Merge pull request 'Rework PDEC FDIR' (#772) from rework-pdec-fdir into main

Reviewed-on: #772
Reviewed-by: Marius Eggert <eggertm@irs.uni-stuttgart.de>

CHANGELOG.md

@@ -18,6 +18,21 @@ will consitute of a breaking change warranting a new major release:
 
 - `eive-tmtc`:
 
+## Fixed
+
+- The handling function of the GPS data is only called once per GPS read. This should remove
+  the fake fix-has-changed events.
+
+## Changed
+
+- PDEC FDIR rework: A full PDEC reboot will now only be performed after a regular PDEC reset has
+  failed 10 times. The mechanism will reset after no PDEC reset has happended for 2 minutes.
+  The PDEC reset will be performed when counting 4 dirty frame events 10 seconds after the count
+  was incremented initially.
+- GPS Fix has changed event is no longer triggered for the EM
+- MGM and SUS rates now will only be calculated, if 2 valid consecutive datapoints are available.
+  The stored value of the last timestep will now be reset, if no actual value is available.
+
 ## Added
 
 - SGP4 Propagator is now used for propagating the position of EIVE. It will only work once
@@ -28,17 +43,6 @@ will consitute of a breaking change warranting a new major release:
 - Parameter to disable usage of MGM4, which is part of the MTQ and therefore cannot be
   disabled without disabling the MTQ itself.
 
-## Fixed
-
-- The handling function of the GPS data is only called once per GPS read. This should remove
-  the fake fix-has-changed events.
-  
-## Changed
-
-- GPS Fix has changed event is no longer triggered for the EM
-- MGM and SUS rates now will only be calculated, if 2 valid consecutive datapoints are available.
-  The stored value of the last timestep will now be reset, if no actual value is available.
-
 # [v6.3.0] 2023-08-03
 
 ## Fixed

mission/system/EiveSystem.cpp

@@ -133,6 +133,10 @@ void EiveSystem::handleEventMessages() {
           case pdec::INVALID_TC_FRAME: {
             if (event.getParameter1() == pdec::FRAME_DIRTY_RETVAL) {
               frameDirtyErrorCounter++;
+              // Check whether threshold was reached after 10 seconds.
+              if(frameDirtyErrorCounter == 1) {
+                frameDirtyCheckCd.resetTimer();
+              }
             }
             break;
           }
@@ -296,42 +300,39 @@ ReturnValue_t EiveSystem::sendFullRebootCommand() {
 }
 
 void EiveSystem::pdecRecoveryLogic() {
-  if (pdecResetWasAttempted and pdecResetWasAttemptedCd.hasTimedOut()) {
-    pdecResetWasAttempted = false;
+  // PDEC reset has happened too often in the last time. Perform reboot to same image.
+  if (pdecResetCounter >= PDEC_RESET_MAX_COUNT_BEFORE_REBOOT) {
+    if (waitingForPdecReboot) {
+      return;
+    }
+    triggerEvent(core::PDEC_REBOOT);
+    // Some delay to ensure that the event is stored in the persistent TM store as well.
+    TaskFactory::delayTask(500);
+    // Send reboot command.
+    ReturnValue_t result = sendSelfRebootCommand();
+    if (result != returnvalue::OK) {
+      sif::error << "Sending a reboot command has failed" << std::endl;
+      // If the previous operation failed, it should be re-attempted the next task cycle.
+      pdecResetCounterResetCd.resetTimer();
+      return;
+    }
+    waitingForPdecReboot = true;
+    return;
   }
-  if (frameDirtyCheckCd.hasTimedOut()) {
+  if (pdecResetCounterResetCd.hasTimedOut()) {
+    pdecResetCounter = 0;
+  }
+  if (frameDirtyCheckCd.hasTimedOut() and frameDirtyErrorCounter > 0) {
     if (frameDirtyErrorCounter >= FRAME_DIRTY_COM_REBOOT_LIMIT) {
-      // If a PTME reset was already attempted and there is still an issue receiving TC frames,
-      // reboot the system.
-      if (pdecResetWasAttempted) {
-        if (waitingForPdecReboot) {
-          return;
-        }
-        triggerEvent(core::PDEC_REBOOT);
-        // Some delay to ensure that the event is stored in the persistent TM store as well.
-        TaskFactory::delayTask(500);
-        // Send reboot command.
-        ReturnValue_t result = sendSelfRebootCommand();
-        if (result != returnvalue::OK) {
-          sif::error << "Sending a reboot command has failed" << std::endl;
-          // If the previous operation failed, it should be re-attempted the next task cycle.
-          pdecResetWasAttemptedCd.resetTimer();
-          return;
-        }
-        waitingForPdecReboot = true;
-        return;
-      } else {
-        // Try one full PDEC reset.
-        CommandMessage msg;
-        store_address_t dummy{};
-        ActionMessage::setCommand(&msg, pdec::RESET_PDEC_WITH_REINIITALIZATION, dummy);
-        commandQueue->sendMessage(pdecHandlerQueueId, &msg);
-        pdecResetWasAttemptedCd.resetTimer();
-        pdecResetWasAttempted = true;
-      }
+      // Try one full PDEC reset.
+      CommandMessage msg;
+      store_address_t dummy{};
+      ActionMessage::setCommand(&msg, pdec::RESET_PDEC_WITH_REINIITALIZATION, dummy);
+      commandQueue->sendMessage(pdecHandlerQueueId, &msg);
+      pdecResetCounterResetCd.resetTimer();
+      pdecResetCounter++;
     }
     frameDirtyErrorCounter = 0;
-    frameDirtyCheckCd.resetTimer();
   }
 }
 

mission/system/EiveSystem.h

@@ -10,6 +10,7 @@
 class EiveSystem : public Subsystem, public HasActionsIF {
  public:
   static constexpr uint8_t FRAME_DIRTY_COM_REBOOT_LIMIT = 4;
+  static constexpr uint32_t PDEC_RESET_MAX_COUNT_BEFORE_REBOOT = 10;
 
   static constexpr ActionId_t EXECUTE_I2C_REBOOT = 10;
 
@@ -39,11 +40,11 @@ class EiveSystem : public Subsystem, public HasActionsIF {
   Countdown frameDirtyCheckCd = Countdown(10000);
   // If the PDEC reset was already attempted in the last 2 minutes, there is a high chance that
   // only a full reboot will fix the issue.
-  Countdown pdecResetWasAttemptedCd = Countdown(120000);
-  bool pdecResetWasAttempted = false;
+  Countdown pdecResetCounterResetCd = Countdown(120000);
   bool waitingForI2cReboot = false;
   bool waitingForPdecReboot = false;
 
+  uint32_t pdecResetCounter = 0;
   ActionHelper actionHelper;
   PowerSwitchIF* powerSwitcher = nullptr;
   std::atomic_uint16_t& i2cErrors;