ab_gp_session_fsm.c

Go to the documentation of this file.

 
#include "ab_gp_session_fsm.h"
 
#include "rte/oal/log/rte_log.h"
#include "rte/utils/string/rte_string.h"
 
#define AB_GP_SESSION_FSM_STATE_COUNT 9U
#define AB_GP_SESSION_FSM_NONE (-1)

static const int8_t s_table[AB_GP_SESSION_FSM_STATE_COUNT][AB_GP_SESSION_EVENT_COUNT] = {
    /* AB_GP_ERTMS_SESSION_IDLE - MA_GRANTED and SHUNTING_AUTHORIZED are ALSO
     * handled directly from here (real, found-live correction, same class
     * as ESTABLISHED's own below): ctx->session_state is driven forward
     * (IDLE -> INITIATED -> ESTABLISHED) ONLY by a real ERTMS-envelope
     * Msg 155 (ab_gp_proc_dispatch.c's handle_msg_155() - confirmed the
     * ONLY call site of ab_gp_proc_session_handle_initiation()/
     * _established() anywhere in this codebase). The flat/simplified wire
     * scheme's own connect handshake (RBC_MSG_P0, ab_gp_train.c) and its
     * own position reports (ab_gp_proc_position_update(), which resets
     * contact_timer_ms but never touches session_state) never call either
     * function - so a train connected purely via the flat scheme (the
     * flow safeAPIRBC2oo2TestEnv's own il_grants_a_movement_authority.robot
     * and most of ma_tests/ actually exercise: Connect Train -> P0, then
     * a bare flat position report, then an IL-side ROUTE_ADD triggers the
     * grant with NO Msg 155 ever sent) has session_state sitting at IDLE
     * for its entire lifetime. Requiring ESTABLISHED-or-later here (this
     * table's own SECOND version, corrected once) would have made every
     * MA grant on that flow permanently unreachable too. This IS a real,
     * documented gap (two not-fully-integrated connection-tracking
     * mechanisms - ab_gp_db_train_is_connected() vs this FSM's own
     * session_state), flagged for a follow-up that wires the flat
     * scheme's own P0/connect path into this FSM for real, not silently
     * routed around forever. */
    {
        AB_GP_ERTMS_SESSION_INITIATED,  /* SESSION_INITIATION_REQUESTED */
        AB_GP_SESSION_FSM_NONE,         /* SESSION_ESTABLISHED_CONFIRMED */
        AB_GP_SESSION_FSM_NONE,         /* TRAIN_DATA_VALIDATED */
        AB_GP_ERTMS_SESSION_FS,         /* MA_GRANTED */
        AB_GP_SESSION_FSM_NONE,         /* MA_REVOKED */
        AB_GP_ERTMS_SESSION_SHUNTING,   /* SHUNTING_AUTHORIZED */
        AB_GP_SESSION_FSM_NONE,         /* SHUNTING_DEAUTHORIZED */
        AB_GP_ERTMS_SESSION_EMERGENCY_STOP, /* EMERGENCY_STOP_ISSUED - legal from every state, see header doc */
        AB_GP_SESSION_FSM_NONE,         /* EMERGENCY_STOP_REVOKED_TO_FS */
        AB_GP_SESSION_FSM_NONE,         /* EMERGENCY_STOP_REVOKED_TO_STANDBY */
        AB_GP_SESSION_FSM_NONE,         /* EMERGENCY_STOP_REVOKED_TO_ESTABLISHED */
        AB_GP_ERTMS_SESSION_IDLE        /* SESSION_TERMINATED - legal from every state incl. self, see header doc */
    },
    /* AB_GP_ERTMS_SESSION_INITIATED */
    {
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_ESTABLISHED,     /* SESSION_ESTABLISHED_CONFIRMED */
        AB_GP_ERTMS_SESSION_DATA_VALIDATED,  /* TRAIN_DATA_VALIDATED - can arrive before negotiation completes */
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_EMERGENCY_STOP,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_IDLE
    },
    /* AB_GP_ERTMS_SESSION_ESTABLISHED - real, found-live correction: MA_GRANTED
     * and SHUNTING_AUTHORIZED are ALSO handled directly from here, not only
     * from DATA_VALIDATED/STANDBY. This codebase's own real connect path
     * (ab_gp_proc_dispatch.c's handle_msg_155(), the wired Msg 155 handler)
     * documents driving straight IDLE -> INITIATED -> ESTABLISHED and
     * deliberately never validating train data ("this project's own
     * simplified flow has no separate train-side confirmation round trip
     * before Full Supervision work can begin... drive straight to
     * ESTABLISHED") - train_data.valid is ONLY ever set by the separate,
     * real-ERTMS-envelope Msg 129 path (ab_gp_proc_dispatch.c's
     * handle_msg_129()), which the simplified flow never sends. Requiring
     * DATA_VALIDATED here (this table's own first version) would have made
     * every MA grant on the simplified flow - the one the real robot MA
     * test suite (il_grants_a_movement_authority.robot and its siblings)
     * actually exercises - permanently unreachable. Caught by tracing the
     * real dispatch code before writing new robot coverage for this
     * table's own earlier tightening, not by running the suite itself. */
    {
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,              /* re-confirmation while already ESTABLISHED: not a transition -
                                               * caller (ab_gp_proc_session_handle_established()) treats
                                               * "no outcome" as "already active, just refresh". */
        AB_GP_ERTMS_SESSION_DATA_VALIDATED,
        AB_GP_ERTMS_SESSION_FS,              /* MA_GRANTED */
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_SHUNTING,        /* SHUNTING_AUTHORIZED */
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_EMERGENCY_STOP,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_IDLE
    },
    /* AB_GP_ERTMS_SESSION_DATA_VALIDATED */
    {
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_FS,          /* MA_GRANTED - first grant */
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_SHUNTING,    /* SHUNTING_AUTHORIZED - before any MA was ever granted */
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_EMERGENCY_STOP,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_IDLE
    },
    /* AB_GP_ERTMS_SESSION_STANDBY (no active MA, session otherwise fine -
     * reached via MA_REVOKED or SHUNTING_DEAUTHORIZED) */
    {
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_FS,          /* MA_GRANTED - (re)grant */
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_SHUNTING,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_EMERGENCY_STOP,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_IDLE
    },
    /* AB_GP_ERTMS_SESSION_FS (active MA) */
    {
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_FS,          /* MA_GRANTED - self, re-granting/recomputing while already FS */
        AB_GP_ERTMS_SESSION_STANDBY,     /* MA_REVOKED - full revocation */
        AB_GP_ERTMS_SESSION_SHUNTING,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_EMERGENCY_STOP,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_IDLE
    },
    /* AB_GP_ERTMS_SESSION_SHUNTING */
    {
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_STANDBY,     /* SHUNTING_DEAUTHORIZED */
        AB_GP_ERTMS_SESSION_EMERGENCY_STOP,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_IDLE
    },
    /* AB_GP_ERTMS_SESSION_EMERGENCY_STOP */
    {
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_EMERGENCY_STOP,  /* EMERGENCY_STOP_ISSUED - self, re-issuing while already active */
        AB_GP_ERTMS_SESSION_FS,              /* EMERGENCY_STOP_REVOKED_TO_FS */
        AB_GP_ERTMS_SESSION_STANDBY,         /* EMERGENCY_STOP_REVOKED_TO_STANDBY */
        AB_GP_ERTMS_SESSION_ESTABLISHED,     /* EMERGENCY_STOP_REVOKED_TO_ESTABLISHED */
        AB_GP_ERTMS_SESSION_IDLE
    },
    /* AB_GP_ERTMS_SESSION_TERMINATING - never actually SET by any procedure
     * today (ab_gp_proc_session_handle_termination() goes straight to
     * IDLE) - only ever a legal SOURCE for re-initiation. Kept here,
     * unreachable in practice today, for whenever a real intermediate
     * TERMINATING step is added. */
    {
        AB_GP_ERTMS_SESSION_INITIATED,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_EMERGENCY_STOP,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_SESSION_FSM_NONE,
        AB_GP_ERTMS_SESSION_IDLE
    }
};
 
bool ab_gp_session_fsm_can_handle(ab_gp_ertms_session_state_t from, ab_gp_session_event_t event,
                                  ab_gp_ertms_session_state_t *out_to)
{
    int8_t result;
 
    if (((uint32_t)from >= AB_GP_SESSION_FSM_STATE_COUNT) || ((uint32_t)event >= (uint32_t)AB_GP_SESSION_EVENT_COUNT))
    {
        return false;
    }
    result = s_table[(uint32_t)from][(uint32_t)event];
    if (result == AB_GP_SESSION_FSM_NONE)
    {
        return false;
    }
    if (out_to != NULL)
    {
        *out_to = (ab_gp_ertms_session_state_t)result;
    }
    return true;
}

static const char *state_name(ab_gp_ertms_session_state_t state)
{
    switch (state)
    {
        case AB_GP_ERTMS_SESSION_IDLE:           return "IDLE";
        case AB_GP_ERTMS_SESSION_INITIATED:      return "INITIATED";
        case AB_GP_ERTMS_SESSION_ESTABLISHED:    return "ESTABLISHED";
        case AB_GP_ERTMS_SESSION_DATA_VALIDATED: return "DATA_VALIDATED";
        case AB_GP_ERTMS_SESSION_STANDBY:        return "STANDBY";
        case AB_GP_ERTMS_SESSION_FS:             return "FS";
        case AB_GP_ERTMS_SESSION_SHUNTING:       return "SHUNTING";
        case AB_GP_ERTMS_SESSION_EMERGENCY_STOP: return "EMERGENCY_STOP";
        case AB_GP_ERTMS_SESSION_TERMINATING:    return "TERMINATING";
        default:                                 return "UNKNOWN";
    }
}
 
static const char *event_name(ab_gp_session_event_t event)
{
    switch (event)
    {
        case AB_GP_SESSION_EVENT_SESSION_INITIATION_REQUESTED:      return "SESSION_INITIATION_REQUESTED";
        case AB_GP_SESSION_EVENT_SESSION_ESTABLISHED_CONFIRMED:     return "SESSION_ESTABLISHED_CONFIRMED";
        case AB_GP_SESSION_EVENT_TRAIN_DATA_VALIDATED:              return "TRAIN_DATA_VALIDATED";
        case AB_GP_SESSION_EVENT_MA_GRANTED:                        return "MA_GRANTED";
        case AB_GP_SESSION_EVENT_MA_REVOKED:                        return "MA_REVOKED";
        case AB_GP_SESSION_EVENT_SHUNTING_AUTHORIZED:               return "SHUNTING_AUTHORIZED";
        case AB_GP_SESSION_EVENT_SHUNTING_DEAUTHORIZED:             return "SHUNTING_DEAUTHORIZED";
        case AB_GP_SESSION_EVENT_EMERGENCY_STOP_ISSUED:             return "EMERGENCY_STOP_ISSUED";
        case AB_GP_SESSION_EVENT_EMERGENCY_STOP_REVOKED_TO_FS:      return "EMERGENCY_STOP_REVOKED_TO_FS";
        case AB_GP_SESSION_EVENT_EMERGENCY_STOP_REVOKED_TO_STANDBY: return "EMERGENCY_STOP_REVOKED_TO_STANDBY";
        case AB_GP_SESSION_EVENT_EMERGENCY_STOP_REVOKED_TO_ESTABLISHED: return "EMERGENCY_STOP_REVOKED_TO_ESTABLISHED";
        case AB_GP_SESSION_EVENT_SESSION_TERMINATED:                return "SESSION_TERMINATED";
        default:                                                    return "UNKNOWN_EVENT";
    }
}

static void log_event(const ab_gp_ertms_train_context_t *ctx, ab_gp_session_event_t event, bool handled,
                      ab_gp_ertms_session_state_t to)
{
    char storage[128];
    rte_string_t line;
    const char *out_cstr = NULL;
 
    if (rte_string_init(&line, storage, sizeof(storage)) != RTE_STATUS_OK)
    {
        return;
    }
    (void)rte_string_copy(&line, "train=");
    (void)rte_string_append_u32(&line, (uint32_t)ctx->train_id);
    (void)rte_string_concat(&line, " event=");
    (void)rte_string_concat(&line, event_name(event));
    (void)rte_string_concat(&line, " state=");
    (void)rte_string_concat(&line, state_name(ctx->session_state));
    if (handled)
    {
        (void)rte_string_concat(&line, " -> ");
        (void)rte_string_concat(&line, state_name(to));
    }
    else
    {
        (void)rte_string_concat(&line, " NOT HANDLED");
    }
 
    if (rte_string_c_str(&line, &out_cstr) == RTE_STATUS_OK)
    {
        rte_log_write(RTE_LOG_LEVEL_DEBUG, "SESSION_FSM", out_cstr);
    }
}
 
bool ab_gp_session_fsm_handle_event(ab_gp_ertms_train_context_t *ctx, ab_gp_session_event_t event)
{
    ab_gp_ertms_session_state_t to = AB_GP_ERTMS_SESSION_IDLE;
    bool handled;
 
    if (ctx == NULL)
    {
        return false;
    }
 
    handled = ab_gp_session_fsm_can_handle(ctx->session_state, event, &to);
    log_event(ctx, event, handled, to);
 
    if (!handled)
    {
        return false;
    }
    ctx->session_state = to;
    return true;
}