AUTOSAR ucm

ucm — Update and Configuration Management

← back to AUTOSAR

What ARA defines

ara::ucm is the platform's OTA/update agent — the "app-store manager." It installs/updates/removes Software Clusters (executables + config + manifests, treated as one atomic unit) and runs each update through a defined state machine (transfer → verify → activate → confirm or roll back), coordinating with Persistency and State Management.

Our adaptation

Theia's ucm is an on-device update agent built around release directories + symlink switching — NOT A/B partitions.

• The on-device FSM: IDLE → DOWNLOADED → VALIDATED → STAGED → INSTALLING → RESTARTING → VERIFYING → ACTIVE → ROLLBACK (split across a control front UcmDaemon, the executor UcmGate, and the FSM UcmFsm).
• Release-dir model: /opt/theia/releases/<ver>/ + current / previous symlinks, atomic rename(2) switch. FULL = re-aim current; PARTIAL = swap one FC's binary + restart just it. PHM-health-gated rollback in seconds.
• Delivery is decoupled from lifecycle: the bytes arrive via Mender (a custom theia-release update module that lands the release dir — the supported customization point, since we don't use Mender's rootfs A/B). Mender's ArtifactInstall_Leave state-script hands off to UCM (RequestUpdate), which runs the AUTOSAR-shaped restart + PHM-verify the bare symlink switch skips. UCM never downloads; Mender never sequences services.

We keep ARA's atomic-Software-Cluster + state-machine + rollback model and drop the A/B-image assumption for a release-dir+symlink scheme that fits a POSIX/systemd box and a stock Mender client.