Multi-tier architecture functional safety monitoring system for complex software systems

Abstract

The application discloses a kind of multi-layer architecture function safety monitoring systems of complex software system, including system operation monitor, state management and switching module, standby state management and switching module, virtual watchdog, global time scheduling state supervision module;System operation monitor includes state supervision module, state switching self-checking module, fault handling measure module, watchdog management module;System operation monitor is used to monitor the fault of application layer software, middle layer software, operating system, and external virtual watchdog is designed to supervise it, and global time scheduling state supervision module is used to supervise global time scheduling service.This application provides a variety of fault determination methods by global supervision state combination, which is beneficial to flexible supervision according to service and configuration of a variety of processing measures;Fault hierarchical monitoring and processing ensure self-recovery in the case of single function software or middle layer software failure without affecting the normal operation of other software.

Description

TECHNICAL FIELD

[0001] The present application relates to a functional safety monitoring mechanism of a software system, in particular to a multi-layer architecture functional safety monitoring system of a complex software system. BACKGROUND

[0002] With the increasing popularity of intelligent driving, intelligent cockpit functions and SOA architecture, automotive electronic and electrical systems (EE systems) have become increasingly complex, covering key areas such as power control, chassis management and autonomous driving.

[0003] Under the trend of multi-domain integration, high-performance central computing platforms (HPC) become the key to achieving this goal. HPC uses one or more powerful processors or processor clusters to deploy multiple operating systems according to different application requirements and functional safety levels. This allows various functional modules to run in parallel in different operating systems, greatly improving resource utilization and system adaptability.

[0004] Any failure of these systems can pose a direct threat to the safety of passengers. Today, the automotive industry is undergoing a major shift from hardware dominance to software-driven, which not only enhances the flexibility of functions and user experience, but also has higher requirements for the safety and reliability of software.

[0005] However, the existing functional safety monitoring mechanism based on AUTOSAR or other similar frameworks can only achieve partial self-recovery when handling application layer software failures. For problems in the middle layer monitoring and state management switching module, the current solution is to restart, which may cause poor user experience in the HPC environment. In addition, in the design of cross-domain and cross-system architecture, most of the current market solutions are limited to reporting fault information of a single domain or system, and there is no effective cross-domain system monitoring strategy. SUMMARY

[0006] To solve the problems in the prior art, the present application provides a multi-layer architecture functional safety monitoring system of a complex software system.

[0007] To achieve the purpose of the present application, the technical solution adopted by the present application is:

[0008] A multi-layer architecture functional safety monitoring system of a complex software system, comprising a system running monitor, a state management and switching module, a backup state management and switching module, a virtual watchdog, and a global time scheduling state supervision module; the system running monitor, the state management and switching module, and the backup state management and switching module are deployed on an A core, the virtual watchdog is deployed on an M core / R core, and the global time scheduling state supervision module is deployed in the system running monitor of the A core or in the M core / R core.

[0009] The system operation monitor comprises a state supervision module, a state switching self-checking module, a fault handling measure module, a watchdog management module, and a global time scheduling state supervision module; the system operation monitor is used to monitor faults of application layer software, intermediate layer software, and an operating system, and an external virtual watchdog is designed to supervise the same, the virtual watchdog cooperates with the watchdog management module and is used to restart the system; the global time scheduling state supervision module is used to supervise global time scheduling services.

[0010] Further, in a single operating system (OS) architecture, the watchdog management module in the system monitoring manager is associated with a virtual watchdog deployed in an external MCU or an independent security island (FSI), and under normal circumstances, the watchdog is fed within a specified time window, and under abnormal circumstances, the watchdog is stopped or fed incorrectly, and the SOC chip is restarted by the virtual watchdog deployed in the external MCU or the FSI.

[0011] Further, in a multi-operating system (OS) based on Hypervisor, the watchdog management module in the system monitoring manager is associated with a software virtual watchdog in the Hypervisor, and under normal circumstances, the watchdog is fed within a specified time window, and under abnormal circumstances, the watchdog is stopped or fed incorrectly, and the corresponding virtual machine (VM) is restarted by the virtual watchdog in the Hypervisor.

[0012] The watchdog management module in the Hypervisor is associated with a virtual watchdog deployed in an external MCU or an independent security island (FSI), and under normal circumstances, the watchdog is fed within a specified time window, and under abnormal circumstances, the watchdog is stopped or fed incorrectly, and the SOC chip is restarted by the virtual watchdog deployed in the external MCU or the FSI.

[0013] Further, the global time scheduling state supervision module is used to supervise global time scheduling services, set the global time and execution duration of the corresponding task to be scheduled and pulled up, and compare with the scheduling table set by the user, and if a single task execution is timed out or the pull-up sequence is incorrect, the corresponding fault is output.

[0014] Further, the state supervision module is flexibly configured and combined into global supervision to supervise the running state of the application layer and intermediate layer software, the basic supervision includes survival supervision, timeout supervision, and logic supervision, and the global supervision combination includes: single basic supervision combination: a single basic supervision is directly defined as a global supervision; multi-basic supervision combination: a global supervision is composed of two or more basic supervisions.

[0015] Further, the state switching self-checking module periodically sends test signals to the state management and switching module by simulating fault signals, and the specific steps are as follows:

[0016] Setting self-check mode period: set a period, timing trigger self-check mechanism;

[0017] Simulated fault signal: in self-check mode, the system generates a simulated fault signal and sends it to the state management and switching module;

[0018] Verify response time: monitor the state management and switching module's response to the simulated fault signal received, ensure that it can correctly issue switching instructions within the set time range, if no correct feedback is received within the set time, it is considered that the state switching path has a fault.

[0019] Further, the causes of failure include state management and switching module itself failure, or IPC communication failure between system running monitor and state management and switching module;

[0020] After the system running monitor detects that the self-check of the state management and switching module has a fault, switch to the backup state management and switching module; the IPC communication between the system running monitor and the state management and switching module adopts IPC master and backup channels to form the redundancy of IPC communication, and automatically switches to the backup IPC channel when the IPC master channel fails.

[0021] Further, the fault handling measure module includes application layer and intermediate layer fault handling measures, state switching self-check failure handling measures, operating system OS fault handling measures, Hypervisor fault handling measures, and global time scheduling state supervision fault handling measures.

[0022] Further, the application layer and intermediate layer fault handling measures switch the running state of the corresponding software components and notify the application layer, and the two measures occur in parallel without priority; according to different business and function safety targets, the state of switching is configured, including switching to another backup function group to enable, or configuring the faulty software component to switch to off and then pull up for fault self-recovery.

[0023] Further, the state switching self-check failure handling measures include two-step measures, the first step is to switch to a backup state management and switching module and switch to a backup IPC mode, and then perform self-check again, if the self-check passes, it will not enter the second step; if the self-check fails again, it will enter the second step, stop the watchdog feeding, and restart the system through the external watchdog.

[0024] The application has the advantages that, compared with the prior art, the Autosar scheme commonly used in the current automobile controller provides a combined manner, but as long as one of the basic supervision in the combination fails, it will be judged as a failure, the global supervision state combination designed in the application provides more diverse failure judgment manners, is beneficial to flexible supervision according to business, and configures diverse processing measures. Compared with the common scheme at present, which only supervises the software execution state of a single controller, the global time scheduling state supervision realized by the application can realize cross-domain software execution timing and execution logic monitoring.

[0025] The hierarchical monitoring and processing manner of the failure guarantees self-recovery in the case of single function software or intermediate layer software failure and does not affect the normal operation of other function software. In the case of failure of a virtual machine VM based on the Hypervisor multi-operating system architecture, a single virtual machine VM can be restarted alone without affecting other virtual machines VM. Only when the operating system and the Hypervisor are seriously failed and cannot be self-recovered, the whole system is restarted. Compared with the software failure supervision scheme on the market at present, most of the failure processing measures are system restart, and the multi-level supervision and processing measures of the application can improve the availability of the product on the basis of meeting the functional safety requirements.

[0026] The application can monitor software module failure and cover the requirements of different ASIL levels for processing units and clock hardware failure through the configurable virtual watchdog and watchdog management module. In the HPC, the virtual watchdog is deployed in the MCU outside the SOC or the independent safety island FSI, which can meet the independence requirement of functional safety. Compared with the virtual watchdog of the common scheme on the market at present, which usually only monitors the software module, if the failure coverage of the hardware components, especially the ASIL D hardware failure coverage, is usually realized by the hardware watchdog, the application has the advantage of saving hardware cost. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 is a schematic diagram of a multi-layer architecture functional safety monitoring system of a complex software system described in the application;

[0028] Figure 2 is a global supervision concept diagram;

[0029] Figure 3 is a single operating system architecture diagram;

[0030] Figure 4 is a multi-operating system architecture diagram based on Hypervisor;

[0031] Figure 5 is a whole vehicle architecture diagram based on a central computing unit HPC;

[0032] Figure 6 is an application layer fault handling measure flow chart;

[0033] Figure 7 is a state switching self-checking failure handling measure flow chart;

[0034] Figure 8 is an operating system OS fault handling measure flow chart. DETAILED DESCRIPTION

[0035] The technical solutions of the present application will be further described below in combination with the drawings and examples. The following examples are only used to more clearly illustrate the technical solutions of the present application, and cannot be used to limit the protection scope of the present application.

[0036] As shown in Figure 1 The multi-layer architecture function safety monitoring system of the complex software system described in the present application comprises a system running monitor, a state management and switching module, a backup state management and switching module, a virtual watchdog, and a global time scheduling state supervision module.

[0037] The software fault and cross-domain scheduling software execution fault under the complex operating system architecture running on the high-performance processor chip are monitored, including: monitoring the timing and logic errors of the application layer software running; monitoring the intermediate layer software service fault; self-checking of the state management and switching module; monitoring the operating system fault affecting the application layer software running; monitoring the fault of the Hypervisor (virtual machine monitor); and monitoring the execution time and logic of the cross-domain scheduling software.

[0038] The system running monitor, the state management and switching module, and the backup state management and switching module are deployed on the A core, the virtual watchdog is deployed on the M core / R core, the A core is a SOC, and the M core / R core is a ZCU / MCU. The global time scheduling supervision is deployed in the system running monitor in the A core, or can be deployed in the M core / R core.

[0039] The system running monitor comprises a state supervision module, a state switching self-checking module, a fault handling measure module, a watchdog management module, and a global time scheduling state supervision module. The system running monitor is used to monitor the faults of the A core application layer software, the intermediate layer software, and the operating system OS. The system running monitor is the main supervision module of the A core, and an external virtual watchdog is designed to supervise it (it can also be realized by a hardware watchdog) to avoid common cause failure.

[0040] The virtual watchdog is mainly used for cooperating with the watchdog management module to not make action when the correct "feed dog" signal is received at the correct time, and sending a trigger restart signal for restarting the virtual machine VM or SOC chip when the correct "feed dog" signal is not received at the correct time. The virtual watchdog can be configured into three forms of watchdogs: a timing watchdog, a window watchdog and a response watchdog, so as to cope with different functional safety levels. The timing watchdog can meet the requirement of ASIL A, the window watchdog can meet the requirement of ASIL B, and the response watchdog can meet the requirement of ASIL C / D. The virtual watchdog can be deployed in an external MCU, an independent safety island FSI or a Hypervisor.

[0041] The multi-layer architecture functional safety monitoring system of the complex software system disclosed by the application can adapt to fault monitoring of different software architectures of a single operating system OS and a multi-operating system OS based on a Hypervisor.

[0042] As shown in Figure 3 , in the architecture form of a single operating system OS, the watchdog management module in the system monitoring manager is associated with the virtual watchdog deployed in an external MCU or an independent safety island FSI. In a normal case, the dog is fed within a specified time window, and in an abnormal case, the dog is stopped or fed incorrectly, and the virtual watchdog deployed in the external MCU or the FSI triggers the restart of the SOC chip.

[0043] As shown in Figure 4 , in the architecture form of a multi-operating system OS based on a Hypervisor, the watchdog management module in the system monitoring manager is associated with the software virtual watchdog in the Hypervisor, and in a normal case, the dog is fed within a specified time window, and in an abnormal case, the dog is stopped or fed incorrectly, and the virtual watchdog in the Hypervisor triggers the restart of the corresponding virtual machine VM. The watchdog management module in the Hypervisor is associated with the virtual watchdog deployed in an external MCU or an independent safety island FSI. In a normal case, the dog is fed within a specified time window, and in an abnormal case, the dog is stopped or fed incorrectly, and the virtual watchdog deployed in the external MCU or the FSI triggers the restart of the SOC chip.

[0044] Figure 4 The number of ZCUs and virtual machines VMs is only illustrative, and different numbers of ZCUs and virtual machines VMs can be used according to different vehicle architectures.

[0045] As shown in Figure 5As shown, it is a typical whole vehicle architecture based on central computing unit HPC. The main business software is deployed on the A core of HPC, but the implementation of whole vehicle function may need the cooperation of HPC-ZCU, for example: ZCU1 collects data and processes -> HPC A core performs business software algorithm processing -> ZCU2 controls output. The whole vehicle function is implemented by the cooperation of A core and M / R core, and there is a timing logic requirement between the software running on each core.

[0046] The global time scheduling state supervision module is designed to supervise the global time scheduling business. The global time and execution time length of the corresponding task can be set and compared with the user-set schedule table. If the single task execution is overtime or the pull-up sequence is incorrect, the corresponding fault is output.

[0047] The system operation monitor includes a state supervision module, a state switching self-checking module, a fault handling measure module, a watchdog management module, and a global time scheduling state supervision module.

[0048] The state supervision module can be flexibly configured and combined into global supervision to supervise the running state of the application layer and the intermediate layer software.

[0049] As shown in Figure 2 The survival supervision, timeout supervision, and logic supervision can all be single basic supervision units. The application software and the intermediate layer software can be supervised by survival supervision, timeout supervision, or logic supervision to achieve the monitoring purpose. The state supervision module determines the state of the single basic supervision according to the checkpoint state of the single basic supervision and the running state of the process where the basic supervision is located.

[0050] When the punched process is not activated, the basic supervision is in the "not activated" state, no fault is detected in the "normal" state, and the fault is detected in the "faulty" state.

[0051] Under the software architecture of HPC controller, multiple function groups under the traditional automobile ECU architecture can exist at the same time. The basic supervision faults set in the function group may correspond to different failure modes, or multiple basic supervision faults may map to the same failure mode. Therefore, a mechanism is needed to combine different basic supervisions to derive the global supervision state according to their states.

[0052] The state supervision determines the global supervision state according to the basic supervision state and the state of the process where it is located. Each function group can have multiple global supervisions at the same time.

[0053] Global supervision combination rules:

[0054] Single basic supervision combination: a single basic supervision can be directly defined as a global supervision.

[0055] Multi-Base Supervision Combination: When a global supervision is composed of two or more base supervisions, the following two logical patterns can be used to determine the status of the global supervision:

[0056] "AND" Pattern: The global supervision status is "Faulty" only when all base supervisions within it are in the "Faulty" state.

[0057] Example: If the global supervision includes base supervisions A, B, and C, it will only be marked as "Faulty" if A, B, and C all fail.

[0058] "OR" Pattern: The global supervision status is "Faulty" as long as any one of the base supervisions within it is in the "Faulty" state.

[0059] Example: If the global supervision includes base supervisions A, B, and C, it will be marked as "Faulty" as long as any one of A, B, or C fails.

[0060] Detecting a failure without timely switching the state is a multiple point failure (first a failure occurs, and the state fails to switch). Therefore, a state switching self-check module is designed to cover the latent failures of state switching failure.

[0061] The state switching self-check module periodically sends test signals to the state management and switching module by simulating fault signals. This process aims to verify whether the state management and switching module can accurately respond and issue corresponding switching instructions within a predetermined time. The specific steps are as follows:

[0062] 1. Set the self-check mode period: Set a period to trigger the self-check mechanism regularly.

[0063] 2. Simulate fault signals: In self-check mode, the system will generate simulated fault signals and send them to the state management and switching module.

[0064] 3. Verify response time: Monitor the response of the state management and switching module to the received simulated fault signals to ensure that it can correctly issue switching instructions within the set time range. If no correct feedback is received within the set time, it is considered that the state switching path has failed.

[0065] The cause of the failure can be a failure of the state management and switching module itself, or a failure of IPC communication between the system operation monitor and the state management and switching module. After the system operation monitor detects a failure in the self-checking of the state management and switching module, the system operation monitor switches to a backup state management and switching module. The IPC communication between the system operation monitor and the state management and switching module adopts two different forms of communication to form the redundancy of the IPC communication. The IPC communication between the system operation monitor and the state management and switching module is a secure key channel, and the main and backup channels of the IPC are automatically switched to the backup channel of the IPC when the main channel fails.

[0066] The watchdog management module is mainly used for feeding the watchdog at a specified time. The virtual watchdog can be matched to three types of watchdog feeding forms: a timer type watchdog, a window type watchdog, and a response type watchdog. The watchdog management module can be deployed in the A-core system operation monitor or the Hypervisor.

[0067] The operating system OS is the basis for the running of application programs. Instead of directly restarting the operating system OS, the operating system failure can be classified and processed to improve product usability. The user state service classifies and processes the operating system OS failure. The operating system kernel restarts the service process. The system key process crashes or locks. The watchdog management module of the system operation monitor is notified. The external watchdog is triggered by the watchdog management module to reset.

[0068] In products with a Hypervisor, the watchdog management module is deployed. The watchdog management module periodically sends a "feed dog" signal to an external virtual watchdog. The Hypervisor key process is bound to the watchdog management module. When a deadlock, resource depletion, or other failure occurs, the external virtual watchdog is triggered to reset by the abnormal "feed dog" signal to restart the SOC chip and the Hypervisor.

[0069] The failure handling measure module can configure different failure handling measures according to different business scenarios and functional safety targets. The failure handling measures include switching the function group state, notifying the application layer (the application layer designs an alarm and other safety measures), and notifying the watchdog to reset.

[0070] As shown in Figure 6 The application layer and the intermediate layer failure handling measures are switching the running state of the corresponding software component and notifying the application layer. The two measures occur in parallel and have no priority. The switched state can be configured according to different businesses and functional safety targets. The switched state includes switching to another backup function group to enable, or can be configured to switch the failed software component to off and then pull it up for failure self-recovery.

[0071] As shown in Figure 7As shown, the state switching self-checking failure processing measure is divided into two steps, the first step is to switch to the standby state management and switching module and switch to the standby IPC mode, and then perform self-checking again, if the self-checking is passed, the second step will not be entered; if the self-checking is not passed again, the second step is entered, the watchdog is stopped, and the system is restarted through the external watchdog.

[0072] As shown in the figure, the operating system OS failure processing measure is classified and processed, the user state service is restarted by the operating system kernel, the system key process crashes or locks, the watchdog management of the system running monitor is notified, and the external watchdog is triggered to reset by the watchdog management. Figure 8

[0073] The Hypervisor failure processing measure is deployed in products with Hypervisor, the watchdog management module is regularly sent to the external virtual watchdog, the Hypervisor key process is bound to the watchdog management, when the deadlock, resource depletion and other failures occur, the external virtual watchdog is triggered to reset by the abnormal "dog feeding" signal, and the SOC chip and Hypervisor are restarted.

[0074] The global time scheduling state supervision failure processing measure notifies the state management and switching module to switch the software component state, notifies the application layer software, and simultaneously re-performs global time synchronization, if the synchronization cannot be restored, the safe software state switched to is maintained.

[0075] The application has the advantages that, compared with the prior art, the Autosar scheme commonly used in the current automobile controller provides a combined mode, but as long as one of the basic supervision in the combination has a fault, it will be judged as a fault, the global supervision state combination designed in the application provides more diverse fault judgment modes, is beneficial to flexible supervision according to business, and configures diverse processing measures.

[0076] ​The hierarchical monitoring and processing mode of faults guarantees self-recovery in the case of single function software or intermediate layer software failure and does not affect the normal operation of other function software. In the case of failure of a certain virtual machine VM based on the Hypervisor multi-operating system architecture, a single virtual machine VM can be restarted alone without affecting other virtual machines VM. Only in the case of serious failure of the operating system and Hypervisor that cannot be self-recovered, the entire system is restarted. Compared with the software failure supervision scheme on the market at present, most of the failure processing measures are to restart the system. The multi-level supervision and processing measures of the present application can improve the availability of the product on the basis of meeting the functional safety requirements.

[0077] The present application can monitor software module failure and cover the requirements of different ASIL levels for processing units and clock hardware failure through the configurable virtual watchdog and watchdog management module. In the HPC, the virtual watchdog deployed in the MCU outside the SOC or the independent safety island FSI can meet the independence requirement of functional safety. Compared with the virtual watchdog of the common scheme on the market at present, which is usually only for software module monitoring, if the failure coverage of hardware components, especially the hardware failure coverage of ASIL D, is usually realized by a hardware watchdog, the present application has the advantage of saving hardware cost.

[0078] The applicant of the present application has made a detailed description and explanation of the embodiments of the present application in combination with the drawings of the specification. However, those skilled in the art should understand that the above embodiments are only preferred embodiments of the present application, and the detailed description is only to help the reader better understand the spirit of the present application, and is not a limitation on the protection scope of the present application. On the contrary, any improvement or modification based on the spirit of the present application should fall within the protection scope of the present application.

Claims

1. A multi-tiered architecture functional safety monitoring system for a complex software system, characterized by, The system comprises a system running monitor, a state management and switching module, a backup state management and switching module, a virtual watchdog, and a global time scheduling state supervision module; the system running monitor, the state management and switching module, and the backup state management and switching module are arranged on the A core, the virtual watchdog is arranged on the M core / R core, and the global time scheduling state supervision module is arranged in the system running monitor of the A core or in the M core / R core; The global time scheduling state supervision module is used for supervising the global time scheduling service, setting the global time and execution time length of the scheduled task, and comparing with the scheduling table set by the user, and outputting the corresponding fault if the single task execution is overtime or the pull-up sequence is incorrect; The system running monitor comprises a state supervision module, a state switching self-checking module, a fault handling measure module, a watchdog management module, and a global time scheduling state supervision module; the system running monitor is used for monitoring the faults of the application layer software, the intermediate layer software, and the operating system, and an external virtual watchdog is designed to supervise the system running monitor; the virtual watchdog cooperates with the watchdog management module and is used for restarting the system; and the global time scheduling state supervision module is used for supervising the global time scheduling service. The state supervision module is flexibly configured and combined into the global supervision by the basic supervision to supervise the running state of the application layer software and the intermediate layer software. The state switching self-checking module periodically sends test signals to the state management and switching module by simulating fault signals. The fault handling measure module comprises application layer and intermediate layer fault handling measures, state switching self-checking failure handling measures, operating system (OS) fault handling measures, Hypervisor fault handling measures, and global time scheduling state supervision fault handling measures.

2. The multi-tier architecture functional safety monitoring system of complex software systems according to claim 1, characterized in that, In the single operating system (OS) architecture, the watchdog management module in the system monitoring manager is associated with the virtual watchdog arranged in the external MCU or the independent safety island (FSI), the watchdog is fed within a specified time window in a normal case, the watchdog is stopped or fed with errors in an abnormal case, and the SOC chip is restarted by the virtual watchdog arranged in the external MCU or the FSI.

3. The multi-tier architecture functional safety monitoring system of complex software system according to claim 1, wherein, In the multi-operating system (OS) based on the Hypervisor, the watchdog management module in the system monitoring manager is associated with the software virtual watchdog in the Hypervisor, the watchdog is fed within a specified time window in a normal case, the watchdog is stopped or fed with errors in an abnormal case, and the corresponding virtual machine (VM) is restarted by the virtual watchdog in the Hypervisor. The watchdog management module in the Hypervisor is associated with the virtual watchdog arranged in the external MCU or the independent safety island (FSI), the watchdog is fed within a specified time window in a normal case, the watchdog is stopped or fed with errors in an abnormal case, and the SOC chip is restarted by the virtual watchdog arranged in the external MCU or the FSI.

4. The multi-tier architecture functional safety monitoring system of complex software system according to claim 1, wherein, The basic supervision comprises survival supervision, timeout supervision, and logic supervision, and the global supervision combination comprises: single basic supervision combination: a single basic supervision is directly defined as a global supervision; and multi-basic supervision combination: a global supervision is composed of two or more basic supervisions.

5. The multi-tier architecture functional safety monitoring system of complex software system according to claim 1, wherein, The state switching self-checking module periodically sends test signals to the state management and switching module through simulated fault signals. The specific steps are as follows: Setting the self-checking mode period: set a period to trigger the self-checking mechanism at regular intervals; Simulating fault signals: in the self-checking mode, the system generates simulated fault signals and sends them to the state management and switching module; Verify response time: monitor the response of the state management and switching module to the received simulated fault signals to ensure that it can correctly issue switching instructions within the set time range. If no correct feedback is received within the set time, it is considered that the state switching path has failed.

6. The multi-tier architecture functional safety monitoring system of a complex software system according to claim 5, wherein, The causes of the fault include the failure of the state management and switching module itself or the IPC communication failure between the system operation monitor and the state management and switching module; After the system operation monitor detects that the self-checking of the state management and switching module has failed, it switches to the backup state management and switching module. The IPC communication between the system operation monitor and the state management and switching module uses IPC master and backup channels to form the redundancy of IPC communication. When the IPC master channel fails, it automatically switches to the backup IPC channel.

7. The multi-tier architecture functional safety monitoring system of complex software system according to claim 1, wherein, Application layer and intermediate layer fault handling measures, switching the corresponding software component running state and notifying the application layer, the two measures occur in parallel, no priority; according to different business and function safety target configuration switch state, including switching to another standby function group enabled, or configure the faulty software component to switch to off and then pull up for fault self-recovery.

8. The multi-tier architecture functional safety monitoring system of complex software system according to claim 1, wherein, State switching self-checking failure handling measures, two-step measures, the first step switches to the backup state management and switching module & switches to the backup IPC mode, and performs self-checking again. If the self-checking is passed, it will not enter the second step; if the self-checking fails again, it will enter the second step, stop the watchdog feeding, and restart the system through the external watchdog.

Images