FEO Component Requirements
|
status: draft
security: NO
safety: ASIL_B
|
||||
FEO Component Requirements#
Application Processes
|
status: valid
security: NO
safety: ASIL_B
|
||||
An application consists of one or more activities executed in one or multiple operating system processes. In particular it consists of the primary process which handles the lifecycle, configuration and execution management. It may optionally consist of one or more secondary processes. The purpose of secondary processes is to run code in separate address spaces (Freedom From Interference) for safety reasons. Each process (primary and secondary) belongs to exactly one application. Each process contains one ore more operating system threads. |
|||||
Activity
|
status: valid
security: NO
safety: ASIL_B
|
||||
Each activitiy is mapped to exactly one thread within the primary or one of the secondary processes. Each activity provides the following functions:
|
|||||
Task Chain
|
status: valid
security: NO
safety: ASIL_B
|
||||
All activities within an application are arranged within a Task Chain. There is exactly one task chain per application. The task chain configuration defines the execution order of the activities. In particular it defines when the task chain is activated (typically in a cyclic manner) and in which order the activities will run. Every task chain may have one or multiple input service activities which will run in the beginning. The purpose of an input service activity is to collect external input signals and provide them to the other activities during task chain execution. Every task may have one or more output service activities which will run in the end. The purpose of an output service activity is to collect signals produced by activities within the task chain and send them to external entities. |
|||||
Scheduler aka Executor
|
status: valid
security: NO
safety: ASIL_B
|
||||
The component shall implement a scheduler (aka executor) that manages the execution of activities in correct order. |
|||||
Service Activity
|
status: valid
security: NO
safety: ASIL_B
|
||||
The component shall enable the implementation and execution of Service Activities, which are a means to interact with the outside world, e.g. via network communication, direct sensor input or direct actuator output. A Service Activity shall be enabled to use APIs external to the framework (e.g. networking APIs, reading from external sensor devices, writing HW I/O, etc.) |
|||||
Agent
|
status: valid
security: NO
safety: ASIL_B
|
||||
In order to execute activities in secondary processes, the Scheduler shall use agents running in the secondary processes. There shall be exactly one agent for each secondary process. The Agent in a secondary process shall receive commands from the Scheduler, invoke actions on Activities within its process and report back to the Scheduler. Each Activity that is part of the task chain in a secondary process shall be associated with an Agent, which takes over the task to wait for a trigger from the Scheduler. When the Agent gets a step request from the Scheduler, it calls the Step function of the Activity. |
|||||
Mapping of Activities to threads
|
status: valid
security: NO
safety: ASIL_B
|
||||
Each activity shall be mapped to one thread. The mapping cannot be changed at runtime. Each activity’s init, step and shutdown functions shall be executed in the assigned thread. |
|||||
Application Lifecycle Phases
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Application Lifecycle shall consists of 3 phases: Init, Run and Shutdown. |
|||||
Initialization of Activities
|
status: valid
security: NO
safety: ASIL_B
|
||||
Initialization of Activities shall be done during application initialization. Each Activity shall be initialized by a call to its init function. The init function shall be invoked in the thread to which the activity is mapped. |
|||||
Stepping of Activities
|
status: valid
security: NO
safety: ASIL_B
|
||||
Each Activity shall be stepped once within each execution of the Task Chain they belong to. Stepping is done by a call to an activity’s step function. The step function shall be invoked in the thread to which the activity is mapped. |
|||||
Shutdown of activities
|
status: valid
security: NO
safety: ASIL_B
|
||||
Shutdown of activities shall be done during application shutdown. Each activity shall be shut down by a call to its shutdown function. The shutdown function shall be invoked in the thread to which the activity is mapped. |
|||||
Component Configuration
|
status: valid
security: NO
safety: ASIL_B
|
||||
The component shall provide a configuration mechanism that supports configuring
|
|||||
Component Configuration from File
|
status: valid
security: NO
safety: ASIL_B
|
||||
It shall be possible to define the component configuration in a pre-defined configuration file. |
|||||
Activity Mapping Configuration
|
status: valid
security: NO
safety: ASIL_B
|
||||
The mapping of activities to threads is done in the component configuration and cannot be changed at runtime. |
|||||
Alive supervision
|
status: valid
security: NO
safety: ASIL_B
|
||||
The component shall provide the functionality to enable the reporting of alive supervision checkpoint to an external health management system (e.g. watchdog) |
|||||
Support of deadline supervision checkpoints
|
status: valid
security: NO
safety: ASIL_B
|
||||
The component shall provide the functionality to enable the reporting of deadline supervision checkpoints to an external health management system (e.g. watchdog) |
|||||
Support of logical supervision
|
status: valid
security: NO
safety: ASIL_B
|
||||
The component shall provide the functionality to enable the reporting of logical supervision checkpoints to an external health management system (e.g. watchdog) |
|||||
Trustable computation
|
status: valid
security: NO
safety: ASIL_B
|
||||
The component shall provide mechanisms to check after the computation of an Activity if the result is trustable. This can be done e.g. via evaluation of floating point exceptions, checking of hardware registers or status information of the software platform. |
|||||
Error Handling for S-CORE v0.5#
Response to termination request
|
status: valid
security: YES
safety: ASIL_B
|
||||
If the primary process receives a termination signal, it shall call the shutdown function of all remaining activities in arbitrary sequence and terminate itself. If a secondary process receives a termination signal, it shall terminate itself. |
|||||
Secondary connection timeout
|
status: valid
security: YES
safety: ASIL_B
|
||||
If not all secondary processes connect to the primary in time, the primary shall terminate itself. The startup functions shall not be triggered. |
|||||
Activity startup error
|
status: valid
security: YES
safety: ASIL_B
|
||||
If an error occurs during the execution of a startup function, the primary process shall abort calling startup functions and terminate itself. For all of the activities whose startup functions have already been called successfully, the corresponding shutdown functions shall be executed in arbitrary sequence. |
|||||
Activity resource allocation error
|
status: valid
security: YES
safety: ASIL_B
|
||||
During initialization (i.e. in the startup function of an activity), activities shall check for resource allocation and report an error to the executor in case of failure. |
|||||
Activity timeout
|
status: valid
security: YES
safety: ASIL_B
|
||||
If a timeout occurs during startup, stepping or shutdown of an activity, the primary process shall shutdown all successfully started activities in arbitrary sequence and terminate itself. |
|||||
Startup timeout
|
status: valid
security: YES
safety: ASIL_B
|
||||
If not all activities reach their initialized state within a certain period of time (startup timeout), the primary process shall shutdown all successfully started activities in arbitrary sequence and terminate itself. |
|||||
Activity stepping error
|
status: valid
security: YES
safety: ASIL_B
|
||||
If an activity fails in the step function, the primary process shall call shutdown for all activities in arbitrary sequence and terminate itself. |
|||||
Activity shutdown error
|
status: valid
security: YES
safety: ASIL_B
|
||||
If an activity fails in the shutdown function, the primary process shall shutdown all remaining activities in arbitrary sequence and terminate itself. |
|||||