- Generated by
1.18.0
|
Safe API Framework
Layered API framework for safety-related applications (ERTMS RBC reference targeting CENELEC EN 50128 SIL 4)
|
| docs | |
| architecture | |
| diagrams | |
| include | |
| safeapi | |
| app | |
| appmanager | |
| sapi_appmanager.h | Application Manager abstraction for safeAPIFramework applications |
| oal | |
| clocksync | |
| sapi_clocksync.h | Pluggable wall-clock synchronization backend (ADR-017) |
| ipc | |
| sapi_ipc.h | OS Abstraction Layer - Inter-process/inter-task communication service |
| sapi_ipc_pubsub.h | IPC Publish-Subscribe Pattern (one-to-many broadcasting) |
| sapi_ipc_request_reply.h | IPC Request-Reply Pattern (RPC-style communication) |
| log | |
| sapi_log.h | OS Abstraction Layer - Logging/diagnostics service |
| memory | |
| sapi_mem_util.h | Thin, MISRA-visible wrappers over the three raw memory-block primitives (fill/copy/compare) every other safeAPIFreamwork or downstream-application module needs but has no business calling libc's <string.h> directly for - sapi_mem_set()/sapi_mem_copy()/ sapi_mem_compare() are the ONE sanctioned call site for each underlying libc function, so an audit for "does this codebase call libc string/memory functions directly" has exactly one file to check instead of grepping every translation unit for <string.h>. Deliberately NOT a "safe string library" (no strcpy/strcat/strlen-style variable-length text handling) - this framework and every application built on it work in fixed-size buffers throughout (CLAUDE.md: no malloc/free), so the only primitives actually needed are fixed-length block operations |
| sapi_memory.h | OS Abstraction Layer - Static memory reservation service |
| sapi_safe_ptr.h | Safe-pointer wrapper: bounds + NULL + corruption-canary checked access to a raw memory region, so callers never perform raw pointer arithmetic on a buffer directly |
| mutex | |
| sapi_mutex.h | OS Abstraction Layer - Mutual exclusion service |
| netlink | |
| sapi_netlink.h | OS Abstraction Layer - Point-to-point network link service |
| nvm | |
| sapi_nvm.h | OS Abstraction Layer - Non-Volatile Memory service |
| platform | |
| sapi_platform.h | OS Abstraction Layer - Real-time platform configuration service (ADR-035) |
| reboot | |
| sapi_reboot.h | OS Abstraction Layer - Controlled reboot service (ADR-004 section 3) |
| task | |
| sapi_task.h | OS Abstraction Layer - Task/thread scheduling service |
| timer | |
| sapi_timer.h | OS Abstraction Layer - Timer service |
| redundancy | |
| channel_link | |
| sapi_channel.h | A single redundant "channel": an opaque transport handle plus send/receive callbacks, with basic health bookkeeping |
| channel_service | |
| sapi_channel_service.h | Application-facing named channel service |
| checkpoint | |
| sapi_checkpoint.h | Bounded checkpoint rendezvous for distributed vital channels (ADR-017) |
| checksum | |
| sapi_checksum.h | Checksum and CRC utilities for data integrity in redundant systems |
| cross_comparator | |
| sapi_cross_comparator.h | Pairwise comparison between exactly 2 registered sapi_channel_t links (ADR-025) |
| dual | |
| sapi_dual_channel.h | "DualChannel" layer of ADR-020: wraps 1..N redundant sapi_dual_msgchannel_t links for fault-tolerant, always-send + bounded-ACK-wait delivery |
| sapi_dual_frames.h | Layer-2 (DualChannel-owned) frame kind/header definitions for ADR-020 - shared between sapi_dual_channel.h and sapi_dual_negotiator.h so both can refer to the same wire structs without either depending on the other (sapi_dual_channel_t has no knowledge of sapi_dual_negotiator_t at all; the negotiator is the one-directional dependent - see ADR-020 section 3 and this module's own README note on ownership direction) |
| sapi_dual_msgchannel.h | "Channel" layer of ADR-020: one EN 50159-defended message channel over one already-open sapi_netlink_handle_t |
| sapi_dual_negotiator.h | Dual state negotiator of ADR-020: decides sapi_dual_state_t for both this instance and its peer, driven over an attached sapi_dual_channel_t's STATE-frame flow |
| sapi_dual_types.h | Shared enums for the sapi_dual module (ADR-020): dual-instance state negotiation and the redundant, EN 50159-defended messaging channel it can run over |
| safechannel | |
| sapi_safechannel.h | Unified, transport-hiding channel factory (ADR-022) |
| voter | |
| sapi_voter.h | N-way voting across registered sapi_channel_t links (2oo2/2oo3/NMR) |
| watchdog | |
| sapi_watchdog.h | Watchdog mechanism for detecting system/task hang conditions |
| utils | |
| buffer | |
| sapi_buffer.h | Cross-layer data buffer abstraction (ADR-002) |
| cast | |
| sapi_cast.h | Checked integer casting between all fixed-width types and size_t (ADR-003). Every conversion in the codebase - narrowing, widening, or sign-changing - goes through one of these functions instead of a bare C-style cast |
| lifecycle | |
| sapi_lifecycle.h | Process-wide application setup-phase lock (ADR-026) |
| notify | |
| sapi_notify.h | Fixed-capacity registered-callback list shape (ADR-030) |
| safestate | |
| sapi_safestate.h | Safe-state transitions and checked assertions (ADR-004) |
| sapi_safety_violation.h | Opt-in notification hook for the three new safety primitives (safe pointer, checked integer arithmetic, bounds check): a SEPARATE, dedicated handler from sapi_safestate_handler_t (sapi_safestate.h) - registering it does not change any of those primitives' own return-code contract (REQ-COMMON-CAST-004/ 005, REQ-OAL-SAFEPTR-001/002) in any way; with no handler registered (the default), nothing about their behavior changes at all |
| status | |
| sapi_status.h | Common status/error codes returned by every Safe API Framework function. Shared across all OS Abstraction Layer (OAL) services |
| string | |
| sapi_string.h | Bounded, checked string manipulation (ADR-006). Replaces strcpy/strcat/sprintf/atoi/strtok-style unbounded operations with checked equivalents built on sapi_buffer_t |
| types | |
| sapi_types.h | Common fixed-width types and the caller-owned-storage handle pattern used by every OAL service (see ADR-001, section 3.4) |
| safeapi_backend | |
| clocksync | |
| sapi_clocksync_backend.h | OS-backend adaptation surface for Clock Synchronization (ADR-005, ADR-017, ADR-021) |
| ipc | |
| sapi_ipc_backend.h | OS-backend adaptation surface for the IPC service (ADR-005, ADR-021) |
| log | |
| sapi_log_backend.h | OS-backend adaptation surface for the Logging/diagnostics service (ADR-005, ADR-021) |
| memory | |
| sapi_memory_backend.h | OS-backend adaptation surface for the static memory pool service (ADR-005, ADR-021) |
| mutex | |
| sapi_mutex_backend.h | OS-backend adaptation surface for the Mutex service (ADR-033, ADR-021) |
| netlink | |
| sapi_netlink_backend.h | OS-backend adaptation surface for the Point-to-Point Network Link service (ADR-005, ADR-021) |
| nvm | |
| sapi_nvm_backend.h | OS-backend adaptation surface for the NVM service (ADR-005, ADR-021) |
| platform | |
| sapi_platform_backend.h | OS-backend adaptation surface for the Real-Time Platform Configuration service (ADR-035, ADR-005, ADR-021) |
| reboot | |
| sapi_reboot_backend.h | OS-backend adaptation surface for the Controlled Reboot service (ADR-004 section 3, ADR-005, ADR-021) |
| task | |
| sapi_task_backend.h | OS-backend adaptation surface for the Task/thread scheduling service (ADR-005, ADR-021) |
| timer | |
| sapi_timer_backend.h | OS-backend adaptation surface for the Timer service (ADR-005, ADR-021) |
| src | |
| app | |
| appmanager | |
| sapi_appmanager.c | Application Manager implementation |
| core | |
| sapi_core_version.c | See safeapi/core/sapi_core_version.h |
| oal | |
| clocksync | |
| sapi_clocksync.c | Implementation of the pluggable clock-sync backend (ADR-017) |
| ipc | |
| sapi_ipc.c | IPC service: validates parameters, then dispatches to the backend registered via sapi_ipc_register_backend() (ADR-005) |
| sapi_ipc_pubsub.c | IPC Publish-Subscribe implementation |
| sapi_ipc_request_reply.c | IPC Request-Reply implementation |
| log | |
| sapi_log.c | Logging service: dispatches to the backend registered via sapi_log_register_backend() (ADR-005). No backend registered is not an error for this service - see sapi_log.h |
| memory | |
| sapi_memory.c | Memory pool service: validates parameters, then dispatches to the backend registered via sapi_mem_pool_register_backend() (ADR-005) |
| sapi_safe_ptr.c | See sapi_safe_ptr.h for behavior |
| mutex | |
| sapi_mutex.c | Mutex service: validates parameters, then dispatches to the backend registered via sapi_mutex_register_backend() (ADR-033) |
| netlink | |
| sapi_netlink.c | Network link service: validates parameters, then dispatches to the backend registered via sapi_netlink_register_backend() (ADR-005). See sapi_ipc.c for the pattern this follows |
| nvm | |
| sapi_nvm.c | NVM service: validates parameters, then dispatches to the backend registered via sapi_nvm_register_backend() (ADR-005) |
| platform | |
| sapi_platform.c | Real-time platform configuration service: validates parameters, then dispatches to the backend registered via sapi_platform_register_backend() (ADR-005, ADR-035) |
| reboot | |
| sapi_reboot.c | Reboot service: dispatches to the backend registered via sapi_reboot_register_backend() (ADR-005) |
| task | |
| sapi_task.c | Task service: validates parameters, then dispatches to the backend registered via sapi_task_register_backend() (ADR-005) |
| timer | |
| sapi_timer.c | Timer service: validates parameters, then dispatches to the backend registered via sapi_timer_register_backend() (ADR-005) |
| redundancy | |
| channel_link | |
| sapi_channel.c | One redundant channel: validates parameters, then dispatches to its configured send/recv callbacks, tracking health as a side effect (ADR-025) |
| channel_service | |
| sapi_channel_service.c | Validation and dispatch for the named channel service |
| checkpoint | |
| sapi_checkpoint.c | Implementation of the bounded checkpoint rendezvous (ADR-017) |
| checksum | |
| sapi_checksum.c | CRC-64 implementation for data integrity checking |
| cross_comparator | |
| sapi_cross_comparator.c | Pairwise channel comparison (ADR-025): validates parameters, receives from both registered channels, and compares them |
| dual | |
| sapi_dual_channel.c | "DualChannel" layer of ADR-020 - see sapi_dual_channel.h |
| sapi_dual_msgchannel.c | "Channel" layer of ADR-020 - see sapi_dual_msgchannel.h |
| sapi_dual_negotiator.c | Dual state negotiator of ADR-020 - see sapi_dual_negotiator.h |
| sapi_dual_types.c | Diagnostics-only string rendering for the sapi_dual module's shared enums (ADR-020) |
| safechannel | |
| sapi_safechannel.c | Unified channel factory: opens netlink links internally, wraps sapi_dual_channel_t or a sapi_voter_t over N sapi_channel_t links (ADR-025) - see sapi_safechannel.h and ADR-022 |
| voter | |
| sapi_voter.c | N-way voting engine (ADR-025): validates parameters, dispatches send/receive to every registered healthy channel, and - for receive - groups the responses by mutual agreement and picks the largest group meeting quorum |
| watchdog | |
| sapi_watchdog.c | Real watchdog implementation: a fixed-size pool of watchdog slots, timed via the already-portable sapi_timer_now() OAL primitive rather than any new OS-specific timing code of its own (REQ-OAL-COMMON-010: no dynamic allocation) |
| utils | |
| buffer | |
| sapi_buffer.c | Implementation of the cross-layer data buffer abstraction (ADR-002) |
| cast | |
| sapi_cast.c | Generated from ADR-003's template; see sapi_cast.h for behavior. Every function widens its input to the int64_t/uint64_t matching the source's signedness, then range-checks against the destination's limit macros before performing the explicit cast |
| lifecycle | |
| sapi_lifecycle.c | Implementation of the process-wide application setup-phase lock - see sapi_lifecycle.h |
| safestate | |
| sapi_safestate.c | Implementation of the safe-state transition facility (ADR-004) |
| sapi_safety_violation.c | See sapi_safety_violation.h for behavior |
| status | |
| sapi_status.c | Implementation of sapi_status_to_string() |
| string | |
| sapi_string.c | Implementation of the bounded string module (ADR-006) |
1.18.0