service interface UpdateAllowedService

The service interface serves a control application to allow or disallow the execution of software updates to State Management (EXP SWArchitecture §9.2.2.1.1 “Interfaces for a SMControlApplication”). Via the provided field, the application transmits the permission status to the controller of the state management ([SWS_SM_91108]). If the field is set to a rejecting state, State Management mandatorily rejects incoming session requests from Update and Configuration Management. Although campaigns are synchronized vehicle-wide, this mechanism ensures that local machine states can prevent an update at any time.

more ›

Role and system context of the service interface

The service interface UpdateAllowedService is a service of the AUTOSAR Adaptive Platform within the functional cluster State Management (SM) ([SWS_SM_91025]). The SM cluster provides this service to other processes via a standardized port ([SWS_SM_91024]). In the system architecture, the interface is one of the interaction interfaces for a control application (SMControlApplication), with the aid of which higher-level application logic can interact with the state machines of State Management (EXP SWArchitecture §9.2.2.1.1 “Interfaces for a SMControlApplication”).

The interface primarily serves for a SMControlApplication to interact with the Controller of State Management (SWS StateManagement §9.2.3 “StateMachine UpdateAllowed service”). While the State Management cluster provides the service instance as a provider, the SMControlApplication acts as a service consumer (interpretation: the application acts as a client proxy within the ara::com pattern). Question Q-ba7662e744d9f9f0 (open) The core task of the interface is to inform State Management whether an update session on the machine shall be granted or denied (SWS StateManagement §9.2.3 “StateMachine UpdateAllowed service”).

Methods, events, and fields

The service interface UpdateAllowedService contains no separate methods or events, but bundles its functionality entirely in a field named UpdateAllowed ([SWS_SM_91108]). This field is of data type UpdateAllowedType and has getter, setter, and notifier functionality (HasGetter = true, HasSetter = true, HasNotifier = true) ([SWS_SM_91108]).

Via the setter, the SMControlApplication can actively set the current permission status and transmit it to State Management ([SWS_SM_91108]). The getter enables querying the stored value, while the notifier reports value changes to subscribers in an event-based manner ([SWS_SM_91108]). The concrete content of the field critically determines whether an upcoming update session is permitted or not (SWS StateManagement §9.2.3 “StateMachine UpdateAllowed service”).

Lifecycle, session sequences, and state dependencies

The update permission takes effect in the context of software update campaigns in which the Update and Configuration Management (UCM) requests an update session from State Management via the method RequestUpdateSession (SWS StateManagement §7.x). Although the fundamental feasibility of an update campaign is to be synchronized and checked in advance at the vehicle level, a campaign can encompass multiple machines and take a considerable amount of time (SWS StateManagement §7.x).

Because local conditions on an individual machine can change during this period of time, the explicit invocation of RequestUpdateSession is mandatory (SWS StateManagement §7.x). The SMControlApplication continuously tracks the permission status via the field UpdateAllowed. If the SMControlApplication permits starting the session (interpretation: by setting a corresponding permission value such as kUpdateAllowed), the modeled process of the controller is permitted to accept the update session (SWS StateManagement §7.x). Question Q-3dd3bcc37bf14309 (open)

Sequence diagram: Denial of an update session by State Management when the value kUpdateNotAllowed is set. Sources: [SWS_SM_00630], SWS StateManagement §7.x

Error handling and Application Errors

If the SMControlApplication refuses the execution of an update, the modeled process controlling the state machine of type Controller must reject the update request from UCM (SWS StateManagement §7.x). When the field UpdateAllowed is set to the value kUpdateNotAllowed, the modeled process of the Controller state machine must mandatorily return the error kOperationRejected on the method invocation RequestUpdateSession ([SWS_SM_00630]).

Via this specific application error, UCM is signaled that the local machine is currently not ready to enter an update session, thereby avoiding erroneous or safety-critical update states ([SWS_SM_00630]).