SNIP_CLASSIC_NVM_SECTION_12_9_Termination_of_OS_Applications

12.9 Termination of OS-Applications Inconsistencies may occur when an OsApplication is terminated and restarted, depending on its state at the termination. • A notification from an asynchronous job started before the termination of OsApplication can occur after the restart of OsApplication. • An asynchronous memory read or write started before the termination of OsApplication can occur after restart, and cause data inconsistency. • A requested mode or state to another OsApplication (e.g. from a SW-C to A BSW) can lead to unsynchronized state machines after an OsApplication restart. Therefore some measures shall be taken to avoid these inconsistencies and guaranty a correct behavior. Integration code shall stop all signals and signalgroups during its OsApplication restart. This ensures that no late asynchronous notification will occur after the OsApplication restart. These signals and signalgroups can be then safely restarted if needed. A SW-C shall cancel jobs on all its memory blocks with a call to NvM_CancelJobs during the restart of its OsApplication. As the job might have already been started, the call to NvM_CancelJobs can return an error; in that case, the OsApplication shall wait until end of the job to continue. After all jobs are ensured to be cancelled, then all memory blocks shall be reset to their initial value, in order to avoid inconsistency of data which might have been written before the cancellation. Any SW-C having responsible for requesting mode or state to BSW mode managers shall always request a default mode upon a restart of its OsApplication. Thus the BSW mode manager would not be stuck into a mode previously requested by the OsApplication before its termination. To support this task, note that RTE offers mechanisms to handle partition stop and restart wrt. mode machines. For mode managers an "error mode" to be set by RTE can be identified. For mode user partition the behaviour can also be selected. Furthermore an interaction to BswM to trigger an action list in case of partition restart can be initiated. Refer to RTE specification for details. As a global hint, in any non-trusted OsApplication, which could be terminated, there shall always be a restart Task which does the following actions: • Cancel all jobs which can result in an asynchronous notification or shared memory, I/O access. • Reset all shared memory with a default value. • Reset any mode or state residing in another OsApplication and controlled by this given OsApplication to a default value. Please note that some of these actions need to be performed even if an OS-Application is merely terminated and not restarted. For example, it may still be necessary to stop all signals and signal groups used by the OsApplication. Otherwise, it may happen that a bus never goes to sleep. Consequently, in such a case it is necessary to activate the restart Task to perform the necessary cleanup even if the OS-Application is only terminated and not restarted. Calling TerminateApplication(<ownappid>,OS_OSAPPLICATION_NO_RESTART) in the restart Task will finally set the OS-Application to APPLICATION_TERMINATED.