功能安全 软件安全机制设计

软件安全档案结构

依据ISO 26262-6（软件层面）与ISO 26262-2（安全管理），软件安全档案应包含以下核心章节。档案以结构化文本（YAML）存储，便于版本管理与自动校验。

软件安全档案模板（YAML）

以下模板覆盖上述章节，并预留ASIL相关字段。实际使用时，将asil_level替换为目标等级（A/B/C/D），并根据项目裁剪方法条目。

# software_safety_plan.yamlproject:  name: "EPS_Software"  safety_plan_version: "1.0"  asil_level: "D"          # 目标ASIL等级safety_goals:  - id: "SG-01"    description: "防止非预期转向助力丧失"    asil: "D"    source: "System_Level_Safety_Plan"lifecycle:  model: "V-Model"  phases:    - phase: "Software Requirements"      entry_criteria: ["System safety requirements frozen"]      exit_criteria: ["SWE.1 work products reviewed"]    - phase: "Software Architectural Design"      entry_criteria: ["SW requirements baselined"]      exit_criteria: ["SW architecture reviewed per ASIL"]    - phase: "Software Unit Design & Implementation"      entry_criteria: ["Architecture approved"]      exit_criteria: ["Units implemented & static analysis clean"]    - phase: "Software Integration & Test"      entry_criteria: ["Units verified"]      exit_criteria: ["Integration tests passed per ASIL"]requirements_traceability:  method: "bidirectional_matrix"  tools: ["DOORS", "Polarion"]development_methods:  asil_d:    - method: "formal_verification"      applies_to: "safety-critical control logic"    - method: "model_based_development"      applies_to: "plant model & controller"    - method: "defensive_implementation"      applies_to: "all safety-related code"  asil_b:   # 示例：低等级裁剪    - method: "walkthroughs"      applies_to: "non-critical modules"verification_strategy:  static_analysis:    tool: "Polyspace"    depth: "all_functions"    asil_d_required: true  unit_test:    coverage: ["statement", "branch", "MC/DC"]    mcdc_required: true    independence: "independent_person"  integration_test:    approach: "incremental"    back_to_back: trueconfiguration_management:  version_control: "Git"  baseline_strategy: "per_milestone"  change_control: "CCB_approval_required"work_products:  - phase: "SW Requirements"    artifacts: ["Software Requirements Specification", "SWE.1 Review Report"]  - phase: "SW Architecture"    artifacts: ["Software Architectural Design", "SWE.2 Review Report"]  - phase: "SW Unit Design"    artifacts: ["Unit Design Document", "Static Analysis Report"]  - phase: "SW Implementation"    artifacts: ["Source Code", "Code Review Record"]  - phase: "SW Integration"    artifacts: ["Integration Test Report", "Verification Results"]

档案完整性校验脚本

该Python脚本读取上述YAML文件，检查关键字段是否存在且符合ASIL要求。若档案缺失必要章节或ASIL等级不匹配，脚本返回非零退出码并列出缺失项。

#!/usr/bin/env python3"""safety_plan_checker.py - 校验软件安全档案完整性用法: python3 safety_plan_checker.py software_safety_plan.yaml"""import sysimport yamlREQUIRED_TOP_KEYS = [    "project", "safety_goals", "lifecycle",    "requirements_traceability", "development_methods",    "verification_strategy", "configuration_management", "work_products"]ASIL_LEVELS = ["A", "B", "C", "D"]def check_asil_consistency(plan):    """检查ASIL等级是否在合法范围内且safety_goals中已声明"""    errors = []    proj_asil = plan.get("project", {}).get("asil_level")    if proj_asil not in ASIL_LEVELS:        errors.append(f"project.asil_level 无效: {proj_asil}，应为 {ASIL_LEVELS}")    goals = plan.get("safety_goals", [])    if not goals:        errors.append("safety_goals 为空，至少需要一个安全目标")    else:        for goal in goals:            if goal.get("asil") not in ASIL_LEVELS:                errors.append(f"安全目标 {goal.get('id')} 的ASIL等级无效")    return errorsdef check_verification_depth(plan):    """ASIL D要求MC/DC覆盖与独立验证"""    errors = []    proj_asil = plan.get("project", {}).get("asil_level")    if proj_asil == "D":        ver = plan.get("verification_strategy", {})        unit = ver.get("unit_test", {})        if not unit.get("mcdc_required"):            errors.append("ASIL D 必须要求 MC/DC 覆盖率")        if unit.get("independence") != "independent_person":            errors.append("ASIL D 要求独立人员执行单元测试评审")    return errorsdef main():    if len(sys.argv) != 2:        print("用法: safety_plan_checker.py <yaml_file>")        sys.exit(2)    try:        with open(sys.argv[1], 'r', encoding='utf-8') as f:            plan = yaml.safe_load(f)    except FileNotFoundError:        print(f"错误: 文件 {sys.argv[1]} 不存在")        sys.exit(2)    except yaml.YAMLError as e:        print(f"YAML解析错误: {e}")        sys.exit(2)    all_errors = []    # 检查顶层键    missing_keys = [k for k in REQUIRED_TOP_KEYS if k not in plan]    if missing_keys:        all_errors.append(f"缺少必要章节: {missing_keys}")    # 执行专项检查    all_errors.extend(check_asil_consistency(plan))    all_errors.extend(check_verification_depth(plan))    if all_errors:        print("软件安全档案校验失败:")        for err in all_errors:            print(f"  - {err}")        sys.exit(1)    else:        print("软件安全档案校验通过: 所有必需章节与ASIL要求均已满足")        sys.exit(0)if __name__ == "__main__":    main()

落地与验证

依赖安装：校验脚本需要PyYAML库，执行pip install pyyaml安装。

运行步骤：

1. 将上述YAML内容保存为software_safety_plan.yaml；
2. 将Python脚本保存为safety_plan_checker.py；
3. 在终端执行：python3 safety_plan_checker.py software_safety_plan.yaml。

判定标准：

• 若档案完整且ASIL D要求（MC/DC、独立验证）已满足，脚本输出校验通过并返回退出码0；
• 若删除YAML中mcdc_required: true行或修改asil_level: "B"，脚本应输出对应错误信息并返回非零退出码。

该档案模板与校验脚本共同构成软件安全档案的落地基线，可直接纳入项目配置管理库，作为后续软件安全生命周期活动的输入基准。