Default Error Tracer (DET)

The Default Error Tracer centrally receives error notifications from BSW modules and SW-Cs. For this purpose, there are Det_ReportError for development errors, Det_ReportRuntimeError for runtime errors, and Det_ReportTransientFault for transient faults, each with module, instance, API, and error identifiers. DET forwards every notification to all configured hooks or callouts of the integrator [SWS_Det_00501]. Operation is started by Det_Init and Det_Start from EcuM. The most important constraint: In R20-11, Det_ReportError does not return to the caller, but halts program execution like an assertion [SWS_Det_00009].

more ›

The Default Error Tracer is the central collection point for error notifications from basic software and software components. It provides three identically structured reporting services with the parameters ModuleId, InstanceId, ApiId, and ErrorId or FaultId: Det_ReportError for development errors, Det_ReportRuntimeError for runtime errors, and Det_ReportTransientFault for transient faults ([SWS_Det_00009], [SWS_Det_01001], [SWS_Det_01003]). EcuM puts DET into operation with Det_Init and then Det_Start ([SWS_Det_00008], SWS DET Fig. 1 p. 34).

Context diagram: DET receives notifications from BSW modules and SW-Cs and forwards them to integrator hooks and optionally to Dlt. Sources: SWS DET Fig. 2 p. 28, [SWS_Det_00202]

DET does not evaluate notifications itself. Each reporting service calls all hooks or callouts configured for it (DetErrorHook, DetReportRuntimeErrorCallout, DetReportTransientFaultCallout), specifically with the same parameters as the notification [SWS_Det_00501]. Via this integrator code, DET also reaches DEM or error storage. In doing so, callouts shall be restricted to short, adequate activities ErrorDescription p. 10.

SW-Cs report via the client-server interface DETService. The RTE adds ModuleId and InstanceId as \"port defined argument values\" from the DET configuration; the SW-C always receives E_OK in return ([SWS_Det_00203], [SWS_Det_00204]).

For error scenarios, how the three services return is crucial. Det_ReportError does not return in R20-11: After the hooks, control flow is halted, like with an assertion ([SWS_Det_00009], RS BSWGeneral p. 33). Runtime notifications, on the other hand, return with E_OK. Transient notifications pass on the callout value, or E_OK without a callout SWS DET Fig. 6 p. 36. Transient faults are omitted as of R24-11, and Dlt calls as of R25-11 SWS DET p. 1.

Sequence diagram: In the event of a development error, DET calls all configured hooks and then halts without returning to the notifier. Sources: SWS DET Fig. 9.2 p. 34, [SWS_Det_00009]

more ›

Role of the Default Error Tracer at the system boundary

The Default Error Tracer (DET) is the central collection point to which basic software modules and software components report detected errors. In R20-11, it provides three identically structured reporting services for this purpose: Det_ReportError for development errors [SWS_Det_00009], Det_ReportRuntimeError for runtime errors [SWS_Det_01001], and Det_ReportTransientFault for transient faults [SWS_Det_01003]. In addition, there are the management services Det_Init, Det_Start, and Det_GetVersionInfo ([SWS_Det_00008], [SWS_Det_00010], [SWS_Det_00011]). DET does not evaluate notifications regarding their content itself. It notifies the configured error hooks with every received notification SWS DET p. 16.

To the outside, DET is narrowly connected. As the only expected interface, the specification mentions optional forwarding to Dlt via Dlt_DetForwardErrorTrace from Dlt_Det.h ([SWS_Det_00211], SWS DET Fig. 2 p. 28). DET only reaches DEM and RTE via integrator-specific code in the callouts ErrorDescription p. 10.

Context diagram: DET receives notifications from BSW modules and, via the RTE, from SW-Cs. It is initialized by EcuM and forwards notifications only to configured integrator code and optionally to Dlt. Sources: SWS DET Fig. 2 p. 28, [SWS_Det_00202], [SWS_Det_00211], ErrorDescription p. 10

Startup: Initialization and start by EcuM

The ECU State Manager initializes DET with Det_Init (service ID 0x00). In doing so, it passes a pointer to the selected configuration set of type Det_ConfigType, whose content is implementation-specific ([SWS_Det_00008], [SWS_Det_00210]). Subsequently, Det_Start (service ID 0x02) starts the tracer [SWS_Det_00010]. Both services are synchronous and non-reentrant. The R20-11 diagram shows the two calls consecutively from EcuM SWS DET Fig. 1 p. 34. EcuM accordingly lists Det_Init and Det_ReportError as optional interfaces SWS EcuM p. 142.

The specification does not explain why initialization and start are separated. Interpretation: The division is likely intended to permit initializing DET very early in startup and enabling regular operation only in a later step [SWS_Det_00010]. Question Q-fee4462bdf189dcf (open)

Sequence diagram: EcuM first calls Det_Init synchronously with the configuration pointer, then Det_Start. Sources: SWS DET Fig. 1 p. 34, [SWS_Det_00008], [SWS_Det_00010]

Three reporting paths and their identifiers

All three reporting services have the same parameter structure:

• ModuleId (uint16);
• InstanceId (uint8), with the value 0 for single-instance modules;
• ApiId (uint8);
• ErrorId or FaultId (uint8).

API and error identifiers are defined in each case by the SWS of the reporting module ([SWS_Det_00009], [SWS_Det_01001], [SWS_Det_01003]). The module ID originates from the list of basic software modules. Of that list, the basic software only uses the range 0..255 EXP LSA p. 157.

Which path is appropriate follows from the error classification. Violated fundamental preconditions are development errors and are treated like an assertion; examples are software bugs, faulty integration, or invalid configuration. The remaining errors are runtime or production errors EXP LSA p. 154. If development error detection is configured, BSW modules report development errors with their assigned module ID via Det_ReportError SWS BSWGeneral p. 57. A preprocessor switch such as SPI_DEV_ERROR_DETECT enables or disables the call EXP LSA p. 113.

Activity diagram: If a fundamental precondition is violated, a development error is reported via Det_ReportError. Otherwise, diagnostic relevance decides between production error and runtime error (Det_ReportRuntimeError). Sources: EXP LSA p. 154, [SWS_Det_00009], [SWS_Det_01001]

Runtime errors are reported, for example, by the ADC driver with ADC_E_BUSY or Dds in the case of dropped messages, in each case via Det_ReportRuntimeError (SWS Adc p. 95, SWS Dds p. 53). A BSW module describes its needs with the ServiceNeeds kind ErrorTracerNeeds. It recognizes the roles Det_ReportError, Det_ReportRuntimeError, and Det_ReportTransientFault TPS BSWMDT p. 266.

Hooks and callouts as a bridge to integrator code

Every call to Det_ReportError calls all functions configured in DetErrorHook. Likewise, Det_ReportRuntimeError and Det_ReportTransientFault call all callouts from DetReportRuntimeErrorCallout and DetReportTransientFaultCallout, respectively [SWS_Det_00501]. Hooks and callouts have the signature of the triggering service and receive the same parameters ([SWS_Det_00181], [SWS_Det_00184], [SWS_Det_00187], SWS DET p. 16). The hook interface <User_Error_Hooks> has the service ID 0x10. It is synchronous and reentrant and always returns E_OK SWS DET p. 25.

What the callouts do is determined by the integrator. For runtime and transient faults, they should be limited to few actions: storing the event, calling DEM, or performing another short, adequate activity ErrorDescription p. 10. After a call to Det_ReportRuntimeError, DET always returns with E_OK, regardless of whether callouts are configured or not (SWS DET Fig. 4 p. 35, SWS DET Fig. 5 p. 35).

Sequence diagram: Det_ReportRuntimeError calls all configured callouts and returns to the notifier with E_OK in any case. Sources: SWS DET Fig. 4 p. 35, SWS DET Fig. 5 p. 35, [SWS_Det_00501]

For Det_ReportTransientFault, DET, on the other hand, passes the return value of the callout through to the notifier. Without a callout, it returns E_OK (SWS DET Fig. 6 p. 36, SWS DET Fig. 7 p. 36). For multiple callouts, a later version describes a logical OR operation of the return values: E_OK is only returned if all callouts return E_OK. This rule presumably applies already to R20-11 SWS DET p. 24. Question (open)

Sequence diagram: Det_ReportTransientFault forwards the return values of the callouts to the notifier; without a callout, it returns E_OK. The OR operation in the case of multiple callouts is marked as an assumption. Sources: SWS DET Fig. 6 p. 36, SWS DET Fig. 7 p. 36, SWS DET p. 24

Connection of software components via service ports

SW-Cs access DET via the client-server interface DETService. Its operations call Det_ReportError or the runtime notification with the module ID of the port [SWS_Det_00202]. ModuleId and InstanceId are not passed by the SW-C itself. The RTE adds them as \"port defined argument values\", whose values originate from DetModuleId and DetInstanceId of the DET configuration ([SWS_Det_00204], [SWS_Det_00205], [SWS_Det_00206]). For SW-Cs, ApiId and ErrorId are not standardized and can be freely assigned in the range 0x00..0xFF. The return value is always E_OK [SWS_Det_00203]. The port interface uses the AUTOSAR data types uint8 and uint16 [SWS_Det_00200].

Sequence diagram: The SW-C passes only ApiId and ErrorId. The RTE adds ModuleId and InstanceId from the configuration; the return value is E_OK. Sources: [SWS_Det_00202], [SWS_Det_00203], [SWS_Det_00204], SWS DET Fig. 3 p. 33

Configuration of notifications

The notification functions are located in the optional container DetNotification (multiplicity 0..1). It contains the lists DetErrorHook and DetReportRuntimeErrorCallout (0..* each). DetErrorHook is configured at pre-compile time and requires the function type Std_ReturnType (*f)(uint16, uint8, uint8, uint8) SWS DET p. 37. In R20-11, DetReportTransientFaultCallout is added [SWS_Det_00501]. The parameter diagram also shows the mandatory container DetGeneral with DetVersionInfoApi and DetForwardToDlt SWS DET (alt) Fig. 6 p. 43. From DetConfigSet/DetModule and DetModuleInstance, the configuration forms the ports Det_{Name} along with module and instance identifiers [SWS_Det_00205].

Behavior in the event of an error

Development errors are treated like assertions. After calling the configured hooks, normal control flow is not continued, and DET halts execution, for example by means of an endless loop or a halt instruction RS BSWGeneral p. 33. This matches the entry for Det_ReportError in R20-11 under Sync/Async: \"Not Applicable: The function never returns\" [SWS_Det_00009]. The diagrams show this HALT with and without a configured hook (SWS DET Fig. 9.2 p. 34, SWS DET Fig. 9.3 p. 35).

Sequence diagram: A BSW module detects a development error and calls Det_ReportError. DET calls all configured hooks and halts afterwards without returning to the notifier. Sources: SWS DET Fig. 9.2 p. 34, SWS DET Fig. 9.3 p. 35, [SWS_Det_00009], [SWS_Det_00501]

Some diagrams deviate from this. A sequence diagram notes that the synchronous or asynchronous behavior depends on the implementation and draws a return to the caller SWS DET Fig. 5 p. 36. The Dio diagram also shows a return after Det_ReportError SWS Dio Fig. 5 p. 41. Normative for R20-11 is [SWS_Det_00009]. A clarification of the Sync/Async specification only followed with R21-11 SWS DET p. 1.

Runtime and transient faults do not interrupt the program flow: DET returns to the notifier with a return value ([SWS_Det_01001], [SWS_Det_01003]). DET itself only has one development error of its own. DET_E_PARAM_POINTER (0x01) occurs when Det_GetVersionInfo is called with a null pointer [SWS_Det_00301]. A later version specifies that this error is reported to all configured callouts. This is presumably also intended for R20-11 SWS DET p. 18. Question Q-3a7f5865d61186d4 (open)

Further detailed evidence

• [SWS_Det_00009]: Signature of Det_ReportError, service ID 0x01, does not return.
• [SWS_Det_01001], [SWS_Det_01003]: Runtime and transient notifications with the service IDs 0x04 and 0x05.
• [SWS_Det_00501]: Requirement to call all configured hooks and callouts.
• [SWS_Det_00181], [SWS_Det_00184], [SWS_Det_00187]: Signatures of hooks and callouts with the service IDs 0x10, 0x11, and 0x12.
• [SWS_Det_00202] to [SWS_Det_00206]: Service port model for SW-Cs.
• [SWS_Det_00008], [SWS_Det_00010], [SWS_Det_00210]: Startup and configuration type.
• [SWS_Det_00211], [SWS_Det_00301]: Dlt forwarding and dedicated development error.

Later releases change the functional scope. A version from R23-11/R24-11 marks Det_ReportTransientFault as OBSOLETE SWS DET p. 24. According to the change history, transient errors are removed with R24-11 and the Dlt calls with R25-11 SWS DET p. 1. In R20-11, both functions are still part of the specification ([SWS_Det_01003], [SWS_Det_00211]).