Watchdog Manager (WdgM)

use

The function WdgM_Init initializes the Watchdog Manager synchronously and is non-reentrant [SWS_WdgM_00151]. The sole input parameter is ConfigPtr, which references the post-build configuration data (WdgM_ConfigType) [SWS_WdgM_00151]. The function formally has no return value (void) [SWS_WdgM_00151].

Error Handling and Boundary Conditions

Prior to initialization, the Watchdog Manager must be in state WDGM_GLOBAL_STATUS_DEACTIVATED: If the development configuration parameter WdgMDevErrorDetect is deactivated and the module is not in this state, WdgM_Init returns without effect [SWS_WdgM_00390].

If the configuration switch WdgMOffModeEnabled is not activated and the initial mode predefined via ConfigPtr would deactivate the watchdog (WDGIF_OFF_MODE), the function aborts without further action and reports the runtime error WDGM_E_DISABLE_NOT_ALLOWED to the Default Error Tracer (DET) [SWS_WdgM_00030]. The return with E_NOT_OK required in the specification is likely to be understood as an interpretation of an internal error abort, since the signature prescribes void [SWS_WdgM_00151]. Question Q-83a164f8f4669d4d (open)

Interaction and Sequence

• Error diagnosis prior to initialization: The function WdgM_GetFirstExpiredSEID() must already be available before calling WdgM_Init in order to read out the previously expired Supervised Entity ID (SEID) [SWS_WdgM_00348].
• RAM cleanup: During initialization, WdgM_Init clears the double-inverted SEID value of the first expired entity stored in uninitialized RAM [SWS_WdgM_00370].
• Status report to the DEM: Within the first call of WdgM_MainFunction after WdgM_Init, the module reports the status PASSED for WDGM_E_SUPERVISION to the DEM if parameter WdgMDemStoppedSupervisionReport is set [SWS_WdgM_00408].

use

The synchronous function WdgM_DeInit serves to de-initialize the Watchdog Manager [SWS_WdgM_00261]. The interface has the service ID 0x01, is provided via the header file WdgM.h, and neither accepts input parameters nor returns a return value to the caller [SWS_WdgM_00261]. The intended call context is presumably the orderly shutdown sequence of the ECU, in which active supervisions are terminated in a controlled manner prior to power-off. Question Q-50d7e49c71d2dfd3 (open)

Functional Scope and Interaction

As part of the de-initialization, the WdgM module completely stops the supervision functions across all configured supervision algorithms and at the same time terminates watchdog handling [SWS_WdgM_00407].

Error Handling and Boundary Conditions

If the Watchdog Manager is already in the global state WDGM_GLOBAL_STATUS_DEACTIVATED at the time of the call, the behavior depends on the configuration parameter WdgMDevErrorDetect: If this development detection is disabled, WdgM_DeInit returns immediately and without any effect [SWS_WdgM_00388].

Regarding concurrency, it is specified that the function is non-reentrant [SWS_WdgM_00261]. Therefore, the call must under no circumstances occur preemptively or in parallel from multiple contexts.

Usage and Semantics

The function WdgM_SetMode serves to synchronously switch the Watchdog Manager to one of the configured operation modes ([SWS_WdgM_00154]). It expects Mode of type WdgM_ModeType as a pass-by-value parameter. The return value Std_ReturnType signals successful execution of the mode change with E_OK and failure with E_NOT_OK ([SWS_WdgM_00154]).

Restrictions and Error Handling

The function is non-reentrant (Non Reentrant) ([SWS_WdgM_00154]). Execution is bound to the current global status of the Watchdog Manager:

• If the module is in neither the status WDGM_GLOBAL_STATUS_OK nor WDGM_GLOBAL_STATUS_FAILED, the function returns without executing any actions ([SWS_WdgM_00145]).
• If the configuration parameter WdgMDevErrorDetect is disabled, a call in status WDGM_GLOBAL_STATUS_DEACTIVATED has no effect at all ([SWS_WdgM_00392]).

Interaction and Effects

If a valid global status (WDGM_GLOBAL_STATUS_OK or WDGM_GLOBAL_STATUS_FAILED) is present, WdgM_SetMode updates the supervised entities and the watchdogs:

• For each Supervised Entity enabled in the target mode, the current state is preserved ([SWS_WdgM_00182]).
• For each Supervised Entity disabled in the target mode, the local state changes to WDGM_LOCAL_STATUS_DEACTIVATED; the results of Active, Deadline, and Logical Supervision are set to correct, and the failed cycle counter is reset to 0 ([SWS_WdgM_00315]). Switching to a mode with deactivation of the entity also clears errors that previously led to WDGM_GLOBAL_STATUS_FAILED ([SWS_WdgM_00182]).
• Finally, the configured watchdog mode parameters for each hardware watchdog are put into effect via the interface WdgIf_SetMode ([SWS_WdgM_00186]).

Usage and Semantics

The synchronous function reports to the Watchdog Manager that a checkpoint within a Supervised Entity has been reached [SWS_WdgM_00263]. It accepts the identifier of the supervised entity (SEID) and the identifier of the reached checkpoint (CheckpointID) as input parameters and returns E_OK upon successful update of the alive counter or E_NOT_OK in case of errors [SWS_WdgM_00263].

Error Handling and Status

If the Watchdog Manager is in status WDGM_GLOBAL_STATUS_DEACTIVATED, the behavior depends on the configuration of the development identifier: If WdgMDevErrorDetect is activated, the function reports the error WDGM_E_UNINIT to the Default Error Tracer (DET) and returns without further effect [SWS_WdgM_00279]. If WdgMDevErrorDetect is deactivated, it returns without any message and without any effect [SWS_WdgM_00394].

Concurrency and Deadlines

The invocation is specified as reentrant [SWS_WdgM_00263]. To determine timestamps and time differences during deadline supervision, the function uses the OS function GetElapsedValue with the CounterID configured for the entity [SWS_WdgM_00373]. Scaling of the time differences to the limit values is performed via parameter OsSecondsPerTick [SWS_WdgM_00374]. If a deadline end checkpoint reaches the call in active mode and the timestamp of the associated start checkpoint is 0, the function terminates successfully without difference measurement [SWS_WdgM_00354].

Usage and Call Context

The synchronous function WdgM_PerformReset instructs the Watchdog Manager to cause a watchdog reset to be triggered [SWS_WdgM_00264]. The interface is declared via the header WdgM.h and has the service ID 0x0f [SWS_WdgM_00264]. It accepts neither input nor output parameters and returns no return value [SWS_WdgM_00264].

Concurrency and Limitations

Since WdgM_PerformReset is defined as non-reentrant (Non Reentrant), no concurrent or preemptive multiple calls may occur [SWS_WdgM_00264]. Callers must therefore ensure that calls are synchronized or issued exclusively from an appropriate context.

State-Dependent Behavior and Error Handling

Execution is subject to the global states of the Watchdog Manager: If the configuration parameter WdgMDevErrorDetect is disabled and the module is in the global status WDGM_GLOBAL_STATUS_DEACTIVATED, the function returns without any effect [SWS_WdgM_00401]. In this case, a reset does not take place at all. The behavior when development detection is enabled (WdgMDevErrorDetect) is not specified in the payload; interpretation: in this case, a corresponding development error is presumably reported in the deactivated state. Question Q-8a726bba4154540f (open)

Usage and Cyclic Execution

The function WdgM_MainFunction executes the periodic tasks of the Watchdog Manager [SWS_WdgM_00159]. It has the signature void WdgM_MainFunction(void), takes no parameters, returns no value, and is provided via header SchM_WdgM.h [SWS_WdgM_00159]. Upon the first call after module initialization, it starts all supervision functions (for all supervision algorithms including the reference cycles) as well as the watchdog handling [SWS_WdgM_00406].

Deadline Supervision and Timeout Detection

In the cyclic calls, WdgM_MainFunction performs deadline supervision to detect timeouts for all entities with active supervision and updates their result [SWS_WdgM_00404]:

• If detection via WdgMEnableTimeoutDetection is activated, the function checks all deadline supervisions configured in the active mode for which the start checkpoint was reported, but the associated end checkpoint is still pending [SWS_WdgM_00403].
• If the measured time difference from the current timestamp exceeds the maximum WdgMDeadlineMax, the function sets the supervision result of the Supervised Entity to failed (incorrect) [SWS_WdgM_00403].

Interaction with the Operating System

To determine timestamps and differences, WdgM_MainFunction invokes the OS function GetElapsedValue with the counter ID configured for the entity (parameter WdgMOSCounter) [SWS_WdgM_00373]. Scaling of the difference values to the limit values WdgMDeadlineMin and WdgMDeadlineMax is performed based on parameter OsSecondsPerTick [SWS_WdgM_00374].

The type WdgM_Mode is defined as a Mode Declaration Group of category EXPLICIT_ORDER and serves to represent supervision states of the module [SWS_WdgM_00334].

Usage and Value Range

SUPERVISION_OK is specified as the initial mode [SWS_WdgM_00334]. Explicit numeric values are defined for the individual modes [SWS_WdgM_00334]:

• SUPERVISION_OK = 0
• SUPERVISION_FAILED = 1
• SUPERVISION_EXPIRED = 2
• SUPERVISION_STOPPED = 3
• SUPERVISION_DEACTIVATED = 4

For the transition value (on transition value) between modes, the value 255 is defined [SWS_WdgM_00334].

Interaction

Due to the categorization into category EXPLICIT_ORDER and the assignment of fixed ordinal values, the group is likely intended for ordered status mapping within the Watchdog Manager [SWS_WdgM_00334]. Question Q-47c55c3bc2e2a23d (open)

The type WdgM_LocalStatusType is used for variables that represent the current local supervision status of an individual supervised entity (Supervised Entity) in the Watchdog Manager [SWS_WdgM_00359]. The data type is derived from the base type uint8 and is provided via header Rte_WdgM_Type.h [SWS_WdgM_00359].

The value range comprises four discrete states according to [SWS_WdgM_00359]:

• WDGM_LOCAL_STATUS_OK (value 0): Supervision of the Supervised Entity exhibits no errors.
• WDGM_LOCAL_STATUS_FAILED (value 1): Supervision has failed, but can still be healed if the entity returns to normal behavior. This applies as long as a configurable error limit is not exceeded; otherwise, the status transitions to WDGM_LOCAL_STATUS_EXPIRED.
• WDGM_LOCAL_STATUS_EXPIRED (value 2): Supervision has failed permanently; this state can no longer be exited.
• WDGM_LOCAL_STATUS_DEACTIVATED (value 4): Local supervision of the Supervised Entity is temporarily deactivated.

Due to the definition in Rte_WdgM_Type.h, the type is likely intended primarily for cross-software-component and cross-RTE exchange of supervision states [SWS_WdgM_00359]. Question Q-a9e584dc4c7cfa3b (open)

The data type WdgM_GlobalStatusType serves to define variables that represent the global supervision status of the Watchdog Manager module [SWS_WdgM_00360]. It is derived from base type uint8 and is made available via header Rte_WdgM_Type.h [SWS_WdgM_00360].

The value range comprises five defined supervision states [SWS_WdgM_00360]:

• WDGM_GLOBAL_STATUS_OK (0): Supervision exhibits no errors whatsoever.
• WDGM_GLOBAL_STATUS_FAILED (1): Supervision has failed, but is still within the permissible error limit.
• WDGM_GLOBAL_STATUS_EXPIRED (2): Supervision has failed and the permissible error limit has been exceeded, but the watchdog driver has not yet been instructed to stop triggering.
• WDGM_GLOBAL_STATUS_STOPPED (3): The error limit has been exceeded and the watchdog driver has been instructed to stop triggering, such that a watchdog reset is imminent.
• WDGM_GLOBAL_STATUS_DEACTIVATED (4): The WdgM module is not initialized and therefore does not control the watchdogs.

Across these states, the type maps the entire cycle of supervision, beginning with deactivation prior to initialization, continuing through regular or fault-tolerant operation, up to multi-stage escalation with final watchdog reset in the event of persistent errors [SWS_WdgM_00360].

The data type WdgM_ModeType serves to uniquely distinguish the different modes configured for the Watchdog Manager [SWS_WdgM_00358]. It is provided for software components and basic software modules via the header file Rte_WdgM_Type.h [SWS_WdgM_00358].

According to specification [SWS_WdgM_00358], the type has the following properties:

• Base type: WdgM_ModeType is derived from the standard data type uint8 [SWS_WdgM_00358].
• Value range: The value range covers 0 to <Number of Modes> [SWS_WdgM_00358].
• Configuration dependency: The actual upper limit of the value range depends on the number of modes configured for the Watchdog Manager [SWS_WdgM_00358].

Since this is a type definition, no runtime parameters, error codes, or asynchronous semantics exist. Interpretation: Due to its declaration in Rte_WdgM_Type.h, WdgM_ModeType is likely to be used primarily for exchanging mode information via RTE interfaces between application software and the Watchdog Manager. Question Q-27975280bc68720e (open)

The element globalmode is defined according to specification [SWS_WdgM_00150] as a provided port (provided port interface) of the Watchdog Manager (WdgM) in the AUTOSAR Classic Platform in release R20-11. WdgM_GlobalMode is indicated as the interface type. The element serves in the overall system as a formal port interface via which the module exposes its status to other software components.

Regarding specific usage, parameters, return values, or data structures, specification [SWS_WdgM_00150] provides no further details. As an interpretation, the port interface is likely to serve primarily to provide the current global supervision status of the Watchdog Manager to higher-level entities such as the BswM or application SW-Cs. Question Q-6a0217eb1d28c1b4 (open) In the absence of differing information in the sources, the mode provisioning is presumably handled synchronously via the RTE.

With respect to error handling, DET or DEM messages, as well as specific error codes, [SWS_WdgM_00150] remains completely silent. Likewise, no normative stipulations regarding reentrancy, priorities, or call contexts are defined in the payload; as an interpretation, however, access is likely to be subject to the general concurrency rules of the WdgM state management. Question Q-28fa9de4b06e3b0d (open) Related requirements do not exist for this element.