tasks_pre_startup.c

Go to the documentation of this file.

 
// Standard Library Includes
#include <stdbool.h>
#include <stdint.h>
 
// Framework Includes
#include <define_error_inject_reset.h>
#include <midware_cpu_manager_diag.h>
#include <midware_error_manager.h>
#include <midware_memory_manager.h>
#include <midware_reset_manager.h>
#include <midware_watchdog_manager_diag.h>
#include <tasks_config.h>
#include <tasks_pre_startup.h>

typedef enum
{
    FSM_STATE_START    = ERRINJ_RESET_NONE,   
    FSM_STATE_CONTINUE = ERRINJ_RESET_CPU,    
    FSM_STATE_COMPLETE = ERRINJ_RESET_WDT,    
    FSM_STATE_CORRUPT  = ERRINJ_RESET_CORRUPT 
} fsmState_t;
 
// Private function prototypes
static errInjectReset_t DetermineErrorInjection(resetReason_t reason);
static fsmState_t DetermineState(void);
static void RunDiagSwdtExpire(void);
static void ResetFsm(void);
static void AbortFsm(void);
 
void T_EnsureSafeState(void)
{
    errFlag_t flag = MW_CheckIoSafe();
 
    // I/O Pins not floated (tri-Stated)
    bool isIoUnsafe = (flag != NO_ERROR);
    if (isIoUnsafe)
    {
        MW_EnableForceFloat(); // Force tri-stating of all I/O pins
        MW_StorePersistentFlag(PFLAG_IO_FLOAT_FAULT, isIoUnsafe);
    }
    else
    {
        /* Intentional misra-c2012-2.2/14.3 deviation */
        if (STRICT_SAFE_STATE == ENABLED)
        {
            MW_EnableForceFloat();
        }
    }
}
 
void T_DetermineResetReason(void)
{
    resetReason_t reason         = MW_GetClearResetReason();
    errInjectReset_t errInjState = DetermineErrorInjection(reason);
 
    /*
     * Only store the reset reason if it is the true reset reason and not an error injection as part
     * of the pre-startup sequence
     */
    if (errInjState != ERRINJ_RESET_NONE)
    {
        uint8_t errInjStateVal = (uint8_t)errInjState;
        // Store reason for reset due to error injection, to complete the pre-startup sequence
        MW_StorePersistentVal(PVAL_ERRINJ_REASON, errInjStateVal);
    }
    else
    {
        uint8_t reasonVal = (uint8_t)reason;
        // Store device reset reason, for later handling in the startup sequence
        MW_StorePersistentVal(PVAL_RESET_REASON, reasonVal);
    }
}
 
// Checks the error injection ongoing flag to determine if the reset was due to an error injection
static errInjectReset_t DetermineErrorInjection(resetReason_t reason)
{
    bool isErrInjOngoing                  = MW_GetPersistentFlag(PFLAG_ERRINJ_ONGOING);
    errInjectReset_t errorInjectionReason = ERRINJ_RESET_NONE;
 
    if (isErrInjOngoing)
    {
        if (reason == RSTRSN_MCHK_DCLS)
        {
            errorInjectionReason = ERRINJ_RESET_CPU;
        }
 
        if (reason == RSTRSN_WDT_TIMEOUT)
        {
            errorInjectionReason = ERRINJ_RESET_WDT;
        }
    }
    return errorInjectionReason;
}
 
void T_RunResetDiagnosticFsm(void)
{
    fsmState_t state   = DetermineState(); // Read persistent memory to figure out the FSM state
    bool isDiagFailure = false; // Diagnostics pass by default if the expected reset occured
 
    // Initial state, perform CPU lockstep error injection
    if (state == FSM_STATE_START)
    {
        // Prevent the system from treating the error injection reset as a real fault
        MW_StorePersistentFlag(PFLAG_ERRINJ_ONGOING, true);
        (void)MW_DiagCpuLockstep(); // Always returns ERROR
 
        // Diagnostic failed to reset the device: go to the next state and report failure
        isDiagFailure = true;
        state         = FSM_STATE_CONTINUE;
    }
 
    // After CPU error injection, store result and perform error injection for watchdogs
    if (state == FSM_STATE_CONTINUE)
    {
        MW_StorePersistentFlag(PFLAG_CPU_INJ_FAULT, isDiagFailure);
 
        RunDiagSwdtExpire(); // Does not reset the device, but will enable the SWDT until next reset
 
        (void)MW_DiagWdtExpire(); // Always returns ERROR
 
        // Diagnostic failed to reset the device: go to the next state and report failure
        isDiagFailure = true;
        state         = FSM_STATE_COMPLETE;
    }
 
    // After WDT error injection, store result and reset FSM
    if (state == FSM_STATE_COMPLETE)
    {
        MW_StorePersistentFlag(PFLAG_WDT_INJ_FAULT, isDiagFailure);
        ResetFsm(); // Clear error injection reason and error injection flag
    }
 
    // If the FSM is corrupted, abort execution to avoid infinite reset loops.
    if (state == FSM_STATE_CORRUPT)
    {
        AbortFsm(); // Set error injection reason to corrupted
    }
}
 
/*
 * Reads the error injection reset reason to determine which state the T_RunResetDiagnosticFsm is
 * in. It is assumed that the reason is stored in persistent memory by another part of the system
 * during determination of the reset reason if the PFLAG_ERRINJ_ONGOING flag is set. The persistent
 * memory can store data between resets, except for POR / BOR resets, in which the FSM is set back
 * to the initial state automatically.
 */
static fsmState_t DetermineState(void)
{
    const uint8_t errInjReasonVal = MW_GetPersistentVal(PVAL_ERRINJ_REASON);
 
    /* Intentional misra-c2012-10.5 deviation */
    const errInjectReset_t errInjReason = (errInjectReset_t)errInjReasonVal;
 
    /* Intentional misra-c2012-10.5 deviation */
    fsmState_t state = (fsmState_t)errInjReason;
 
    const bool invalidReasonVal = (errInjReason > ERRINJ_RESET_CORRUPT);
    const bool flagsCorrupted   = MW_IsPersistentFlagsCorrupt();
 
    // Check if a single bit flip has occured in the reset reason data
    const bool errInjOngoing  = MW_GetPersistentFlag(PFLAG_ERRINJ_ONGOING);
    const bool stateCorrupted = ((errInjOngoing == false) && (state != FSM_STATE_START));
 
    // If persistent data used by the FSM is corrupted, the FSM state itself is corrupted
    if (invalidReasonVal || flagsCorrupted || stateCorrupted)
    {
        state = FSM_STATE_CORRUPT;
    }
 
    return state;
}
 
// Performs the Syncronous Watchdog Expire diagnostic and stores the result in persistent memory.
static void RunDiagSwdtExpire(void)
{
    errFlag_t result   = MW_DiagSwdtExpire(PRE_STARTUP_SWDT_RESET_VAL);
    bool isDiagFailure = true;
 
    if (result == NO_ERROR)
    {
        isDiagFailure = false;
    }
 
    MW_StorePersistentFlag(PFLAG_SWDT_INJ_FAULT, isDiagFailure);
}
 
// Reset FSM by clearing the reason and error injection flag
static void ResetFsm(void)
{
    const errInjectReset_t fsmReset = ERRINJ_RESET_NONE;
    const uint8_t fsmResetVal       = (uint8_t)fsmReset;
    MW_StorePersistentVal(PVAL_ERRINJ_REASON, fsmResetVal);
    MW_StorePersistentFlag(PFLAG_ERRINJ_ONGOING, false);
}
 
/*
 * Report that the FSM was aborted for later handling by setting the error injection reason to
 * corrupt, indicating that the stored true reset reason cannot be trusted, since it is not possible
 * to know if it is the true reset reason or if it was overwritten by an error injection reset.
 */
static void AbortFsm(void)
{
    const errInjectReset_t fsmAborted = ERRINJ_RESET_CORRUPT;
    const uint8_t fsmAbortedVal       = (uint8_t)fsmAborted;
    MW_StorePersistentVal(PVAL_ERRINJ_REASON, fsmAbortedVal);
}