Recovery Actions#
The following diagram gives an overview of the recovery escalation.
Fig. 1 Recovery action escalation chain#
Note
It is planned to support more Run Target Recovery Actions in the future, e.g. switching to a different Run Target than the Fallback Run Target.
Show the planned escalation chain
Fig. 2 Planned recovery action escalation chain. In contrast to the diagram above, the Run Target Recovery Action is now a separate step in the escalation chain.#
A Component Failure is first handled by the Component Recovery Action. A Component Recovery Action may be to simply try restarting the failed component. If no Component Recovery Action is configured or it does not succeed, the Run Target Recovery Action activates the Fallback Run Target. If this also fails, the Watchdog triggers a Machine Reset. Currently, the Run Target Recovery Action is synonymous to activation of the Fallback Run Target.
The Fallback Run Target is a special Run Target defined in the Launch Manager configuration (see Configuration parameters st... (feat_arc_sta__lifecycle__cfg_params_static)), this shall be used as a minimal system state that allows diagnosis of the failure. The State Manager is expected to transition the system out of the Fallback Run Target to retry normal operation.
The following sequence diagrams are based on the example dependency graph described in Components & Run Targets.
The configurable recovery actions are shown as ComponentRecoveryAction and RunTargetRecoveryAction in Configuration Structure.
Component failure#
A component may fail outside of a Run Target transition for one of the following reasons:
The components underlying process crashes
The component supervision fails (e.g. the component does not send alive notification in the expected frequency)
Component crash#
Launch Manager - Crash Recovery
|
status: valid
security: YES
safety: ASIL_B
|
||||
The diagram shows a component crash during an active Run Target (outside of a Run Target transition). The component can be configured with a recovery action that defines the reaction to a crash. If a Restart Recovery Action is configured then only the crashed component is restarted, not dependent components. If the restart fails, the next recovery stage is to execute the Run Target Recovery Action, i.e. activating the Fallback Run Target. See Launch Manager - Run Target... (feat_arc_dyn__lifecycle__run_target_failure) for reference. |
|||||
Component supervision failure#
Launch Manager - Supervision Failure
|
status: valid
security: YES
safety: ASIL_B
|
||||
The diagram shows a component supervision failure during an active Run Target (outside of a Run Target transition). For details of detection supervision failures, see Alive Monitoring Start (feat_arc_dyn__lifecycle__alive_monitor_start). The subsequent recovery behavior is identical to the process crash scenario in Launch Manager - Crash Reco... (feat_arc_dyn__lifecycle__crash). |
|||||
Run Target transition failure#
A Run Target transition might fail for the following reasons:
A component failed to activate within its timeout (exceeding its configured activation retries)
A Run Target transition exceeds its configured transition timeout
A component that is already active fails while the transition is still ongoing
If a Run Target transition fails, the Launch Manager executes the Run Target Recovery Action as configured for the affected Run Target. The currently only supported Run Target Recovery Action is the activation of the fallback Run Target.
Launch Manager - Run Target Transition Failure
|
status: valid
security: YES
safety: ASIL_B
|
||||
The diagram shows a failing Run Target transition from Run Target “Minimal” to Run Target “Running”. Component app1 does not reach its ready condition, even after all configured activation attempts have been exhausted, which makes the whole transition fail. The Launch Manager then executes the Run Target Recovery Action of Run Target “Running” and activates the Fallback Run Target. Components that are not part of the Fallback Run Target are deactivated, components that were never activated stay deactivated. |
|||||