deeaitch/ota-reference-design
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

06 - atomic update

Browse Source
This commit is contained in:
deeaitch committed 2026-10-20 12:27:04 -04:00
1 parent 6d63457737
commit 2bdacaf37a
21 files changed
+1302 -365
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

diagrams/plantuml/ab-installation-recovery.puml
+42
View File
@@ -0,0 +1,42 @@
@startuml
title A/B installation and restart decisions
skinparam shadowing false
skinparam monochrome true
state "A confirmed\nB inactive; no pending trial" as Idle
state "Intent saved\nWriting B" as Writing
state "B fully written\nNot yet verified" as Written
state "B verified\nPrepared state saved" as Prepared
state "Trial request saved\nOTA progress may still be old" as Requested
state "Inspect saved boot state\nand target release" as Inspect
state "Separate recovery policy" as Recovery
state "Trial boot lifecycle\nSee existing trial boot diagram" as Trial
[*] --> Idle
Idle --> Writing : save release and target
Writing --> Written : complete storage writes
Written --> Prepared : verify expected contents; save prepared state
Prepared --> Requested : boot control saves trial request
Requested --> Trial : restart; consume attempt through boot control
Writing --> Inspect : restart
Written --> Inspect : restart
Prepared --> Inspect : restart
Requested --> Inspect : restart before entering trial lifecycle
Inspect --> Writing : A selected; B incomplete\nrestart preparation under policy
Inspect --> Prepared : A selected; B complete\nverify again; save prepared state
Inspect --> Requested : saved B trial found\nrepair progress; preserve attempt count
Inspect --> Recovery : no valid boot state
Written --> Idle : verification fails; abandon B
Recovery --> [*]
Trial --> [*]
note right of Inspect
Read boot state before writing B.
Never infer confirmation from progress.
A saved boot request wins over old progress.
end note
legend bottom
One A-to-B installation. No shared data migration or shared boot update.
Writes assume the platform's durability and record validation contract.
Trial outcomes and later updates belong to the trial boot lifecycle.
endlegend
@enduml
diagrams/plantuml/ab-installation-sequence.puml
+48
View File
@@ -0,0 +1,48 @@
@startuml
title A/B preparation and activation
skinparam shadowing false
skinparam monochrome true
participant "OTA manager" as Manager
participant Installer
database "Slot B" as B
database "OTA progress" as Progress
participant "Boot control" as Boot
note over Manager, Boot
A is confirmed. B is inactive. No earlier trial is pending.
One installer owns B. A and shared data are preserved.
end note
Manager -> Progress : Save intent: release and target B
Manager -> Installer : Prepare B
Installer -> B : Write release
Installer -> B : Complete required storage operations
Installer -> B : Read and verify installed contents
Installer --> Manager : Verified expected release
note over Manager, Boot
Reset before activation: boot A.
Inspect B and verify again before a new activation request.
end note
Manager -> Progress : Save prepared release B
Manager -> Boot : Save trial request for B
Boot -> Boot : Persist target and attempt limit
note right of Boot
Interrupted state write:
read valid old or new state,
or enter defined recovery.
end note
Boot --> Manager : Trial request saved
note over Manager, Boot
Reset here: boot control may start B.
Old OTA progress must not cause a rewrite or fresh attempts.
end note
Manager -> Progress : Save trial-requested result
Manager -> Boot : Restart into trial
ref over Manager, Boot
Existing A/B trial boot, checks, and confirmation diagram
end ref
legend bottom
Success path only. Any error stops forward progress and requires state inspection.
Arrows assume completed durable operations under the platform storage contract.
A saved trial request is not confirmation.
endlegend
@enduml
diagrams/readme.md
+4 -2
View File
@@ -1,12 +1,14 @@
# OTA diagrams
PlantUML sources accompany chapters 03–05. The diagrams describe the illustrative A/B design, not a required platform or partition table.
PlantUML sources accompany chapters 03–06. The diagrams describe the example A/B design, not a required platform or partition table.
| View | Source | Preview |
|---|---|---|
| Roles and the server/device boundary | [PlantUML](plantuml/ota-architecture.puml) | [PNG](rendered/ota-architecture.png) |
| Trial boot, confirmation and recovery | [PlantUML](plantuml/ab-trial-boot.puml) | [PNG](rendered/ab-trial-boot.png) |
| Storage areas and access responsibilities | [PlantUML](plantuml/ab-storage-layout.puml) | [PNG](rendered/ab-storage-layout.png) |
| Preparation and activation sequence | [PlantUML](plantuml/ab-installation-sequence.puml) | Source only |
| Installation states and restart decisions | [PlantUML](plantuml/ab-installation-recovery.puml) | Source only |
From the repository root, regenerate previews with a local PlantUML installation and Graphviz:
@@ -14,4 +16,4 @@ From the repository root, regenerate previews with a local PlantUML installation
JAVA_TOOL_OPTIONS=-Djava.awt.headless=true plantuml -tpng -o ../rendered diagrams/plantuml/*.puml
```
Keep sources and previews together when changing a diagram. No external rendering service is needed. State transitions assume valid durable records; these pictures do not establish power-loss safety. The [A/B simulation](../examples/simulations/ab-trial-boot/readme.md) explores the same logical transitions.
Chapters 03–05 include existing previews. The chapter 06 diagrams are provided as sources only; generate previews locally when needed. No external rendering service is needed. These diagrams do not establish power-loss safety. The [A/B simulation](../examples/simulations/ab-trial-boot/readme.md) covers trial boot. The [interrupted installation model](../examples/simulations/interrupted-installation/readme.md) covers preparation, old progress, and supplied boot-record write outcomes.