.. # ******************************************************************************* # Copyright (c) 2026 Contributors to the Eclipse Foundation # # See the NOTICE file(s) distributed with this work for additional # information regarding copyright ownership. # # This program and the accompanying materials are made available under the # terms of the Apache License Version 2.0 which is available at # https://www.apache.org/licenses/LICENSE-2.0 # # SPDX-License-Identifier: Apache-2.0 # ******************************************************************************* message_passing_fmea ==================== Overview -------- .. list-table:: :header-rows: 1 * - Failure Mode - Guideword - ASIL - Interface * - :ref:`IpcChannelUnavailable ` - - B - IServer.StartListening, IServer.StopListening, IClientFactory.Create, IClientConnection.Start, IClientConnection.Stop, IServerConnection.RequestDisconnect * - :ref:`MessageNotDeliveredCorrectly ` - - B - IServerConnection.Reply, IClientConnection.Send, IClientConnection.SendWaitReply, IClientConnection.SendWithCallback * - :ref:`NotificationNotDelivered ` - - B - IServerConnection.Notify, IClientConnection.Start * - :ref:`ServerMessageHandlingFailure ` - - B - IServer.StartListening, IConnectionHandler.OnMessageSent, IConnectionHandler.OnMessageSentWithReply * - :ref:`MessageTimingViolated ` - - B - IServerConnection.Reply * - :ref:`IpcApiMisuseOrLifecycleViolation ` - - B - IClientConnection.Send, IClientConnection.SendWaitReply, IClientConnection.SendWithCallback, IClientConnection.Restart, IServerConnection.Reply, IServerConnection.RequestDisconnect * - :ref:`ConnectionContextDataWrong ` - - B - IServerConnection.GetClientIdentity, IServerConnection.GetUserData * - :ref:`StateMachineError ` - - B - IClientConnection.GetState, IClientConnection.GetStopReason Failure Modes ------------- .. dropdown:: MessagePassing.ConnectionContextDataWrong :name: fmea-messagepassing-connectioncontextdatawrong .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface IServerConnection.GetClientIdentity, IServerConnection.GetUserData .. grid-item-card:: Failure Effect The server makes access control or application logic decisions based on wrong context data; the client may be incorrectly granted or denied access, or receive incorrect responses, potentially violating safety goals. .. grid:: 1 .. grid-item-card:: Description Identity or cached context data associated with a server connection is absent, incomplete, or incorrect. .. rubric:: Root Cause Analysis .. uml:: fta_connection_context_data_wrong.puml .. dropdown:: MessagePassing.IpcApiMisuseOrLifecycleViolation :name: fmea-messagepassing-ipcapimisuseorlifecycleviolation .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface IClientConnection.Send, IClientConnection.SendWaitReply, IClientConnection.SendWithCallback, IClientConnection.Restart, IServerConnection.Reply, IServerConnection.RequestDisconnect .. grid-item-card:: Failure Effect Undefined behavior, silent message drop, or application crash; unexpected messages may corrupt application-level protocol state. .. grid:: 1 .. grid-item-card:: Description An IPC operation is invoked at the wrong lifecycle stage or outside its valid call context. .. rubric:: Root Cause Analysis .. uml:: fta_ipc_api_misuse_or_lifecycle_violation.puml .. dropdown:: MessagePassing.IpcChannelUnavailable :name: fmea-messagepassing-ipcchannelunavailable .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface IServer.StartListening, IServer.StopListening, IClientFactory.Create, IClientConnection.Start, IClientConnection.Stop, IServerConnection.RequestDisconnect .. grid-item-card:: Failure Effect Clients cannot send or receive messages. .. grid:: 1 .. grid-item-card:: Description The IPC channel between client and server cannot be established or maintained .. rubric:: Root Cause Analysis .. uml:: fta_ipc_channel_unavailable.puml .. dropdown:: MessagePassing.MessageNotDeliveredCorrectly :name: fmea-messagepassing-messagenotdeliveredcorrectly .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface IServerConnection.Reply, IClientConnection.Send, IClientConnection.SendWaitReply, IClientConnection.SendWithCallback .. grid-item-card:: Failure Effect The receiver processes no data, incomplete data, or incorrect data; messages may also be routed to an unintended server instance. Application behavior may be incorrect or a safety goal may be violated. .. grid:: 1 .. grid-item-card:: Description A message sent via the IPC channel is not, only partially with corrupted content delivered. .. rubric:: Root Cause Analysis .. uml:: fta_message_not_delivered_correctly.puml .. rubric:: Control Measures .. grid:: 1 .. grid-item-card:: **OsIpcFaultHandling** :bdg-warning:`ASIL B` The component shall detect OS IPC transport failures by checking the return value of every OS call. .. grid-item-card:: **SendBufferArgumentValidation** :bdg-warning:`ASIL B` The component shall validate all arguments of Send, SendWaitReply, and SendWithCallback before any IPC operation is initiated. .. dropdown:: MessagePassing.MessageTimingViolated :name: fmea-messagepassing-messagetimingviolated .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface IServerConnection.Reply .. grid-item-card:: Failure Effect FTTI violations may occur on safety-relevant communication paths. .. grid:: 1 .. grid-item-card:: Description A message or reply is delivered outside of the specified timing bounds required by the application. .. rubric:: Root Cause Analysis .. uml:: fta_message_timing_violated.puml .. dropdown:: MessagePassing.NotificationNotDelivered :name: fmea-messagepassing-notificationnotdelivered .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface IServerConnection.Notify, IClientConnection.Start .. grid-item-card:: Failure Effect The client misses an asynchronous server event or acts on incomplete, corrupted, stale, or spurious notification data; application behavior may be incorrect or a safety goal may be violated. .. grid:: 1 .. grid-item-card:: Description A server-initiated notification is not, only partially, delayed, with corrupted content or when not intended delivered. .. rubric:: Root Cause Analysis .. uml:: fta_notification_not_delivered.puml .. dropdown:: MessagePassing.ServerMessageHandlingFailure :name: fmea-messagepassing-servermessagehandlingfailure .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface IServer.StartListening, IConnectionHandler.OnMessageSent, IConnectionHandler.OnMessageSentWithReply .. grid-item-card:: Failure Effect Request message is silently dropped or never answered; the client's SendWaitReply call blocks or times out, stalling potential safety-relevant communication. .. grid:: 1 .. grid-item-card:: Description Server-side message or connection handler fails to process a received message or to produce a required reply. .. rubric:: Root Cause Analysis .. uml:: fta_server_message_handling_failure.puml .. dropdown:: MessagePassing.StateMachineError :name: fmea-messagepassing-statemachineerror .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface IClientConnection.GetState, IClientConnection.GetStopReason .. grid-item-card:: Failure Effect Application logic based on connection state makes incorrect decisions; error recovery paths may be triggered incorrectly or missed entirely. .. grid:: 1 .. grid-item-card:: Description GetState or GetStopReason returns an incorrect lifecycle state that does not match the actual connection state. .. rubric:: Root Cause Analysis .. uml:: fta_state_machine_error.puml Control Measures ---------------- .. list-table:: :header-rows: 1 * - Control Measure - ASIL - Description * - OsIpcFaultHandling - B - The component shall detect OS IPC transport failures by checking the return value of every OS call. * - SendBufferArgumentValidation - B - The component shall validate all arguments of Send, SendWaitReply, and SendWithCallback before any IPC operation is initiated. * - BE_MessageTooBig - B - The component shall enforce the configured max_send_size, max_reply_size, and max_notify_size limits on every client send path and every server Reply and Notify path. * - BE_SendQueueExhausted - B - The component shall use a pre-allocated, bounded pool for asynchronous client send messages and return an error when the pool is exhausted without blocking or silently dropping the message.