SNIP_CLASSIC_APPLICATIONLEVELERRORHANDLING_SECTION_10_4_Integrator_Responsibility

10.4 Integrator Responsibility The integrator has the overall responsibility for implementing the terminate and restart actions required by providing the code for the Protection Hook and the Restart Task as well as any glue code necessary for coordination and proper incorporation of the functionality. The following is a checklist of things that need to be done by the integrator or developer in order to get proper handling of termination and restart of partitions: 1. Decompose applications into SW-Cs and group the SW-Cs according to chosen partitions/error containment regions. 2. Configure partitions and OS-Applications in accordance with outcome of decomposition. 3. Indicate for each SW-C whether it can be terminated or restarted (and of course, make sure the implementation of the SW-C supports this). 4. Indicate for each partition whether it can be terminated or restarted. 5. Decide upon error handling policies and strategies for the partitions. Base decision of restart and termination of a given partition on e.g. error type and number of previous restarts, and any other information relevant for the decision. 6. Implement the chosen policies and strategies in the Protection Hook (remember that there is one global Protection Hook for the entire ECU). Notify the RTE of the decision using Rte_PartitionTerminated_<partition>() or Rte_PartitionRestarting_<partition>(). Return the proper code representing the decision. o PRO_IGNORE if nothing shall be done. o PRO_TERMINATEAPPL_RESTART if the partition shall be restarted or terminated. o PRO_SHUTDOWN if the OS (and thus eventually the ECU) shall be shut down. 7. Implement the necessary clean-up actions in the OSRestartTask of the partition (there is one such task per partition) and configure the BSW accordingly. Remember that this task should be triggered both when terminating and when restarting a partition, and that the necessary clean-up actions are not necessarily the same for both activities. Thus, the OSRestartTask must be able to find out whether the partition shall be terminated or restarted in order to perform the correct clean-up actions. The suggested way to do this is to implement the partition state machine described in Section 10.3.2. 8. If there is a need for application-level coordination of error handling across multiple partitions, implement an application-level error manager (ALEM) either as a dedicated SW-C or as part of another SW-C. Note that such an ALEM must not be in any of the partitions it is set to monitor. Use the TerminateApplication() API to control the termination and restart of partitions from an ALEM.