SNIP_CLASSIC_APPLICATIONLEVELERRORHANDLING_SECTION_7_3_1_5_OS_Application_state_machine

7.3.1.5 OS-Application state machine An OS-Application can be in one of the following states (see OS SWS [14] and Figure 7.2): • APPLICATION_ACCESSIBLE: In this state, no protection violations have been detected and the software in the OS-Application runs normally. • APPLICATION_RESTARTING: The OS-Application is in a state of emergency after the detection of a serious error. No resources of the OS-Application can be accessed from other OS-Applications and only the OSRestartTask is running. All other tasks/OsIsrs/Alarms/etc. are terminated. The only way to get information into the OS-Application is to poll from the inside (i.e. from inside the OSRestartTask). • APPLICATION_TERMINATED: The OS-Application is no more. Nothing is running. No access allowed from other OS-Applications. The only way to exit this state is to restart the OS (by restarting the ECU). Figure 7.2: OS-Application State Machine. The OS-Application is set in the APPLICATION_ACCESSIBLE state by the StartOS () call. Once it has entered this state, all OS internal setup activities are completed, and the OS-Application is ready for execution. All state changes after startup are due to exceptional events which trigger the Protection Hook, or explicit requests to change the state of an OS-Application by calls to TerminateApplication(). After the Protection Hook returns PRO_TERMINATEAPPL_RESTART to the OS, or the application-level request for restart is issued, the state of the OS-Application changes from APPLICATION_ACCESSIBLE to APPLICATION_RESTARTING. This means that resources held by the OS-Application are made inaccessible to other OS-Applications and no tasks belonging to the OS-Applications are running (or being activated). The OS then starts the OSRestartTask which can perform any necessary cleaning (e.g., in the SW-Cs and the BSW) before a decision is made to either restart or completely terminate the OS-Application. Going from APPLICATION_RESTARTING to APPLICATION_ACCESSIBLE is achieved by allowing access to OS-Application resources using the call AllowAccess() in the OSRestartTask. Going from APPLICATION_RESTARTING to APPLICATION_TERMINATED is achieved by an explicit request for termination from within the OSRestartTask, i.e., a call to TerminateApplication() with the ego-ID and NO_RESTART as parameters. Going from APPLICATION_ACCESSIBLE to APPLICATION_TERMINATED is achieved by returning PRO_TERMINATEAPPL from the Protection Hook or by an external request using the TerminateApplication() call with NO_RESTART as parameter. This transition should not be used when dealing with partitions as no cleanup activities will be performed here and thus the partition is potentially left in an inconsistent state which may persist in future starts of the ECU. When in APPLICATION_RESTARTING calling TerminateApplication() with ego-ID and RESTART does not make sense. In fact may lead to an infinite loop (a new OSRestartTask is started, which may again call TerminateApplication with the ego-ID and RESTART).