Automotive Embedded Systems: AUTOSAR Architecture and ISO 26262 Functional Safety

/* AUTOSAR Classic Platform Layer Structure */
┌─────────────────────────────────────────────────────────────────────┐
│                    APPLICATION LAYER                                 │
│  ┌───────────┐ ┌───────────┐ ┌───────────┐ ┌───────────┐           │
│  │  Engine   │ │Transmission│ │   Brake   │ │  HVAC     │           │
│  │  Control  │ │  Control   │ │  Control  │ │  Control  │    SWCs   │
│  │   SWC     │ │    SWC     │ │    SWC    │ │   SWC     │           │
│  └─────┬─────┘ └─────┬─────┘ └─────┬─────┘ └─────┬─────┘           │
│        │             │             │             │                   │
├────────┴─────────────┴─────────────┴─────────────┴───────────────────┤
│                    RUNTIME ENVIRONMENT (RTE)                         │
│      Virtual Functional Bus Implementation - Port Interfaces         │
├─────────────────────────────────────────────────────────────────────┤
│                    BASIC SOFTWARE (BSW)                              │
│  ┌─────────────────────────────────────────────────────────────┐    │
│  │                     SERVICES LAYER                           │    │
│  │  ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌────────┐ │    │
│  │  │   OS    │ │  COM    │ │   DCM   │ │   DEM   │ │  NvM   │ │    │
│  │  └─────────┘ └─────────┘ └─────────┘ └─────────┘ └────────┘ │    │
│  │  ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌────────┐ │    │
│  │  │   BswM  │ │  EcuM   │ │  SchM   │ │  WdgM   │ │  FiM   │ │    │
│  │  └─────────┘ └─────────┘ └─────────┘ └─────────┘ └────────┘ │    │
│  └─────────────────────────────────────────────────────────────┘    │
│  ┌─────────────────────────────────────────────────────────────┐    │
│  │                  ECU ABSTRACTION LAYER                       │    │
│  │  ┌─────────┐ ┌─────────┐ ┌─────────────────┐ ┌────────────┐ │    │
│  │  │ IoHwAb  │ │ ComHwAb │ │ OnBoard Device  │ │   Memory   │ │    │
│  │  │         │ │         │ │  Abstraction    │ │ Abstraction│ │    │
│  │  └─────────┘ └─────────┘ └─────────────────┘ └────────────┘ │    │
│  └─────────────────────────────────────────────────────────────┘    │
│  ┌─────────────────────────────────────────────────────────────┐    │
│  │           MICROCONTROLLER ABSTRACTION LAYER (MCAL)           │    │
│  │  ┌─────┐ ┌─────┐ ┌─────┐ ┌─────┐ ┌─────┐ ┌─────┐ ┌───────┐ │    │
│  │  │ DIO │ │ ADC │ │ PWM │ │ SPI │ │ CAN │ │ FLS │ │  GPT  │ │    │
│  │  └─────┘ └─────┘ └─────┘ └─────┘ └─────┘ └─────┘ └───────┘ │    │
│  │  ┌─────┐ ┌─────┐ ┌─────┐ ┌─────┐ ┌─────┐ ┌─────┐ ┌───────┐ │    │
│  │  │ ICU │ │ LIN │ │ ETH │ │ WDG │ │ MCU │ │ PORT│ │  FEE  │ │    │
│  │  └─────┘ └─────┘ └─────┘ └─────┘ └─────┘ └─────┘ └───────┘ │    │
│  └─────────────────────────────────────────────────────────────┘    │
├─────────────────────────────────────────────────────────────────────┤
│                    MICROCONTROLLER HARDWARE                          │
│              (Infineon AURIX, NXP S32K, Renesas RH850)               │
└─────────────────────────────────────────────────────────────────────┘

<!-- Software Component Type Definition -->
<APPLICATION-SW-COMPONENT-TYPE UUID="a1b2c3d4-e5f6-...">
  <SHORT-NAME>BrakeController</SHORT-NAME>
  <ADMIN-DATA>
    <SDGS>
      <SDG GID="AutosarStandard.BswConfiguration">
        <SD GID="SafetyLevel">ASIL-D</SD>
      </SDG>
    </SDGS>
  </ADMIN-DATA>
  <PORTS>
    <R-PORT-PROTOTYPE UUID="...">
      <SHORT-NAME>WheelSpeed_FL</SHORT-NAME>
      <REQUIRED-INTERFACE-TREF DEST="SENDER-RECEIVER-INTERFACE">
        /Interfaces/WheelSpeedInterface
      </REQUIRED-INTERFACE-TREF>
    </R-PORT-PROTOTYPE>
    <R-PORT-PROTOTYPE UUID="...">
      <SHORT-NAME>WheelSpeed_FR</SHORT-NAME>
      <REQUIRED-INTERFACE-TREF DEST="SENDER-RECEIVER-INTERFACE">
        /Interfaces/WheelSpeedInterface
      </REQUIRED-INTERFACE-TREF>
    </R-PORT-PROTOTYPE>
    <P-PORT-PROTOTYPE UUID="...">
      <SHORT-NAME>BrakeForceRequest</SHORT-NAME>
      <PROVIDED-INTERFACE-TREF DEST="CLIENT-SERVER-INTERFACE">
        /Interfaces/BrakeControlInterface
      </PROVIDED-INTERFACE-TREF>
    </P-PORT-PROTOTYPE>
  </PORTS>
  <INTERNAL-BEHAVIORS>
    <SWC-INTERNAL-BEHAVIOR>
      <SHORT-NAME>BrakeController_IB</SHORT-NAME>
      <RUNNABLES>
        <RUNNABLE-ENTITY>
          <SHORT-NAME>BrakeControl_10ms</SHORT-NAME>
          <MINIMUM-START-INTERVAL>0.01</MINIMUM-START-INTERVAL>
          <CAN-BE-INVOKED-CONCURRENTLY>false</CAN-BE-INVOKED-CONCURRENTLY>
          <SYMBOL>BrakeControl_10ms_Runnable</SYMBOL>
        </RUNNABLE-ENTITY>
      </RUNNABLES>
    </SWC-INTERNAL-BEHAVIOR>
  </INTERNAL-BEHAVIORS>
</APPLICATION-SW-COMPONENT-TYPE>

/* AUTOSAR OS Task Configuration */
TASK(BrakeControlTask) {
    PRIORITY = 10;                    /* Higher number = higher priority */
    SCHEDULE = FULL;                  /* Preemptive scheduling */
    ACTIVATION = 1;                   /* Max pending activations */
    AUTOSTART = TRUE;                 /* Start automatically */
    STACK_SIZE = 2048;                /* Task stack in bytes */
    TIMING_PROTECTION = TRUE;
    EXECUTION_BUDGET = 500us;         /* Max execution time */
    TIME_FRAME = 10ms;                /* Period for budget */
};

TASK(DiagnosticTask) {
    PRIORITY = 5;
    SCHEDULE = FULL;
    ACTIVATION = 1;
    AUTOSTART = FALSE;
    STACK_SIZE = 4096;
    /* Lower priority, larger stack for diagnostic handling */
};

ALARM(BrakeControlAlarm) {
    COUNTER = SystemTimer;
    ACTION = ACTIVATETASK { TASK = BrakeControlTask; };
    AUTOSTART = TRUE {
        ALARMTIME = 10;               /* Initial delay in ticks */
        CYCLETIME = 10;               /* Period in ticks (10ms @ 1ms tick) */
    };
};

ISR(CAN_RX_Interrupt) {
    CATEGORY = 2;                     /* Category 2: Can use OS services */
    PRIORITY = 15;                    /* Hardware interrupt priority */
    RESOURCE = CAN_ResourceLock;
};

/* Memory Protection Configuration */
APPLICATION(SafetyApp_ASILD) {
    TRUSTED = TRUE;
    STARTUPHOOK = TRUE;
    ERRORHOOK = TRUE;
    TASK = BrakeControlTask;
    ISR = CAN_RX_Interrupt;
    MEMORY = {
        ROM = 0x00100000..0x0017FFFF;
        RAM = 0x20000000..0x2000FFFF;
    };
};

┌─────────────────────────────────────────────────────────────────────┐
│                    COM (Communication)                               │
│              Signal-based communication interface                    │
├─────────────────────────────────────────────────────────────────────┤
│                    PDU Router (PduR)                                 │
│           Routes PDUs between communication modules                  │
├────────────┬────────────┬────────────┬────────────┬─────────────────┤
│   CanIf    │   LinIf    │   FrIf     │   EthIf    │    DoIP         │
│ CAN Inter- │ LIN Inter- │ FlexRay    │ Ethernet   │ Diagnostics     │
│   face     │   face     │ Interface  │ Interface  │ over IP         │
├────────────┼────────────┼────────────┼────────────┼─────────────────┤
│   CanTrcv  │   LinTrcv  │   FrTrcv   │   EthTrcv  │                 │
│ Transceiver│ Transceiver│ Transceiver│ Transceiver│                 │
├────────────┴────────────┴────────────┴────────────┴─────────────────┤
│                    MCAL Drivers                                      │
│      Can, Lin, Fr, Eth - Hardware-specific implementations           │
└─────────────────────────────────────────────────────────────────────┘

/* SecOC Message Authentication Structure */

Original PDU:
┌────────────────────────────────────────────────────────────────┐
│                    Payload Data (N bytes)                       │
└────────────────────────────────────────────────────────────────┘

Secured PDU (with SecOC):
┌────────────────────────────────────────────────────────────────┐
│ Payload Data │ Freshness Value │ MAC (Truncated)               │
│   (N bytes)  │    (4 bytes)    │   (4-16 bytes)                │
└────────────────────────────────────────────────────────────────┘

MAC Calculation:
MAC = CMAC-AES-128(Key, FreshnessValue || DataID || Payload)

/* SecOC Configuration Example */
SecOC_TxPduCollection {
    TxSecuredPdu: BrakeCommand_Secured {
        SecuredPduLength: 16
        AuthInfoTxLength: 8        /* 4 bytes freshness + 4 bytes MAC */
        SecuredTxPduVerification: TRUE
        FreshnessValueTxBitLength: 32
        AuthenticationBuildAttempts: 1
        TxAuthServiceConfigRef: AES_CMAC_Config
    }
}

SecOC_RxPduCollection {
    RxSecuredPdu: BrakeCommand_Secured {
        AuthInfoRxLength: 8
        SecuredRxPduVerification: TRUE
        FreshnessValueRxBitLength: 32
        VerificationStatusPropagationMode: BOTH
        UseAuthDataFreshness: USE_FRESHNESS_WITH_AUTH_DATA
        RxAuthServiceConfigRef: AES_CMAC_Config
    }
}

/* Freshness Value Management */
Approaches:
1. Counter-based: Monotonic counter synchronized between Tx/Rx
2. Time-based: Synchronized time with tolerance window
3. Trip counter: Reset at ignition, combined with message counter

/* CAN FD vs Classic CAN Comparison */
┌──────────────────────────────────────────────────────────────────┐
│ Parameter           │ Classic CAN     │ CAN FD                   │
├──────────────────────────────────────────────────────────────────┤
│ Arbitration Rate    │ Up to 1 Mbps    │ Up to 1 Mbps             │
│ Data Rate           │ Up to 1 Mbps    │ Up to 5 Mbps (8 Mbps*)   │
│ Payload Size        │ 0-8 bytes       │ 0-64 bytes               │
│ CRC                 │ 15-bit          │ 17-bit (≤16B) / 21-bit   │
│ Bit Stuffing        │ Classic         │ Fixed stuffing in CRC    │
└──────────────────────────────────────────────────────────────────┘
*8 Mbps in some implementations with short bus lengths

/* CAN FD PDU Configuration */
CanIfRxPduCfg: BrakeCommand_FD {
    CanIfRxPduCanIdType: EXTENDED_FD
    CanIfRxPduCanId: 0x18FF0201
    CanIfRxPduDlc: 32                   /* 32-byte payload */
    CanIfRxPduUserRxIndicationName: Com_RxIndication
}

CanIfTxPduCfg: BrakeStatus_FD {
    CanIfTxPduCanIdType: STANDARD_FD
    CanIfTxPduCanId: 0x201
    CanIfTxPduDlc: 64                   /* Maximum payload */
    CanIfTxPduType: DYNAMIC
}

/* E2E Protection Profiles */

Profile 1: For short messages (≤8 bytes)
├── CRC: 8-bit CRC-8-SAE J1850
├── Counter: 4-bit sequence counter
├── DataID: 16-bit identifier
└── Use case: Body/comfort signals

Profile 2: For medium messages (≤16 bytes)
├── CRC: 8-bit CRC-8-SAE J1850
├── Counter: 4-bit with timeout
├── DataID: 16-bit identifier
└── Use case: Chassis control

Profile 4: For larger messages with comprehensive protection
├── CRC: 32-bit CRC-32 (IEEE 802.3)
├── Counter: 16-bit sequence counter
├── Length: 16-bit explicit length field
├── DataID: 32-bit identifier
└── Use case: ADAS sensor data

Profile 5: For safety-critical with two CRCs
├── CRC1: 16-bit CRC over data
├── CRC2: 16-bit CRC over counter + CRC1
├── Counter: 8-bit sequence
└── Use case: Brake-by-wire, steer-by-wire

/* E2E State Machine */
┌─────────┐     Valid      ┌─────────┐
│ INITIAL │ ─────────────► │  VALID  │
└─────────┘                └────┬────┘
     ▲                          │
     │                     Invalid × N
     │                          │
     │      Valid          ┌────▼────┐
     └─────────────────────│ INVALID │
                           └─────────┘

┌─────────────────────────────────────────────────────────────────────┐
│                    ADAPTIVE APPLICATIONS                             │
│  ┌───────────┐ ┌───────────┐ ┌───────────┐ ┌───────────┐           │
│  │  ADAS     │ │Navigation │ │Infotain-  │ │ OTA       │           │
│  │  App      │ │   App     │ │  ment     │ │ Manager   │           │
│  └─────┬─────┘ └─────┬─────┘ └─────┬─────┘ └─────┬─────┘           │
│        │             │             │             │                   │
├────────┴─────────────┴─────────────┴─────────────┴───────────────────┤
│                    ARA (AUTOSAR Runtime for Adaptive)                │
│  ┌─────────────────────────────────────────────────────────────┐    │
│  │                   FUNCTIONAL CLUSTERS                        │    │
│  │                                                               │    │
│  │  ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐            │    │
│  │  │ara::com │ │ara::diag│ │ara::exec│ │ara::log │            │    │
│  │  │Communic-│ │Diagnos- │ │Execution│ │Logging  │            │    │
│  │  │ation    │ │tics     │ │Managemt │ │& Tracing│            │    │
│  │  └─────────┘ └─────────┘ └─────────┘ └─────────┘            │    │
│  │                                                               │    │
│  │  ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐            │    │
│  │  │ara::per │ │ara::phm │ │ara::sm  │ │ara::ucm │            │    │
│  │  │Persist- │ │Platform │ │State    │ │Update & │            │    │
│  │  │ency     │ │Health   │ │Managemt │ │Config   │            │    │
│  │  └─────────┘ └─────────┘ └─────────┘ └─────────┘            │    │
│  │                                                               │    │
│  │  ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐            │    │
│  │  │ara::iam │ │ara::nm  │ │ara::tsync│ │ara::crypto│          │    │
│  │  │Identity │ │Network  │ │Time     │ │Cryptogra-│            │    │
│  │  │& Access │ │Managemt │ │Sync     │ │phy       │            │    │
│  │  └─────────┘ └─────────┘ └─────────┘ └─────────┘            │    │
│  └─────────────────────────────────────────────────────────────┘    │
│                                                                       │
│  ┌─────────────────────────────────────────────────────────────┐    │
│  │                     ara::core                                │    │
│  │      Result, ErrorCode, Future/Promise, Span, Array         │    │
│  └─────────────────────────────────────────────────────────────┘    │
├─────────────────────────────────────────────────────────────────────┤
│                    OPERATING SYSTEM (POSIX)                          │
│                 Linux / QNX / PikeOS / Other POSIX                   │
├─────────────────────────────────────────────────────────────────────┤
│                    HARDWARE PLATFORM                                 │
│         NVIDIA Orin, Qualcomm SA8xxx, Intel x86, ARM                │
└─────────────────────────────────────────────────────────────────────┘

// Service Interface Definition (from Service Interface Description)
class RadarServiceInterface {
public:
    // Events (publish-subscribe)
    ara::com::Event<ObjectList> ObjectDetected;
    ara::com::Event<RadarStatus> StatusChanged;

    // Methods (request-response)
    ara::core::Future<ConfigResult> Configure(
        const RadarConfig& config);
    ara::core::Future<CalibrationResult> Calibrate(
        const CalibrationParams& params);

    // Fields (getter/setter with notification)
    ara::com::Field<SensorState> CurrentState;
};

// Service Skeleton (Provider) Implementation
class RadarServiceSkeleton : public RadarServiceInterface {
public:
    RadarServiceSkeleton(ara::com::InstanceIdentifier instance)
        : instance_(instance) {
        // Register service with Service Discovery
        OfferService();
    }

    ~RadarServiceSkeleton() {
        StopOfferService();
    }

    void ProcessFrame(const RadarFrame& frame) {
        // Process radar data
        ObjectList detected = RunDetection(frame);

        // Publish event to all subscribers
        ObjectDetected.Send(detected);

        // Update field (notifies subscribers)
        CurrentState.Update(SensorState::kProcessing);
    }

    ara::core::Future<ConfigResult> Configure(
            const RadarConfig& config) override {
        // Validate and apply configuration
        ara::core::Promise<ConfigResult> promise;

        if (ValidateConfig(config)) {
            ApplyConfig(config);
            promise.set_value(ConfigResult::kSuccess);
        } else {
            promise.set_value(ConfigResult::kInvalidParameter);
        }

        return promise.get_future();
    }

private:
    ara::com::InstanceIdentifier instance_;
};

// Service Proxy (Consumer) Usage
void ConsumeRadarService() {
    // Find available service instances
    auto handles = RadarServiceProxy::FindService(
        ara::com::InstanceIdentifier("RadarFront"));

    if (handles.empty()) {
        ara::log::LogError() << "Radar service not found";
        return;
    }

    // Create proxy from handle
    RadarServiceProxy proxy(handles[0]);

    // Subscribe to events
    proxy.ObjectDetected.SetReceiveHandler(
        [](ara::com::SamplePtr<ObjectList> sample) {
            for (const auto& obj : sample->objects) {
                ProcessDetectedObject(obj);
            }
        });
    proxy.ObjectDetected.Subscribe(10);  // Cache up to 10 samples

    // Call method asynchronously
    RadarConfig config{.mode = RadarMode::kLongRange};
    auto future = proxy.Configure(config);

    // Handle result when ready
    future.then([](ara::core::Future<ConfigResult> f) {
        auto result = f.get();
        if (result == ConfigResult::kSuccess) {
            ara::log::LogInfo() << "Radar configured successfully";
        }
    });
}

// Application State Machine
class MyApplication {
public:
    void Initialize() {
        // Register state change handler
        ara::exec::ExecutionClient exec_client;
        exec_client.SetStateChangeHandler(
            [this](ara::exec::FunctionGroupState state) {
                HandleStateChange(state);
            });

        // Report running state to Execution Management
        exec_client.ReportExecutionState(
            ara::exec::ExecutionState::kRunning);
    }

    void HandleStateChange(ara::exec::FunctionGroupState state) {
        switch (state) {
            case ara::exec::FunctionGroupState::kOff:
                Shutdown();
                break;
            case ara::exec::FunctionGroupState::kVerify:
                PerformSelfTest();
                break;
            case ara::exec::FunctionGroupState::kRunning:
                StartProcessing();
                break;
        }
    }

    void Shutdown() {
        // Clean shutdown sequence
        StopServices();
        SavePersistentData();
        ReleaseResources();

        // Report terminated state
        ara::exec::ExecutionClient().ReportExecutionState(
            ara::exec::ExecutionState::kTerminated);
    }
};

// Execution Manifest (JSON)
{
    "applicationManifest": {
        "applicationId": "RadarPerception",
        "version": "2.1.0",
        "processes": [{
            "name": "radar_main",
            "executable": "/opt/radar/bin/radar_perception",
            "schedulingPolicy": "FIFO",
            "schedulingPriority": 80,
            "resourceGroup": "SafetyPartition",
            "startupConfigs": [{
                "functionGroup": "Driving",
                "startupOption": "automatic"
            }]
        }]
    }
}

Concept Phase                                          Production & Operation
     │                                                          │
     ▼                                                          ▲
┌─────────────────┐                              ┌─────────────────────┐
│ Item Definition │                              │ Production & Field  │
│ HARA            │                              │ Monitoring          │
│ Safety Goals    │                              └─────────────────────┘
└────────┬────────┘                                          ▲
         │                                                   │
         ▼                                                   │
┌─────────────────────┐                    ┌─────────────────────────┐
│ Functional Safety   │                    │ Functional Safety       │
│ Concept             │                    │ Assessment              │
└────────┬────────────┘                    │ Safety Validation       │
         │                                 └─────────────────────────┘
         ▼                                              ▲
┌─────────────────────────┐          ┌─────────────────────────────┐
│ Technical Safety        │          │ System Integration &        │
│ Concept                 │          │ Testing                     │
└────────┬────────────────┘          └─────────────────────────────┘
         │                                        ▲           ▲
    ┌────┴────┐                              ┌────┴───┐  ┌────┴───┐
    ▼         ▼                              │        │  │        │
┌───────┐ ┌───────┐                     ┌────────┐ ┌────────┐
│  HW   │ │  SW   │                     │  HW    │ │  SW    │
│Design │ │Design │                     │ Test   │ │ Test   │
└───┬───┘ └───┬───┘                     └────────┘ └────────┘
    │         │                              ▲           ▲
    ▼         ▼                              │           │
┌───────┐ ┌───────┐                     ┌────────┐ ┌────────┐
│  HW   │ │  SW   │                     │  HW    │ │  SW    │
│ Impl. │ │ Impl. │ ──────────────────► │ Unit   │ │ Unit   │
└───────┘ └───────┘                     │ Test   │ │ Test   │
                                        └────────┘ └────────┘

/* ASIL Decomposition Rules (ISO 26262-9) */

// Valid decompositions:
ASIL D = ASIL D(D)                    // No decomposition (single channel)
ASIL D = ASIL C(D) + ASIL A(D)        // Two channels
ASIL D = ASIL B(D) + ASIL B(D)        // Two equal channels
ASIL D = ASIL B(D) + ASIL A(D) + ASIL A(D)  // Three channels

ASIL C = ASIL C(C)                    // No decomposition
ASIL C = ASIL B(C) + ASIL A(C)        // Two channels
ASIL C = ASIL A(C) + ASIL A(C) + ASIL A(C)  // Three channels

ASIL B = ASIL B(B)                    // No decomposition
ASIL B = ASIL A(B) + ASIL A(B)        // Two channels
ASIL B = ASIL QM(B) + ASIL A(B) + ASIL A(B)  // Three channels

/* Example: Brake-by-Wire with ASIL Decomposition */
┌─────────────────────────────────────────────────────────────────────┐
│                    Safety Goal: Prevent Unintended Braking          │
│                              ASIL D                                  │
└─────────────────────────────────────────────────────────────────────┘
                              │
              ┌───────────────┴───────────────┐
              ▼                               ▼
┌─────────────────────────┐     ┌─────────────────────────┐
│ Primary Brake Control   │     │ Safety Monitor          │
│ ASIL B(D)               │     │ ASIL B(D)               │
│                         │     │                         │
│ - Brake algorithm       │     │ - Plausibility checks   │
│ - Sensor processing     │     │ - Watchdog supervision  │
│ - Actuator control      │     │ - Safe state trigger    │
└─────────────────────────┘     └─────────────────────────┘

/* Single-Point Fault Metric (SPFM) */
SPFM = 1 - (Σλ_SPF) / (Σλ_total)

Where:
- λ_SPF = Failure rate of single-point faults (not detected, not safe)
- λ_total = Total failure rate of safety-related hardware elements

/* Latent Fault Metric (LFM) */
LFM = 1 - (Σλ_LF) / (Σλ_total - Σλ_SPF - Σλ_MPF_detected)

Where:
- λ_LF = Failure rate of latent faults (multi-point, not detected)
- λ_MPF_detected = Failure rate of detected multi-point faults

/* Probabilistic Metric for Random Hardware Failures (PMHF) */
PMHF = Σλ_SPF + Σ(λ_RF × λ_LF × T_lifetime/2)

Where:
- λ_RF = Residual fault rate
- T_lifetime = Expected operational lifetime (typically 8000-12000 hours)

/* Example Calculation for Brake ECU */
Component: Brake Pressure Sensor
- Base failure rate (λ_base) = 100 FIT
- Safe fault portion = 40%
- Dangerous fault portion = 60%
- Diagnostic coverage (DC) = 99%

λ_safe = 100 × 0.40 = 40 FIT
λ_dangerous = 100 × 0.60 = 60 FIT
λ_SPF = λ_dangerous × (1 - DC) = 60 × 0.01 = 0.6 FIT
λ_RF_detected = λ_dangerous × DC = 60 × 0.99 = 59.4 FIT

For ASIL D (SPFM ≥ 99%):
SPFM = 1 - 0.6/100 = 99.4% ✓ Meets requirement

/* Diagnostic Coverage Requirements */
        ASIL B    ASIL C    ASIL D
Low:    ≥60%      ≥70%      ≥70%
Medium: ≥90%      ≥97%      ≥99%
High:   ≥99%      ≥99%      ≥99%

┌──────────────────────────────────────────────────────────────────────┐
│                    DOMAIN-BASED ARCHITECTURE                         │
│                    (70-100+ ECUs typical)                            │
├──────────────┬──────────────┬──────────────┬──────────────┬─────────┤
│  POWERTRAIN  │    CHASSIS   │     BODY     │     ADAS     │INFOTAIN.│
│   DOMAIN     │    DOMAIN    │    DOMAIN    │    DOMAIN    │ DOMAIN  │
├──────────────┼──────────────┼──────────────┼──────────────┼─────────┤
│ Engine ECU   │ ABS ECU      │ BCM          │ Front Radar  │ Head    │
│ Trans. ECU   │ ESP ECU      │ Door Module  │ Front Camera │ Unit    │
│ Inverter MCU │ EPS ECU      │ Door Module  │ Corner Radar │ Cluster │
│ BMS          │ Air Susp.    │ Door Module  │ Corner Radar │ Amp     │
│ Charger ECU  │ Steering     │ Door Module  │ Rear Camera  │ Tuner   │
│ DC-DC Conv.  │ Angle        │ HVAC         │ Lidar        │ Display │
│              │ Brake Boost  │ Seat (x4)    │ USS (x12)    │         │
│              │              │ Lighting     │              │         │
├──────────────┴──────────────┴──────────────┴──────────────┴─────────┤
│                    CAN / LIN / FlexRay Networks                      │
│              Multiple separate networks per domain                   │
└──────────────────────────────────────────────────────────────────────┘

Problems with Domain Architecture:
- 5km+ of wiring harness (25-40 kg weight)
- 70-100 ECUs with redundant compute
- Complex multi-gateway routing
- Software updates require multiple ECUs
- High total system cost

┌──────────────────────────────────────────────────────────────────────┐
│                    ZONAL ARCHITECTURE                                │
│                    (3-5 Domain Controllers + Zone Gateways)          │
├──────────────────────────────────────────────────────────────────────┤
│                  CENTRAL COMPUTE PLATFORM (CCP)                      │
│  ┌────────────────┐  ┌────────────────┐  ┌────────────────┐         │
│  │ Vehicle Control│  │   ADAS / AD    │  │  Infotainment  │         │
│  │  Domain Ctrl   │  │  Domain Ctrl   │  │  Domain Ctrl   │         │
│  │ (AUTOSAR CP)   │  │ (AUTOSAR AP)   │  │ (Linux/Android)│         │
│  │ ASIL D capable │  │ ASIL B + QM    │  │     QM         │         │
│  └────────────────┘  └────────────────┘  └────────────────┘         │
│                                                                       │
│                    ETHERNET BACKBONE (10Gbps+)                       │
│                    Time-Sensitive Networking (TSN)                   │
├────────────┬────────────┬────────────┬────────────┬──────────────────┤
│   ZONE     │   ZONE     │   ZONE     │   ZONE     │      ZONE        │
│   FRONT    │   LEFT     │   RIGHT    │   REAR     │      ROOF        │
│  GATEWAY   │  GATEWAY   │  GATEWAY   │  GATEWAY   │     GATEWAY      │
├────────────┼────────────┼────────────┼────────────┼──────────────────┤
│• Headlights│• Door ECU  │• Door ECU  │• Taillights│• Roof antenna    │
│• Front     │• Mirror    │• Mirror    │• Trunk     │• Panoramic roof  │
│  sensors   │• Seat      │• Seat      │• Rear      │• V2X unit        │
│• HVAC front│• Window    │• Window    │  sensors   │• Connectivity    │
│            │            │            │• Charging  │  module          │
└────────────┴────────────┴────────────┴────────────┴──────────────────┘

Benefits of Zonal Architecture:
- 30-40% reduction in wiring harness (weight and cost)
- Reduced ECU count: 100+ → 10-15
- Simplified software updates
- Better scalability for new features
- Improved electromagnetic compatibility (EMC)

/* TARA Process (ISO/SAE 21434) */

1. ASSET IDENTIFICATION
   ├── Hardware: ECUs, sensors, communication interfaces
   ├── Software: OS, applications, configuration data
   ├── Data: Calibration, personal data, cryptographic keys
   └── Services: Diagnostics, OTA, remote functions

2. THREAT IDENTIFICATION (STRIDE Model)
   ├── Spoofing: Fake GPS, spoofed CAN messages
   ├── Tampering: Modified firmware, altered calibration
   ├── Repudiation: Deny sending command
   ├── Information Disclosure: Key extraction, eavesdropping
   ├── Denial of Service: CAN bus flooding, ECU crash
   └── Elevation of Privilege: Gain root access, unlock features

3. IMPACT ASSESSMENT
   ├── Safety Impact: Map to ISO 26262 ASIL
   ├── Financial Impact: Direct loss, liability
   ├── Operational Impact: Vehicle availability
   └── Privacy Impact: Personal data breach

4. ATTACK FEASIBILITY RATING
   ├── Elapsed Time: ≤1 day, ≤1 week, ≤1 month, ≤6 months, >6 months
   ├── Expertise: Layman, Proficient, Expert, Multiple Experts
   ├── Knowledge: Public, Restricted, Confidential, Strictly Confidential
   ├── Window of Opportunity: Unlimited, Easy, Moderate, Difficult, None
   └── Equipment: Standard, Specialized, Bespoke, Multiple Bespoke

5. RISK DETERMINATION
   Risk Value = Impact × Attack Feasibility
   Treatment: Avoid, Reduce, Transfer, Accept

6. CYBERSECURITY GOALS AND REQUIREMENTS
   ├── Confidentiality requirements
   ├── Integrity requirements
   ├── Availability requirements
   └── Authentication/Authorization requirements

┌─────────────────────────────────────────────────────────────────────┐
│                    OTA UPDATE ECOSYSTEM                              │
├─────────────────────────────────────────────────────────────────────┤
│                   CLOUD INFRASTRUCTURE                               │
│  ┌─────────────┐ ┌─────────────┐ ┌───────────────────────────────┐ │
│  │ Update Mgmt │ │  Signing    │ │     Campaign Management       │ │
│  │   Server    │ │   Service   │ │  • Vehicle targeting          │ │
│  │             │ │  (HSM-based)│ │  • Rollout scheduling         │ │
│  │             │ │             │ │  • A/B testing                │ │
│  │             │ │             │ │  • Rollback triggers          │ │
│  └─────────────┘ └─────────────┘ └───────────────────────────────┘ │
│                         │                                           │
│                    [TLS 1.3 + Certificate Pinning]                  │
│                         │                                           │
├─────────────────────────┼───────────────────────────────────────────┤
│                   VEHICLE PLATFORM                                   │
│                         │                                           │
│  ┌─────────────────────┐│┌───────────────────────────────────────┐ │
│  │   Connectivity      │││       OTA Master Controller           │ │
│  │   Module (TCU)      │││  • Download management                │ │
│  │                     │││  • Signature verification             │ │
│  │  • 4G/5G modem      │││  • Dependency resolution             │ │
│  │  • WiFi client      │││  • Installation orchestration         │ │
│  └─────────────────────┘│└───────────────────────────────────────┘ │
│                         │                                           │
│                    [Automotive Ethernet]                            │
│                         │                                           │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐           │
│  │ECU with  │  │ECU with  │  │ECU with  │  │ECU with  │           │
│  │A/B Parts │  │A/B Parts │  │A/B Parts │  │A/B Parts │           │
│  └──────────┘  └──────────┘  └──────────┘  └──────────┘           │
└─────────────────────────────────────────────────────────────────────┘

/* A/B Partition Strategy */

┌─────────────────────────────────────────────────────────────────────┐
│                    FLASH MEMORY LAYOUT                               │
├─────────────────────────────────────────────────────────────────────┤
│ ┌─────────────────┐                      ┌─────────────────┐       │
│ │   Bootloader    │ (Protected, rarely updated)             │       │
│ └─────────────────┘                                         │       │
│                                                              │       │
│ ┌─────────────────┐  ┌─────────────────┐                    │       │
│ │  Partition A    │  │  Partition B    │                    │       │
│ │  ┌───────────┐  │  │  ┌───────────┐  │                    │       │
│ │  │ Boot Img  │  │  │  │ Boot Img  │  │                    │       │
│ │  ├───────────┤  │  │  ├───────────┤  │  Version: 2.1.0   │       │
│ │  │  Kernel   │  │  │  │  Kernel   │  │  Status: ACTIVE   │       │
│ │  ├───────────┤  │  │  ├───────────┤  │  Boot Count: 847  │       │
│ │  │  Root FS  │  │  │  │  Root FS  │  │                    │       │
│ │  ├───────────┤  │  │  ├───────────┤  │                    │       │
│ │  │Application│  │  │  │Application│  │  Version: 2.0.5   │       │
│ │  └───────────┘  │  │  └───────────┘  │  Status: STANDBY  │       │
│ └─────────────────┘  └─────────────────┘  Last: 2 weeks ago│       │
│        ↑                     ↑                              │       │
│     RUNNING              UPDATE TARGET                       │       │
│                                                              │       │
│ ┌─────────────────────────────────────────────────────────┐ │       │
│ │              Persistent Data Partition                   │ │       │
│ │  • User settings         • Calibration data             │ │       │
│ │  • Diagnostic history    • Security keys (encrypted)    │ │       │
│ └─────────────────────────────────────────────────────────┘ │       │
└─────────────────────────────────────────────────────────────────────┘

Update Process:
1. Download new image → Verify signature → Write to Partition B
2. Set boot flag → Partition B = pending
3. Reboot → Bootloader loads Partition B
4. If boot successful → Mark B as active, A as standby
5. If boot fails → Automatic rollback to A

// Secure OTA verification implementation (C++)
class OTAVerifier {
public:
    enum class VerifyResult {
        kSuccess,
        kSignatureInvalid,
        kVersionRollback,
        kIncompatibleHardware,
        kCorruptedPackage,
        kInsufficientSpace
    };

    VerifyResult Verify(const UpdatePackage& package) {
        // 1. Verify package integrity (hash)
        if (!VerifyHash(package)) {
            LogSecurityEvent("Package hash mismatch");
            return VerifyResult::kCorruptedPackage;
        }

        // 2. Verify signature chain (RSA-PSS or ECDSA)
        if (!VerifySignatureChain(package)) {
            LogSecurityEvent("Signature verification failed");
            return VerifyResult::kSignatureInvalid;
        }

        // 3. Anti-rollback check (monotonic counter)
        if (package.version <= GetSecureVersionCounter()) {
            LogSecurityEvent("Rollback attempt blocked");
            return VerifyResult::kVersionRollback;
        }

        // 4. Hardware compatibility check
        if (!CheckHardwareCompatibility(package.metadata)) {
            return VerifyResult::kIncompatibleHardware;
        }

        // 5. Storage space check
        if (!CheckStorageSpace(package.size)) {
            return VerifyResult::kInsufficientSpace;
        }

        return VerifyResult::kSuccess;
    }

private:
    bool VerifySignatureChain(const UpdatePackage& pkg) {
        // Load OEM root certificate from secure storage
        Certificate root_cert = HSM::LoadRootCertificate();

        // Verify intermediate certificate
        if (!root_cert.Verify(pkg.intermediate_cert)) {
            return false;
        }

        // Verify package signature
        Certificate intermediate(pkg.intermediate_cert);
        return intermediate.VerifySignature(
            pkg.data,
            pkg.signature,
            SignatureAlgorithm::ECDSA_P384_SHA384
        );
    }
};

/* Sensor Fusion Approaches */

1. EARLY FUSION (Raw Data Level)
   ┌─────────┐  ┌─────────┐  ┌─────────┐
   │ Camera  │  │  Radar  │  │  Lidar  │
   │Raw Image│  │Raw Points│ │Raw Cloud│
   └────┬────┘  └────┬────┘  └────┬────┘
        │           │            │
        └───────────┼────────────┘
                    ▼
           ┌───────────────┐
           │  Joint        │  Combine raw data
           │  Processing   │  before detection
           └───────────────┘

   Pros: Maximum information preservation
   Cons: Requires synchronized, calibrated sensors
         High computational cost

2. LATE FUSION (Object Level)
   ┌─────────┐  ┌─────────┐  ┌─────────┐
   │ Camera  │  │  Radar  │  │  Lidar  │
   │Detection│  │Detection│  │Detection│
   └────┬────┘  └────┬────┘  └────┬────┘
        │           │            │
   [Objects]   [Objects]    [Objects]
        │           │            │
        └───────────┼────────────┘
                    ▼
           ┌───────────────┐
           │    Object     │  Merge detected
           │    Fusion     │  objects only
           └───────────────┘

   Pros: Independent processing pipelines
         Easier to add/remove sensors
   Cons: Information loss before fusion
         Inconsistent detections harder to resolve

3. MID-LEVEL FUSION (Feature Level) - Most Common
   ┌─────────┐  ┌─────────┐  ┌─────────┐
   │ Camera  │  │  Radar  │  │  Lidar  │
   │Features │  │Features │  │Features │
   └────┬────┘  └────┬────┘  └────┬────┘
        │           │            │
   [BEV Grid]  [BEV Grid]   [BEV Grid]
        │           │            │
        └───────────┼────────────┘
                    ▼
           ┌───────────────┐
           │ Feature Fusion│  Neural network
           │    Network    │  combines features
           └───────────────┘

   Pros: Good balance of info and efficiency
   Cons: Requires careful feature engineering

┌─────────────────────────────────────────────────────────────────────┐
│                    ADAS SOFTWARE STACK                               │
├─────────────────────────────────────────────────────────────────────┤
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │                    APPLICATION LAYER                            │ │
│ │  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐           │ │
│ │  │   AEB    │ │   ACC    │ │   LKA    │ │   TJA    │  ADAS     │ │
│ │  │(ASIL D) │ │(ASIL B) │ │(ASIL B) │ │(ASIL B) │  Functions│ │
│ │  └──────────┘ └──────────┘ └──────────┘ └──────────┘           │ │
│ └─────────────────────────────────────────────────────────────────┘ │
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │                    PLANNING & DECISION                          │ │
│ │  ┌──────────────────┐ ┌──────────────────┐                      │ │
│ │  │  Path Planning   │ │ Motion Planning   │                      │ │
│ │  └──────────────────┘ └──────────────────┘                      │ │
│ └─────────────────────────────────────────────────────────────────┘ │
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │                    PERCEPTION LAYER                             │ │
│ │  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐           │ │
│ │  │ Object   │ │  Lane    │ │Free Space│ │ Traffic  │           │ │
│ │  │Detection │ │Detection │ │Detection │ │  Sign    │           │ │
│ │  └──────────┘ └──────────┘ └──────────┘ └──────────┘           │ │
│ │  ┌───────────────────────────────────────────────────┐         │ │
│ │  │              Sensor Fusion                        │         │ │
│ │  └───────────────────────────────────────────────────┘         │ │
│ └─────────────────────────────────────────────────────────────────┘ │
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │                    SENSOR INTERFACE                             │ │
│ │  ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐        │ │
│ │  │Camera  │ │ Radar  │ │ Lidar  │ │  USS   │ │  IMU   │        │ │
│ │  │ ISP    │ │Process │ │Process │ │Process │ │Process │        │ │
│ │  └────────┘ └────────┘ └────────┘ └────────┘ └────────┘        │ │
│ └─────────────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────────┘

/* AEB System Requirements */

Detection Requirements:
├── Primary: Forward-facing 77 GHz radar (>200m range)
├── Secondary: Forward camera with DNN object detection
├── Fusion: Track-to-track with confidence scoring
└── Redundancy: Independent channels for decomposition

Timing Requirements:
├── Sensor-to-decision latency: <100ms typical, <150ms worst-case
├── Decision-to-actuation latency: <50ms
├── End-to-end (detection to braking): <200ms
└── Cycle time: 10-20ms for perception, 5-10ms for actuation

Safety Mechanisms:
├── Dual-channel plausibility checking
├── Sensor self-test (functional degradation detection)
├── Actuator monitoring (brake pressure feedback)
├── Driver override capability (pedal input priority)
└── Graceful degradation to warning-only mode

/* AEB Activation Thresholds (Euro NCAP 2024) */
┌─────────────────────────────────────────────────────────────────────┐
│ Scenario            │ Speed   │ TTC Threshold │ Decel Rate         │
├─────────────────────────────────────────────────────────────────────┤
│ Car-to-Car Rear     │ 80 km/h │ 1.6 seconds   │ 0.6g (partial)     │
│ Car-to-Pedestrian   │ 60 km/h │ 2.0 seconds   │ 0.6g (full stop)   │
│ Car-to-Cyclist      │ 60 km/h │ 2.0 seconds   │ 0.6g (full stop)   │
│ Junction (CPNC)     │ 60 km/h │ 1.5 seconds   │ 0.6g               │
│ Intersection (ATA)  │ 50 km/h │ Variable      │ 0.8g (emergency)   │
└─────────────────────────────────────────────────────────────────────┘

/* ACC Control Architecture */

┌─────────────────────────────────────────────────────────────────────┐
│                         ACC STATE MACHINE                            │
├─────────────────────────────────────────────────────────────────────┤
│                                                                       │
│    ┌──────────┐    Set Speed    ┌──────────────┐                    │
│    │   OFF    │ ───────────────►│    ACTIVE    │                    │
│    └──────────┘                 └───────┬──────┘                    │
│         ▲                               │                            │
│         │                    ┌──────────┴──────────┐                │
│         │                    ▼                     ▼                │
│    Cancel/            ┌──────────────┐    ┌──────────────┐          │
│    Brake              │  Speed Mode  │    │ Follow Mode  │          │
│         │             │(No target)   │    │(Target ahead)│          │
│         │             └──────────────┘    └──────────────┘          │
│         │                    │                     │                │
│         │                    └──────────┬──────────┘                │
│         │                               ▼                            │
│         │                    ┌──────────────┐                        │
│         │                    │   OVERRIDE   │                        │
│         └────────────────────┤ (Accel/Brake)│                        │
│                              └──────────────┘                        │
└─────────────────────────────────────────────────────────────────────┘

Control Algorithm Components:
├── Target Detection: Radar-based lead vehicle identification
├── Target Selection: Nearest in-lane vehicle with heading filter
├── Gap Control: Time-gap based distance regulation (1.0-2.5 seconds)
├── Speed Control: PI controller for setspeed tracking
├── Transition: Smooth handoff between speed and follow modes
└── Actuator Interface: Throttle/brake request generation

Performance Specifications:
├── Detection Range: 0-150m (primary radar)
├── Maximum Deceleration: 0.3g (comfort), 0.5g (pre-collision)
├── Maximum Acceleration: 0.2g (eco), 0.3g (normal), 0.4g (sport)
├── Speed Range: 30-180 km/h (highway), 0-60 km/h (stop-and-go)
└── Lateral Offset Tolerance: ±0.5m for target association

/* Lane Detection Pipeline */

Camera Input (1920x1080 @ 30fps)
        │
        ▼
┌───────────────────┐
│  Perspective      │  Remove perspective distortion
│  Transform (IPM)  │  Birds-eye view generation
└─────────┬─────────┘
          │
          ▼
┌───────────────────┐
│  Lane Feature     │  CNN/Transformer backbone
│  Extraction       │  (ResNet-18 or EfficientNet-B0)
└─────────┬─────────┘
          │
          ▼
┌───────────────────┐
│  Lane Line        │  Polynomial curve fitting
│  Fitting          │  (3rd order: y = ax³ + bx² + cx + d)
└─────────┬─────────┘
          │
          ▼
┌───────────────────┐
│  Temporal         │  Kalman filter for smooth tracking
│  Filtering        │  Handle occlusions/shadows
└─────────┬─────────┘
          │
          ▼
┌───────────────────┐
│  Lateral Offset   │  Calculate vehicle position relative
│  Calculation      │  to lane center (meters)
└───────────────────┘

LKA Intervention Logic:
├── Warning Zone: Lateral offset > 0.3m, haptic feedback
├── Assist Zone: Lateral offset > 0.5m, steering torque applied
├── Emergency Zone: Lateral offset > 0.7m, increased torque
├── Override: Driver steering input > 3Nm disables assist
└── Deactivation: No lane markings detected for > 3 seconds

/* V2X Communication Types */

V2V (Vehicle-to-Vehicle):
├── Collision Warning: Share position, speed, heading, acceleration
├── Emergency Vehicle Alert: Ambulance/fire truck approaching
├── Queue Warning: Sudden braking propagation down traffic queue
└── Intersection Movement Assist: Blind corner/left turn assist

V2I (Vehicle-to-Infrastructure):
├── Traffic Signal Timing: GLOSA (Green Light Optimal Speed Advisory)
├── Road Condition Warning: Ice, fog, construction zones
├── Speed Limit Information: Dynamic speed limits
└── Toll/Parking Integration: Automated payment systems

V2P (Vehicle-to-Pedestrian):
├── Crosswalk Detection: Pedestrian smartphone notification
├── Vulnerable Road User Warning: Cyclists, scooters
└── School Zone Alert: Enhanced awareness near schools

V2N (Vehicle-to-Network):
├── Traffic Information: Real-time traffic flow data
├── HD Map Updates: Fresh road geometry and landmarks
├── Remote Diagnostics: Vehicle health monitoring
└── OTA Orchestration: Update scheduling and download

/* V2X Technology Comparison */
┌──────────────────────────────────────────────────────────────────────┐
│ Technology    │ Latency  │ Range    │ Requires Infra │ Standard      │
├──────────────────────────────────────────────────────────────────────┤
│ DSRC/ITS-G5   │ <50ms   │ 300-500m │ Yes (RSU)      │ IEEE 802.11p  │
│ C-V2X (LTE)   │ <100ms  │ 400-700m │ Optional       │ 3GPP Rel. 14  │
│ C-V2X (5G NR) │ <10ms   │ 500m+    │ Optional       │ 3GPP Rel. 16+ │
└──────────────────────────────────────────────────────────────────────┘