AUTOSAR WatchdogManager规范解读

版权申诉

150 浏览量更新于2024-07-18 1 收藏 2.52MB PDF 举报

"AUTOSAR_SWS_WatchdogManager.pdf 是一份关于AUTOSAR（AUTomotive Open System ARchitecture）中Watchdog Manager的规范文档，主要涵盖了Watchdog Manager的功能、配置以及错误处理等方面，适用于智能驾驶和车辆标准领域。文档经过多次修订，增加了对监控超时检测的支持，明确了启动行为，修正了错误代码，并进行了编辑性修订。" AUTOSAR是一种开放的汽车软件系统架构，旨在标准化汽车电子和软件系统的开发。Watchdog Manager是AUTOSAR系统中的一个重要组件，它负责监控和管理ECU（电子控制单元）的运行状态，确保系统在出现故障时能够采取适当的措施，维持车辆的安全运行。 Watchdog Manager的主要功能包括： 1. **监视任务执行**：Watchdog Manager监控每个任务的执行周期，确保它们在预设的时间内完成。如果某个任务超出其设定的期限（由WdgMDeadlineMin和WdgMDeadlineMax定义的阈值）未完成，Watchdog Manager会触发一个警告或错误。 2. **超时检测**：在R19-11版本中，增强了对任务执行超时的检测能力，使得系统能更准确地识别并处理长时间未响应的任务。 3. **启动行为**：文档中澄清了Watchdog Manager在启动过程中的行为，包括当WdgIf_SetMode在初始化阶段失败时如何处理，确保了系统启动的稳定性和可靠性。 4. **错误处理与恢复**：Watchdog Manager定义了一套错误处理算法及其配置，当检测到错误时，可以执行预设的错误响应策略，如复位ECU或切换到备用模式。此外，文档还修正和添加了错误代码，以便于调试和故障诊断。 5. **接口与配置**：Watchdog Manager与其他组件如EcuPartition和OS Application之间的交互也得到了澄清，确保了不同组件间的协同工作。 6. **编辑性改进**：包括文档结构的优化、表格的更新以及清除开发错误等，提高了文档的可读性和准确性。 AUTOSAR_SWS_WatchdogManager.pdf文档详细阐述了Watchdog Manager的规范，对于理解和实现智能驾驶系统中的故障安全机制具有重要意义。通过持续的版本更新，该规范不断优化和完善，为汽车软件开发者提供了更加可靠和稳定的工具。

Specification of Watchdog Manager

AUTOSAR CP R20-11

16 of 139 Document ID 80: AUTOSAR_SWS_WatchdogManager

3 Related Documentation

3.1 Input Documents

[1] Layered Software Architecture

AUTOSAR_EXP_LayeredSoftwareArchitecture.pdf

[2] General Requirements on Basic Software Modules

AUTOSAR_SRS_BSWGeneral.pdf

[3] Requirements on Mode Management

AUTOSAR_SRS_ModeManagement.pdf

[4] Specification of Platform Types

AUTOSAR_SWS_PlatformTypes.pdf

[5] Specification of RTE

AUTOSAR_SWS_RTE.pdf

[6] Specification of ECU State Manager

AUTOSAR_SWS_ECUStateManager.pdf

[7] Basic Software Module Description Template

AUTOSAR_TPS_BSWModuleDescriptionTemplate.pdf

[8] List of Basic Software Modules

AUTOSAR_TR_BSWModuleList.pdf

[9] AUTOSAR General Specification for Basic Software Modules

AUTOSAR_SWS_BSWGeneral.pdf

3.2 Related specification

AUTOSAR provides a General Specification on Basic Software modules [9] (SWS

BSW General), which is also valid for Watchdog Manager.

Thus, the specification SWS BSW General shall be considered as additional and

required specification for Watchdog Manager.

Specification of Watchdog Manager

AUTOSAR CP R20-11

17 of 139 Document ID 80: AUTOSAR_SWS_WatchdogManager

4 Constraints and Assumptions

4.1 Limitations and conditions of use

The main limitations of Watchdog Manager design are as follows. They may be

removed in upcoming versions of this document:

 For Logical Supervision, Watchdog manager does not support any

overlapping Graphs - a Checkpoint shall belong to maximum one Graph. This

is required to be able to allocate a received Checkpoint notification to a Graph.

This means that:

o No Checkpoint shall belong to two External Graphs,

o No Checkpoint shall belong to two Internal Graphs,

o No Checkpoint shall belong to one Internal and one External Graphs.

 Watchdog Manager does not support Logical Supervision of concurrently

executed Supervised Entities, because it follows only one instance of a Graph

at a time. This means that the current specification of Watchdog Manager

does not support the following:

o Logical Supervision of functions of BSW modules that are executed in

more than one task.

 Libraries cannot call BSWs, so libraries cannot be supervised by Watchdog

Manager.

 It is not standardized how BSW modules are identified with Supervised Entity

IDs.

 The nesting of Deadline Supervision (i.e. start 1, start 2, end 2, end 1) is not

supported.

 The Alive Supervision function with more than one Checkpoint per Supervised

Entity is not consistently specified within the document. For now it is

recommended to support only one Alive Supervision Checkpoint per

Supervised Entity.

 In order to shutdown or restart (as error reaction) a partition containing

Supervised Entities, the integrator code (OS Application's restart task) must

deactivate (or deactivate + activate) all Supervised Entities of the involved

partition, by calling available functions of Watchdog Manager. This is a bit

complex, in future releases of this document it is considered to add a new

function of Watchdog Manager for this.

Further limitations:

 The Watchdog Manager does not encapsulate the Watchdog Driver

initialization. The Watchdog Driver initialization will be performed by the ECU

State Manager [6] early in the startup process.

Specification of Watchdog Manager

AUTOSAR CP R20-11

18 of 139 Document ID 80: AUTOSAR_SWS_WatchdogManager

 The Watchdog Manager is initialized after the OS has been started. Hence, it

cannot be responsible for controlling the Watchdog Driver earlier in the startup

process. Usually, it is sufficient to configure a large enough initial timeout in

the Watchdog Driver to bridge the gap between Watchdog Driver and

Watchdog Manager initialization. Alternatively, the Integrator may use ECU

State Manager facilities (callouts).

 The Watchdog Manager is de-initialized before the OS shutdown. Hence, it

cannot be responsible for controlling the Watchdog Driver later in the

shutdown process. Usually, it is sufficient to configure a large enough final

timeout that is set when the Watchdog Manager is de-initialized. This allows

bridging the gap between Watchdog Manager de-initialization and system

power-off or resetting. Alternatively, the Integrator may use ECU State

Manager facilities (callouts).

 For ECUs which implement sleep modes, if the hardware watchdog remains

active in these sleep modes, its triggering shall also be handled by the ECU

State Manager.

 The error recovery mechanism “Immediate MCU Reset” is available only on

microcontrollers that are able to perform a reset by using the hardware feature

of the microcontroller.

 All of following conditions must be met for the expected operation of WdgM

supervision:

o Initialized Wdg Interface,

o Initialized OS (because of possible usage of OSCounter)

o Initialized WdgM (done by calling WdgM_Init)

o Periodic invocation of WdgM_MainFunction preferably by AUTOSAR

BSW scheduler; during startup the invocation may be done by another

module.

 Note: The deviations/jitters on the periodic call of

WdgM_MainFunction will lead to a potential risk of delayed

detection in both Alive Supervision and Deadline Supervision

(timeouts) and false/missed detection in Alive Supervision.

 Note: Any blocking of this periodic invocation will cause loss of

Deadline Supervision (timeout detection part), Alive Supervision,

all state transition of both Local/Global Supervision Status and

resulting Error Handling mechanisms to recover from supervision

failures, except the last resort "Reset by Hardware Watchdog"

due to the loss of the Watchdog Handling (no trigger to the

hardware instance via WdgIf).

 A Supervised Entity with all its Checkpoints may belong to only one OS-

Application (at most). Because OS-application can run on one core only,

therefore one specific Supervised Entity may run at one core.

 The Deadline Supervision (timeout detection part) and Alive Supervision is

highly depending on the periodic invocation of WdgM_MainFunction: the

Specification of Watchdog Manager

AUTOSAR CP R20-11

20 of 139 Document ID 80: AUTOSAR_SWS_WatchdogManager

5 Dependencies to Other Modules

 Watchdog Interface (WdgIf)

The Watchdog Manager module is responsible for changing the mode of the

Watchdog Driver and for reporting to the Watchdog Driver the condition to

trigger the hardware watchdog. The services of the Watchdog Driver are

accessed via the Watchdog Interface which allows addressing multiple

watchdog instances.

 ECU State Manager (EcuM)

The ECU State Manager is responsible for initializing, de-initializing of the

Watchdog Manager module and for triggering the hardware watchdog in sleep

modes.

 Micro Controller Unit Driver (Mcu)

The Watchdog Manager module may perform an immediate reset of the ECU

in case of a supervision failure. This reset service is provided by the MCU

driver.

 Default Error Tracer (Det)

If development error detection is enabled, the Watchdog Manager module

informs the Default Error Tracer about detected development errors.

 Diagnostic Event Manager (Dem)

The Watchdog Manager may notify the Diagnostic Event Manager about

detected functional / production-code relevant errors.

 BSW Scheduler (SchM)

The BSW Scheduler is responsible for calling the scheduled functions of the

Watchdog Manager module. The Watchdog Manager module uses the

services of the BSW Scheduler to implement critical sections.

 Runtime Environment (Rte)

The Runtime Environment is responsible for propagating Checkpoint

information from Supervised Entities in SW-Cs or in CDDs to the Watchdog

Manager module. The Watchdog Manager module uses the services of the

Runtime Environment to inform SW-Cs about changes in the supervision

status. BSW Modules can call the Watchdog Manager module without using

RTE.

 BSW Mode Manager (BswM)

The Basic Software Mode Manager is responsible for restarting a non-trusted

partition. A Supervised Entity can be associated to an OS Application. If the

supervision of the Supervised Entity fails, the Watchdog Manager requests a

restart of the corresponding partition.

 Operating system (OS)

The Operating System is used by Watchog Manager to provide the timestamp.

剩余138页未读，继续阅读

电动汽车控制与安全

粉丝: 267
资源: 4186

AUTOSAR WatchdogManager规范解读

AUTOSAR的看门狗管理规范

AUTOSAR的看门狗接口规范

AutoSar4.4(AutoSar 标准文档)

AUTOSAR_SWS_WatchdogManager.zip

AUTOSAR-SWS-WatchdogManager.pdf

AUTOSAR_SWS_CAN_NM.pdf

AUTOSAR_AP_SWS_Cryptography.pdf

AUTOSAR_CP_SWS_KeyManager.pdf

AUTOSAR_AP_SWS_IntrusionDetectionSystemManager.pdf

AUTOSAR_CP_SWS_IntrusionDetectionSystemManager.pdf

最新资源