sapi_checkpoint.h File Reference

Bounded checkpoint rendezvous for distributed vital channels (ADR-017). More...

#include <stdint.h>
#include "safeapi/utils/status/sapi_status.h"
#include "safeapi/utils/types/sapi_types.h"
#include "safeapi/redundancy/voter/sapi_voter.h"
#include "safeapi/redundancy/watchdog/sapi_watchdog.h"

Include dependency graph for sapi_checkpoint.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures
struct	sapi_checkpoint_config_t
	Checkpoint configuration. More...

Functions
sapi_status_t	sapi_channel_checkpoint (sapi_voter_t *voter, const sapi_checkpoint_config_t *config)
	Performs one bounded checkpoint rendezvous across every channel registered with a voter.

Detailed Description

Bounded checkpoint rendezvous for distributed vital channels (ADR-017).

Implements sapi_channel_checkpoint(), already specified (but never built) in docs/REDUNDANCY_ARCHITECTURE.md: a bounded-time rendezvous that lets channels running on separate machines - possibly in separate geographic locations - agree on "we are both at the same point" without depending on wall-clock agreement. Two channels are considered synchronized not because their clocks match, but because they both confirmed the same checkpoint_id to each other within max_delay_ms; if that confirmation doesn't happen in time, that is itself a fault and is handled exactly like a voting disagreement is elsewhere in this framework - safe-state, not silence.

This module adds no new transport backend of its own (ADR-017 section 2.2, updated by ADR-025): it reuses a sapi_voter_t's own registered sapi_channel_t links - each already carrying whatever transport an integrator plugged in (sapi_ipc over POSIX/RTOS, or a real network link) - so checkpoint messages travel over the same channels a disagreement vote already would. This is how "pluggable" is achieved here, consistent with ADR-005 rather than inventing a second plug-in point.

The EN 50159-style message envelope (sequence number, sender ID, timestamp, CRC-64) is not reinvented either: every checkpoint-arrival message is a sapi_vital_message_t (sapi_checksum.h), verified with sapi_checksum_vital_message_verify() before it is allowed to count toward quorum.

Definition in file sapi_checkpoint.h.