM, GPIO, I2C, MQTT)

• SW Architecture— Per-ECU decomposition, task scheduling, 81 SSR-to-module allocation
• BSW Architecture— 18 modules with full C API signatures, 3 platform targets
• vECU Architecture— POSIX MCAL abstraction, Docker containers, CI/CD
• SWR-CVC (35 reqs)
• SWR-FZC (32 reqs)
• SWR-RZC (30 reqs)
• SWR-SC (26 reqs)
• SWR-BCM (12 reqs)
• SWR-ICU (10 reqs)
• SWR-TCU (15 reqs)
• SWR-BSW (27 reqs)

• Unit Test Plan
• Unit Test Report— 1,648 unit tests across all ECUs + BSW
• Integration Strategy
• Integration Test Report
• SW Verification Plan
• Release Notes
• System Integration Report
• System Verification Report
• MIL Report
• SIL Report
• PIL Report
• HIL Report

• Hardware Requirements— 33 HWRs in 7 categories
• Hardware Design— Per-ECU circuit designs, power distribution, BOM

• Quality Assurance Plan
• CM Strategy— Git Flow, baselines, access rights
• Traceability Matrix— 475 traced: SG to FSR to TSR to SSR to SWR to test
• Architecture Decision Log— 13 ADRs with T1-T4 tier scoring
• Progress Dashboard