Function Inhibition Manager (FiM)

This service re-initializes the FIM.

This service reports the permission state to the functionality.

This service is provided to be called by the Dem in order to inform the Fim about monitor status changes.

Service FiM_MainFunction.

This service initializes the FIM.

This service returns the version information of this module.

Triggers on changes of the component failed status.

This service sets the availability of a function. The function is only available if FiMAvailability Support is configured as True.

Service CBFidStatusChanged.

Type for the FunctionID Variation –

This type defines a data structure for the post build parameters of the FIM. At initialization the FIM gets a pointer to a structure of this type to get access to its configuration data, which is necessary for initializsation.

The configuration process shall guarantee that FunctionIds are unique per FiM. Two distinct functionalities with different dependencies on events shall never have the same FunctionId (see also [SWS_Fim_00007]).

The FiM module's environment shall use the FunctionId to directly point to the associated functionality information (permission status etc.)

FID numbers shall be unique per FiM.

The FiM module shall provide the possibility to modify the inhibit conditions by post-built configuration.

If the implementation uses status variables for the permission of the FIDs, the status variables shall be readable for tracking purposes by the calibra- tion system (to be defined by AUTOSAR) during the development phase of the ECU.

The flow of information starts with the API call of the Dem provid- ing changes of the event information. This information is processed and dependencies to FIDs are evaluated. Finally, the permission state of the FIDs is accessed via API through the RTE (Figure 7.1).

The FiM module shall calculate the inhibit status based on the actual status of the inhibit source and the calibrated mask which exists for each inhibit source (ref. 10.2.7). The FiM module shall inhibit the FID if the Monitor status is equal to the calibrated mask (=Defect, Tested, NotTested). The inhibition is deactivated if the mask of the event does not match anymore the calibrated value.

The configuration process of the FiM shall create data structures within the FiM module to store the inhibit relations (EventID - FID - applicable mask).

The FID permission state contains the information whether a functionality represented by its FID can be executed. If the permission state == TRUE, the functionality associated with the FID is permitted to be executed. If the permis- sion state == FALSE, the functionality associated with the FID is not allowed to be executed.

The configuration engineer shall provide at compile time the in- hibit conditions for each FID required for handling the dependencies of functionalities and events in the FiM module.

If Dem events status information is used, the FiM module shall compute the permission states for all FIDs at its initialization based on all restored monitor status information (not only events stored in the fault memory) of the Dem.

The FiM module shall ensure an immediate control of functionality by synchronously responding to an incoming permission query. The FiM module shall realize this behavior either by storing the permission state as a status variable or by evaluation of the event states upon permission query.

The purpose of the FiM module is to provide services to control (permit / inhibit) functionality within SW-Cs based on Dem events being supported as inhibit conditions.

The function FiM_GetFunctionPermission shall deliver the return value synchronously to enable direct use of this information for controlling and executing the underlying code in the software component.

The FiM shall compute the permission of a FID independently of the state of other FIDs.

The AUTOSAR Function Inhibition Manager (FiM) has inter- faces and dependencies on the Diagnostic Event Manager (Dem), the Software Com- ponents (SW-C) with FID interface, the ECU State Manager, the RTE and the BSW modules supposed to be inhibited by the FiM.

If development error detection is turned on the FiM module shall report an error to the DET if it has not successfully completed the initialization and has detected not permitted access.

If development error detection for the module FiM is enabled: the function FiM_GetFunctionPermission shall perform a plausibility check on the FID range. If a FID is out of range, the function shall raise a development error and return no permission (FALSE).

If development error detection for the module FiM is enabled: the function FiM_GetFunctionPermission shall check that the initialization of the module FiM has been completed. If the function detects that the initialization is not complete, it shall raise a development error and return no permission (FALSE).

If development error detection for the module FiM is enabled: the function FiM_DemTriggerOnMonitorStatus shall perform a plausibility check on the EventId. If the requested EventId is not existing in the Dem configuration, the function shall raise the development error FIM_E_EVENTID_OUT_OF_RANGE .

If development error detection for the module FiM is enabled: The function FiM_DemTriggerOnMonitorStatus shall check for complete initialization of the FiM. If the function detects that the initialization is not complete, it shall raise a development error.

A static status variable denoting if the FiM is initialized shall be initialized with value 0 before any APIs of the FiM is called. FiM_Init shall set the static status variable to a value not equal to 0.

The FiM configuration shall support summarizing events. A sum- marized event consists of multiple single diagnostic events.

Figure 10.1: FiM configuration

The FiM shall also be able to process the inhibit conditions of all FIDs associated to one summarized event if one of the Dem Events associated to this summarized event is reported to the FiM.

The Function Inhibition Manager shall use the FID - EventIDs - inhibition masks relations provided by the software components to determine the permission state for all configured FIDs.

The SW Components and the BSW shall use the function FiM_- GetFunctionPermission to query for the permission to execute a certain function- ality represented by the respective FID.

The FiM shall perform the evaluation of actual EventIds status in- formation cyclically for all the EventIds using the inhibition mask and then calculate the corresponding FID permission states. FiM shall access the monitor status information using the API Dem_GetMonitorStatus if Dem and FiM are implemented as sepa- rate modules. FiM shall access the monitor status structure of Dem if Dem and FiM are implemented as a bundle.

The function FiM_DemInit shall compute the permission state for all FIDs.

If FiM module polls monitor status (as defined in configuration parameter FiMEventUpdateTriggeredByDem = FALSE) and decides to do it in a cyclic manner, FiM_MainFunction shall be used to calculate the permission states of all EventIds using their inhibition masks. The API Dem_GetMonitorStatus shall be used to get status information of EventIds.

Type of error Related error code Error value API function called before the FiM module has been full initialized or after the FiM module has been shut down FIM_E_UNINIT 0x01 FiM_GetFunctionPermission called with wrong FID FIM_E_FID_OUT_OF_RANGE 0x02 Dem calls FiM with invalid EventId FIM_E_EVENTID_OUT_OF_RANGE 0x03 API is invoked with NULL Pointer. FIM_E_PARAM_POINTER 0x04 Invalid configuration set selection FIM_E_INIT_FAILED 0x05

Dem_GetMonitorStatus Dem.h Gets the current monitor status for an event. SchM_ActMainFunction_FiM <none> Invokes the SchM_ActMainFunction function to trigger the activation of a corresponding main processing function.

Det_ReportError Det.h Service to report development errors.

Module Header File Imported Type Dem.h Dem_ComponentIdType Rte_Dem_Type.h Dem_EventIdType Dem Rte_Dem_Type.h Dem_MonitorStatusType Std_Types.h Std_ReturnType Std Std_Types.h Std_VersionInfoType

The function FiM_DemInit shall access the EventId states via the function Dem_GetMonitorStatus and the component information via Dem_Get- ComponentFailed .

Name FunctionInhibition Comment The SW Components can use this service to query for the permission to execute a certain functionality represented by a FID. IsService true Variation – 0 E_OK Operation successful Possible Errors 1 E_NOT_OK Operation failed Operation GetFunctionPermission Comment Get the permission state of the respective FID. Mapped to API FiM_GetFunctionPermission Variation – Permission Type boolean Direction OUT Comment The permission of the requested FID. TRUE: FID has permission to run FALSE: FID has no permission to run, i.e. shall not be executed Parameters Variation – Possible Errors E_OK E_NOT_OK

A client can query the FiM for execution permission for a specific function. The FIDs which represent the functions are not directly used by the client SW-C. Instead, the mechanism of "port-defined argument values" is used and every FID is mapped to a separate port that is responsible for the data exchange via RTE. Type FiM_FunctionIdType Port Defined Argument Value(s) Value {ecuc(FiM/FiMConfigSet/FiMFID/FiMFunctionId.value)} Variation Name = {ecuc(FiM/FiMConfigSet/FiMFID.SHORT-NAME)}

If Dem_GetMonitorStatus returns E_NOT_OK, the FIM shall not consider this event in its inhibition mask calculation

The Function Inhibition Manager shall use the FID - DemCom- ponentId - inhibition configuration to determine the permission state for the configured FID. Upon changes of the FAILED status of a DemComponent , the function status shall be recalculated. Whenever the component status is FAILED ( ComponentFailedStatus = TRUE), the FID is inhibited.

If the FIM is configured for cyclically polling the status, the FIM shall use the API Dem_GetComponentFailed to get the current FAILED status of a component.

If the FIM is configured for being triggered on eventStatus (Fi MCyclicEventEvaluation), the FIM shall accept the status changed information of a DemComponent by providing the function FiM_DemTriggerOnComponentStatus .

The initialization of Dem and Fim shall always follow the below order : step 0) Dem_PreInit step 1) Non-volatile memory data has to be available. step 2) FiM_Init (setting up internal variables); after FiM_Init , the Fim is not yet ready to be used. step 3) Dem_Init : do the internal DEM initialization and use FiM_DemInit to finally initialize the FIM

If FiM_GetFunctionPermission is called before the FiM is initialized, the FiM shall return E_NOT_OK.( FiM_DemInit ).

If a function (FID) is set to not available using the interface FiM_SetFunctionAvailable , its permission state FiM_GetFunctionPermis- sion shall always return FALSE

Name ControlFunctionAvailable Comment SW Components can use this service to set the availability of a function. IsService true Variation ({ecuc(FiM/FiMGeneral/FiMAvailabilitySupport)} == True) 0 E_OK Operation successful Possible Errors 1 E_NOT_OK Operation failed Operation SetFunctionAvailable Comment Sets the availability of a function. Mapped to API FiM_SetFunctionAvailable Variation – Availability Type boolean Direction IN Comment The permission of the requested FID: TRUE: Function is available. FALSE: Function is not available. Parameters Variation – Possible Errors E_OK E_NOT_OK

A client can set the availability for a specific function. Type FiM_FunctionIdType Port Defined Argument Value(s) Value {ecuc(FiM/FiMConfigSet/FiMFID/FiMFunctionId.value)} Variation ({ecuc(FiM/FiMGeneral/FiMAvailabilitySupport)} == True) Name = {ecuc(FiM/FiMConfigSet/FiMFID.SHORT-NAME)}

[SWS_Fim_00109]

[SWS_Fim_00110] [SWS_Fim_91001]

These requirements are not applicable to this specification.

[SWS_Fim_91001]

[SWS_Fim_91003]

[SWS_Fim_91004] Definition of ClientServerInterface FunctionInhibitionCallback Upstream requirements: SRS_Fim_04700 ⌈ Name FunctionInhibitionCallback Comment The SW Components can use this service to get informed on permission state changes of a FID. IsService true Variation – Possible Errors E_OK Operation successful Operation CBFidStatusChanged Comment – Mapped to API CBFidStatusChanged Variation – Status Type FiM_FunctionIdType Direction IN Comment Set to INIT if the FiM is calling this callback due to the initialisation of the module. If set to CHANGED, this callback indicates a FID state change Variation – Permission Type boolean Parameters Direction IN ▽ △ Comment Indicates the initial/new FID permission state. TRUE: FID has permission to run FALSE: FID has no permission to run. Variation – Possible Errors E_OK ⌋

For each configured FiMInhibitionConfigura- tion , at least one of FiMInhSumRef or FiMInhEventRef or FiMInhComponen- tRef shall be configured.

For each configured FiMInhibitionConfigura- tion , at least one of FiMInhSumRef or FiMInhEventRef or FiMInhComponen- tRef shall be configured.

These requirements are not applicable to this specifica- tion.