AUTOSAR WdgM标准详解：Specification of Watchdog Manager

需积分: 0 168 浏览量更新于2024-06-16 1 收藏 1.34MB PDF 举报

"AUTOSAR WdgM标准是汽车软件行业的一个重要规范，全称为Watchdog Manager，由AUTOSAR（Automotive Open System Architecture）组织制定。该标准详细定义了监控器管理器的功能和行为，旨在确保车载电子系统的可靠性和安全性。WdgM主要负责监控系统中的任务执行情况，防止因软件故障导致的系统不稳定或失效。" 在AUTOSAR Classic Platform的标准发布R23-11中，Watchdog Manager规范经历了多次更新和改进。例如，在R23-11版本中，进行了编辑性的修改，提升了文档的清晰度和一致性。在R22-11版本中，同样进行了编辑性改动，以保证信息的准确无误。而在R21-11版本中，解决了一个关于确定Supervised Entity ID值的不一致问题，统一了SWS WdgM和TPS之间的规定。同时，将"Partition Restart/Shutdown"功能标记为过时，并移除了冗余参数WdgMDemStoppedSupervisionReport。值得注意的是，在R20-11版本中，WdgM的标准得到了扩展，以支持集群化的软件架构（Classic Platform Flexibility），包括对多个主功能的支持。这一扩展增强了WdgM在复杂系统环境下的适应性。此外，该版本还明确了WdgMDeadlineMin和WdgMDeadlineMax阈值的含义，更新了错误报告部分的结构和表格，使得故障检测和诊断更加直观和有效。 AUTOSAR WdgM标准的这些变化反映了汽车行业对软件可靠性和安全性的不断提高的要求，以及随着车辆电子化和智能化程度加深，对系统监控机制的复杂性和灵活性的需求。通过WdgM，开发者可以更好地监控和管理车载软件任务，预防潜在的故障，提高系统的稳定性和用户体验。

Specification of Watchdog Manager

AUTOSAR CP R23-11

Graph Control Flow Graph. A set of Checkpoints connected through Transitions,

where at least one of Checkpoints is an Initial Checkpoint. There is a path

(through Transitions) between any two Checkpoints of the Graph.

External Graph Graph that may involve more than one Supervised Entity. Its configuration is

mode-dependent.

Cross-Cluster External Graph A special kind of External Graph that spans over multiple Software Clusters

for Clustered Software Architecture. Its configuration is mode-dependent

(controlled by Host Software Cluster) and has dedicated configuration structure

additionally.

Note: External Graph within one Software Cluster can be modelled without

the configuration structure dedicated for clustered software architecture.

External Transition An External Transition is a transition between two Checkpoints, where the

Checkpoints belong to different Supervised Entities.

Local Supervision Status Status that represents the current result of alive-supervision of a single

Supervised Entity.

Logical Supervision Kind of online supervision of software that checks if the software (Supervised

Entity or set of Supervised Entities) is executed in the sequence defined by the

programmer (by the developed code).

Internal Graph Graph that may not span over several Supervised Entity. Its configuration is

mode-independent and can be disabled by disabling the corresponding

Supervised Entity.

Internal Transition

An Internal Transition is a transition between two Checkpoints of a Supervised

Entity.

Mode

A mode is a certain set of states of the various state machines that are running in

the vehicle that are relevant to a particular entity, e.g. a SW-C, a BSW module,

an application, a whole vehicle

In its lifetime, an entity changes between a set of mutually exclusive modes.

These changes are triggered by environmental data, e.g. signal reception,

operation invocation.

In the context of the Watchdog Manager a mode is defined by a set of

configuration options. The set of Supervised Entities to be supervised may vary

from mode to mode.

Supervised Entity A software entity which is included in the super vision of the Watchdog Manager.

Each Supervised Entity has exactly one identifier. A Supervised Entity denotes a

collection of Checkpoints within an instance of Software Component Types or

Basic Software Modules. There may be zero, one or more Supervised Entities in

an instance of Software Component Types or Basic Software Modules.

Supervised Entity Identifier An Identifier that identifies uniquely a Super vised Entity within an Application.

Supervision Counter An independent data resource in context of a Supervised Entity which is updated

by the Watchdog Manager during each Supervision Cycle and which is used by

the Alive Supervision algorithm to perform the check against counted Alive

Indications.

Supervision Cycle The time base of Supervision Reference Cycle of Watchdog Manager,

where the cyclic Alive Supervision is performed. And it’s also the interval for

updating Global Supervision Status and execution of resulting Recovery Actions.

This is done in every call of the Main Function of belonging Watchdog Manager

and mode-dependent (may vary when swiching mode).

Supervision Reference Cycle The amount of Supervision Cycles to be used as reference by the Alive

Supervision to perform the check of counted Alive Indications (individually for

each Supervised Entity) and mode-dependent.

Table 2.2: Terms used in the scope of this Document

16 of 132 Document ID 80: AUTOSAR_CP_SWS_WatchdogManager

Specification of Watchdog Manager

AUTOSAR CP R23-11

4 Constraints and assumptions

4.1 Limitations and conditions of use

The main limitations of Watchdog Manager design are as follows. They may be re-

moved in upcoming versions of this document:

• {DRAFT} A Supervised Entity cannot span over multiple EcucPartitions.

• {DRAFT} Handling of unconnected transition proxies for Logical Supervision

based on Cross-Cluster External Graph by Watchdog Manager is un-

specified in this release.

• As libraries cannot call BSWs, libraries cannot be supervised by Watchdog Man-

ager.

• The nesting of Deadline Supervision (i.e. start 1, start 2, end 2, end 1) is not

supported.

• The Alive Supervision function with more than one Checkpoint per Supervised

Entity is not consistently specified within the document. For now, it is recom-

mended to support only one Alive Supervision Checkpoint per Supervised En-

tity.

Further limitations:

• The Watchdog Manager does not encapsulate the Watchdog Driver initialization.

The Watchdog Driver must be initialized by [4, Specification of ECU State Man-

ager] in the startup process before the initialization of the Watchdog Manager.

• The Watchdog Manager is initialized after the OS has been started. Hence, it

cannot be responsible for controlling the Watchdog Driver earlier in the startup

process. Usually, it is sufficient to configure a large enough initial timeout in

the Watchdog Driver to bridge the gap between Watchdog Driver and Watchdog

Manager initialization. Alternatively, the Integrator may use ECU State Manager

facilities (callouts).

• The Watchdog Manager is de-initialized before the OS shutdown. Hence, it can-

not be responsible for controlling the Watchdog Driver later in the shutdown pro-

cess. Usually, it is sufficient to configure a large enough final timeout that is

set when the Watchdog Manager is de-initialized. This allows bridging the gap

between Watchdog Manager de-initialization and system power-off or resetting.

Alternatively, the Integrator may use ECU State Manager facilities (callouts).

• For ECUs which implement sleep modes, if the hardware watchdog remains ac-

tive in these sleep modes, its triggering shall also be handled by the ECU State

Manager.

• The error recovery mechanism “Immediate MCU Reset” is available only on mi-

crocontrollers that are able to perform a reset by using the hardware feature of

the microcontroller.

18 of 132 Document ID 80: AUTOSAR_CP_SWS_WatchdogManager

Specification of Watchdog Manager

AUTOSAR CP R23-11

• All of following conditions must be met for the expected operation of WdgM su-

pervision:

– Initialized Wdg Interface,

– Initialized OS (because of possible usage of OsCounter)

– Initialized WdgM (done by calling WdgM_Init)

– Periodic invocation of WdgM_MainFunction preferably by AUTOSAR BSW

scheduler; during startup the invocation may be done by another module.

∗ Note: The deviations/jitters on the per iodic call of WdgM_MainFunc-

tion will lead to a potential risk of delayed detection in both Alive

Supervision and Deadline Supervision (timeout detection part) and

false/missed detection in Alive Supervision.

∗ Note: Any blocking of this periodic invocation will cause loss of Deadline

Supervision (timeout detection part), Alive Supervision, all state transi-

tion of both Local/Global Supervision Status and resulting Error Han-

dling mechanisms to recover from supervision failures, except the last

resort “Reset by Hardware Watchdog” due to the loss of the Watchdog

Handling (no trigger to the hardware instance via WdgIf).

• A Supervised Entity with all its Checkpoints may belong to only one OS-

Application (at most). Because OS-application can run on one core only, there-

fore one specific Supervised Entity may run at one core.

• The Deadline Supervision (timeout detection part) and Alive Supervision is highly

depending on the periodic invocation of WdgM_MainFunction: the periodicity

shall be chosen carefully according to the requested value of the timeout detec-

tion.

• {DRAFT} The result of WdgM_GetFirstExpiredSEID in software architecture

with multi-partition configuration may be not fully reliable, depending on imple-

mentation (at least, it cannot be achieved without reliable and common time

stamping over partitions, but it will not to be standardized).

• Watchdog Manager cannot detect timeout of Deadline Supervision for the Super-

vised Entities which are running in Category 2 ISRs.

– Rationale: A deadlock of Runnable Entities which are running in Category 2

ISR blocks the execution of WdgM_MainFunction on Task level.

4.2 Applicability to car domains

No restriction.

19 of 132 Document ID 80: AUTOSAR_CP_SWS_WatchdogManager

Specification of Watchdog Manager

AUTOSAR CP R23-11

5 Dependencies to other modules

Watchdog Interface (WdgIf) The Watchdog Manager module is responsible for

changing the mode of the Watchdog Driver and for reporting to the Watchdog

Driver the condition to trigger the hardware watchdog. The services of the Watch-

dog Driver are accessed via the Watchdog Interface which allows addressing

multiple watchdog instances.

ECU State Manager (EcuM) The ECU State Manager is responsible for initializing,

de-initializing of the Watchdog Manager module and for triggering the hardware

watchdog in sleep modes.

Micro Controller Unit Driver (Mcu) The Watchdog Manager module may perform an

immediate reset of the ECU in case of a supervision failure. This reset service is

provided by the MCU driver.

Default Error Tracer (Det) If development error detection is enabled, the Watchdog

Manager module informs the Default Error Tracer about detected development

errors.

Diagnostic Event Manager (Dem) The Watchdog Manager may notify the Diagnostic

Event Manager about detected functional / production-code relevant errors.

BSW Scheduler (SchM) The BSW Scheduler is responsible for calling the scheduled

functions of the Watchdog Manager module. The Watchdog Manager module

uses the services of the BSW Scheduler to implement critical sections.

Runtime Environment (Rte) The Runtime Environment is responsible for propagat-

ing Checkpoint information from Supervised Entities in SW-Cs or in CDDs to

the Watchdog Manager module. The Watchdog Manager module uses the ser-

vices of the Runtime Environment to inform SW-Cs about changes in the supervi-

sion status. BSW Modules can call the Watchdog Manager module without using

RTE.

Operating system (Os) The Operating System is used by Watchdog Manager to pro-

vide the timestamp.

{DRAFT} Software Cluster Connector (SwCluC) SwCluC (introduced by Classic

Platform Flexility Concept) can establish internal connection of WdgM over Soft-

ware Clusters, by means of Binary Manifests. Note that, inter-EcucPartition con-

nection within a WdgM will be established without SwCluC, as it’s a part of BSW

Multicore Distribution Concept and its way for implementation is not standardized

(one of typical implementation method is master-satellite pattern).

20 of 132 Document ID 80: AUTOSAR_CP_SWS_WatchdogManager

剩余131页未读，继续阅读

Jason小小

粉丝: 573
资源: 12

AUTOSAR WdgM标准详解：Specification of Watchdog Manager

autosar标准

AUTOSAR 标准类型

autosar wdgm

autosar wdgm 配置

autosar wdgm举例

autosar wdgm deadline适用场景

Vector AUTOSAR BSW模块WdgM组件详细介绍

WdgM autosar

Vector AUTOSAR Components BSW模块：WdgM.zip

AUTOSAR培训教材.rar

最新资源